Wasabi secretly installing javaw.exe Java(TM) Platform SE binary

[ristein]

General Description

After installation on Windows 11 I saw a program called Java accessing my private files in some random folder. Windows notified me only because it needed to download virtual files from the cloud.
After digging into this I was sure I installed a virus, because I had five processes running called Java and two listed under Startup Apps but Java was not listed under installed programs and those processes were lying in a folder called AppData\Roaming\btl\bin\javaw.exe which I could not find any mention about online.
Even after searching in this github and the forum I found no mention of this behaviour.
Back in version 2.0.3 on Windows 10 I have not seen this.
Could you please explain following:

1. what this does
2. why this seems hiding like a virus
3. why wasabi does not remove these when uninstalling
4. how I can get rid of the three apps in Startup apps after uninstalling

Screenshots

How To Reproduce?

1. Go to website
2. Click on download
3. Execute file
4. follow installation instructions
5. see processes in Task Manager

Operating System

Windows 11 23H2 (fresh install)

Wasabi Version

2.0.7

[yahiheb]

Where did you download this?

Make sure it was from https://wasabiwallet.io, there are some fake websites claiming to be Wasabi.

[ristein]

sure, this was one of the first things I checked

[molnard]

I installed v2.0.7. I do see Wasabi there but no Javaw. I cannot reproduce the issue.

[ristein]

the installation file from the website seems to be different than the one from github, I tried the one from github now and no Java got installed

[remcoros]

the installation file from the website seems to be different than the one from github, I tried the one from github now and no Java got installed

The links on the website (https://wasabiwallet.io/#download) point directly to the Github release files. So you must have been on another website !?

[ristein]

ok, this seems like I was indeed on the wrong page. The one with .is or .app instead of .io as TLD.
Sorry for the false alarm

[remcoros]

ok, this seems like I was indeed on the wrong page. The one with .is or .app instead of .io as TLD. Sorry for the false alarm

scary stuff man. make sure to run some anti-virus or rootkit scanner and remove all leftovers.

[ristein]

I could not see anything suspicious, I hope it only wanted my mnenomic