MalwareTipsTools

File scan report

Scan another file

Verdict Safe

Analyzed , 2 months ago

Is TLauncher.exe safe? Yes, no threats found.

A validly signed TLauncher Minecraft launcher flagged by only 2 of the 68 antivirus engines that checked it, one calling it a potentially unwanted program, with no major detections and no high-risk behaviour in the test run.

Moderate evidence · No engine flags it, but no publisher signature confirms who made it.

Run it as usual if it came from the official source

Use it only if downloaded from the official TLauncher source, keep your antivirus enabled, and decline optional bundled offers.

Good practice2 tips

We found nothing harmful in this file.

  1. Run it only if it came from the developer's own website or an official app store.

  2. Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Share this file report

TLauncher.exe: Safe — MalwareTips file scan

The link always shows the latest result for this exact file (its SHA-256 fingerprint).

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

2 of 68 flagged

  • Flagged 2
  • No detection 66
  • No result 7
FileTLauncher.exe9.7 MBSHA-256 f0cb809918c2…a714ce
  • Code signing TLauncher Inc.
  • Test run Completed
  • First seen 4mo ago
It has a valid digital signature from TLauncher Inc..

Chapter 02

Why we think so

2 points against it and 4 in its favour, checked against the scan evidence.

MT AI Engine · Verdict analysis

The reasoning behind this verdict

Analyst conclusion

This launcher carries a valid signature from TLauncher Inc. and only 2 of the 68 antivirus engines that checked it flagged it: Malwarebytes as a potentially unwanted program and VBA32 with a generic Launch4j dropper label. None of the major engines flagged it, and the sandbox runs showed it starting Java and fetching launcher configuration.

Full reasoning

The VBA32 label describes the Launch4j Java wrapper the launcher is built with, and the Malwarebytes label is a potentially-unwanted-program category, not a malware family. The signature from TLauncher Inc. verifies, though the publisher has limited history with us. The sandbox runs show a Java launcher starting its bundled runtime, writing logs and caching configuration, with no named injection target or persistence. Over a thousand distinct sources have submitted the file since it was first seen on Jul 5, 2026.

Detailed assessment

What We Detected

2 of the 68 antivirus engines that checked it flagged this launcher: Malwarebytes labels it a potentially unwanted program and VBA32 uses a generic Launch4j dropper label. None of the 18 major engines flagged it. The file carries a valid signature from TLauncher Inc.

Threat Behavior

The sandbox runs show a Java-based launcher starting its own Java runtime from the TLauncher data folder, writing logs and downloading launcher configuration and images. No process injection target, persistence or malicious sandbox verdict was recorded, and the checked hosts had no malicious reputation.

What To Do Now

If you obtained it from the official TLauncher channel and want this launcher, it can be used. Keep your antivirus enabled and decline any optional extra offers during setup.

Where this verdict could be wrong2 caveats
  • Malwarebytes labels the file a potentially unwanted program, and a prior file from the same signer received a cautious assessment, so bundled unwanted components cannot be fully excluded.
  • The signer is not on our curated publisher list and has little history with us.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Points in its favour
  • Valid code signature from TLauncher Inc.
  • None of the major engines flagged the file.
  • Sandbox activity matches a Java game launcher with no high-risk techniques observed.
  • Submitted by over a thousand distinct sources.
Points against
  • One engine labels the file a potentially unwanted program.
  • The signing publisher has little history with us and is not on our curated list.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete
  • 29sandbox rule tags
  • 5spawned processes
  • 20network contacts
  • 31filesystem & mutex artifacts
Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

29

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

  • T1010
  • T1012
  • T1027· Obfuscated code
  • T1033· Reads user info
  • T1036
  • T1047
  • T1055· Process injection
  • T1059· Runs commands
  • T1071· Application protocol
  • T1074
  • T1082· System recon
  • T1083· Scans your files
  • T1090
  • T1105· Network file transfer
  • T1106
  • T1129· Loads modules
  • T1202
  • T1482
  • T1485
  • T1486· File encryption
  • T1497· Sandbox evasion
  • T1497.001· Sandbox evasion
  • T1548
  • T1562· Disables security
  • T1562.001· Disables security
  • T1564· Hides artifacts
  • T1564.003· Hides artifacts
  • T1568
  • T1574· Execution hijack

Observed activity

Processes started
5

Programs the file ran, with their command lines.

  • starter-core-1.268-v6.exe"C:\Users\<USER>\Desktop\starter-core-1.268-v6.exe"
  • javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\starter-core-1.268-v6.exe"
  • java.exeC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\bin\java.exe -Dsun.java2d.uiScale.enabled=false -Xmx1536m -Dfile.encoding=UTF8 -Djava.net.preferIPv4Stack=true --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/sun.awt.image=ALL-UNNAMED --add-opens=java.desktop/sun.java2d=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.image=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=…
  • javaw.exeC:\Program Files\Java\jre1.8.0_321\bin\javaw.exe -jar C:\Users\<USER>\Downloads\starter-core-1.268-v6.exe
  • java.exeC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\bin\java.exe -Dsun.java2d.uiScale.enabled=false -Xmx1536m -Dfile.encoding=UTF8 -Djava.net.preferIPv4Stack=true --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/sun.awt.image=ALL-UNNAMED --add-opens=java.desktop/sun.java2d=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.image=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=…
Network contacts
20

20 hosts, listed as 18 addresses, 4 links. Links show the host and path only.

  • IP address195.201.104.213
  • IP address104.20.15.15
  • IP address104.26.10.134
  • IP address150.171.110.195
  • IP address195.201.83.254
  • IP address172.66.129.18
Show all 22 entries for network contacts
  • IP address176.9.101.148
  • IP address104.20.7.182
  • IP address185.175.46.50
  • IP address212.41.10.12
  • IP address104.21.62.76
  • IP address172.67.70.32
  • IP address148.251.7.26
  • IP address104.20.14.15
  • IP address150.171.109.71
  • IP address217.168.244.242
  • IP address150.171.109.65
  • IP address150.171.110.193
  • URLhttp://advancedrepository.net/check.bin
  • URLhttp://advancedrepository.net/tlauncher-sources/prod/release/tlauncher/starterUpdateV1_bridge.json
  • URLhttp://img.tlauncher.org/update/downloads/configs/client/video/tl-discord-en.png
  • URLhttp://img.tlauncher.org/update/downloads/configs/client/images/img-up-for-server.png
Files
30

Files the file created, changed or deleted.

  • WrittenC:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5216
  • WrittenC:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
  • WrittenC:\Users\<USER>\AppData\Roaming\.tlauncher\logs\starter\log.2026-07-05_18.log
  • WrittenC:\Users\<USER>\AppData\Local\Temp\imageio355229352328223702.tmp
  • WrittenC:\Users\<USER>\AppData\Local\Temp\imageio1467050269030202348.tmp
  • WrittenC:\Users\<USER>\AppData\Local\Temp\imageio3754000199794267823.tmp
Show all 30 entries for files
  • WrittenC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\protection.txt
  • WrittenC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json.temp
  • WrittenC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json
  • WrittenC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json.metadata
  • WrittenC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9369\dependencies.json.temp
  • WrittenC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9369\dependencies.json
  • WrittenC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9369\dependencies.json.metadata
  • WrittenC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9369\resources.json.temp
  • WrittenC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9369\resources.json
  • DeletedC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json.temp
  • DeletedC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9369\dependencies.json.temp
  • DeletedC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9369\resources.json.temp
  • DeletedC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\javaConfig21.json.temp
  • DeletedC:\Users\<USER>\AppData\Roaming\.tlauncher\starter\jre-21.0.11-windows-x64.zip
  • DeletedC:\Users\<USER>\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\configs_v1\pages\index_en.html.temp
  • DeletedC:\Users\<USER>\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\configs\inner_servers-1.2.json.temp
  • DeletedC:\Users\<USER>\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\libraries\org\tlauncher\authlib\libraries-1.7.json.temp
  • DeletedC:\Users\<USER>\AppData\Roaming\java\webview\.test
  • DeletedC:\Users\<USER>\AppData\Roaming\java\webview\localstorage\.test
  • DeletedC:\Users\<USER>\AppData\Local\Temp\socket_92793781
  • DeletedC:\Users\<USER>\AppData\Local\Temp\imageio2497488848524583605.tmp
  • DeletedC:\Users\<USER>\AppData\Local\Temp\imageio6675878790815219270.tmp
  • DeletedC:\Users\<USER>\AppData\Local\Temp\imageio9103290226475136747.tmp
  • DeletedC:\Users\user\AppData\Local\Temp\hsperfdata_user\3360
Mutexes
1

Named locks a program uses so only one copy runs; malware families often reuse them.

  • Global\OneSettingQueryMutex+compat+encapsulation
Sandbox background — not the file
11

The analysis machine's own processes and connections, recorded in every run.

  • VM processicacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  • VM processservices.exeC:\Windows\system32\services.exe
  • VM processsvchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p
  • VM processsvchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup
  • VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
  • VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
Show all 11 entries for sandbox background — not the file
  • VM processlsass.exeC:\Windows\system32\lsass.exe
  • VM processsvchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
  • VM processsvchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
  • VM processicacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant everyone:(OI)(CI)M
  • VM host8.8.8.8
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked
  • a1fb74983ba0d8eb876f…e6c89eNot checked
    no saved verdict
  • d627e7065391634c7aee…b1d224Not checked
    no saved verdict
  • c04118aed95ef281c6b3…8c3c48Not checked
    no saved verdict
  • edd691fc6ad7c7f3167e…3718b1Not checked
    no saved verdict
  • 533fcbcf37d49f379094…8fbdd5Not checked
    no saved verdict
  • 9ed26791dc2d8629fdf8…3e269bNot checked
    no saved verdict
  • 9ecd53bc4faff6895812…3b3799Not checked
    no saved verdict
  • 1887ffd2b41d8787c584…6d5af5Not checked
    no saved verdict
  • a171ee4c734dd2da837e…36ca26Not checked
    no saved verdict
  • 7eb52e240f1d92c808d1…e95173Not checked
    no saved verdict

Chapter 04

Technical details

2 of the 68 antivirus engines that checked it flag it; signed by TLauncher Inc..

Sources checked

Every check behind this verdict

6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.

SourceStatusResultChecked
Antivirus enginesVirusTotal · 75 enginesCompleteWorth noting: 2 of 68 engines flagged it · 7 gave no result · treated as non-decisive Details for antivirus engines
Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded Details for sandbox run
Contacted hostsMalwareTips URL scannerPartial2 of 20 contacted hosts were cross-checked; coverage is incomplete Details for contacted hosts
Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule Details for signature rules
Malware sample databaseabuse.ch MalwareBazaarCompleteNot listed
Known-software referenceCIRCL hashlookupCompleteNo match

Engines that flagged it 2

The Safe verdict weighed these detections and treats them as non-decisive.

  • MalwarebytesPUP.Optional.TLauncher
  • VBA32TrojanDropper.Win32.Launch4j

File fingerprint

Last analyzed
Aug 12, 2026, 9:53 AM UTC
SHA-256
f0cb809918c2bf85a8eef2bcbd35218e75426b4e5698ca1cca50acf3e5a714ce
SHA-1
c770f518ac82dfa316c3293722db36db2e81ddb8
MD5
945b2a20000dcf96c356b15a1ca00abc

About this file

TLauncher.exe is a Win32 EXE file of 9.7 MB.

Type and size
Win32 EXE · 9.7 MB
Signer
TLauncher Inc.Valid code signature.
First seen
Jul 5, 2026On VirusTotal.
Submitted by
1,057 distinct sources
Packer
None detected
Entropy
7.89 of 8

First scanned Updated

Verdict history

  1. Suspicious
  2. Safeafter a re-check of the saved evidence

Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.

Antivirus consensus

2 of 68 engines flagged this file

2 malicious0 suspicious66 not flagged7 no result

7 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

  • Tier-118 engines
    0flagged
  • Tier-234 engines
    1flagged
  • Low-trust16 engines
    1flagged
View all 75 engine results
  • MalwarebytesMalicious: PUP.Optional.TLauncher
  • VBA32Malicious: TrojanDropper.Win32.Launch4j
  • AcronisClean
  • AhnLab-V3Clean
  • AlibabaClean
  • alibabacloudClean
  • ALYacClean
  • Antiy-AVLClean
  • APEXClean
  • ArcabitClean
  • AvastClean
  • Avast-MobileNo result
  • AVGClean
  • AviraClean
  • BitDefenderClean
  • BitDefenderFalxNo result
  • BkavNo result
  • CAT-QuickHealClean
  • ClamAVClean
  • CMCClean
  • CrowdStrikeClean
  • CTXClean
  • CylanceClean
  • CynetClean
  • DeepInstinctClean
  • DrWebClean
  • ElasticClean
  • EmsisoftClean
  • ESET-NOD32Clean
  • F-SecureClean
  • FortinetClean
  • GDataClean
  • GoogleNo result
  • GridinsoftClean
  • huorongClean
  • IkarusClean
  • JiangminClean
  • K7AntiVirusClean
  • K7GWClean
  • KasperskyClean
  • KingsoftClean
  • LionicClean
  • MaxSecureClean
  • McAfeeDClean
  • MicrosoftClean
  • MicroWorld-eScanClean
  • NANO-AntivirusClean
  • PaloaltoClean
  • PandaClean
  • RisingClean
  • SangforClean
  • SentinelOneClean
  • SkyhighNo result
  • SophosClean
  • SUPERAntiSpywareClean
  • SymantecClean
  • SymantecMobileInsightNo result
  • TACHYONClean
  • tehtrisClean
  • TencentClean
  • TrapmineClean
  • TrellixENSClean
  • TrendMicroClean
  • TrendMicro-HouseCallClean
  • TrustlookNo result
  • VaristClean
  • VIPREClean
  • VirITClean
  • ViRobotClean
  • WebrootClean
  • XcitiumClean
  • YandexClean
  • ZillyaClean
  • ZoneAlarmClean
  • ZonerClean
Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic
MITRE ATT&CK profile
Defense evasion× 1
Behavior heuristics
Deterministic patterns derived from scan data and observed runtime behavior
  • ProcessInjection
    T1055
    low

    VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.

    Evidence
    T1055 (sandbox MITRE mapping)
PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 7.89Unpacked
Section entropy9 sections
.text
6.25
.data
0.31
.rdata
5.56
.eh_fram
4.88
.bss
0.00
.idata
4.92
.CRT
0.12
.tls
0.20
.rsrc
5.50
0.0Packed threshold 7.28.0
Prevalence

How widely this file has been seen

Widely uploaded, but first seen within the last six months. No strong prior applies.

Common
Unique uploaders
1,057
Hundreds of people have uploaded this — common.
Total submissions
1,239
Includes repeat uploads by the same source.
First seen
4mo ago
Jul 5, 2026
Prevalence quadrant
Rare · New
Needs evidence-led scrutiny
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Often established software

Chapter 05

Questions & answers

Short answers to the 7 questions people ask most about this file.

Is TLauncher.exe safe?
We found nothing harmful in TLauncher.exe. 2 of the 68 antivirus engines that checked it flag it; after weighing the other evidence we treat those alerts as false alarms. It has a valid digital signature from TLauncher Inc.. Run it only if it came from the developer's own website or an official app store.
What is TLauncher.exe?
TLauncher.exe is a Windows program, about 9.7 MB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Jul 5, 2026.
How many antivirus engines detected TLauncher.exe?
2 of the 68 antivirus engines that checked it flag TLauncher.exe, including Malwarebytes and VBA32. We weigh which engines flagged it and what else the scan found, not just the count.
Is TLauncher.exe digitally signed?
Yes. TLauncher.exe has a valid digital signature from TLauncher Inc., which shows the file hasn't been changed since that publisher signed it. Malware is sometimes signed with stolen certificates, so a signature alone isn't proof of safety.
What is the SHA-256 hash of TLauncher.exe?
The SHA-256 fingerprint of TLauncher.exe is f0cb809918c2bf85a8eef2bcbd35218e75426b4e5698ca1cca50acf3e5a714ce, and its MD5 is 945b2a20000dcf96c356b15a1ca00abc. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.
Is it safe to run TLauncher.exe?
We found nothing harmful in TLauncher.exe, and its digital signature checks out. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.
How up to date is this analysis of TLauncher.exe?
This report reflects the scan on Aug 12, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.
Chapter 06

Community

Member reviews and reports for this exact file hash.

Related file reports

Other files people checked with the same signer, and recent reports with the same rating. A matching signer does not make two files the same: only the SHA-256 fingerprint identifies a file.

All file reports
Scan another
Check a different file
URL instead?
Check if a link is safe
This report and its SHA-256 fingerprint are public, so the next person who checks the same file gets an instant answer; documents and images are listed by type instead of their file name. A file we had not seen before is uploaded to VirusTotal, whose security partners and subscribers can download it; MalwareTips deletes its own copy after the scan. If you ran this file and are worried, scan your device with up-to-date security software.