File name:

arclight-forge-1.16.5-1.0.25-7cf92be3.jar

Full analysis: https://app.any.run/tasks/e1db8ee2-50bf-415c-b197-4a1ae98f6ea2
Verdict: Malicious activity
Analysis date: April 19, 2025, 09:19:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
java
arch-doc
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

D669E51EF65BD717DB8CA5F40BAB8692

SHA1:

EE50053B940DB272747F3EF7570B02274C4AE22A

SHA256:

0711487FB8D624BD89BD74E8BAB271C8BEFB96485282DE5CCC6FD85CF9A40F98

SSDEEP:

98304:qmOgvIwdc3nFXAJEwNLDbiGr65u4lAFHcd0JwKl/UelHqhbPw7yH9YBZYP8x/gQ1:JmWX6pN4yw5xaw926r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • javaw.exe (PID: 7020)

  • INFO

    • Create files in a temporary directory

      • javaw.exe (PID: 7020)
      • java.exe (PID: 6644)
      • javaw.exe (PID: 5608)
      • java.exe (PID: 3300)
      • javaw.exe (PID: 6252)
      • javaw.exe (PID: 3900)

    • Application based on Java

      • javaw.exe (PID: 7020)
      • javaw.exe (PID: 5608)
      • javaw.exe (PID: 6252)
      • javaw.exe (PID: 3900)

    • Creates files in the program directory

      • javaw.exe (PID: 7020)

    • Reads the machine GUID from the registry

      • javaw.exe (PID: 7020)
      • java.exe (PID: 6644)
      • javaw.exe (PID: 6252)
      • java.exe (PID: 3300)
      • javaw.exe (PID: 3900)

    • Reads the computer name

      • javaw.exe (PID: 7020)
      • java.exe (PID: 6644)
      • javaw.exe (PID: 6252)
      • java.exe (PID: 3300)
      • javaw.exe (PID: 3900)

    • Checks supported languages

      • javaw.exe (PID: 7020)
      • java.exe (PID: 6644)
      • javaw.exe (PID: 5608)
      • javaw.exe (PID: 6252)
      • java.exe (PID: 3300)
      • javaw.exe (PID: 3900)

    • Creates files or folders in the user directory

      • javaw.exe (PID: 7020)

    • Checks proxy server information

      • java.exe (PID: 6644)
      • java.exe (PID: 3300)
      • slui.exe (PID: 6540)

    • The sample compiled with english language support

      • javaw.exe (PID: 7020)

    • Reads the software policy settings

      • slui.exe (PID: 2316)
      • slui.exe (PID: 6540)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 5728)

    • Reads security settings of Internet Explorer

      • OpenWith.exe (PID: 5728)
      • notepad.exe (PID: 1760)

    • Manual execution by a user

      • javaw.exe (PID: 6252)
      • notepad.exe (PID: 1760)
      • javaw.exe (PID: 3900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jar | Java Archive (56.8)
.zip | ZIP compressed archive (15.6)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2023:10:22 03:52:40
ZipCRC: 0x00000000
ZipCompressedSize: 2
ZipUncompressedSize: -
ZipFileName: META-INF/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
17
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe icacls.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe svchost.exe rundll32.exe no specs java.exe conhost.exe no specs slui.exe openwith.exe no specs javaw.exe no specs javaw.exe java.exe conhost.exe no specs notepad.exe no specs javaw.exe

Process information

PID
CMD
Path
Indicators
Parent process
1760"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\eula.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2316"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2908C:\WINDOWS\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3300"C:\Program Files\Java\jre1.8.0_271\bin\java" -Djava.net.useSystemProxies=true -jar forge-1.16.5-36.2.39-installer.jar --installServer .C:\Program Files\Java\jre1.8.0_271\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\java.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3900"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\Desktop\arclight-forge-1.16.5-1.0.25-7cf92be3.jar" C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4056\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4776\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5608C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
25 046
Read events
25 043
Write events
3
Delete events
0

Modification events

(PID) Process:(5728) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jar\OpenWithProgids
Operation:writeName:jarfile
Value:
Executable files
117
Suspicious files
97
Text files
33
Unknown types
0

Dropped files

PID
Process
Filename
Type
7020javaw.exeC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamptext
MD5:874E574CFB23319051850895685C9470
SHA256:C1CA5A59CD4ADAFEDBE24EBEA28372B0304AABF38D87AC248A00B8B8FBEC107B
7020javaw.exeC:\Users\admin\AppData\Local\Temp\1101914240497arclight.conf.tmptext
MD5:1662BC117CF34024EEA46B1BD5D0100F
SHA256:16D28D2AEED8FA0BBCAD21F42DABE8AE4B2EF934CC301D7C33987BDD99DEBC35
7020javaw.exeC:\Users\admin\AppData\Local\Temp\arclight.conftext
MD5:1662BC117CF34024EEA46B1BD5D0100F
SHA256:16D28D2AEED8FA0BBCAD21F42DABE8AE4B2EF934CC301D7C33987BDD99DEBC35
7020javaw.exeC:\Users\admin\AppData\Local\Temp\libraries\org\ow2\asm\asm-util\9.0\asm-util-9.0.jarjava
MD5:DDBCAA2262311E04A6B0560787B47DA4
SHA256:2AF6E7D01E0862E75193F3C01A06A689B0A245947E29F38EB683633391519BB6
7020javaw.exeC:\Users\admin\AppData\Local\Temp\libraries\org\ow2\asm\asm-analysis\9.0\asm-analysis-9.0.jarjava
MD5:DAED5F6BC67AC8F01BEBECA0BB72A369
SHA256:2D46DE6DF856A4DAAC9AA534459AB7287EB80584E9109850405E5B302DC9C2A6
7020javaw.exeC:\Users\admin\AppData\Local\Temp\libraries\org\fusesource\jansi\jansi\1.18\jansi-1.18.jarjava
MD5:6EE32DE8880DA9F02552474F60AB6FBD
SHA256:109E64FC65767C7A1A3BD654709D76F107B0A3B39DB32CBF11139E13A6F5229B
7020javaw.exeC:\Users\admin\AppData\Local\Temp\libraries\org\apache\maven\maven-resolver-provider\3.8.1\maven-resolver-provider-3.8.1.jarcompressed
MD5:14B2E340C01E51B8D8B3CE21EE1740FD
SHA256:A829D2D819851A43F1009DA781470CA0A94E0EDE684562EE6E07B7BCE0E35210
7020javaw.exeC:\Users\admin\AppData\Local\Temp\libraries\jline\jline\2.12.1\jline-2.12.1.jarcompressed
MD5:96E04A388FFFF0ADEE6C2CE64612A7A1
SHA256:7A79C9CF47D47537CCF5239E374FA32A6D50B8AFD92C19D193B7BD94DA645D43
7020javaw.exeC:\Users\admin\AppData\Local\Temp\libraries\org\jline\jline-terminal\3.12.1\jline-terminal-3.12.1.jarjava
MD5:3C52BE5AB5E3847BE6E62269DE924CB0
SHA256:EB6115680F732562F0E8E6777F127DECE81E23B25015925F3C4A2A900D48CC9E
7020javaw.exeC:\Users\admin\AppData\Local\Temp\libraries\com\googlecode\json-simple\json-simple\1.1.1\json-simple-1.1.1.jarjava
MD5:5CC2C478D73E8454B4C369CEE66C5BC7
SHA256:4E69696892B88B41C55D49AB2FDCC21EEAD92BF54ACC588C0050596C3B75199C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
196
DNS requests
27
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6712
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6712
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7020
javaw.exe
119.28.56.73:443
arclight.mcxk.net
Tencent Building, Kejizhongyi Avenue
HK
unknown
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
google.com
  • 216.58.206.78
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
arclight.mcxk.net
  • 119.28.56.73
unknown
login.live.com
  • 20.190.160.64
  • 40.126.32.140
  • 20.190.160.66
  • 40.126.32.76
  • 20.190.160.5
  • 20.190.160.14
  • 40.126.32.68
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
arclight.hypertention.cn
  • 43.152.25.74
  • 101.33.5.30
  • 43.152.27.99
  • 172.235.24.96
  • 172.233.0.133
  • 170.187.231.7
  • 139.177.193.41
  • 43.152.43.121
  • 172.235.251.16
  • 172.104.135.123
  • 172.235.24.97
unknown
arclight.hypoglycemia.icu
  • 172.67.223.39
  • 104.21.46.39
unknown
maven.minecraftforge.net
  • 172.67.161.211
  • 104.21.58.163
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .icu Domain
7020
javaw.exe
Potentially Bad Traffic
ET INFO Suspicious Domain (*.icu) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
arclight-forge-1.16.5-1.0.25-7cf92be3.jar