File verdict·Evidence-based file assessment

Our call: Is OptiFine_1.21.11_HD_U_J9.jar safe?Safe

Item: OptiFine_1.21.11_HD_U_J9.jar
Rating: 4.5
Author: MalwareTips File Scanner

Open or run with normal care

92Safety ratingLow observed risk

Safety rating92/100Low observed risk

Evidence snapshot

0 of 75 antivirus engines flagged the file.Observed · Antivirus analysis
One or more independent reference checks were incomplete or unavailable.Derived · External-intelligence coverage
The hash has been submitted 3,899 times from 2,950 sources.Derived · Saved report facts

OptiFine_1.21.11_HD_U_J9.jar

7.7 MB

63a60c48b3370920e9…be668d3903

Antivirus

0 of 75 flagged

Sandbox

Runtime complete

Code signing

Not applicable

First seen

First seen 3mo ago

01

Before opening or running

Open or run it only when its publisher and download source have been independently verified.

02

If you already opened or ran it

Keep normal device protection enabled and stop if the file behaves unexpectedly.

Scan transparency

Coverage & freshness

3 of 5 complete

Complete means the check returned a usable result. It does not mean the file is safe.

Antivirus
Complete
0 of 75 engines flagged the file.
Updated Apr 30, 2026, 4:50 PM UTC
Sandbox
Complete
1 isolated runtime environment contributed observations.
Updated May 1, 2026, 1:20 AM UTC
Network
Not run
No contacted-host reputation check is recorded.
No timestamp recorded
YARA
Complete
Rule evaluation completed with no recorded matches.
Updated May 1, 2026, 1:20 AM UTC
External intel
Not run
No independent reference checks are recorded.
No timestamp recorded

Recorded behavior

Attack story

Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.

ObservedDerived

Input file

The submitted object

1

FileObserved
OptiFine_1.21.11_HD_U_J9.jar
63a60c48b3370920e96d4c32570d7154d17b3a86654c4f1d1df418be668d3903
01Uploaded file

Processes

Runtime execution

2

ProcessObserved
Observed process
"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\<USER>\Desktop\download.jar"
02Isolated runtime analysis
ProcessObserved
Observed process
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
03Isolated runtime analysis
+1 more recorded observation in Analyst mode

Files

Created or changed

2

Written fileObserved
3720
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\3720
04Isolated runtime analysis
Written fileObserved
3903daac9bc4a3b7.timestamp
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
05Isolated runtime analysis
+1 more recorded observation in Analyst mode

5 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.

Chapter 02

Intelligence

The saved assessment, checked against the scan evidence and recorded coverage.

No saved analyst narrative

This report keeps the verified scan facts available below without inventing an analysis that was not saved with the scan.

Chapter 03

Behavior

Plain-English impact first, then the observed runtime evidence.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK

7

Adversary techniques mapped to the MITRE ATT&CK framework.

T1064T1082· System reconT1083· Scans your filesT1518.001· Checks your AVT1543.002· Service installT1562.001· Disables securityT1564.001· Hides artifacts

Spawned processes

15

$(unnamed)

"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\<USER>\Desktop\download.jar"

$(unnamed)

C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

$(unnamed)

C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\runtime.jar"" >> C:\cmdlinestart.log 2>&1

$(unnamed)

C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

$(unnamed)

"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\runtime.jar"

$(unnamed)

/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

$(unnamed)

/usr/lib/rsyslog/rsyslog-rotate

$(unnamed)

/usr/bin/systemctl systemctl kill -s HUP rsyslog.service

+7 more processes captured.

Filesystem & mutexes

15

Files written14

C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\3720
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp
C:\Users\user\AppData\Local\Temp\hsperfdata_user
C:\Users\user\AppData\Local\Temp\hsperfdata_user\7164

+9 more

Files deleted1

C:\Users\user\AppData\Local\Temp\hsperfdata_user\3484

Dropped payload

Files this sample writes at runtime

This file drops 8 children at runtime. None are currently flagged malicious in our cache.

8 unseen

db65a1c9cae09215c805…43321bNever scanned
never seen before
7b7364406fc3be34c265…b422c8Never scanned
never seen before
e31dba7b57e069034269…780edbNever scanned
never seen before
d87c5f3cdfb5b7c0510e…1ade9eNever scanned
never seen before
ed2124b2226efa886282…187042Never scanned
never seen before
2423ea593d6f112e0729…0c58b2Never scanned
never seen before
44a3bab2c338e3bca24c…d3b9e7Never scanned
never seen before
ac941ead01d5451a7a9f…253227Never scanned
never seen before

Chapter 04

Detection & Forensics

Consensus, attribution, signatures, code structure, prevalence, and identity.

Evidence map

Detection sources at a glance

1 completed · 3 unavailable

Antivirus

No match

0/75 flagged

Malware samples

Unavailable

unavailable

Researcher rules

Unavailable

unavailable

Reference software

Unavailable

unavailable

Threat attribution

No specific family attributed

The available sources did not agree on a named threat category.

External intelligence

Researcher-database status unavailable

This legacy report does not record whether the independent reference checks completed.

YARA rules

No matches

The rule pass completed without a saved public match.

Antivirus consensus

0 of 75 engines flagged this file

0 malicious0 suspicious75 not flagged

Tier-117 engines

0flagged

Tier-241 engines

0flagged

Low-trust17 engines

0flagged

No antivirus engine flagged this file.

View all 75 engine results

AcronisOK

AhnLab-V3OK

AlibabaOK

alibabacloudOK

ALYacOK

Antiy-AVLOK

APEXtyp

ArcabitOK

AvastOK

Avast-MobileOK

AVGOK

AviraOK

BitDefenderOK

BitDefenderFalxtyp

Bkavfai

CAT-QuickHealOK

ClamAVtim

CMCOK

CrowdStrikeOK

CTXOK

Cylancetyp

CynetOK

DeepInstincttyp

DrWebOK

Elastictyp

EmsisoftOK

ESET-NOD32OK

F-SecureOK

FortinetOK

GDataOK

Googlefai

GridinsoftOK

huorongOK

IkarusOK

JiangminOK

K7AntiVirusOK

K7GWOK

KasperskyOK

KingsoftOK

LionicOK

MalwarebytesOK

MaxSecureOK

McAfeeDOK

MicrosoftOK

MicroWorld-eScanOK

NANO-AntivirusOK

Paloaltotyp

PandaOK

Risingtim

SangforOK

SentinelOnetyp

Skyhightim

SophosOK

SUPERAntiSpywareOK

SymantecOK

SymantecMobileInsighttyp

TACHYONOK

tehtristyp

TencentOK

Trapminetyp

TrellixENStim

TrendMicroOK

TrendMicro-HouseCallOK

Trustlookfai

VaristOK

VBA32OK

VIPREOK

VirITOK

ViRobotOK

WebrootOK

XcitiumOK

YandexOK

Zillyatim

ZoneAlarmOK

ZonerOK

PE structure

Not applicable

PE structure analysis applies to Windows executable formats, not this file type.

Prevalence

How widely this file has been seen

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium

Unique uploaders

2,950

Hundreds of people have uploaded this — common.

Total submissions

3,899

Includes repeat uploads by the same source.

First seen

3mo ago

Feb 5, 2026

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

File identity

Fingerprint and provenance

File name: OptiFine_1.21.11_HD_U_J9.jar
Format: JAR
Code signing: Not applicable to this file type
Size: 7.7 MB
Last analyzed: May 1, 2026, 1:20 AM UTC

SHA-256

63a60c48b3370920e96d4c32570d7154d17b3a86654c4f1d1df418be668d3903

Chapter 05

Safety & FAQ

Complete recovery guidance and answers for the next decision.

What to do now

This file appears low risk based on the evidence available now.

Open or run it only when its publisher and download source have been independently verified.
A clean result reduces known risk, but it cannot guarantee that every new or targeted threat has been detected.
Keep your antivirus and Windows updates switched on so you stay protected.

Frequently asked

Safety FAQ

Is OptiFine_1.21.11_HD_U_J9.jar safe?

OptiFine_1.21.11_HD_U_J9.jar appears safe. 0 of 75 antivirus engines flagged it. Open or run it only when its publisher and download source have been independently verified.

What is OptiFine_1.21.11_HD_U_J9.jar?

OptiFine_1.21.11_HD_U_J9.jar is a Java application or archive, about 7.7 MB. Our analysis did not identify a verdict-driving threat signal. A file's name can be reused by different files, so we identify it by its cryptographic hash (below).

How many antivirus engines detected OptiFine_1.21.11_HD_U_J9.jar?

None — 0 of 75 antivirus engines flagged OptiFine_1.21.11_HD_U_J9.jar. That's reassuring, though it is not proof that a file is safe, so we also weigh its behaviour, identity, and reputation.

What is the SHA-256 hash of OptiFine_1.21.11_HD_U_J9.jar?

The SHA-256 hash of OptiFine_1.21.11_HD_U_J9.jar is 63a60c48b3370920e96d4c32570d7154d17b3a86654c4f1d1df418be668d3903, and its MD5 is a1ce0d17ef1fc016582a82234cccf2f1. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.

Is it safe to open or run OptiFine_1.21.11_HD_U_J9.jar?

Based on the recorded evidence, OptiFine_1.21.11_HD_U_J9.jar has a low observed risk. The important caveat is source: make sure you downloaded it from the official website or a trusted store, because attackers sometimes distribute malware-laced copies under a legitimate file's name. If your own antivirus flags it, verify the source and the exact hash before overriding the warning.

How up to date is this analysis of OptiFine_1.21.11_HD_U_J9.jar?

This report reflects the scan run on May 1, 2026. Because a file's hash never changes, the identity of OptiFine_1.21.11_HD_U_J9.jar is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.

Our call: Is OptiFine_1.21.11_HD_U_J9.jar safe?Safe

Recommended next actions

Before opening or running

If you already opened or ran it

Coverage & freshness

Antivirus

Sandbox

Network

YARA

External intel

Attack story

OptiFine_1.21.11_HD_U_J9.jar

Observed process

Observed process

3720

3903daac9bc4a3b7.timestamp

Why these facts are shown

No saved analyst narrative

Detection sources at a glance

YARA rules

PE structure

Fingerprint and provenance

What to do now

Safety FAQ