HMCL

Launcher by HMCL-dev (huanghongxun)

A launcher for installing mods and managing your game.

DownloadCheck a file you have

Note from Modgrade

This launcher also lets you play without buying Minecraft, which Mojang's terms do not allow. A bought copy gives you an official account and access to the servers that require one: minecraft.net .

How we got this result

  1. Files checkedWe compare the fingerprint and the content of each file with the malware we and others have found, and look at what is inside it.4 of 4 official filesLast checked on 2 Nov 2026
  2. Deep checkOur own tools read the code of each current file and look for what harmful code does, like stealing logins or running hidden programs.3 of 4 official filesLast checked on 2 Nov 2026
  3. Passed Nothing harmful found in its 4 official files.Our checks look for known signs of harm. They cannot prove that a file is harmless.

At a glance

Download
Official files for Windows and Linux, and one file for every system.
Fake sites
6 fake sites found.
Privacy
Sends data. It sends data we could not identify.
Releases
Latest release on 17 Sep 2026.

Every official file

See each file in Releases

The files of version 3.16.4, by system and kind of download.

SystemPortablePackageJarOther
WindowsHMCL-3.16.4.exePassedProgramFile checked on 2 Nov 2026Deep check on 2 Nov 2026No fileNo fileNo file
LinuxNo fileHMCL-3.16.4.debPassedDebian packageFile checked on 2 Nov 2026No fileHMCL-3.16.4.shPassedScriptFile checked on 2 Nov 2026Deep check on 2 Nov 2026
All systemsNo fileNo fileHMCL-3.16.4.jarPassedJava fileFile checked on 2 Nov 2026Deep check on 2 Nov 2026No file
PassedDeep checkNo file

Have a copy of HMCL? Check that it is the official one.

Drop it here. We compare its fingerprint with the official HMCL files and the files of the fake sites we know.

Source code
Public on GitHub
Official site
hmcl.huangyuhui.net

Which file for my computer?

HMCL-3.16.4.exe

PassedNo harmful code foundReleased 17 Sep 202610.4 MB

Download

The same file we checked, straight from github.com.

Official site

6 sites use its name to give other files. See Fake sites

Download page
hmcl.huangyuhui.net/download
Newest version
3.16.4, released on 17 Sep 2026

Passed

Nothing harmful found in its 4 official files, version 3.16.4.

Our checks look for known signs of harm. They cannot prove that a file is harmless.

What we checked

A launcher runs on your computer like any program, and it downloads the game and its mods, so harmful code in it can steal your accounts or files.

Files checkedEach official file is downloaded on a separate machine, opened with every file inside it and never run. ClamAV, a free antivirus, and our YARA rules look for known signs of harm in all of it.
4 of its 4 official files, with every file inside them.Last checked on 2 Nov 2026
Deep checkOur own tools read the Java code in the files and look for what harmful code does, like stealing logins or running hidden programs. They read Java code only.
3 of its 4 official files. 1 hold no Java code: programs made for one system.
Same as listedA fingerprint of the file. The same fingerprint means the same file, byte for byte.
Every file we checked has the SHA-256 that GitHub gives.
Older releases
4 official files of 1 older release, every one checked.

What we found

What its Java code can do. None of this is harmful by itself: many launchers and mods do the same.

Reads the login data of other programs
Reads the login data of other programs (launcher account files). The name of the Minecraft Launcher's account file, launcher_accounts.json, is in HMCL's list of files it leaves out when you export a modpack (MODPACK_BLACK_LIST in ModAdviser, read in its public source code on 2 Nov 2026), so your logins never go into a pack you share. It does not read the file.minecraft_accounts
Accepts connections from other computers
The code references server sockets or an embedded web server. Used by some tools for local web interfaces, profilers, or LAN features.In all 3 files whose Java code we read
Can connect to the internet
It has code that can go online, for example to check for updates, sign you in or download the game. What it sends is in Privacy.In all 3 files whose Java code we read
Can download and run new code
One class references both network APIs and class loading. This is the pattern of auto-updating loaders, but also of some harmful programs. Only the source of the downloaded data tells which.In 1 of the 3 files whose Java code we read
Contains code made for your system
Native libraries (.dll, .so, .dylib) run outside the Java sandbox. Used for speed, compression, audio, graphics or database engines.In 1 of the 3 files whose Java code we read
Contains packed files it does not list
Files packed inside the file that its own description does not list. In a launcher these are usually the libraries it needs.In 1 of the 3 files whose Java code we read
Contains programs or scripts
The archive contains files such as .exe, .bat or .sh. They are listed with their size, format and sha256, never run. Libraries such as JavaCPP (ffmpeg.exe), LWJGL or JNA bundle them by design, so this is worth knowing but not a warning by itself.In 1 of the 3 files whose Java code we read
Creates code while it runs
The code can create or load pieces of code while it runs. Launchers load the game, its mod loaders and their own modules this way.In 1 of the 3 files whose Java code we read
Names files of other programs
Strings in the code name places where other programs keep their files. A launcher can need some of them, for example to find the game or Java.In 1 of the 3 files whose Java code we read
Starts other programs
The code can start another program on your computer. Common reasons: opening a web link or a folder, reading hardware information, launching a helper tool.In 1 of the 3 files whose Java code we read

The evidence2

Each finding of our checks: the file, what it is in plain words, where our tools saw it, and the rule that matched.

  • Reads the login data of other programs
    Reads the login data of other programs (launcher account files).In HMCL-3.16.4.jarorg.jackhuang.hmcl.modpack.ModAdviser minecraft_accounts: string "launcher_accounts.json"Rule: login_storeThe name of the Minecraft Launcher's account file, launcher_accounts.json, is in HMCL's list of files it leaves out when you export a modpack (MODPACK_BLACK_LIST in ModAdviser, read in its public source code on 2 Nov 2026), so your logins never go into a pack you share. It does not read the file.
    Judged information
  • Reads the login data of other programs
    Reads the login data of other programs (launcher account files).In HMCL-3.17.0.364.jarorg.jackhuang.hmcl.modpack.ModAdviser minecraft_accounts: string "launcher_accounts.json"Rule: login_storeThe name of the Minecraft Launcher's account file, launcher_accounts.json, is in HMCL's list of files it leaves out when you export a modpack (MODPACK_BLACK_LIST in ModAdviser, read in its public source code on 2 Nov 2026), so your logins never go into a pack you share. It does not read the file.
    Judged information

What is inside

The 3,934 files inside HMCL-3.16.4.exe. Only the first 400 are listed.

Java code
212 files.
Jar files inside
4 files.
Programs for Windows, Mac or Linux
2 files.
Graphics
115 images.
Other
67 files.

Every file

  • assets/175 files
  • com/google/165 files
    • errorprone/annotations/29 files
      • concurrent/4 files
        • GuardedBy.class458 B
        • LazyInit.class591 B
        • LockMethod.class496 B
        • UnlockMethod.class500 B
      • CanIgnoreReturnValue.class496 B
      • CheckReturnValue.class505 B
      • CompatibleWith.class487 B
      • CompileTimeConstant.class479 B
      • DoNotCall.class466 B
      • DoNotMock.class598 B
      • FormatMethod.class468 B
      • FormatString.class452 B
      • ForOverride.class668 B
      • Immutable.class557 B
      • ImmutableTypeParameter.class479 B
      • IncompatibleModifiers.class688 B
      • InlineMe.class514 B
      • InlineMeValidationDisabled.class392 B
      • Keep.class502 B
      • Modifier.class1.7 KB
      • MustBeClosed.class373 B
      • NoAllocation.class354 B
      • OverridingMethodsMustInvokeSuper.class489 B
      • RequiredModifiers.class680 B
      • RestrictedApi.class661 B
      • SuppressPackageLocation.class432 B
      • ThreadSafe.class484 B
      • ThreadSafeTypeParameter.class481 B
      • Var.class609 B
    • gson/136 files
      • annotations/5 files
        • Expose.class523 B
        • JsonAdapter.class548 B
        • SerializedName.class566 B
        • Since.class456 B
        • Until.class456 B
      • internal/76 files
        • bind/37 files
          • ArrayTypeAdapter.class3.4 KB
          • ArrayTypeAdapter$1.class2.0 KB
          • CollectionTypeAdapterFactory.class2.8 KB
          • CollectionTypeAdapterFactory$Adapter.class3.2 KB
          • DefaultDateTypeAdapter.class6.9 KB
          • DefaultDateTypeAdapter$1.class1.6 KB
          • DefaultDateTypeAdapter$DateType.class2.5 KB
          • DefaultDateTypeAdapter$DateType$1.class944 B
          • EnumTypeAdapter.class4.5 KB
          • EnumTypeAdapter$1.class1.5 KB
          • JsonAdapterAnnotationTypeAdapterFactory.class6.9 KB
          • JsonAdapterAnnotationTypeAdapterFactory$1.class325 B
          • JsonAdapterAnnotationTypeAdapterFactory$DummyTypeAdapterFactory.class1.5 KB
          • JsonElementTypeAdapter.class5.8 KB
          • JsonElementTypeAdapter$1.class971 B
          • JsonTreeReader.class8.8 KB
          • JsonTreeReader$1.class691 B
          • JsonTreeReader$2.class853 B
          • JsonTreeWriter.class6.2 KB
          • JsonTreeWriter$1.class766 B
          • MapTypeAdapterFactory.class3.6 KB
          • MapTypeAdapterFactory$Adapter.class6.9 KB
          • NumberTypeAdapter.class3.0 KB
          • NumberTypeAdapter$1.class1.4 KB
          • NumberTypeAdapter$2.class802 B
          • ObjectTypeAdapter.class5.1 KB
          • ObjectTypeAdapter$1.class1.4 KB
          • ObjectTypeAdapter$2.class956 B
          • ReflectiveTypeAdapterFactory.class14 KB
          • ReflectiveTypeAdapterFactory$1.class1.7 KB
          • ReflectiveTypeAdapterFactory$2.class4.3 KB
          • ReflectiveTypeAdapterFactory$Adapter.class4.0 KB
          • ReflectiveTypeAdapterFactory$BoundField.class1.2 KB
          • ReflectiveTypeAdapterFactory$FieldReflectionAdapter.class2.7 KB
          • ReflectiveTypeAdapterFactory$FieldsData.class1.5 KB
          • ReflectiveTypeAdapterFactory$RecordAdapter.class7.0 KB
          • SerializationDelegatingTypeAdapter.class710 B
        • ConstructorConstructor.class15 KB
        • Excluder.class6.4 KB
        • Excluder$1.class2.3 KB
        • GsonBuildConfig.class395 B
        • GsonTypes.class12 KB
        • GsonTypes$GenericArrayTypeImpl.class1.6 KB
        • GsonTypes$ParameterizedTypeImpl.class3.2 KB
        • GsonTypes$WildcardTypeImpl.class2.4 KB
        • JavaVersion.class2.0 KB
        • JsonReaderInternalAccess.class484 B
        • LazilyParsedNumber.class2.3 KB
        • LinkedTreeMap.class12 KB
        • LinkedTreeMap$1.class906 B
        • LinkedTreeMap$EntrySet.class2.0 KB
        • LinkedTreeMap$EntrySet$1.class1.5 KB
        • LinkedTreeMap$KeySet.class1.6 KB
        • LinkedTreeMap$KeySet$1.class1.3 KB
        • LinkedTreeMap$LinkedTreeMapIterator.class2.0 KB
        • LinkedTreeMap$Node.class3.5 KB
        • NonNullElementWrapperList.class3.5 KB
        • NumberLimits.class1.5 KB
        • ObjectConstructor.class262 B
        • PreJava9DateFormatProvider.class1.5 KB
        • Primitives.class1.5 KB
        • ReflectionAccessFilterHelper.class2.9 KB
        • ReflectionAccessFilterHelper$1.class282 B
        • ReflectionAccessFilterHelper$AccessChecker.class1.6 KB
        • ReflectionAccessFilterHelper$AccessChecker$1.class1.5 KB
        • ReflectionAccessFilterHelper$AccessChecker$2.class955 B
        • Streams.class2.4 KB
        • Streams$1.class219 B
        • Streams$AppendableWriter.class2.3 KB
        • Streams$AppendableWriter$CurrentWrite.class1.4 KB
        • TroubleshootingGuide.class701 B
        • UnsafeAllocator.class3.1 KB
        • UnsafeAllocator$1.class1.2 KB
        • UnsafeAllocator$2.class1.2 KB
        • UnsafeAllocator$3.class1.1 KB
        • UnsafeAllocator$4.class1.2 KB
      • ExclusionStrategy.class291 B
      • FieldAttributes.class1.9 KB
      • FieldNamingPolicy.class3.3 KB
      • FieldNamingPolicy$1.class711 B
      • FieldNamingPolicy$2.class837 B
      • FieldNamingPolicy$3.class914 B
      • FieldNamingPolicy$4.class993 B
      • FieldNamingPolicy$5.class993 B
      • FieldNamingPolicy$6.class993 B
      • FieldNamingPolicy$7.class993 B
      • FieldNamingStrategy.class621 B
      • FormattingStyle.class1.9 KB
      • Gson.class26 KB
      • Gson$1.class2.0 KB
      • Gson$2.class2.0 KB
      • Gson$3.class1.9 KB
      • Gson$4.class1.7 KB
      • Gson$5.class2.5 KB
      • Gson$FutureTypeAdapter.class2.2 KB
      • GsonBuilder.class14 KB
      • InstanceCreator.class302 B
      • JsonArray.class5.8 KB
      • JsonDeserializationContext.class413 B
      • JsonDeserializer.class510 B
      • JsonElement.class4.1 KB
      • JsonIOException.class731 B
      • JsonNull.class925 B
      • JsonObject.class4.8 KB
      • JsonParseException.class732 B
      • JsonParser.class3.4 KB
      • JsonPrimitive.class5.8 KB
      • JsonSerializationContext.class301 B
      • JsonSerializer.class437 B
      • JsonStreamParser.class2.5 KB
      • JsonSyntaxException.class743 B
      • LongSerializationPolicy.class1.5 KB
      • LongSerializationPolicy$1.class856 B
      • LongSerializationPolicy$2.class978 B
      • ReflectionAccessFilter.class1015 B
      • ReflectionAccessFilter$1.class1.2 KB
      • ReflectionAccessFilter$2.class1.2 KB
      • ReflectionAccessFilter$3.class1.2 KB
      • ReflectionAccessFilter$4.class1.2 KB
      • ReflectionAccessFilter$FilterResult.class1.4 KB
      • Strictness.class1.1 KB
      • ToNumberPolicy.class1.7 KB
      • ToNumberPolicy$1.class967 B
      • ToNumberPolicy$2.class911 B
      • ToNumberPolicy$3.class2.2 KB
      • ToNumberPolicy$4.class1.6 KB
      • ToNumberStrategy.class256 B
      • TypeAdapter.class3.7 KB
      • TypeAdapter$1.class213 B
      • TypeAdapter$NullSafeTypeAdapter.class2.2 KB
      • TypeAdapterFactory.class384 B
  • META-INF/59 files
    • jsoup/1 file
      • LICENSE1.1 KB
    • nanohttpd/2 files
      • default-mimetypes.properties667 B
      • mimetypes.properties74 B
    • proguard/1 file
      • gson.pro3.1 KB
    • services/1 file
      • java.net.spi.URLStreamHandlerProvider56 B
    • versions/47 files
      • 11/org/jsoup/helper/3 files
        • HttpClientExecutor.class9.8 KB
        • HttpClientExecutor$ProxyWrap.class1.4 KB
        • RequestAuthHandler.class2.1 KB
      • 12/com/jfoenix/adapters/9 files
        • skins/7 files
          • ColorPickerSkin.class2.5 KB
          • ComboBoxListViewSkin.class1.3 KB
          • DatePickerSkin.class3.8 KB
          • ListViewSkin.class1.2 KB
          • NestedTableColumnHeader.class802 B
          • ProgressBarSkin.class2.5 KB
          • TableColumnHeader.class717 B
        • ExceptionHelper.class520 B
        • ReflectionHelper.class5.1 KB
      • 17/com/jfoenix/adapters/1 file
        • ReflectionHelper.class3.9 KB
      • 9/34 files
        • com/jfoenix/adapters/28 files
          • skins/25 files
            • ButtonSkin.class414 B
            • CheckBoxSkin.class1.8 KB
            • ColorPickerSkin.class3.0 KB
            • ComboBoxListViewSkin.class1.6 KB
            • DatePickerSkin.class4.3 KB
            • JFXNestedTableColumnHeader.class1.3 KB
            • JFXTableColumnHeader.class8.0 KB
            • JFXTableHeaderRow.class900 B
            • JFXTableHeaderRow$1.class1.3 KB
            • JFXTreeTableViewSkin.class1.4 KB
            • ListViewSkin.class1.5 KB
            • NestedTableColumnHeader.class942 B
            • ProgressBarSkin.class3.0 KB
            • RadioButtonSkin.class1.8 KB
            • SliderSkin.class1.8 KB
            • TableColumnHeader.class813 B
            • TableHeaderRow.class536 B
            • TableViewSkinBase.class836 B
            • TabPaneSkin.class1.8 KB
            • TextAreaSkin.class2.4 KB
            • TextFieldSkin.class2.4 KB
            • ToggleButtonSkin.class456 B
            • TreeTableCellSkin.class796 B
            • TreeTableRowSkin.class748 B
            • TreeTableViewSkin.class979 B
          • IJFXTreeView.class176 B
          • ReflectionHelper.class3.8 KB
          • VirtualFlowHelper.class2.6 KB
        • org/tukaani/xz/6 files
          • check/1 file
            • CRC64.class1.5 KB
          • common/1 file
            • ByteArrayView.class2.7 KB
          • lz/4 files
            • BasicMatchLengthFinder.class814 B
            • MatchLength.class2.4 KB
            • MatchLengthFinder.class191 B
            • UnalignedLongLEMatchLengthFinder.class976 B
    • AL2.09.9 KB
    • annotations.kotlin_module24 B
    • hmcl_signature512 B
    • LGPL2.124 KB
    • LICENSE797 B
    • LICENSE.txt1.1 KB
    • MANIFEST.MF926 B
  • LICENSE.txt1.4 KB

Sends data

It sends data we could not identify.

Its code
Can contact 2 web addresses.

We find the web addresses its code can contact, but we cannot see everything a launcher does while it runs. Wrong result? Tell us

What we checked

A launcher can send information about you over the internet, such as your player name or your login.

Deep checkWe read the code and list each web address it can contact, and what it sends. We leave out code that is never used.
The Java code of all 3 files that hold some. See each file in Releases
Web addresses
sessionserver.mojang.com: Talks to an online service the launcher works with.Sends: nothing about youAddress built while it runsThe code builds this address while it runs, so it is not written in the file.: Purpose not known.Sends: nothing about you
Also named in its codeAddresses written in its code that no code we read contacts: a link shown to you, a default setting, or code we could not follow.
alist.8mi.techapi.curseforge.comapi.minecraftservices.comapi.modrinth.comapi.mojang.combmclapi2.bangbang93.comdl.liteloader.comdocs.hmcl.netdummy.exampleedge.forgecdn.netfiles.minecraftforge.netgithub.comhmcl.glavo.sitehmcl.huangyuhui.netlaunchermeta.mojang.comlibraries.minecraft.netlittleskin.cnlogin.live.comlogin.microsoftonline.commaven.fabricmc.netmaven.neoforged.netmeta.fabricmc.netmeta.legacyfabric.netmeta.quiltmc.orgmirrors.cloud.tencent.commod.mcimirror.topmodrinth.compiston-meta.mojang.comrepo.mumfrey.comrepo1.maven.orgterracotta.glavo.sitewww.bilibili.comwww.loongnix.cnwww.mcmod.cnwww.microsoft.comwww.xbox.com

Releases

Current files 4All releases 8

Current files: the official files of version 3.16.4.

Current fileVersionSystemReleasedFileOur checkGet it on
3.16.4WindowsProgram17 Sep 2026HMCL-3.16.4.exe10.4 MB SHA-256 632c2d8873…PassedNo harmful code found. Checked on 2 Nov 2026.2 Nov 2026
3.16.4LinuxDebian package17 Sep 2026HMCL-3.16.4.deb9.4 MB SHA-256 57a1b0ed4c…PassedNothing harmful found. Checked on 2 Nov 2026.2 Nov 2026
3.16.4LinuxScript17 Sep 2026HMCL-3.16.4.sh10.0 MB SHA-256 23b52b5f80…PassedNo harmful code found. Checked on 2 Nov 2026.2 Nov 2026
3.16.4All systemsJava file17 Sep 2026HMCL-3.16.4.jar10.0 MB SHA-256 98f0123f38…PassedNo harmful code found. Checked on 2 Nov 2026.2 Nov 2026
4 of 4 current files

A fake site uses the name of HMCL to offer its download from an address that is not the official one.

How to know the official site

Official site
hmcl.huangyuhui.net
Also leads there
hmcl.icu sends you to hmcl.huangyuhui.net.
Files come from
github.com/HMCL-dev
SHA-256A fingerprint of the file. The same fingerprint means the same file, byte for byte.
HMCL-3.16.4.exe632c2d8873f5a11dd2ffd8418564174995c6a248de5206668c6be114e943e372Every official file and its SHA-256, in Releases
Check a file
docs.hmcl.net/verify.html HMCL's own page: drop a file on it and it says if the file is an official build.

The 6 fake sites we foundChecked on 4 Nov 2026

Of these, 2 give a file with malware and 4 no file we could get. Sites in one fold share their pages and their download.

hmcl.infohmcl.computerMalware2 sites with a link-swap script. All online

hmcl.info and hmcl.computer were registered at Spaceship in the same second, on 17 Sep 2026. Pages in 7 and 6 languages.

A script on their pages sets every download button to starting-download1.theworkpc.com, which sends to a zip in the same file store as the fake Prism Launcher and Minecraft Launcher sites.

  • hmcl.infoOnline. Its download buttons are swapped for the fake zip.Registered 17 Sep 2026 at Spaceship · Checked 4 Nov 2026
  • hmcl.computerOnline. Its download buttons are swapped for the fake zip.Registered 17 Sep 2026 at Spaceship · Checked 4 Nov 2026

Their download

The setup in this zip installs a hidden remote control program: someone else can use your computer.

The download is a zip. The setup inside has the name of the HMCL 3.15.2 program, but it is SqlSetupBootstrapper.exe, a program of Microsoft SQL Server, signed by Microsoft. Next to it is a small unsigned file, SqlSetupBootstrapper.dll. A Windows program loads the code libraries it needs, its DLL files, and looks for them in its own folder first. The kit uses this to make Microsoft's program run its own DLL: security researchers call this DLL side-loading.

The DLL decodes two data files of the zip into an MSI, the format of Windows installers, and installs it with no window. Then it opens the real HMCL 3.15.2 program, which is also in the zip under another name, so you see the normal setup and nothing else.

The MSI calls itself Microsoft Visual C++ 2022 Redistributable (x64), by Microsoft Corporation, the name of a package that many games install. It is really ScreenConnect, a remote control program that companies use to help their staff from a distance. It installs as a service, a program that Windows starts by itself each time the computer starts, also in Safe Mode with networking. The service connects to a relay, a server that passes the connection on, at 442.open-fast-ports.com (442.fast-ports.com in the zips of 5 Nov 2026). Whoever runs that relay can see your screen, use your mouse and keyboard and move files, at any time, with nobody at the computer.

What you would see is hidden too. Its settings turn off the icon near the clock, the banner that says the computer is being controlled and the messages when someone connects, and keep your wallpaper on during a session. In Settings, Apps, it shows as Microsoft Visual C++ 2022 Redistributable (x64), by Microsoft Corporation, with no Modify or Repair button. Its service has a version number for a name, and its folder in Program Files is named like a Visual C++ package. Only the files inside that folder, and the process in Task Manager, keep the ScreenConnect name.

It also adds a credential provider, the part of Windows that draws the sign-in screen, so the other side can work there too, before anyone signs in.

ClamAV and our YARA rules found nothing in the zip: the MSI only exists once the DLL has decoded it. Decoded, our YARA rules recognise ScreenConnect. The zip is rebuilt often, each time with a new SHA-256, so a list of known files cannot catch it.

Technical details

hmcl-3.15.2.zip
SHA-256 0748ccf00172d953afb8b39d434352a96e63db9105e6348ed518d4b1fb8ab7be25 MB, checked on 2 Nov 2026
redist\2019\patch.dat
SHA-256 e1e349862f929523adfc44c9cf84b7dcd61fd360ccf89388a01866104bded00aThe same in every copy until 4 Nov 2026
Decoded MSI
SHA-256 71bd4a3c340a1da1e16c896cf4cfbd57eaa51ce8161a3dee6fae0a970a23a9b0Microsoft Visual C++ 2022 Redistributable (x64) 14.38.33135.0, ScreenConnect 24.1.6.8875
Relay
442.open-fast-ports.com, port 8041 (442.fast-ports.com from 5 Nov 2026)Unattended Access session, tag c=hmcl-3.15.2
Service
Named 14.38.33135.0, starts with WindowsAlso under SafeBoot\Network
hmcl.siteNo file we could getIts files are on file-sharing services, which we do not follow.Online

Registered at Spaceship on 16 Sep 2026. Chinese pages titled 'HMCL official site'.

Its buttons lead to file-sharing services (Quark and Baidu Netdisk).

  • hmcl.siteOnline. Its files are on file-sharing services, which we do not follow.Registered 16 Sep 2026 at Spaceship · Checked 4 Nov 2026

Its download

Its files are on file-sharing services, which we do not follow.

hmclmc.comNo file we could getIts files are on file-sharing services, which we do not follow.Online

Registered on 23 Oct 2026, on the same server as the fake PCL2 site pcl2mc.com, registered the same day.

Its buttons lead to a file-sharing service (Quark Netdisk).

  • hmclmc.comOnline. Its files are on file-sharing services, which we do not follow.Registration date not public · Checked 4 Nov 2026

Its download

Its files are on file-sharing services, which we do not follow.

ukuang.cnNo file we could getIts files are on file-sharing services, which we do not follow.Online

A Chinese page for HMCL, with a PC and an Android version. Its registration date is not public.

Its buttons lead to a file-sharing service (Quark Netdisk).

  • ukuang.cnOnline. Its files are on file-sharing services, which we do not follow.Registration date not public · Checked 4 Nov 2026

Its download

Its files are on file-sharing services, which we do not follow.

If you downloaded a file from one of these sites

  1. Drop the file in the Scanner. It tells you if it is an official file of HMCL or a file of these sites.
  2. If it is not an official file and you have not opened it, delete it.
  3. If you opened it: the setup installs ScreenConnect, a genuine remote control program that antivirus programs usually do not flag, so a scan is not enough. Check for it and remove it with the steps of our report.
  4. If you signed in to the launcher it installed: use "sign out everywhere" in your Microsoft security settings and change your Microsoft account password.
  5. Get HMCL from its official site, hmcl.huangyuhui.net .
Downloads
Not publishedHMCL does not publish how many times it is downloaded. GitHub's count covers only its few downloads there.
Created
22 Jun 2015Its GitHub repository
Latest release
17 Sep 2026Version 3.16.4
License
GPL-3.0 Public on GitHub

About

Hello Minecraft! Launcher is a cross-platform launcher for managing Minecraft installations and customizing game setups. It supports installing Forge, NeoForge, Cleanroom, Fabric, Legacy Fabric, Quilt, LiteLoader, and OptiFine, as well as managing mods and creating modpacks. Players can import Curse, MultiMC, and Modrinth modpacks and export HMCL, MultiMC, and MCBBS modpacks. The launcher also offers interface customization, including themes, color schemes, and background images. It runs across operating systems including Windows, Linux, macOS, and FreeBSD, and supports CPU architectures such as x86, ARM, RISC-V, MIPS, and LoongArch.

Written from its official pages: its GitHub page and hmcl.huangyuhui.net . How we write it