just from simple intercepting the jvm traffic it contacts legitclient.com/getclient and /Java,/getnatives,
an exaple of this is https://legitclient.com/getToken?uid=0000&hwid=hwid (would be like bsdfesdf38472934hdsf83) &clientId=dog-launcher
then if it gets right credentials (uid and hwid) then...