File scan report
Verdict Safe
Is krypton-
None of the 64 antivirus engines that checked it flagged this widely shared Java archive, first seen on Jan 9, 2026, and the combined sandbox verdict was clean with no high-risk…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
The file shows no signs of malware; download it only from its official source and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the project's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 11
- Code signing Not applicable
- Test run Completed
- First seen 9mo ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The combined sandbox verdict across four runs was clean, with no network contacts and no high-risk techniques recorded. No reference database lists it as malware.
None of the 64 antivirus engines that checked it flagged the file, including all 18 major antivirus engines that reported on it. The archive has been submitted by 206 distinct sources over roughly nine months, which is unusual for a targeted threat. Four sandbox runs produced a combined clean verdict, contacted no hosts, and showed only Java activity in the test run with no injection or persistence. One defence-tampering mapping appeared without any matching artefact, which is common on harmless files. Public malware-sharing and rule databases returned no matches. The archive's contents were not examined by our own static analysis, and no host-reputation check was saved.
What We Detected
None of the 64 antivirus engines that checked it flagged this Java archive, and no malware-sharing database or community rule set lists it. It has been submitted by 206 distinct sources since it was first seen on Jan 9, 2026.
Threat Behavior
Four sandbox runs launched the archive with Java on Windows and Linux. The combined sandbox verdict was clean: the runs recorded only ordinary Java runtime files, no network contacts, no injection into other processes, and no persistence. A defence-related technique label appeared without any supporting artefact, which is routine for harmless software. Our own static analysis did not examine the archive's contents.
What To Do Now
The evidence does not point to malware. If this is a game client or mod, obtain it from its official project page and keep your antivirus enabled while using it.
Where this verdict could be wrong2 caveats
- The file name suggests a Minecraft-style client or cheat loader, and the contents of the archive were not inspected by our own static analysis, so bundled unwanted code cannot be fully ruled out.
- Fresh or obfuscated Java malware is sometimes missed by engines that only see compressed class files, though wide distribution over many months makes that less likely here.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 64 antivirus engines that checked it flagged the file.
- Submitted by 206 distinct sources since Jan 9, 2026.
- The combined sandbox verdict was clean, with no network contacts or high-risk techniques.
- No listing in public malware-sharing or rule databases.
- The file name resembles a game client or cheat-style loader, a category sometimes used to spread unwanted code.
- Our own static analysis did not examine the archive's contents.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 10sandbox rule tags
- 7spawned processes
- 0network contacts
- 16filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1064
- T1082· System recon
- T1106
- T1202
- T1518.001· Checks your AV
- T1543.002· Service install
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.001· Hides artifacts
- T1564.003· Hides artifacts
Observed activity
Processes started
7Programs the file ran, with their command lines.
java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\<USER>\Desktop\download.jar"cmd.exeC:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\runtime.jar"" >> C:\cmdlinestart.log 2>&1java.exe"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\runtime.jar"cmd.exeC:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\sample.jar"" >> C:\cmdlinestart.log 2>&1java.exe"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\sample.jar"java/usr/bin/java -jar /tmp/sample.jar
Show all 7 entries for processes started
java/usr/bin/java -jar /tmp/download.jar
Files
16Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5532 - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user\6828 - Written
C:\cmdlinestart.log
Show all 16 entries for files
- Written
\Device\ConDrv\\Connect - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user\5240 - Written
/proc/4993/coredump_filter - Written
/tmp/hsperfdata_root/4993 - Written
/var/log/auth.log.1.gz - Written
/var/log/kern.log.1.gz - Written
/proc/4971/coredump_filter - Written
/tmp/hsperfdata_root/4971 - Deleted
/tmp/hsperfdata_root/4993 - Deleted
/tmp/hsperfdata_root/4971
Sandbox background — not the file
7The analysis machine's own processes and connections, recorded in every run.
- VM process
icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog - VM process
rsyslog-rotate/usr/lib/rsyslog/rsyslog-rotate - VM process
systemctl/usr/bin/systemctl systemctl kill -s HUP rsyslog.service - VM process
gzip/bin/gzip
Show all 7 entries for sandbox background — not the file
- VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/mail.info/var/log/mail.warn/var/log/mail.err/var/log/mail.log/var/log/daemon.log/var/log/kern.log/var/log/auth.log/var/log/user.log/var/log/lpr.log/var/log/cron.log/var/log/debug/var/log/messages
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache. 3 have no saved verdict and were not checked; that is missing coverage, not a finding.
- d7d6dc42eb299bb4a5fe…61b1aeNot checkedno saved verdict
- f998cc7e01fbb4982b1f…bae18cNot checkedno saved verdict
- b49a44998b582bb6105e…1b5db2Not checkedno saved verdict
Chapter 04
Technical details
None of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 27, 2026, 10:27 AM UTC
- SHA-256
25d64a2b585784be5914c5071ed824fc94682496bebab6429e529041e598efcc- SHA-1
6f5bb19644b8415b1b77fbf8e3a6e92473d3820a- MD5
e1afe956a5f121679e228a80e95ef8ee
About this file
krypton-new-gen.jar is a JAR file of 633.8 kB.
- Type and size
- JAR · 633.8 kB
- Signer
- Not applicable
- First seen
- Jan 9, 2026On VirusTotal.
- Submitted by
- 206 distinct sources
First scanned
Antivirus consensus
0 of 64 engines flagged this file
11 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is krypton-new-gen.jar safe?
What is krypton-new-gen.jar?
How many antivirus engines detected krypton-new-gen.jar?
What is the SHA-256 hash of krypton-new-gen.jar?
Is it safe to open or run krypton-new-gen.jar?
How up to date is this analysis of krypton-new-gen.jar?
Community
Member reviews and reports for this exact file hash.