Edit tour

Windows Analysis Report
OneLaunch.exe

Overview

General Information

Sample Name:	OneLaunch.exe
Analysis ID:	840120
MD5:	6b50f5cd91f309d9b882a36abc7a5b38
SHA1:	3d32352e1d4a697def1d2e80a77b88eef22e94ba
SHA256:	e6fbc6f99c534c974b5188232c951c54388dbe2f62d4ba80382363330d7a14e2
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

AV process strings found (often used to terminate AV products)

Queries the volume information (name, serial number etc) of a device

One or more processes crash

Checks if the current process is being debugged

Classification

Analysis Advice

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample crashes during execution, try analyze it on another analysis machine

Process Tree

System is w10x64

OneLaunch.exe (PID: 6408 cmdline: C:\Users\user\Desktop\OneLaunch.exe MD5: 6B50F5CD91F309D9B882A36ABC7A5B38)

WerFault.exe (PID: 6672 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 784 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: OneLaunch.exe

Static PE information: certificate valid

Source: OneLaunch.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: PresentationFramework.ni.pdbRSDS~J source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: PresentationFramework.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.Core.ni.pdbRSDSD source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: PresentationCore.ni.pdbRSDS source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: WindowsBase.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.Xaml.ni.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: WindowsBase.ni.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: mscorlib.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.ni.pdbRSDS source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.Xaml.ni.pdbRSDS\| source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.pdbL source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: PresentationCore.ni.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.Xaml.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: mscorlib.ni.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: WindowsBase.ni.pdbRSDS source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.Core.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: WindowsBase.pdbMZ@ source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: PresentationFramework.ni.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: PresentationCore.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.ni.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.Core.ni.pdb source: WER9A9A.tmp.dmp.2.dr

Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: "url": "https://www.linkedin.com/", equals www.linkedin.com (Linkedin)
Source: OneLaunch.exe	String found in binary or memory: LinkedinSvgIcon3https://www.linkedin.com/ equals www.linkedin.com (Linkedin)
Source: OneLaunch.exe	String found in binary or memory: MyspaceSvgIcon_1https://www.myspace.com/ equals www.myspace.com (Myspace)
Source: OneLaunch.exe	String found in binary or memory: Vhttps://www.youtube.com/watch?v=vhpC4m61w-o equals www.youtube.com (Youtube)
Source: OneLaunch.exe	String found in binary or memory: shopping_videoWhttps://www.youtube.com/watch?v=vhpC4m61w-o equals www.youtube.com (Youtube)
Source: OneLaunch.exe	String found in binary or memory: yahoo_news!YahooNewsSvgIcon7https://www.yahoo.com/news/ equals www.yahoo.com (Yahoo)
Source: OneLaunch.exe	String found in binary or memory: youtubemusic!YouTubeMusicIcon1https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: OneLaunch.exe	String found in binary or memory: http://c36b2225-69a8-4ab3-ab72-69b8a6ceffea.com/?2541b810-da0f-4159-a37e-0c9e9c8c70ae
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dfsweb.wyo.gov/economic-assistance/snap
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dhhs.ne.gov/Pages/SNAP.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dhr.maryland.gov/food-supplement-program/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dhss.alaska.gov/dpa/Pages/SNAP/default.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://humanservices.hawaii.gov/bessd/snap/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://jfs.ohio.gov/ocomm_root/1000OurServices.stm#FA-2
Source: OneLaunch.exe	String found in binary or memory: http://openspeedtest.com/increase-your-internet-speed.php
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://otda.ny.gov/programs/snap/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://reddit.com
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://scdmvonline.com/Forms-And-Manuals
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://schemas.microsoft.
Source: Amcache.hve.2.dr	String found in binary or memory: http://upx.sf.net
Source: OneLaunch.exe	String found in binary or memory: http://wbd_ol.ampxdirect.com/amazon?sub1=default&sub2=amazon&sub3=dynamiclink&cu=
Source: OneLaunch.exe, 00000000.00000000.258239673.0000000000F72000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://wpfanimatedgif.codeplex.com
Source: OneLaunch.exe	String found in binary or memory: http://www.cc.com/shows
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.dcf.ks.gov/services/ees/Pages/Food/FoodAssistance.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.dcfs.la.gov/page/93
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.dhhr.wv.gov/bcf/Services/familyassistance/Pages/Supplemental-Nutritional-Assistance-Progr
Source: OneLaunch.exe	String found in binary or memory: http://www.dhl.com/khttps://www.trackingmore.com/track/en/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.dhs.ri.gov/Programs/SNAPApplyNow.php
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.dhs.state.il.us/page.aspx?item=33698
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.dmv.ri.gov/forms/license/index.php
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.dmv.ri.gov/forms/registration/index.php
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.dot.nd.gov/dotnet2/view/forms.aspx?category=yes#driverslicense
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.dot.nd.gov/dotnet2/view/forms.aspx?category=yes#title&registration
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.dot.state.wy.us/home/driver_license_records/formsapplications.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.dot.state.wy.us/home/titles_plates_registration.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.dss.virginia.gov/benefit/snap.cgi
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.elections.alaska.gov/Core/voterregistration.php
Source: OneLaunch.exe	String found in binary or memory: http://www.fedex.com/ohttps://www.trackingmore.com/track/en/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mva.maryland.gov/forms/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mvd.newmexico.gov/forms.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.nd.gov/dhs/services/financialhelp/foodstamps.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.okdhs.org/services/snap/Pages/default.aspx
Source: OneLaunch.exe	String found in binary or memory: http://www.pricegrabber.com/
Source: OneLaunch.exe	String found in binary or memory: http://www.shopzilla.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.tennessee.gov/humanservices/topic/supplemental-nutrition-assistance-program-snap
Source: OneLaunch.exe	String found in binary or memory: http://www.ups.com/khttps://www.trackingmore.com/track/en/
Source: OneLaunch.exe	String found in binary or memory: http://youtube.com
Source: OneLaunch.exe	String found in binary or memory: https://abc.com/browse/
Source: OneLaunch.exe, 00000000.00000000.258239673.0000000000F72000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aol.com/mail
Source: OneLaunch.exe	String found in binary or memory: https://api.cognitive.microsofttranslator.com
Source: OneLaunch.exe	String found in binary or memory: https://api.keen.io/3.0/projects/
Source: OneLaunch.exe	String found in binary or memory: https://api.mapbox.com/geocoding/v5/mapbox.places/
Source: OneLaunch.exe	String found in binary or memory: https://api.mixpanel.com/engage?verbose=1#profile-set
Source: OneLaunch.exe	String found in binary or memory: https://api.mixpanel.com/engage?verbose=1#profile-set-once
Source: OneLaunch.exe	String found in binary or memory: https://api.mixpanel.com/track
Source: OneLaunch.exe	String found in binary or memory: https://api.mixpanel.com/trackjhttps://api.mixpanel.com/engage?verbose=1#profile-setthttps://api.mix
Source: OneLaunch.exe	String found in binary or memory: https://api.unsplash.com/search/photos
Source: OneLaunch.exe	String found in binary or memory: https://api.unsplash.com/search/photosVWB_-Q7UDVbJmcZVL6aynPfuxjyj6r_cQZeNBJzGYV0M8An
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://azdot.gov/motor-vehicles/forms-and-publications
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://azsos.gov/elections/voting-election/register-vote-or-update-your-current-voter-information
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://benefind.ky.gov/General/SnapOverview
Source: OneLaunch.exe	String found in binary or memory: https://ca.indeed.com/?r=us
Source: OneLaunch.exe	String found in binary or memory: https://calendar.yahoo.com/subscribe
Source: OneLaunch.exe	String found in binary or memory: https://cards.barclaycardus.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dcf.vermont.gov/benefits/3SquaresVT
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dds.georgia.gov/dds-forms-and-manuals/forms
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://des.az.gov/services/basic-needs/food/nutrition-assistance-formerly-food-stamp-program
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dfcs.georgia.gov/food-stamps
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dhr.alabama.gov/food-assistance/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dhs.dc.gov/service/supplemental-nutrition-assistance-snap
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dhs.iowa.gov/food-assistance
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dld.utah.gov/handbooksprintableforms/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dmv.dc.gov/page/dc-dmv-forms
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dmv.de.gov/forms/index.shtml
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dmv.nebraska.gov/forms
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dmv.ny.gov/forms
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dmv.vermont.gov/forms-and-information
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dmvnv.com/dmvforms.htm
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://doa.alaska.gov/dmv/forms/
Source: OneLaunch.exe	String found in binary or memory: https://docs.google.com/document/?usp=docs_alc
Source: OneLaunch.exe	String found in binary or memory: https://docs.google.com/presentation/?usp=slides_alc
Source: OneLaunch.exe	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=sheets_alc
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dojmt.gov/driving/driver-licensing-forms/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dojmt.gov/driving/vehicle-title-registration-forms/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dor.georgia.gov/documents/forms?field_lp_form_type_target_id=36051
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dor.mo.gov/forms/index.php?category=1
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dor.mo.gov/forms/index.php?category=2
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dos.myflorida.com/elections/for-voters/voter-registration/register-to-vote-or-update-your-in
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dphhs.mt.gov/hcsd/SNAP
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dps.mn.gov/divisions/dvs/forms-documents/Pages/drivers-license-forms.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dps.mn.gov/divisions/dvs/forms-documents/Pages/motor-vehicle-forms.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dps.sd.gov/resource-library?keyword=&agencyTopic=5&sort=1&paging=50
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dss.sc.gov/assistance-programs/snap/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dss.sd.gov/economicassistance/snap/
Source: OneLaunch.exe	String found in binary or memory: https://duckduckgo.com/?q=
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://dwss.nv.gov/SNAP/Food/
Source: OneLaunch.exe	String found in binary or memory: https://earth.google.com/web/
Source: OneLaunch.exe	String found in binary or memory: https://ebay.us/KyCMip/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://elect.ky.gov/registertovote/Pages/default.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://elections.delaware.gov/voter/votereg.shtml
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://elections.hawaii.gov/voters/registration/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://elections.maryland.gov/voter_registration/application.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://elections.ri.gov/voting/registration.php
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://elections.wi.gov/forms
Source: OneLaunch.exe	String found in binary or memory: https://fast.com/
Source: OneLaunch.exe	String found in binary or memory: https://fast.com/phttps://templates.office.com/en-US/Search/results?query=
Source: OneLaunch.exe	String found in binary or memory: https://genius.com/search?q=
Source: OneLaunch.exe	String found in binary or memory: https://gmail.com
Source: OneLaunch.exe	String found in binary or memory: https://gmail.com/1https://mail.google.com/9https://accounts.google.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://healthandwelfare.idaho.gov/FoodCashAssistance/FoodStamps/tabid/90/Default.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://humanservices.arkansas.gov/about-dhs/dco/programs-services/support-services#snap
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://idahovotes.gov/
Source: OneLaunch.exe	String found in binary or memory: https://imgur.com/
Source: OneLaunch.exe	String found in binary or memory: https://instagram.com
Source: OneLaunch.exe	String found in binary or memory: https://instagram.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://iowadot.seamlessgov.com/driver-id-services
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://iowadot.seamlessgov.com/vehicles
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://itd.idaho.gov/itddmv/?target=drivers-license-id-cards#forms
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://itd.idaho.gov/itddmv/?target=registration-plates#forms-publications
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://jobs.utah.gov/customereducation/services/foodstamps/index.html
Source: OneLaunch.exe	String found in binary or memory: https://keep.google.com/
Source: OneLaunch.exe	String found in binary or memory: https://kizi.com/
Source: OneLaunch.exe	String found in binary or memory: https://login.aol.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.0000000000F72000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://login.aol.com/?src=mail
Source: OneLaunch.exe	String found in binary or memory: https://login.yahoo.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.0000000000F72000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mail.live.com
Source: OneLaunch.exe, 00000000.00000000.258239673.0000000000F72000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mail.yahoo.com
Source: OneLaunch.exe, 00000000.00000000.258239673.0000000000F72000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mail.yahoo.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mn.gov/dhs/people-we-serve/adults/economic-assistance/food-nutrition/programs-and-services/s
Source: OneLaunch.exe	String found in binary or memory: https://music.amazon.com/home
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mydss.mo.gov/food-assistance/food-stamp-program
Source: OneLaunch.exe	String found in binary or memory: https://office.live.com/start/Excel.aspx?omkt=en-US
Source: OneLaunch.exe	String found in binary or memory: https://office.live.com/start/PowerPoint.aspx?omkt=en-US
Source: OneLaunch.exe	String found in binary or memory: https://office.live.com/start/Word.aspx?omkt=en-US
Source: OneLaunch.exe	String found in binary or memory: https://onelaunch.com/eulaIhttps://onelaunch.com/privacy-policy
Source: OneLaunch.exe	String found in binary or memory: https://onelaunch.com/uninstalli/onelaunch;component/ui/aboutdialog/aboutdialog.xaml
Source: OneLaunch.exe	String found in binary or memory: https://open.spotify.com/
Source: OneLaunch.exe	String found in binary or memory: https://outlook.live.com/owa/
Source: OneLaunch.exe	String found in binary or memory: https://outlook.live.com/owa/?nlp=1
Source: OneLaunch.exe	String found in binary or memory: https://outlook.office.com/calendar/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ovr.sos.wv.gov/Register/Landing#Landing
Source: OneLaunch.exe	String found in binary or memory: https://play.getfungamesnow.com
Source: OneLaunch.exe	String found in binary or memory: https://play.getfungamesnow.com/games?g=checkers-legend
Source: OneLaunch.exe	String found in binary or memory: https://play.getfungamesnow.com/games?g=freecell-solitaire
Source: OneLaunch.exe	String found in binary or memory: https://play.getfungamesnow.com/games?g=mahjong-deluxe
Source: OneLaunch.exe	String found in binary or memory: https://play.getfungamesnow.com/games?g=solitaire
Source: OneLaunch.exe	String found in binary or memory: https://play.getfungamesnow.com/games?g=spider-solitaire
Source: OneLaunch.exe	String found in binary or memory: https://play.getfungamesnow.com/games?g=sudoku-html5
Source: OneLaunch.exe	String found in binary or memory: https://play.getfungamesnow.com/games?g=tentrix
Source: OneLaunch.exe	String found in binary or memory: https://play.getfungamesnow.com/games?g=tic-tac-toe-html5
Source: OneLaunch.exe	String found in binary or memory: https://plus.onelaunch.com/api/news/newscategoriesmCouldn
Source: OneLaunch.exe	String found in binary or memory: https://poki.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://portal.ct.gov/DMV/Online-Forms/Online-Forms/All-DMV-Forms
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://portal.ct.gov/DSS/SNAP/Supplemental-Nutrition-Assistance-Program---SNAP/Documents
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://portal.ct.gov/SOTS/Election-Services/Register-to-Vote/Voter-Registration-Application-English
Source: OneLaunch.exe	String found in binary or memory: https://r.v2i8b.com/api/v1/bid/redirect?campaign_id=01GSZ9YW40ZVTQ8S2EVDWJVPCN&url=https://amazon.co
Source: OneLaunch.exe	String found in binary or memory: https://rdbrckrebase.zendesk.com/api/v2/tickets.json
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://revenue.alabama.gov/forms/?d=motor-vehicle
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sddor.seamlessgov.com/CO19011000093206930
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sdsos.gov/elections-voting/voting/register-to-vote/default.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://search-safely.com/ntp/index.html?p=6osz&s=https%3A%2F%2Fsearch-safely.com%2Fsn%3Fa%3Dxle_rne
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://search-safely.com/sn?a=xle_rnew_00_00_ssg60&cd=_cd_&cr=_cr_&q=
Source: OneLaunch.exe	String found in binary or memory: https://search.yahoo.com/search?p=
Source: OneLaunch.exe	String found in binary or memory: https://sohu.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sos.ga.gov/index.php/Elections/register_to_vote
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sos.iowa.gov/elections/voterinformation/voterregistration.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sos.kansas.gov/elections/registration-voting/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sos.nebraska.gov/elections/voter-forms
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sos.nh.gov/HowRegVote.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sos.oregon.gov/voting/Pages/registration.aspx?lang=en
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sos.tn.gov/products/elections/register-vote
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sos.vermont.gov/elections/voters/registration/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sosmt.gov/elections/vote/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://soswy.state.wy.us/Elections/RegisteringToVote.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://stackoverflow.com/
Source: OneLaunch.exe	String found in binary or memory: https://stackoverflow.com/%wellsfargo_popular9/favicons/wellsfargo.com.png
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://studentaid.gov/resources
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://suggestqueries.google.com/complete/search?output=firefox&q=
Source: OneLaunch.exe	String found in binary or memory: https://support.onelaunch.com/hc/en-us
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://tax.utah.gov/forms-pubs/mv-forms
Source: OneLaunch.exe	String found in binary or memory: https://templates.office.com/en-US/Search/results?query=
Source: OneLaunch.exe	String found in binary or memory: https://templates.office.com/en-US/Search/results?query=calendar
Source: OneLaunch.exe	String found in binary or memory: https://templates.office.com/en-us/brochures
Source: OneLaunch.exe	String found in binary or memory: https://templates.office.com/en-us/budgets
Source: OneLaunch.exe	String found in binary or memory: https://templates.office.com/en-us/business
Source: OneLaunch.exe	String found in binary or memory: https://templates.office.com/en-us/calendars
Source: OneLaunch.exe	String found in binary or memory: https://templates.office.com/en-us/flyers
Source: OneLaunch.exe	String found in binary or memory: https://templates.office.com/en-us/invoices
Source: OneLaunch.exe	String found in binary or memory: https://templates.office.com/en-us/letters
Source: OneLaunch.exe	String found in binary or memory: https://templates.office.com/en-us/presentations
Source: OneLaunch.exe	String found in binary or memory: https://templates.office.com/en-us/resumes-and-cover-letters
Source: OneLaunch.exe	String found in binary or memory: https://translate.google.ca/?sl=
Source: OneLaunch.exe	String found in binary or memory: https://translate.google.ca/history?sl=
Source: OneLaunch.exe	String found in binary or memory: https://translate.google.ca/saved?sl=
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://transportation.ky.gov/Organizational-Resources/Pages/Forms-Library-(TC-94).aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://transportation.ky.gov/Organizational-Resources/Pages/Forms-Library-(TC-96).aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://transportation.wv.gov/DMV/Forms/Pages/Search-Results.aspx?Title=&DMVFormNumber=&DMVFormCateg
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://travel.state.gov/content/travel/en/passports/how-apply/forms.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://travel.state.gov/content/travel/en/us-visas/visa-information-resources/forms.html
Source: OneLaunch.exe	String found in binary or memory: https://twitter.com
Source: OneLaunch.exe	String found in binary or memory: https://twitter.com/
Source: OneLaunch.exe	String found in binary or memory: https://unsplash.com/
Source: OneLaunch.exe	String found in binary or memory: https://update.onelaunch.com/settings
Source: OneLaunch.exe	String found in binary or memory: https://update.onelaunch.com/settingssSomething
Source: OneLaunch.exe	String found in binary or memory: https://update.onelaunch.com/update)Installing
Source: OneLaunch.exe	String found in binary or memory: https://videos-cdn.onelaunch.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://vip.sos.nd.gov/PortalListDetails.aspx?ptlhPKID=73&ptlPKID=7
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://voteinfo.utah.gov/
Source: OneLaunch.exe	String found in binary or memory: https://wbd_ol.ampxdirect.com/amazon?sub1=default&sub2=amazon
Source: OneLaunch.exe	String found in binary or memory: https://web.whatsapp.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://wisconsindot.gov/Pages/dmv/license-drvs/rcd-crsh-rpt/driver-forms.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://wisconsindot.gov/Pages/dmv/vehicles/frms-pubs/veh-forms.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.alea.gov/dps/driver-license/driver-license-forms
Source: OneLaunch.exe	String found in binary or memory: https://www.allrecipes.com/search?q=O/onelaunch;component/ui/apps/tvapp.xaml
Source: OneLaunch.exe	String found in binary or memory: https://www.ally.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.amazon.com/gp/help/customer/display.html/ref=hp_bc_nav?ie=UTF8&nodeId=201887920)DailyDea
Source: OneLaunch.exe	String found in binary or memory: https://www.amazon.com/gp/help/customer/display.html/ref=hp_bc_nav?ie=UTF8&nodeId=201887920Hhttps://
Source: OneLaunch.exe	String found in binary or memory: https://www.amazon.com/s?k=
Source: OneLaunch.exe	String found in binary or memory: https://www.amc.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.americanexpress.com/en-us/account/login/
Source: OneLaunch.exe	String found in binary or memory: https://www.apple.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.apple.com/apple-tv-plus/
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily-chinese/dog.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily-chinese/dragon.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily-chinese/horse.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily-chinese/monkey.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily-chinese/pig.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily-chinese/rabbit.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily-chinese/rooster.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily-chinese/sheep.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily-chinese/snake.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily-chinese/tiger.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily-chinese/today/ox.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily-chinese/today/rat.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily/aquarius.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily/aries.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily/cancer.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily/capricorn.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily/gemini.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily/leo.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily/libra.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily/pisces.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily/sagittarius.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily/scorpio.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily/taurus.html
Source: OneLaunch.exe	String found in binary or memory: https://www.astrology.com/horoscope/daily/virgo.html
Source: OneLaunch.exe	String found in binary or memory: https://www.bankofamerica.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.bankrate.com/calculators/index-of-debt-management-calculators.aspx
Source: OneLaunch.exe	String found in binary or memory: https://www.bankrate.com/calculators/index-of-debt-management-calculators.aspxRhttps://www.bankrate.
Source: OneLaunch.exe	String found in binary or memory: https://www.bestbuy.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.bestcrosswords.com/bestcrosswords/SolvableOnline.page
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.bmv.ohio.gov/forms-dl.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.bmv.ohio.gov/forms-vr.aspx
Source: OneLaunch.exe	String found in binary or memory: https://www.bnymellon.com/us/en/client-access.html/
Source: OneLaunch.exe	String found in binary or memory: https://www.calculatestuff.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.calculatestuff.com/Bhttps://www.dictionary.com/browse
Source: OneLaunch.exe	String found in binary or memory: https://www.cancer.org/healthy/eat-healthy-get-active/take-control-your-weight/body-mass-index-bmi-c
Source: OneLaunch.exe	String found in binary or memory: https://www.capitalone.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.cbs.com/shows/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.cdss.ca.gov/food-nutrition/calfresh
Source: OneLaunch.exe	String found in binary or memory: https://www.chase.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.citi.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.classifiedads.com/search.php?lid=z
Source: OneLaunch.exe	String found in binary or memory: https://www.classifiedads.com/search.php?lid=z8https://genius.com/search?q=
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.cms.gov/Medicare/CMS-Forms/CMS-Forms/CMS-Forms-List
Source: OneLaunch.exe	String found in binary or memory: https://www.cnn.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.colorado.gov/pacific/cdhs/supplemental-nutrition-assistance-program-snap
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.colorado.gov/pacific/dmv/forms-licenses
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.colorado.gov/pacific/dmv/forms-vehicles
Source: OneLaunch.exe	String found in binary or memory: https://www.convertworld.com/en/
Source: OneLaunch.exe	String found in binary or memory: https://www.coupons.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.craigslist.org/
Source: OneLaunch.exe	String found in binary or memory: https://www.craigslist.org/about/sites
Source: OneLaunch.exe	String found in binary or memory: https://www.crazygames.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.creativecenter.brother/en-us/home/home-category/calendars/monthly-calendars
Source: OneLaunch.exe	String found in binary or memory: https://www.creativecenter.brother/en-us/home/home-category/calendars/yearly-calendars
Source: OneLaunch.exe	String found in binary or memory: https://www.cwtv.com/shows/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.cyberdriveillinois.com/publications/motorist/home.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.dcboe.org/Data-Resources-Forms/Forms-and-Resources
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.dfa.arkansas.gov/driver-services/forms/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.dfa.arkansas.gov/motor-vehicle/motor-vehicle-forms/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.dhhs.nh.gov/dfa/foodstamps/index.htm
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.dhs.wisconsin.gov/foodshare/index.htm
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.dhss.delaware.gov/dhss/dss/foodstamps.html
Source: OneLaunch.exe	String found in binary or memory: https://www.dictionary.com/browse/
Source: OneLaunch.exe	String found in binary or memory: https://www.disneyplus.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.dmv.ca.gov/portal/dmv/detail/forms/forms
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.dmv.pa.gov/_layouts/pa.penndot.formsandpubs/formsandpubs.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.dmv.virginia.gov/forms/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.dol.wa.gov/forms/formsdriver.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.dol.wa.gov/forms/formsvehicle.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.dor.ms.gov/Pages/MotorVehicle-Forms.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.dps.texas.gov/internetforms/SectionDetail.aspx?ID=15&SpeclSection=Driver%20License
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.driverservicebureau.dps.ms.gov/files-pdfs
Source: OneLaunch.exe	String found in binary or memory: https://www.dropbox.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.ecosia.org/search?q=
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.elections.il.gov/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.elections.ny.gov/votingregister.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.elections.virginia.gov/registration/voter-forms/
Source: OneLaunch.exe	String found in binary or memory: https://www.epicurious.com/search/Fhttps://www.foodnetwork.com/search/dhttps://www.myfoodandfamily.c
Source: OneLaunch.exe	String found in binary or memory: https://www.epicurious.com/search/Ghttps://www.foodnetwork.com/search/ehttps://www.myfoodandfamily.c
Source: OneLaunch.exe	String found in binary or memory: https://www.espn.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.etsy.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.expresslane.org/Pages/Forms-and-Manuals.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.flhsmv.gov/resources/forms/
Source: OneLaunch.exe	String found in binary or memory: https://www.fox.com/entertainment/
Source: OneLaunch.exe	String found in binary or memory: https://www.geico.com/save/local-gas-prices/
Source: OneLaunch.exe	String found in binary or memory: https://www.goldmansachs.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.google.ca/maps
Source: OneLaunch.exe	String found in binary or memory: https://www.google.com/calendar/
Source: OneLaunch.exe	String found in binary or memory: https://www.google.com/maps/
Source: OneLaunch.exe	String found in binary or memory: https://www.google.com/maps/Jdir/?api=1&origin=
Source: OneLaunch.exe	String found in binary or memory: https://www.google.com/maps/search/ATMs;OriginSuggestionsPopupVisibleEDestinationSuggestionsPopupVis
Source: OneLaunch.exe	String found in binary or memory: https://www.google.com/maps/search/Hotels
Source: OneLaunch.exe	String found in binary or memory: https://www.google.com/maps/search/Museums
Source: OneLaunch.exe	String found in binary or memory: https://www.google.com/maps/search/Pharmacies
Source: OneLaunch.exe	String found in binary or memory: https://www.google.com/maps/search/Restaurants
Source: OneLaunch.exe	String found in binary or memory: https://www.google.com/maps/search/Things
Source: OneLaunch.exe	String found in binary or memory: https://www.google.com/maps/search/Transit
Source: OneLaunch.exe	String found in binary or memory: https://www.google.com/s2/favicons?domain=
Source: OneLaunch.exe	String found in binary or memory: https://www.google.com/search?q=
Source: OneLaunch.exe	String found in binary or memory: https://www.greetingsisland.com/cards
Source: OneLaunch.exe	String found in binary or memory: https://www.greetingsisland.com/cards/birthday
Source: OneLaunch.exe	String found in binary or memory: https://www.greetingsisland.com/cards/events-and-occasions
Source: OneLaunch.exe	String found in binary or memory: https://www.greetingsisland.com/cards/holidays
Source: OneLaunch.exe	String found in binary or memory: https://www.greetingsisland.com/cards/thank-you
Source: OneLaunch.exe	String found in binary or memory: https://www.greetingsisland.com/cards/thoughts-and-feelings/congratulations
Source: OneLaunch.exe	String found in binary or memory: https://www.greetingsisland.com/cards/thoughts-and-feelings/friendship
Source: OneLaunch.exe	String found in binary or memory: https://www.greetingsisland.com/cards/thoughts-and-feelings/love-and-romance
Source: OneLaunch.exe	String found in binary or memory: https://www.greetingsisland.com/invitations
Source: OneLaunch.exe	String found in binary or memory: https://www.greetingsisland.com/search/en/
Source: OneLaunch.exe	String found in binary or memory: https://www.groupon.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.hbo.com/series/all-series
Source: OneLaunch.exe	String found in binary or memory: https://www.homedepot.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.hsbc.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.hsd.state.nm.us/LookingForAssistance/Supplemental_Nutrition_Assistance_Program__SNAP_.as
Source: OneLaunch.exe	String found in binary or memory: https://www.hulu.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.icloud.com/calendar
Source: OneLaunch.exe	String found in binary or memory: https://www.imdb.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.imom.com/printable_categories/printable-calendars/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.in.gov/bmv/2472.htm
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.in.gov/bmv/2524.htm
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.in.gov/fssa/dfr/2691.htm
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.in.gov/sos/elections/2403.htm
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.irs.gov/forms-instructions
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ksrevenue.org/dovforms.html
Source: OneLaunch.exe	String found in binary or memory: https://www.linkedin.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.locanto.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.maine.gov/dhhs/ofi/services/snap/index.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.maine.gov/sos/bmv/forms/index.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.maine.gov/sos/cec/elec/voter-info/voterguide.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mass.gov/lists/rmv-forms-and-applications
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mass.gov/snap-benefits-formerly-food-stamps
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mdhs.ms.gov/economic-assistance/snap/
Source: OneLaunch.exe	String found in binary or memory: https://www.messenger.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.michaels.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.michigan.gov/mdhhs/0
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.michigan.gov/sos/0
Source: OneLaunch.exe	String found in binary or memory: https://www.msn.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.myflfamilies.com/service-programs/access/food-assistance-and-suncap.shtml
Source: OneLaunch.exe	String found in binary or memory: https://www.myspace.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.nbc.com/shows/all/popular
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ncdhhs.gov/assistance/low-income-services/food-nutrition-services-food-stamps
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ncdot.gov/dmv/downloads/Pages/default.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ncsbe.gov/Voters/Registering-to-Vote
Source: OneLaunch.exe	String found in binary or memory: https://www.netflix.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.nh.gov/safety/divisions/dmv/forms/index.htm
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.nj.gov/humanservices/dfd/programs/njsnap/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.nvsos.gov/SOSVoterRegForm/
Source: OneLaunch.exe	String found in binary or memory: https://www.nytimes.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.office.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.office.com/%craigslist_popular9/favicons/craigslist.org.png
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ohiosos.gov/elections/voters/register/#gref
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ok.gov/dps/Forms/index.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ok.gov/elections/Voter_Info/Register_to_Vote/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ok.gov/tax/Individuals/Motor_Vehicle/Forms_&_Publications/General_Motor_Vehicle_Forms/
Source: OneLaunch.exe	String found in binary or memory: https://www.onenote.com/notebooks?omkt=en-US
Source: OneLaunch.exe	String found in binary or memory: https://www.oodle.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.oregon.gov/DHS/ASSISTANCE/FOOD-BENEFITS/pages/index.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.oregon.gov/odot/dmv/pages/form/index.aspx?wp2624=l:100
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.pavoterservices.pa.gov/Pages/VoterRegistrationApplication.aspx
Source: OneLaunch.exe	String found in binary or memory: https://www.paypal.com/us
Source: OneLaunch.exe	String found in binary or memory: https://www.paypal.com/us/
Source: OneLaunch.exe	String found in binary or memory: https://www.pinterest.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.pnc.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.primevideo.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.reddit.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.retailmenot.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.salesforce.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.scvotes.org/south-carolina-voter-registration-information
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.sec.state.ma.us/ele/eleifv/howreg.htm
Source: OneLaunch.exe	String found in binary or memory: https://www.sho.com/series
Source: OneLaunch.exe	String found in binary or memory: https://www.shopify.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/add-page-numbers-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/o
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/add-watermark-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/onli
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/compress-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=o
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/delete-pdf-pages/?uid=1018533&wid=7135&ref=sodapdf.com/online&c
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/excel-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=o
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/gif-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/html-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/jpg-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/merge-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&k
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/ocr-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&key
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/password-protect-pdf/?uid=1018533&wid=7135&ref=sodapdf.com%2Fon
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/password-protect-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/onli
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/pdf-converter/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/pdf-creator/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/pdf-editor/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/pdf-form-filler-creator/?uid=1018533&wid=7135&ref=sodapdf.com/o
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/pdf-reader/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/pdf-to-excel/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=o
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/pdf-to-html/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/pdf-to-jpg/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/pdf-to-ppt/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/pdf-to-word/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/png-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/ppt-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/resize-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/rotate-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/sign-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&ke
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/split-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&k
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/txt-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/unlock-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/word-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.sos.alabama.gov/alabama-votes/voter/register-to-vote
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.sos.arkansas.gov/elections/voter-information/voter-registration-information
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.sos.ca.gov/elections/voter-registration/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.sos.la.gov/ElectionsAndVoting/RegisterToVote/Pages/default.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.sos.mo.gov/elections/goVoteMissouri/register
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.sos.ms.gov/elections-voting/pages/voter-registration-information.aspx
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.sos.state.co.us/pubs/elections/vote/VoterHomeMobile.htm
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.sos.state.mn.us/elections-voting/register-to-vote/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.sos.state.nm.us/voting-and-elections/voter-information/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.sos.state.tx.us/elections/voter/reqvr.shtml
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.sos.wa.gov/elections/print-voter-registration-forms.aspx
Source: OneLaunch.exe	String found in binary or memory: https://www.sparkchess.com/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ssa.gov/forms/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.state.nj.us/mvc/about/forms.htm
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.state.nj.us/state/elections/voter-registration.shtml
Source: OneLaunch.exe	String found in binary or memory: https://www.td.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.techwalla.com/articles/how-to-speed-up-an-internet-connection
Source: OneLaunch.exe	String found in binary or memory: https://www.ted.com/opack://application:
Source: OneLaunch.exe	String found in binary or memory: https://www.thesaurus.com/browse/
Source: OneLaunch.exe	String found in binary or memory: https://www.tiktok.com/trending/?lang=en
Source: OneLaunch.exe	String found in binary or memory: https://www.timeanddate.com/calendar/create.html#Monthly
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.tmall.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.tmall.com/%The
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.tn.gov/revenue/title-and-registration/forms.html
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.tn.gov/safety/driver-services.html
Source: OneLaunch.exe	String found in binary or memory: https://www.trackingmore.com/%packagetracker_app
Source: OneLaunch.exe	String found in binary or memory: https://www.trackingmore.com/track/en/
Source: OneLaunch.exe	String found in binary or memory: https://www.tripadvisor.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.truist.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.trustpilot.com/evaluate/onelaunch.com
Source: OneLaunch.exe	String found in binary or memory: https://www.trustpilot.com/evaluate/onelaunch.comhhttps://rdbrckrebase.zendesk.com/api/v2/tickets.js
Source: OneLaunch.exe	String found in binary or memory: https://www.tumblr.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.twitch.tv/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.txdmv.gov/forms
Source: OneLaunch.exe	String found in binary or memory: https://www.unionbank.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.usbank.com/index.html/
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.uscis.gov/forms
Source: OneLaunch.exe	String found in binary or memory: https://www.usps.com/mhttps://www.trackingmore.com/track/en/
Source: OneLaunch.exe	String found in binary or memory: https://www.walmart.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.wellsfargo.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.wikihow.com/Maximize-the-Speed-of-Your-Internet-Connection
Source: OneLaunch.exe	String found in binary or memory: https://www.xe.com/currencyconverter/
Source: OneLaunch.exe	String found in binary or memory: https://www.xe.com/currencyconverter/Ahttps://www.convertworld.com/en/Shttps://www.bankrate.com/calc
Source: OneLaunch.exe	String found in binary or memory: https://www.yahoo.com/news/
Source: OneLaunch.exe	String found in binary or memory: https://www.yelp.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.youtube.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.youtube.com/watch?v=vhpC4m61w-o
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.zillow.com/
Source: OneLaunch.exe	String found in binary or memory: https://www.zillow.com/#pinterest_popular7/favicons/pinterest.com.png
Source: OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://yourtexasbenefits.hhsc.texas.gov/programs/snap
Source: OneLaunch.exe	String found in binary or memory: https://youtube.com/

Source: C:\Users\user\Desktop\OneLaunch.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 784

Source: OneLaunch.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: C:\Users\user\Desktop\OneLaunch.exe

File read: C:\Users\user\Desktop\OneLaunch.exe

Jump to behavior

Source: OneLaunch.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\OneLaunch.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OneLaunch.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.91%
Source: C:\Users\user\Desktop\OneLaunch.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\OneLaunch.exe C:\Users\user\Desktop\OneLaunch.exe
Source: C:\Users\user\Desktop\OneLaunch.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 784

Source: C:\Users\user\Desktop\OneLaunch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6408

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A9A.tmp

Jump to behavior

Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/add-watermark-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&key1=AddWatermarkToPdf
Source: OneLaunch.exe	String found in binary or memory: LaunchOnStartup-LaunchBrowserOnStartup#ClipboardShortcut/ShowSoftwareUpdatePopup'FirstRunAfterUpdate
Source: OneLaunch.exe	String found in binary or memory: U--keep-alive-for-test --no-startup-window
Source: OneLaunch.exe	String found in binary or memory: https://www.sodapdf.com/services/web/add-page-numbers-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&key1=AddPageNumbersToPdf
Source: OneLaunch.exe	String found in binary or memory: Vresources/wallpaperassets/loading_40@2x.png

Source: classification engine

Classification label: clean1.winEXE@2/6@0/0

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\OneLaunch.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: OneLaunch.exe

Static file information: File size 12398808 > 1048576

Source: OneLaunch.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: OneLaunch.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: OneLaunch.exe

Static PE information: certificate valid

Source: OneLaunch.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0xba3800

Source: OneLaunch.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: PresentationFramework.ni.pdbRSDS~J source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: PresentationFramework.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.Core.ni.pdbRSDSD source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: PresentationCore.ni.pdbRSDS source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: WindowsBase.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.Xaml.ni.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: WindowsBase.ni.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: mscorlib.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.ni.pdbRSDS source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.Xaml.ni.pdbRSDS\| source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.pdbL source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: PresentationCore.ni.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.Xaml.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: mscorlib.ni.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: WindowsBase.ni.pdbRSDS source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.Core.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: WindowsBase.pdbMZ@ source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: PresentationFramework.ni.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: PresentationCore.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.ni.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.pdb source: WER9A9A.tmp.dmp.2.dr
Source:	Binary string: System.Core.ni.pdb source: WER9A9A.tmp.dmp.2.dr

Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.2.dr	Binary or memory string: VMware
Source: Amcache.hve.2.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.2.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.2.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.2.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.2.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.2.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.2.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.2.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.2.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.2.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.2.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.2.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.2.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.2.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.2.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.18227214.B64.2106252220,BiosReleaseDate:06/25/2021,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.2.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Users\user\Desktop\OneLaunch.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\OneLaunch.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\OneLaunch.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\OneLaunch.exe

Queries volume information: C:\Users\user\Desktop\OneLaunch.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\OneLaunch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.2.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.2.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.2.dr	Binary or memory string: procexp.exe

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
OneLaunch.exe	0%	ReversingLabs
OneLaunch.exe	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://www.sos.state.nm.us/voting-and-elections/voter-information/	0%	Virustotal		Browse
https://play.getfungamesnow.com/games?g=spider-solitaire	1%	Virustotal		Browse
https://play.getfungamesnow.com	0%	Avira URL Cloud	safe
https://videos-cdn.onelaunch.com/	0%	Avira URL Cloud	safe
https://play.getfungamesnow.com/games?g=mahjong-deluxe	0%	Avira URL Cloud	safe
https://play.getfungamesnow.com/games?g=sudoku-html5	0%	Avira URL Cloud	safe
https://plus.onelaunch.com/api/news/newscategoriesmCouldn	0%	Avira URL Cloud	safe
https://www.sos.state.nm.us/voting-and-elections/voter-information/	0%	Avira URL Cloud	safe
https://play.getfungamesnow.com/games?g=spider-solitaire	0%	Avira URL Cloud	safe
https://www.sec.state.ma.us/ele/eleifv/howreg.htm	0%	Avira URL Cloud	safe
https://www.ohiosos.gov/elections/voters/register/#gref	0%	Avira URL Cloud	safe
http://www.dot.state.wy.us/home/titles_plates_registration.html	0%	Avira URL Cloud	safe
http://www.dot.state.wy.us/home/driver_license_records/formsapplications.html	0%	Avira URL Cloud	safe
https://soswy.state.wy.us/Elections/RegisteringToVote.aspx	0%	Avira URL Cloud	safe
https://r.v2i8b.com/api/v1/bid/redirect?campaign_id=01GSZ9YW40ZVTQ8S2EVDWJVPCN&url=https://amazon.co	0%	Avira URL Cloud	safe
https://sosmt.gov/elections/vote/	0%	Avira URL Cloud	safe
https://update.onelaunch.com/settingssSomething	0%	Avira URL Cloud	safe
https://www.sos.state.tx.us/elections/voter/reqvr.shtml	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.getfungamesnow.com/games?g=spider-solitaire	OneLaunch.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.sodapdf.com/services/web/gif-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&	OneLaunch.exe	false		high
http://www.dss.virginia.gov/benefit/snap.cgi	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.sos.state.nm.us/voting-and-elections/voter-information/	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://videos-cdn.onelaunch.com/	OneLaunch.exe	false	Avira URL Cloud: safe	unknown
https://www.astrology.com/horoscope/daily/scorpio.html	OneLaunch.exe	false		high
https://plus.onelaunch.com/api/news/newscategoriesmCouldn	OneLaunch.exe	false	Avira URL Cloud: safe	unknown
https://www.google.com/maps/search/Restaurants	OneLaunch.exe	false		high
https://dmv.dc.gov/page/dc-dmv-forms	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.crazygames.com/	OneLaunch.exe	false		high
https://www.thesaurus.com/browse/	OneLaunch.exe	false		high
https://dld.utah.gov/handbooksprintableforms/	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.dropbox.com/	OneLaunch.exe	false		high
https://www.cnn.com/	OneLaunch.exe	false		high
https://mail.yahoo.com/	OneLaunch.exe, 00000000.00000000.258239673.0000000000F72000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.dot.nd.gov/dotnet2/view/forms.aspx?category=yes#driverslicense	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://sos.nebraska.gov/elections/voter-forms	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.astrology.com/horoscope/daily-chinese/horse.html	OneLaunch.exe	false		high
https://play.getfungamesnow.com/games?g=mahjong-deluxe	OneLaunch.exe	false	Avira URL Cloud: safe	unknown
https://www.astrology.com/horoscope/daily-chinese/today/ox.html	OneLaunch.exe	false		high
https://templates.office.com/en-us/business	OneLaunch.exe	false		high
https://www.amazon.com/gp/help/customer/display.html/ref=hp_bc_nav?ie=UTF8&nodeId=201887920)DailyDea	OneLaunch.exe	false		high
https://www.primevideo.com/	OneLaunch.exe	false		high
https://sos.vermont.gov/elections/voters/registration/	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.astrology.com/horoscope/daily-chinese/sheep.html	OneLaunch.exe	false		high
https://open.spotify.com/	OneLaunch.exe	false		high
https://www.sodapdf.com/services/web/word-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol	OneLaunch.exe	false		high
http://www.okdhs.org/services/snap/Pages/default.aspx	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://sohu.com/	OneLaunch.exe	false		high
https://www.dmv.virginia.gov/forms/	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.mass.gov/lists/rmv-forms-and-applications	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://itd.idaho.gov/itddmv/?target=registration-plates#forms-publications	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.dfa.arkansas.gov/driver-services/forms/	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://api.mapbox.com/geocoding/v5/mapbox.places/	OneLaunch.exe	false		high
https://des.az.gov/services/basic-needs/food/nutrition-assistance-formerly-food-stamp-program	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.usbank.com/index.html/	OneLaunch.exe	false		high
https://www.walmart.com/	OneLaunch.exe	false		high
https://www.nbc.com/shows/all/popular	OneLaunch.exe	false		high
https://poki.com/	OneLaunch.exe	false		high
https://www.sodapdf.com/services/web/sign-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&ke	OneLaunch.exe	false		high
https://www.classifiedads.com/search.php?lid=z	OneLaunch.exe	false		high
https://play.getfungamesnow.com/games?g=sudoku-html5	OneLaunch.exe	false	Avira URL Cloud: safe	unknown
https://www.sodapdf.com/services/web/jpg-to-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&	OneLaunch.exe	false		high
https://dojmt.gov/driving/vehicle-title-registration-forms/	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.zillow.com/	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.sodapdf.com/services/web/password-protect-pdf/?uid=1018533&wid=7135&ref=sodapdf.com%2Fon	OneLaunch.exe	false		high
https://dhs.dc.gov/service/supplemental-nutrition-assistance-snap	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://play.getfungamesnow.com	OneLaunch.exe	false	Avira URL Cloud: safe	unknown
https://www.sec.state.ma.us/ele/eleifv/howreg.htm	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.xe.com/currencyconverter/Ahttps://www.convertworld.com/en/Shttps://www.bankrate.com/calc	OneLaunch.exe	false		high
https://www.sodapdf.com/services/web/resize-pdf/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&	OneLaunch.exe	false		high
https://www.maine.gov/sos/cec/elec/voter-info/voterguide.html	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://login.aol.com/	OneLaunch.exe	false		high
https://www.cyberdriveillinois.com/publications/motorist/home.html	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://jobs.utah.gov/customereducation/services/foodstamps/index.html	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.dot.nd.gov/dotnet2/view/forms.aspx?category=yes#title&registration	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://sos.ga.gov/index.php/Elections/register_to_vote	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://api.cognitive.microsofttranslator.com	OneLaunch.exe	false		high
https://www.hsbc.com/	OneLaunch.exe	false		high
https://elections.hawaii.gov/voters/registration/	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.dot.state.wy.us/home/titles_plates_registration.html	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nh.gov/safety/divisions/dmv/forms/index.htm	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.nytimes.com/	OneLaunch.exe	false		high
https://www.dps.texas.gov/internetforms/SectionDetail.aspx?ID=15&SpeclSection=Driver%20License	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://elections.ri.gov/voting/registration.php	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://dmv.vermont.gov/forms-and-information	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.dot.state.wy.us/home/driver_license_records/formsapplications.html	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.yahoo.com/news/	OneLaunch.exe	false		high
https://www.cms.gov/Medicare/CMS-Forms/CMS-Forms/CMS-Forms-List	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.bnymellon.com/us/en/client-access.html/	OneLaunch.exe	false		high
https://office.live.com/start/Excel.aspx?omkt=en-US	OneLaunch.exe	false		high
https://kizi.com/	OneLaunch.exe	false		high
https://revenue.alabama.gov/forms/?d=motor-vehicle	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.astrology.com/horoscope/daily-chinese/monkey.html	OneLaunch.exe	false		high
https://www.tmall.com/	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://suggestqueries.google.com/complete/search?output=firefox&q=	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.sodapdf.com/services/web/pdf-to-ppt/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&	OneLaunch.exe	false		high
https://travel.state.gov/content/travel/en/us-visas/visa-information-resources/forms.html	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.sodapdf.com/services/web/pdf-reader/?uid=1018533&wid=7135&ref=sodapdf.com/online&cmp=ol&	OneLaunch.exe	false		high
https://www.dol.wa.gov/forms/formsvehicle.html	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://sosmt.gov/elections/vote/	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bankrate.com/calculators/index-of-debt-management-calculators.aspxRhttps://www.bankrate.	OneLaunch.exe	false		high
https://www.astrology.com/horoscope/daily/pisces.html	OneLaunch.exe	false		high
https://www.ohiosos.gov/elections/voters/register/#gref	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://dhr.maryland.gov/food-supplement-program/	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://soswy.state.wy.us/Elections/RegisteringToVote.aspx	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://mydss.mo.gov/food-assistance/food-stamp-program	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.mdhs.ms.gov/economic-assistance/snap/	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://gmail.com	OneLaunch.exe	false		high
https://transportation.ky.gov/Organizational-Resources/Pages/Forms-Library-(TC-94).aspx	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.greetingsisland.com/cards/thoughts-and-feelings/friendship	OneLaunch.exe	false		high
https://www.trustpilot.com/evaluate/onelaunch.com	OneLaunch.exe	false		high
https://www.dor.ms.gov/Pages/MotorVehicle-Forms.aspx	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://r.v2i8b.com/api/v1/bid/redirect?campaign_id=01GSZ9YW40ZVTQ8S2EVDWJVPCN&url=https://amazon.co	OneLaunch.exe	false	Avira URL Cloud: safe	unknown
https://update.onelaunch.com/settingssSomething	OneLaunch.exe	false	Avira URL Cloud: safe	unknown
https://www.bankofamerica.com/	OneLaunch.exe	false		high
https://www.sos.state.tx.us/elections/voter/reqvr.shtml	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.colorado.gov/pacific/cdhs/supplemental-nutrition-assistance-program-snap	OneLaunch.exe, 00000000.00000000.258239673.000000000107C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.google.com/maps/search/Museums	OneLaunch.exe	false		high
https://www.amc.com/	OneLaunch.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	840120
Start date and time:	2023-04-03 17:38:06 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	OneLaunch.exe
Detection:	CLEAN
Classification:	clean1.winEXE@2/6@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): fs.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, watson.telemetry.microsoft.com
Execution Graph export aborted for target OneLaunch.exe, PID 6408 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:39:18	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_OneLaunch.exe_59d50513dab8840497ff693d94c33de8cdcaa5e_29ecb7e7_1a76be5e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0139768033418046
Encrypted:	false
SSDEEP:	192:gNKnxOiHHBUZMXyaPWQvlB5/u7sWS274ItUz:uKxO8BUZMXyaJv/u7sWX4ItUz
MD5:	F6EB6E0FF65ED639FDB81EFEEE60C2E2
SHA1:	6C2519D7276AA6B399745F950260749C266B105E
SHA-256:	5CCD188B3E5F71EC10BCF23E8493AD77D96F0AC455C067CC5C0DC34ED050BAE6
SHA-512:	8556BCCC8A4753C389630464B6BC36600979DB24B5025265CA1C67147C230869C9B71AA096E81DD04C49CC9E50CECCE8A32AE3FEB42B8C71CBDAB9F0AC38C460
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.2.5.0.4.2.3.4.8.8.5.3.3.5.3.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.2.5.0.4.2.3.4.9.4.6.2.7.1.2.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.5.6.9.4.a.4.4.-.2.b.d.3.-.4.9.3.0.-.8.9.2.b.-.b.b.0.f.7.c.e.c.a.c.0.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.0.a.6.c.0.1.4.-.1.7.b.3.-.4.e.b.5.-.a.6.6.e.-.2.a.5.9.7.4.f.c.2.4.0.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.O.n.e.L.a.u.n.c.h...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.O.n.e.L.a.u.n.c.h...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.0.8.-.0.0.0.1.-.0.0.1.f.-.d.5.d.4.-.1.0.d.c.8.d.6.6.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.9.e.b.4.4.9.6.4.3.d.8.c.a.3.6.d.9.f.3.a.9.6.2.1.d.a.b.d.9.5.0.0.0.0.0.0.0.0.0.!.0.0.0.0.3.d.3.2.3.5.2.e.1.d.4.a.6.9.7.d.e.f.1.d.2.e.8.0.a.7.7.b.8.8.e.e.f.2.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A9A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Apr 4 00:39:09 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	221958
Entropy (8bit):	4.5998496865934575
Encrypted:	false
SSDEEP:	3072:4Z9vfmTFb07jd+p/cbOk93JTZ2PUil0JeCyUCgUk2WI9gIOgF5SIJJM:4TvQ0Ep5U8BTjNWI9RpD
MD5:	47B6E469C4203AF9B4080BFBA720439D
SHA1:	6E5B54E4E8CE77C8918E7890E93B59D90A2571B2
SHA-256:	C8C23D07DDBD03657CDF49C7511EDDA16DDD62E3B6F8B0A2D3B383C3CFB53438
SHA-512:	C2168A573509EB4354174B1A5394656F740A959EEAA94E74F8D85E53D23761B7A6B4849F5F8064A957E7FBE03FF7BB4B5931B4A426BD525810045E3D0FA9EFAE
Malicious:	false
Reputation:	low
Preview:	MDMP....... ........q+d.........................................4..........T.......8...........T................D...........................................................................................U...........B..............GenuineIntelW...........T............q+d.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C60.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8312
Entropy (8bit):	3.696273508180597
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiaY6q6YqOSUu0gmfJ4x8SeCprH89bycsf+Gm:RrlsNil6q6YTSUu0gmfJ42Suyvfm
MD5:	959029A1E2CC8DB52DD5AECF0E0A34C8
SHA1:	5AD61FD2BA24A78E875090E54F1E78A3D80679A1
SHA-256:	3C1D80199AA44F799BB3C729C029415CD25F20B6260E50DC49C89C88A93983FF
SHA-512:	F0AD9A1EBD2F613AF97F0533DBD8937A7DDC9F41791308171E5A2B2843341E0638CC7E31999471C449CF37F9A096CE9DE84EEAAF59E91D58927F98FD6C8D9ABC
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.0.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CCE.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	4.47511904942995
Encrypted:	false
SSDEEP:	48:cvIwSD8zsltJgtWI9+AWgc8sqYjv8fm8M4JiLjFq+q8SyuoQBCVokd:uITflHp5grsqYYJLPoQBCmkd
MD5:	BD60B45B7D2091C01A0BCE16C9382A7D
SHA1:	EEA72F35B5E92E42CC5763C57B0415A2338028BE
SHA-256:	98703662E41061459FEE9008D99DEBA81D1B6BBF57C1F250CAA52D274A39C971
SHA-512:	462E5480F42D22F725E80A55B55C8FBC855E81A9AF729B4132486DE0B8B6D906BDF137DF70958B7BF8EAECAC7DD379058E77D04975E09039172880614FA756BA
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1982029" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.292473171780898
Encrypted:	false
SSDEEP:	12288:1ksJGdH5GA4cA93gBGOoj530cXS1uYUuIZrh1kpXD5hiQQRJJdrshekZ:tJGdH5GA4cA93gQnb+
MD5:	14467E7BBC43D7395730FB075FB743C7
SHA1:	9A7D9D96AC269112E14AD8E85803EE89E8681136
SHA-256:	336E9A335793F3D53BDA659CE73411B14094B1D1FF97F019BE4A3B71A7CC6FF7
SHA-512:	F0CAD47B90500FFF29B1ECA66FD6CC211C81A5D12B8480F6350C946C8ACF13460C1AA16B28C3605318F5691849EEE81BE92092A4B3BFF3A21CAD680A3EBA54AA
Malicious:	false
Reputation:	low
Preview:	regfj...j...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm...f.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	3.9917817977975663
Encrypted:	false
SSDEEP:	768:P6FRftx15WJ4JaUbFAJtPfq43WoGbfNasE3gMqCrHvUiBpwem7z+BqKpTeqWQe7O:6f+9U0VWhdMasSlrd
MD5:	79C2667F9EC3A8B5CCBBE13C3482A5A3
SHA1:	FDA46E76000EFD2FBFED54EDBDFFB041E15BE8ED
SHA-256:	704812B218F42D7AC81C1C052940E51F89CCF593120A72B2E52952739FA39220
SHA-512:	A54DCAB5CB0DD3EF4867E9CF4901F84E5A5EEB237CAEB3F81BBDBB6F779D359A01464B4339F81BB60F031B6E7C8AD201483524670E084CAE11F33DA67ACC48E9
Malicious:	false
Reputation:	low
Preview:	regfi...i...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm...f.................................................................................................................................................................................................................................................................................................................................................HvLE........i.................G/I......}.........0...........@.......0..hbin................p.\..,..........nk,.n...f.................................. ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk .n...f...... ........................... .......Z.......................Root........lf......Root....nk .n...f...................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.647257258558833
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.91% Win32 Executable (generic) a (10002005/4) 49.86% InstallShield setup (43055/19) 0.21% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	OneLaunch.exe
File size:	12398808
MD5:	6b50f5cd91f309d9b882a36abc7a5b38
SHA1:	3d32352e1d4a697def1d2e80a77b88eef22e94ba
SHA256:	e6fbc6f99c534c974b5188232c951c54388dbe2f62d4ba80382363330d7a14e2
SHA512:	6c93b982a4f06e845a83d7cd5cd42bea6bb509e634b1dd7e1ed927920638adb3e6a14c5d9a6a868a47a25f0b847b30307c2fa6fb7d9e146b4668991d913ad1ee
SSDEEP:	196608:dE9ZAP0WAW0f2kkXmuFRKRmaidClaDpl7o8PMjjK9T:e9U0WAW0f2kkWuj6VaDpDPS29T
TLSH:	40C6F113B78995D6C56307B203B1B1619AB7FC3926A081CF7A4EF33A7876750CC62663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..d.........."...0..8...........V... ...`....@.. ....................................`................................

File Icon


Icon Hash:	cc97e96de9f1c7f6

Static PE Info

General

Entrypoint:	0xfa56f2
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6410FC3F [Tue Mar 14 22:59:11 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	7/11/2021 5:00:00 PM 7/16/2023 4:59:59 PM
Subject Chain	CN=ONELAUNCH TECHNOLOGIES INC., O=ONELAUNCH TECHNOLOGIES INC., L=Victoria, S=British Columbia, C=CA
Version:	3
Thumbprint MD5:	9DE00FD2B1A8652F5AA537982B132D46
Thumbprint SHA-1:	1A2578549C554ABA5C79637D735B4786957FA719
Thumbprint SHA-256:	AAAFC9ECFDF5E0BF4C8D6263AA3BACC4800EADBF2272D542C19794DA279F306E
Serial:	0A118F49AB8E6B2FF7EDA31ADD5B43C8

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba56a0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xba6000	0x2e238	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xbd2000	0x10d8	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xbd6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xba37b0	0xba3800	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xba6000	0x2e238	0x2e400	False	0.5347445101351351	data	6.440749934176237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xbd6000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xba61e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m
RT_ICON	0xba6658	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 2835 x 2835 px/m
RT_ICON	0xba6ff0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m
RT_ICON	0xba80a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m
RT_ICON	0xbaa660	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m
RT_ICON	0xbae898	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 2835 x 2835 px/m
RT_ICON	0xbb7d50	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m
RT_ICON	0xbc8588	0xac67	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON	0xbd3200	0x76	data
RT_VERSION	0xbd3288	0x2f6	data
RT_MANIFEST	0xbd3590	0xca4	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

• OneLaunch.exe
• WerFault.exe

Click to jump to process

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Behavior

• OneLaunch.exe
• WerFault.exe

Click to jump to process

Target ID:	0
Start time:	17:39:05
Start date:	03/04/2023
Path:	C:\Users\user\Desktop\OneLaunch.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\OneLaunch.exe
Imagebase:	0x570000
File size:	12398808 bytes
MD5 hash:	6B50F5CD91F309D9B882A36ABC7A5B38
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	17:39:08
Start date:	03/04/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 784
Imagebase:	0x2c0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Function 01AE0581 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.285871331.0000000001AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ae0000_OneLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c43e7793fb4470c6852f8231093a8a7f875ada6f34f4b1e43c331d32add5be5
Instruction ID: b3eabfce6c558f3bba88801f09515a0ee8d77ee4bbf38b2070b9f854a06fcb47
Opcode Fuzzy Hash: 6c43e7793fb4470c6852f8231093a8a7f875ada6f34f4b1e43c331d32add5be5
Instruction Fuzzy Hash: 48F0A7317083405FD7118B68D809A957FF2DF86310F1980DAE588CB363CB67AC15C751

Uniqueness

Uniqueness Score: -1.00%

Function 01AE0590 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.285871331.0000000001AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ae0000_OneLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e4d38ce36b3964d169a2ca2cbbcbadfb81ee93c88ad2dd3710995b6d077c45
Instruction ID: 488fa37b3458fb40dd7409ee75222528992b9cee111c9172adcec2cdb050613b
Opcode Fuzzy Hash: f0e4d38ce36b3964d169a2ca2cbbcbadfb81ee93c88ad2dd3710995b6d077c45
Instruction Fuzzy Hash: 1AE086357042146FD310575DD804F967BDADBCA720F1540A5F6448B3A7CFA3AC418795

Uniqueness

Uniqueness Score: -1.00%

Function 01AE0CA8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.285871331.0000000001AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ae0000_OneLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 842d5e99f2cab5cf6a3be19df7abf8f9177450a787649fd9b71f36bb2205525f
Instruction ID: 88b8cac90b946ccfebc1e3db63bd5621095cebb9a65826097b0ed77dfa5133fb
Opcode Fuzzy Hash: 842d5e99f2cab5cf6a3be19df7abf8f9177450a787649fd9b71f36bb2205525f
Instruction Fuzzy Hash: 44E04FB1846304BFC792CAF0DC02AE97FB4DB41320F0180A7E900D6451E2B24D51CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01AE0CB8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.285871331.0000000001AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ae0000_OneLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7071e9ea87e77e10e021a8f37b001ecc08dd0fafa056293da97fa4e9b1a7ae0
Instruction ID: 2f974f12127daa1c0c73182117275f687558a588dac8661543a727527a81746e
Opcode Fuzzy Hash: d7071e9ea87e77e10e021a8f37b001ecc08dd0fafa056293da97fa4e9b1a7ae0
Instruction Fuzzy Hash: ECD0C97694020CBBDB10CEE09C05F9ABBACD714700F108062BE04D6180E6729A209795

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OneLaunch.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_OneLaunch.exe_59d50513dab8840497ff693d94c33de8cdcaa5e_29ecb7e7_1a76be5e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A9A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C60.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CCE.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: OneLaunch.exePID: 6408, Parent PID: 3452

General

Windows Analysis Report
OneLaunch.exe