File name:

forge-1.15.2-31.1.18-installer.jar

Full analysis: https://app.any.run/tasks/8a5e9339-35ce-4b20-9e2f-d4355f54a861
Verdict: Malicious activity
Analysis date: March 06, 2020, 23:51:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

CA083CB95A657042D7EB4D23A742BC53

SHA1:

7F4AFCCEF48F07550F9175148B683CA62ACFD548

SHA256:

ADF0381B22C85E2DB265C95D324CBE78FEA4646C0C15DBD15E168F8E06207730

SSDEEP:

196608:lnZ3Fq/E7VDsOs3pRGX66pHOZvd+/gqQzbYtRRTBx9t:FZ3FqcDi3Upud+ovzbMvTBxf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Creates files in the user directory

      • javaw.exe (PID: 4092)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2020:02:27 06:19:18
ZipCRC: 0x52e6d791
ZipCompressedSize: 11800
ZipUncompressedSize: 31810
ZipFileName: META-INF/MANIFEST.MF
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe

Process information

PID
CMD
Path
Indicators
Parent process
4092"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\forge-1.15.2-31.1.18-installer.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\javaw.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
23
Read events
22
Write events
1
Delete events
0

Modification events

(PID) Process:(4092) javaw.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
javaw.exe
Executable files
16
Suspicious files
30
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
4092javaw.exeC:\Users\admin\AppData\Local\Temp\imageio3548320383436903395.tmp —
MD5:—
SHA256:—
4092javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\minecraft_server.1.15.2.jar —
MD5:—
SHA256:—
4092javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\forge-1.15.2-31.1.18.jarjava
MD5:—
SHA256:—
4092javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\1.15.2.jsontext
MD5:—
SHA256:—
4092javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\libraries\net\minecraftforge\forge\1.15.2-31.1.18\forge-1.15.2-31.1.18.jarjava
MD5:—
SHA256:—
4092javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:—
SHA256:—
4092javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm-commons\7.2\asm-commons-7.2.jarjava
MD5:321121317A6C6221CC26E8F9EE97022F
SHA256:0E86B8B179C5FB223D1A880A0FF4960B6978223984B94E62E71135F2D8EA3558
4092javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm\7.2\asm-7.2.jarjava
MD5:26CF10DFD4729FD22FCAE0694E041167
SHA256:7E6CC9E92EB94D04E39356C6D8144CA058CDA961C344A7F62166A405F3206672
4092javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
4092javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\libraries\net\minecraftforge\coremods\2.0.0-milestone.1\coremods-2.0.0-milestone.1.jarcompressed
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
4
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4092
javaw.exe
99.86.1.139:443
launchermeta.mojang.com
AT&T Services, Inc.
US
unknown
4092
javaw.exe
143.204.212.134:443
launcher.mojang.com
—
US
unknown
4092
javaw.exe
142.44.226.189:443
files.minecraftforge.net
OVH SAS
CA
malicious
4092
javaw.exe
99.86.4.83:443
libraries.minecraft.net
AT&T Services, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
launchermeta.mojang.com
  • 99.86.1.139
whitelisted
launcher.mojang.com
  • 143.204.212.134
whitelisted
files.minecraftforge.net
  • 142.44.226.189
suspicious
libraries.minecraft.net
  • 99.86.4.83
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
forge-1.15.2-31.1.18-installer.jar