URL:

https://dl2.tlauncher.org/f.php?f=files%2FTLauncher-2.919-Installer-1.3.4.exe

Full analysis: https://app.any.run/tasks/18fc9e8a-ffbc-41d6-b598-d8dfdfa47d5f
Verdict: Malicious activity
Analysis date: April 20, 2024, 17:09:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

CB2F2D368245B79E3989141EC2A07D55

SHA1:

46E278FECAA28D368FCAE00C05531D0F27877E45

SHA256:

ADA42B70FAE82ECCCF85E00521C41AE721CA022E1626C794CB0DA9CB15A62CF4

SSDEEP:

3:N8R1JVLu5DceHXNCcyFXISe4A:2D/65Dce3/yFXlK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • TLauncher-2.919-Installer-1.3.4.exe (PID: 2624)
      • irsetup.exe (PID: 1972)
      • javaw.exe (PID: 2980)
      • BrowserInstaller.exe (PID: 4084)

    • Actions looks like stealing of personal data

      • irsetup.exe (PID: 1972)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • TLauncher-2.919-Installer-1.3.4.exe (PID: 2624)
      • irsetup.exe (PID: 1972)
      • BrowserInstaller.exe (PID: 4084)
      • javaw.exe (PID: 2980)

    • Reads the Internet Settings

      • TLauncher-2.919-Installer-1.3.4.exe (PID: 2624)
      • irsetup.exe (PID: 1972)
      • BrowserInstaller.exe (PID: 4084)
      • irsetup.exe (PID: 3128)
      • WMIC.exe (PID: 1852)
      • WMIC.exe (PID: 1924)
      • WMIC.exe (PID: 1348)
      • WMIC.exe (PID: 1852)

    • Reads security settings of Internet Explorer

      • TLauncher-2.919-Installer-1.3.4.exe (PID: 2624)
      • irsetup.exe (PID: 3128)
      • BrowserInstaller.exe (PID: 4084)
      • irsetup.exe (PID: 1972)

    • Checks for Java to be installed

      • irsetup.exe (PID: 1972)
      • TLauncher.exe (PID: 2500)
      • TLauncher.exe (PID: 3944)

    • Checks Windows Trust Settings

      • irsetup.exe (PID: 1972)
      • irsetup.exe (PID: 3128)

    • Reads settings of System Certificates

      • irsetup.exe (PID: 1972)
      • irsetup.exe (PID: 3128)
      • dxdiag.exe (PID: 1192)

    • Adds/modifies Windows certificates

      • irsetup.exe (PID: 1972)

    • Reads Microsoft Outlook installation path

      • irsetup.exe (PID: 1972)

    • Reads the Windows owner or organization settings

      • irsetup.exe (PID: 1972)
      • irsetup.exe (PID: 3128)

    • Reads Internet Explorer settings

      • irsetup.exe (PID: 1972)

    • Creates a software uninstall entry

      • irsetup.exe (PID: 1972)

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 2980)
      • javaw.exe (PID: 2096)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1236)
      • cmd.exe (PID: 3932)
      • cmd.exe (PID: 240)
      • cmd.exe (PID: 2452)
      • cmd.exe (PID: 1392)
      • cmd.exe (PID: 3260)
      • cmd.exe (PID: 2232)

    • Uses WMIC.EXE to obtain operating system information

      • cmd.exe (PID: 1236)
      • cmd.exe (PID: 3932)

    • Process requests binary or script from the Internet

      • javaw.exe (PID: 2980)
      • javaw.exe (PID: 2096)

    • The process drops C-runtime libraries

      • javaw.exe (PID: 2980)

    • Process drops legitimate windows executable

      • javaw.exe (PID: 2980)

    • Uses WMIC.EXE to obtain CPU information

      • cmd.exe (PID: 240)

    • Uses ICACLS.EXE to modify access control lists

      • javaw.exe (PID: 2096)

    • Uses WMIC.EXE to obtain quick Fix Engineering (patches) data

      • cmd.exe (PID: 2232)

    • Creates/Modifies COM task schedule object

      • dxdiag.exe (PID: 1192)

  • INFO

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 668)
      • msedge.exe (PID: 452)

    • Application launched itself

      • msedge.exe (PID: 668)

    • The process uses the downloaded file

      • msedge.exe (PID: 3572)
      • msedge.exe (PID: 668)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 452)
      • msedge.exe (PID: 668)

    • Create files in a temporary directory

      • TLauncher-2.919-Installer-1.3.4.exe (PID: 2624)
      • irsetup.exe (PID: 1972)
      • BrowserInstaller.exe (PID: 4084)
      • irsetup.exe (PID: 3128)
      • javaw.exe (PID: 2980)
      • javaw.exe (PID: 604)
      • javaw.exe (PID: 2096)

    • Checks supported languages

      • TLauncher-2.919-Installer-1.3.4.exe (PID: 2624)
      • irsetup.exe (PID: 1972)
      • BrowserInstaller.exe (PID: 4084)
      • irsetup.exe (PID: 3128)
      • TLauncher.exe (PID: 2500)
      • javaw.exe (PID: 2980)
      • chcp.com (PID: 2880)
      • javaw.exe (PID: 604)
      • TLauncher.exe (PID: 3944)
      • chcp.com (PID: 1656)
      • javaw.exe (PID: 2096)
      • chcp.com (PID: 2812)
      • chcp.com (PID: 1376)
      • chcp.com (PID: 3128)
      • chcp.com (PID: 268)
      • chcp.com (PID: 584)

    • Reads the computer name

      • TLauncher-2.919-Installer-1.3.4.exe (PID: 2624)
      • irsetup.exe (PID: 1972)
      • BrowserInstaller.exe (PID: 4084)
      • irsetup.exe (PID: 3128)
      • javaw.exe (PID: 2980)
      • javaw.exe (PID: 604)
      • javaw.exe (PID: 2096)

    • Reads the machine GUID from the registry

      • irsetup.exe (PID: 1972)
      • irsetup.exe (PID: 3128)
      • javaw.exe (PID: 2980)
      • javaw.exe (PID: 2096)

    • Reads the software policy settings

      • irsetup.exe (PID: 1972)
      • irsetup.exe (PID: 3128)
      • dxdiag.exe (PID: 1192)

    • Checks proxy server information

      • irsetup.exe (PID: 3128)
      • irsetup.exe (PID: 1972)

    • Creates files or folders in the user directory

      • irsetup.exe (PID: 3128)
      • irsetup.exe (PID: 1972)
      • javaw.exe (PID: 2980)
      • javaw.exe (PID: 604)
      • javaw.exe (PID: 2096)

    • Creates files in the program directory

      • javaw.exe (PID: 2980)
      • irsetup.exe (PID: 1972)
      • javaw.exe (PID: 2096)

    • Manual execution by a user

      • TLauncher.exe (PID: 3944)

    • Reads security settings of Internet Explorer

      • dxdiag.exe (PID: 1192)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
106
Monitored processes
52
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs tlauncher-2.919-installer-1.3.4.exe no specs tlauncher-2.919-installer-1.3.4.exe irsetup.exe msedge.exe no specs msedge.exe no specs browserinstaller.exe irsetup.exe tlauncher.exe no specs javaw.exe icacls.exe no specs cmd.exe no specs chcp.com no specs wmic.exe no specs tlauncher.exe no specs javaw.exe no specs cmd.exe no specs chcp.com no specs wmic.exe no specs javaw.exe icacls.exe no specs cmd.exe no specs cmd.exe no specs chcp.com no specs chcp.com no specs wmic.exe no specs systeminfo.exe no specs cmd.exe no specs chcp.com no specs cmd.exe no specs chcp.com no specs dxdiag.exe no specs cmd.exe no specs chcp.com no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240cmd.exe /C chcp 437 & wmic CPU get NAMEC:\Windows\System32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
268chcp 437 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
452"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1536 --field-trial-handle=1184,i,10803978325504844609,10390684645182964168,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
584chcp 437 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
604"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe—TLauncher.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
668"C:\Program Files\Microsoft\Edge\Application\msedge.exe" "https://dl2.tlauncher.org/f.php?f=files%2FTLauncher-2.919-Installer-1.3.4.exe"C:\Program Files\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1028"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1628 --field-trial-handle=1184,i,10803978325504844609,10390684645182964168,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1044C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ntmarta.dll
1192dxdiag /whql:off /t C:\Users\admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txtC:\Windows\System32\dxdiag.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft DirectX Diagnostic Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dxdiag.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1236cmd.exe /C chcp 437 & wmic os get osarchitectureC:\Windows\System32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
43 290
Read events
42 861
Write events
370
Delete events
59

Modification events

(PID) Process:(668) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(668) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(668) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(668) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(668) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(668) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(668) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(668) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
BC16498D20752F00
(PID) Process:(668) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\FirstNotDefault
Operation:delete valueName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
(PID) Process:(668) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
Executable files
140
Suspicious files
83
Text files
840
Unknown types
7

Dropped files

PID
Process
Filename
Type
668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\1b0700a7-113c-4f7e-b1bd-42b891723f84.tmp —
MD5:—
SHA256:—
668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1bd231.TMP —
MD5:—
SHA256:—
668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF1bd250.TMP —
MD5:—
SHA256:—
668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1bd28f.TMP —
MD5:—
SHA256:—
668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
1288msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pma~RF1bd08b.TMP —
MD5:886E82F2CA62ECCCE64601B30592078A
SHA256:E5E13D53601100FF3D6BB71514CBCCC4C73FE9B7EF5E930100E644187B42948E
668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State~RF1bd1e3.TMP —
MD5:6EB6B80193BBD69C1814A257B64541C3
SHA256:C241C44AE5D29F84DEBE35F27D4C419DA1EDCE86399E9F55940EE8250286B86A
668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat —
MD5:A6EBC0D32A7B9304824D19DB63B4E37A
SHA256:E991057C2B1718A151C5FD06E1C153F57130D195454A1F94C8C4C20971697093
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
50
DNS requests
30
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2980
javaw.exe
GET
302
78.46.66.120:80
http://res.tlauncher.org/b/libraries/com/google/guava/guava/19.0/guava-19.0.jar
unknown
—
—
unknown
2980
javaw.exe
GET
302
78.46.66.120:80
http://res.tlauncher.org/b/libraries/org/apache/commons/commons-lang3/3.4/commons-lang3-3.4.jar
unknown
—
—
unknown
2980
javaw.exe
GET
302
78.46.66.120:80
http://res.tlauncher.org/b/libraries/net/sf/jopt-simple/jopt-simple/4.9/jopt-simple-4.9.jar
unknown
—
—
unknown
2980
javaw.exe
GET
302
78.46.66.120:80
http://res.tlauncher.org/b/libraries/log4j/log4j/1.2.17/log4j-1.2.17.jar
unknown
—
—
unknown
2980
javaw.exe
GET
302
78.46.66.120:80
http://res.tlauncher.org/b/libraries/org/tukaani/xz/1.5/xz-1.5.jar
unknown
—
—
unknown
1080
svchost.exe
GET
200
92.123.180.33:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0351668c06fee42b
unknown
—
—
unknown
2980
javaw.exe
GET
302
78.46.66.120:80
http://res.tlauncher.org/b/libraries/org/tlauncher/tlauncher-resource/1.4/tlauncher-resource-1.4.jar
unknown
—
—
unknown
2980
javaw.exe
GET
302
78.46.66.120:80
http://res.tlauncher.org/b/libraries/com/github/junrar/junrar/0.7/junrar-0.7.jar
unknown
—
—
unknown
2980
javaw.exe
GET
302
78.46.66.120:80
http://res.tlauncher.org/b/libraries/com/google/inject/guice/4.1.0/guice-4.1.0.jar
unknown
—
—
unknown
2980
javaw.exe
GET
302
78.46.66.120:80
http://res.tlauncher.org/b/libraries/org/apache/httpcomponents/fluent-hc/4.5.13/fluent-hc-4.5.13.jar
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
452
msedge.exe
104.20.65.88:443
dl2.tlauncher.org
CLOUDFLARENET
—
unknown
668
msedge.exe
239.255.255.250:1900
—
—
—
unknown
452
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
452
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
452
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
668
msedge.exe
224.0.0.251:5353
—
—
—
unknown
452
msedge.exe
92.123.180.49:443
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
Akamai International B.V.
IT
unknown

DNS requests

Domain
IP
Reputation
dl2.tlauncher.org
  • 104.20.65.88
  • 104.20.64.88
unknown
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
  • 92.123.180.49
  • 92.123.180.18
whitelisted
www.bing.com
  • 95.101.20.162
  • 95.101.20.161
  • 95.101.20.155
  • 95.101.20.210
  • 95.101.20.163
  • 95.101.20.160
  • 95.101.20.154
  • 95.101.20.208
  • 95.101.20.225
whitelisted
tlauncher.org
  • 104.20.65.88
  • 104.20.64.88
unknown
ctldl.windowsupdate.com
  • 92.123.180.33
  • 92.123.180.50
  • 92.123.180.9
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
self.events.data.microsoft.com
  • 20.189.173.16
whitelisted
res.tlauncher.org
  • 78.46.66.120
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET POLICY Vulnerable Java Version 1.8.x Detected
—
—
Potentially Bad Traffic
ET POLICY Vulnerable Java Version 1.8.x Detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://dl2.tlauncher.org/f.php?f=files%2FTLauncher-2.919-Installer-1.3.4.exe