File scan report

Verdict Safe

Analyzed Aug 25, 20262 months ago

Is baritone-standalone-forge-1.10.1.jar safe? Yes, no threats found.

Widely submitted JAR with zero engine detections and no malicious sandbox or file it created signals.

Strong evidence · Widely seen for a long time, and nothing harmful found.

Open or run it as usual if it came from the official source

The sample shows no malicious indicators; it can be used as a standard Minecraft Forge mod while keeping security software active.

Good practice2 tips

We found nothing harmful in this file.

Run it only if it came from the project's own website.
Keep your security software and system updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

0 of 64 flagged

Flagged 0
No detection 64
No result 11

Filebaritone-standalone-forge-1.10.1.jar443.9 kBSHA-256 96677c8d8c3b…ef95c7

Code signing Not applicable
Test run Completed
First seen 3y ago

None of the 64 antivirus engines that checked it flag it.

Chapter 02

Why we think so

0 points against it and 3 in its favour, checked against the scan evidence.

Analyst conclusion

All 64 antivirus engines that checked it returned clean results and the file has been submitted by 445 sources over three years. Sandbox execution produced no malicious verdict and no malicious files it created were dropped.

6 sources checked · 5 complete · 1 not needed or not applicable. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

11sandbox rule tags
4spawned processes
0network contacts
17filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

11

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1055· Process injection
T1071· Application protocol
T1082· System recon
T1106
T1202
T1203
T1518.001· Checks your AV
T1562.001· Disables security
T1564· Hides artifacts
T1564.003· Hides artifacts
T1574.002· Execution hijack

Observed activity

Processes started

4

Programs the file ran, with their command lines.

java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\<USER>\Desktop\download.jar"
7za.exeC:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\download.jar"
java.exeC:\Program Files (x86)\Common Files\Oracle\Java\java8path_target_3194906\java.exe java.exe -jar "C:\Users\user\Desktop\download.jar"
java.exe"C:\Program Files\Java\jre1.8.0_421\bin\java.exe" -jar C:\Users\user\Desktop\download.jar

Files

17

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5276
WrittenC:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
WrittenC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8748.timestamp
WrittenC:\Users\user\AppData\Local\Temp\JavaLauncher.log
WrittenC:\Users\user\AppData\Local\Temp\hsperfdata_user
WrittenC:\Users\user\AppData\Local\Temp\hsperfdata_user\7892

Show all 17 entries

WrittenC:\jar\META-INF
WrittenC:\jar\META-INF\MANIFEST.MF
WrittenC:\jar\META-INF\mods.toml
WrittenC:\jar\baritone
WrittenC:\jar\baritone.refmap.json
WrittenC:\jar\baritone\BaritoneProvider.class
WrittenC:\jar\baritone\a.class
WrittenC:\jar\baritone\aa.class
WrittenC:\jar\baritone\ab.class
DeletedC:\Users\user\AppData\Local\Temp\hsperfdata_user\3716
Deleted/tmp/hsperfdata_root/3303

Sandbox background — not the file

2

The analysis machine's own processes and connections, recorded in every run.

VM processicacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
VM processconhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Dropped payload

Files this sample writes at runtime

This file drops 8 children at runtime. None are currently flagged malicious in our cache. 8 have no saved verdict and were not checked; that is missing coverage, not a finding.

8 not checked

0bdcbec8bdc38bb469e1…9facfbNot checked
no saved verdict
bb4a9fa4c0e9d97d4ca0…b88157Not checked
no saved verdict
119913a792811ed8cbba…31ddc7Not checked
no saved verdict
8fca6090c65f8488752d…9cfe71Not checked
no saved verdict
82fabeb178f24e91faea…6e3cb2Not checked
no saved verdict
c3e95cd44dd914e6430b…edb829Not checked
no saved verdict
aee09e46be744b310399…e2e697Not checked
no saved verdict
35df95230fb11ce2a221…2b0035Not checked
no saved verdict

Chapter 04

Technical details

None of the 64 antivirus engines that checked it flag it.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete0 of 64 engines flagged it · 11 gave no result DetailsJul 30, 2026

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsAug 25, 2026

Contacted hostsMalwareTips URL scannerNot neededThe sandbox recorded no contacted hosts to check

Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule DetailsAug 25, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedAug 25, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchAug 25, 2026

File fingerprint

Last analyzed: Aug 25, 2026, 7:56 PM UTC

SHA-256: 96677c8d8c3b2e9f4584855c4173b2e82c1fa0f02e4409f7feeea86d5aef95c7
SHA-1: 3733df2533a42c67072f7142417db8a396938145
MD5: ea15525c97f8e63977f1bf393a412258

About this file

baritone-standalone-forge-1.10.1.jar is a JAR file of 443.9 kB.

Type and size: JAR · 443.9 kB
Signer: Not applicable
First seen: Jun 15, 2023On VirusTotal.
Submitted by: 445 distinct sources

First scanned Aug 25, 2026

Antivirus consensus

0 of 64 engines flagged this file

0 malicious0 suspicious64 not flagged11 no result

11 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
0flagged
Tier-233 engines
0flagged
Low-trust13 engines
0flagged

No antivirus engine flagged this file.

View all 75 engine results

AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXNo result
ArcabitClean
AvastClean
Avast-MobileClean
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceNo result
CynetClean
DeepInstinctNo result
DrWebClean
ElasticNo result
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoNo result
PandaClean
RisingClean
SangforClean
SentinelOneNo result
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisNo result
TencentClean
TrapmineNo result
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

445

Hundreds of people have uploaded this — common.

Total submissions

488

Includes repeat uploads by the same source.

First seen

3y ago

Jun 15, 2023

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is baritone-standalone-forge-1.10.1.jar safe?

We found nothing harmful in baritone-standalone-forge-1.10.1.jar. None of the 64 antivirus engines that checked it flag it. Run it only if it came from the project's own website.

What is baritone-standalone-forge-1.10.1.jar?

baritone-standalone-forge-1.10.1.jar is a Java program (JAR), about 443.9 kB. VirusTotal first saw it on Jun 15, 2023.

How many antivirus engines detected baritone-standalone-forge-1.10.1.jar?

None of the 64 antivirus engines that checked it flag baritone-standalone-forge-1.10.1.jar. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.

What is the SHA-256 hash of baritone-standalone-forge-1.10.1.jar?

The SHA-256 fingerprint of baritone-standalone-forge-1.10.1.jar is 96677c8d8c3b2e9f4584855c4173b2e82c1fa0f02e4409f7feeea86d5aef95c7, and its MD5 is ea15525c97f8e63977f1bf393a412258. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to open or run baritone-standalone-forge-1.10.1.jar?

We found nothing harmful in baritone-standalone-forge-1.10.1.jar. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of baritone-standalone-forge-1.10.1.jar?

This report reflects the scan on Aug 25, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Is baritone-standalone-forge-1.10.1.jar safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Files

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

File fingerprint

About this file

0 of 64 engines flagged this file

Signatures and behavior heuristics

How widely this file has been seen

Questions & answers

Community

Is baritone-standalone-forge-1.10.1.jar safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Techniques observed in the sandbox

Observed activity

Processes started

Files

Sandbox background — not the file

File fingerprint

About this file

Related file reports