Hi Jimy,
I would sugest that you analyse it with an jvm introspect tool. Im using byteman ( jboss.org/byteman ). You can write simple script to analyse when a class is istantiated. So if you have suspicious classes you can check its status on runtime. Hope that it can help