Security & Transparency

Current release

Files and SHA-256 hashes

The files of the current release: the launcher installer and the update packages. Each file shows its SHA-256 hash, the ClamAV result and its code signing status. The contents of the installer and of every package are unpacked and scanned file by file.

Release scan

The release pipeline runs the scan before publishing, on the exact files that go out for download. We use unmodified ClamAV with the official signature database, updated right before the scan. A detection, an incomplete scan or an unavailable scanner blocks publication unless the result is reviewed and acknowledged with a written reason. An acknowledgement does not hide the result: the detection and the reason stay in the published data.

Scan now

The files of the current release are scanned again after every release and every 6 hours when the release or the signature database has changed (at least once a day). Use the button to request a scan right away. The scan runs on GitHub Actions: it downloads the files from GitHub, checks their SHA-256 hashes against the signed security.json and scans them with the ClamAV daemon using a current database. The result is published in the release as security-scan.json, and the website only displays it. A full scan takes from a few to about fifteen minutes.

How do I verify the files myself?

You do not have to take this page's word for it. Download a file and compare its SHA-256 hash with the list above. security.json and security.json.sig are attached to the release on GitHub. You can verify the security.json signature with our public key (Ed25519): the signed bytes are THSECURITY1, a newline, then the exact file contents.

# SHA-256 hash of the downloaded file (compare with the list above)
Get-FileHash .\TrilogyHub-Setup.exe -Algorithm SHA256

# Authenticode signature (when the release is signed)
Get-AuthenticodeSignature .\TrilogyHub-Setup.exe | Format-List Status, StatusMessage, SignerCertificate, TimeStamperCertificate

# security.json signature (Git Bash, Linux, macOS; OpenSSL 3)
echo "MCowBQYDK2VwAyEAZxrFZtgT4mBZBa599fvMiQn3ptdyzwrdukFgDrmDc3s=" | openssl base64 -d -A > th-release.der
printf 'THSECURITY1\n' > signed.bin && cat security.json >> signed.bin
openssl base64 -d -A -in security.json.sig -out security.sig.bin
openssl pkeyutl -verify -pubin -inkey th-release.der -keyform DER -rawin -in signed.bin -sigfile security.sig.bin

# SHA-256 hash of a file
sha256sum TrilogyHub-Setup.exe

node -e "const c=require('crypto'),f=require('fs');const k=c.createPublicKey({key:Buffer.from('MCowBQYDK2VwAyEAZxrFZtgT4mBZBa599fvMiQn3ptdyzwrdukFgDrmDc3s=','base64'),format:'der',type:'spki'});console.log(c.verify(null,Buffer.concat([Buffer.from('THSECURITY1\n'),f.readFileSync('security.json')]),k,Buffer.from(f.readFileSync('security.json.sig','utf8').trim(),'base64'))?'OK':'INVALID')"

You can also scan a file with your own antivirus or your own ClamAV installation (clamscan TrilogyHub-Setup.exe). Results may differ if your signature database is a different version.

Code signing

An Authenticode digital signature lets Windows check who published a file and whether it has changed since it was signed. When a certificate is configured, the release pipeline signs the executable files with a SHA-256 file digest and an RFC 3161 SHA-256 timestamp, and verifies each signature right after signing. The private key is not kept in the repository or on the website. A signature confirms the publisher and the integrity of a file; it says nothing about whether the program is safe.

Third-party libraries shipped unchanged (for example Microsoft components) keep their own publisher's signature. The signature status in the list above shows this.

Why might antivirus software flag the launcher?

Trilogy Hub adds multiplayer to a game that does not have it. To do that, it does things antivirus programs watch closely:

• DLL injection - the multiplayer client runs as a library loaded into the game process. Some malware uses the same technique, so antivirus heuristics react to the method itself.
• Anti-cheat - cheat protection inspects the game's memory and modules and detects debuggers and memory dumping tools. Behaviour like this can look like spyware to a heuristic scanner.
• Self-updating - the launcher downloads and replaces client files on its own (every package is signed and verified before it is installed).
• New, rarely seen files - every release ships new files whose reputation in antivirus databases still has to build up. Until a certificate is configured, the files also carry no publisher signature.

Every detection is investigated individually. A feature being necessary does not automatically make a detection a false positive. An example from October 2026: when scanning the launcher, ClamAV reported the signatures Win.Trojan.Virut-70 and Win.Trojan.Virut-265 in two launcher files. We confirmed that the official, unmodified electron.exe from Electron 44.5.1 (matching the SHA-256 published by the Electron project) produces the same result. The matching bytes are in ordinary program code and the file's entry point is unchanged, which does not fit a Virut infection, since Virut appends itself to files and takes over their execution. The detection was therefore acknowledged as a false positive, and its description, reason and expiry date are visible in the release data above.

If your antivirus reports a Trilogy Hub file, compare its SHA-256 hash with this page and contact us on Discord or the forum with the name of the antivirus and of the detection.

Notice