File scan report
Verdict Safe
Is Marlow's Crystal Optimizer-
This widely shared Minecraft optimizer mod JAR has zero detections across 74 antivirus engines and ran cleanly in a sandbox, showing only normal Java activity in the test run.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
This mod can be used normally; obtain it from official mod repositories and keep your antivirus protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the project's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 10
- Code signing Not applicable
- Test run Completed
- First seen 9mo ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 64 antivirus engines that checked it flagged this Java mod, including all major antivirus engines. It has been submitted by 362 different sources over about nine months, and a sandbox run recorded only standard Java launcher and analysis-harness activity with no network connections.
No engine among the 74 flagged the file, and 16 major antivirus engines returned clean results. The file is common and has circulated for 283 days across 362 submitters, which fits a popular Minecraft performance mod. No network contacts were recorded, though no host-reputation cross-check result is available. Six dropped files lack saved verdicts, which is a coverage gap rather than a risk.
What We Detected
None of the 64 antivirus engines that checked it flagged this JAR file, including Kaspersky, ESET-NOD32, BitDefender, Microsoft and Avira. The file has been seen from 362 distinct sources over roughly nine months, consistent with a popular Minecraft client-side optimizer mod.
Threat Behavior
One sandbox run returned a clean result. The recorded activity consists of Java launching the JAR, the sandbox's own tracing agent, Java adjusting permissions on its standard usage-tracking folder, and routine Linux log rotation. Two technique tags related to service creation and defense impairment were mapped, but no process in the recording performs those actions. No domains or IP addresses were contacted, and no complete host-reputation result is available. Six dropped files have no saved verdict.
What To Do Now
The evidence supports using this mod normally. Download mods from official sources such as Modrinth or CurseForge, keep your antivirus enabled, and re-scan if you obtain a different version from an unofficial site.
Where this verdict could be wrong2 caveats
- The sandbox mapped two offensive-looking techniques (service creation and impairing defenses), though the recorded processes do not show the sample doing either; a single run may also miss delayed or conditional behaviour.
- Six dropped files have no saved verdict, and external threat-intel coverage was unavailable for this scan.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 64 antivirus engines that checked it flagged the file
- Major antivirus engines including Kaspersky, ESET and Microsoft reported it clean
- Widely shared: 362 different submitters over about nine months
- The sandbox run finished with a clean result and no network contacts were recorded
- The sandbox mapped two offensive-sounding techniques, although the recorded processes do not show the file performing them
- Six files dropped during analysis have no saved verdict yet
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 10sandbox rule tags
- 4spawned processes
- 0network contacts
- 13filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1064
- T1082· System recon
- T1106
- T1202
- T1518.001· Checks your AV
- T1543.002· Service install
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.001· Hides artifacts
- T1564.003· Hides artifacts
Observed activity
Processes started
4Programs the file ran, with their command lines.
java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\<USER>\Desktop\sample.jar"cmd.exeC:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\sample.jar"" >> C:\cmdlinestart.log 2>&1java.exe"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\sample.jar"java/usr/bin/java -jar /tmp/runtime.jar
Files
13Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5444 - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user\884 - Written
C:\cmdlinestart.log
Show all 13 entries for files
- Written
\Device\ConDrv\\Connect - Written
/proc/4992/coredump_filter - Written
/tmp/hsperfdata_root/4992 - Written
/var/log/auth.log.1.gz - Written
/var/log/kern.log.1.gz - Deleted
C:\Users\user\AppData\Local\Temp\hsperfdata_user\6600 - Deleted
/tmp/hsperfdata_root/4992
Sandbox background — not the file
7The analysis machine's own processes and connections, recorded in every run.
- VM process
icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog - VM process
rsyslog-rotate/usr/lib/rsyslog/rsyslog-rotate - VM process
systemctl/usr/bin/systemctl systemctl kill -s HUP rsyslog.service - VM process
gzip/bin/gzip
Show all 7 entries for sandbox background — not the file
- VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/mail.info/var/log/mail.warn/var/log/mail.err/var/log/mail.log/var/log/daemon.log/var/log/kern.log/var/log/auth.log/var/log/user.log/var/log/lpr.log/var/log/cron.log/var/log/debug/var/log/messages
Files this sample writes at runtime
This file drops 2 children at runtime. None are currently flagged malicious in our cache. 2 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 1ac7d6a0c53eaac78227…c15d23Not checkedno saved verdict
- d93d573cc7bd409b0881…835c14Not checkedno saved verdict
Chapter 04
Technical details
None of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 16, 2026, 4:58 PM UTC
- SHA-256
dc7969358bca82956964a7a96d4aa5911ae267d533ae639aa5ea48c7f50188c5- SHA-1
e8e1866db684c1f6fab8c6b67ebf1f4f57a6de22- MD5
148157d9e6cd822e0c7eb2b1629edf8f
About this file
Marlow's Crystal Optimizer-1.21.11-1.0.5.jar is a JAR file of 108.6 kB.
- Type and size
- JAR · 108.6 kB
- Signer
- Not applicable
- First seen
- Jan 6, 2026On VirusTotal.
- Submitted by
- 362 distinct sources
First scanned
Antivirus consensus
0 of 64 engines flagged this file
10 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-234 engines0flagged
- Low-trust13 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITNo result
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Marlow's Crystal Optimizer-1.21.11-1.0.5.jar safe?
What is Marlow's Crystal Optimizer-1.21.11-1.0.5.jar?
How many antivirus engines detected Marlow's Crystal Optimizer-1.21.11-1.0.5.jar?
What is the SHA-256 hash of Marlow's Crystal Optimizer-1.21.11-1.0.5.jar?
Is it safe to open or run Marlow's Crystal Optimizer-1.21.11-1.0.5.jar?
How up to date is this analysis of Marlow's Crystal Optimizer-1.21.11-1.0.5.jar?
Community
Member reviews and reports for this exact file hash.