File scan report
Verdict Safe
Is ASM2 Launcher. exe safe? Yes, no threats found.
Only 2 of the 71 antivirus engines that checked it raised generic alerts, while extensive historical prevalence, evidence from the test run, and complete host checks provide…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 71 flagged
- Flagged 2
- No detection 69
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 12y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The two generic detections come only from less reliable engines; none of the major antivirus engines flagged the executable. It has circulated since Apr 30, 2014 among 1,266 submitters, and the test run recorded no malicious verdict, named injection target, persistence, malicious child, or hostile contacted host.
Only 2 of the 71 antivirus engines that checked it flagged the executable, and both alerts were generic detections from less reliable engines. All 18 major antivirus engines that reported on it were silent. The file has substantial history, with 1,266 distinct submitters and a first-seen date of Apr 30, 2014. Six sandbox runs recorded no malicious verdict, named injection target, or persistence, while the two technique mappings lacked the artefacts needed to substantiate them. The complete reputation check of observed contacts found no malicious or suspicious host, and no classified file it created was harmful. The unsigned status warrants ordinary source verification, but the overall evidence strongly indicates false-positive detections.
What We Detected
Only 2 of the 71 antivirus engines that checked it flagged the executable. APEX used a generic malicious label and MaxSecure used a generic trojan label; none of the 18 major antivirus engines that reported on it raised an alert. The file is unsigned, but it has been widely submitted and was first seen on Apr 30, 2014.
Threat Behavior
Six sandbox runs produced no recorded malicious verdict, persistence indicator, or named injection target. The complete reputation check covering all observed contacts found no malicious or suspicious destination, and none of the classified dropped files was harmful.
What To Do Now
The evidence supports treating the two generic alerts as false positives. Obtain the executable from the original game installation or another trusted distribution channel, keep security software enabled, and verify its SHA-256 before running it.
Where this verdict could be wrong2 caveats
- The executable is unsigned, so there is no verified publisher identity.
- APEX and MaxSecure flagged it using generic malicious or trojan labels.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 18 major antivirus engines that reported on the executable flagged it.
- The file has 1,266 distinct submitters and was first seen on Apr 30, 2014.
- Six sandbox runs recorded no malicious verdict, persistence, or named injection target.
- A complete reputation check of all observed contacts found no malicious or suspicious host.
- No classified dropped file was harmful; one matched a known-software reference entry.
- The executable has no verified publisher signature.
- Two less reliable engines applied generic malicious or trojan labels.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 6 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 6isolated sandbox runs
- 20sandbox rule tags
- 9spawned processes
- 22network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was detonated in 6 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
20MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1018
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1056· Keylogging
- T1056.001· Keylogging
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1087
- T1095· Custom network
- T1112
- T1129· Loads modules
- T1497.001· Sandbox evasion
- T1518.001· Checks your AV
- T1562.001· Disables security
- T1574.002· Execution hijack
- T1614
Observed activity
Processes started
9Programs the file ran, with their command lines.
file.exe"C:\Users\<USER>\AppData\Local\Temp\file.exe"fondue.exe"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dllFonDUE.EXE"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dllOptionalFeatures.EXE"C:\Windows\system32\OptionalFeatures.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dllslui.exeC:\Windows\System32\slui.exe -Embeddingwmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Show all 9 entries for processes started
d74e869e744a5fc36271cedc97e0658e6d7bb5c16828c8cc854213ddc93ae84d.exe%SAMPLEPATH%\d74e869e744a5fc36271cedc97e0658e6d7bb5c16828c8cc854213ddc93ae84d.exedw20.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exeimportant_document.exe
Network contacts
2222 hosts, listed as 2 domains, 20 addresses, 6 links. Links show the host and path only.
- Domain
img-prod-cms-rt-microsoft-com.akamaized.net - Domain
login.live.com - IP address
151.139.188.48 - IP address
13.107.4.52 - IP address
23.215.176.129 - IP address
23.35.98.25
Show all 28 entries for network contacts
- IP address
23.213.175.152 - IP address
23.216.147.61 - IP address
23.209.116.19 - IP address
23.198.146.35 - IP address
23.216.147.52 - IP address
23.216.147.74 - IP address
23.216.147.55 - IP address
23.209.116.56 - IP address
23.32.75.13 - IP address
23.55.168.81 - IP address
23.51.202.8 - IP address
23.216.147.78 - IP address
23.59.198.43 - IP address
23.216.147.71 - IP address
104.98.118.163 - IP address
104.98.118.146 - URL
http://151.139.188.48/filestreamingservice/files/61ece5c0-b56e-46c8-9f21-205d42502371/pieceshash - URL
http://151.139.188.48/filestreamingservice/files/cdd505a5-b16f-4c68-a000-442b3d554622 - URL
http://151.139.188.48/filestreamingservice/files/cdd505a5-b16f-4c68-a000-442b3d554622/pieceshash - URL
http://151.139.188.48/filestreamingservice/files/e0d94aa6-d6c1-47f5-8b3a-06050b8d0f94 - URL
http://151.139.188.48/filestreamingservice/files/e0d94aa6-d6c1-47f5-8b3a-06050b8d0f94/pieceshash - URL
http://151.139.188.48/filestreamingservice/files/61ece5c0-b56e-46c8-9f21-205d42502371
Files
30Files the file created, changed or deleted.
- Written
C:\WINDOWS\system32\d3d9caps.dat - Written
C:\WINDOWS\system32\d3d9caps.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_executable.exe_b78728fd9e8189dd5c4c0a2189a3fe8babf104c_00000000_10ace276 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_executable.exe_b78728fd9e8189dd5c4c0a2189a3fe8babf104c_00000000_10ace276\Report.wer - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC8B.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC8B.tmp.WERInternalMetadata.xml
Show all 30 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD28.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD28.tmp.xml - Written
C:\Users\user\AppData\Roaming - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_program.exe_f9ad7b7e5e1af8c17f7a0be30f288b6cc6c9fa_00000000_0ad6b6ca - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_program.exe_f9ad7b7e5e1af8c17f7a0be30f288b6cc6c9fa_00000000_0ad6b6ca\Report.wer - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0A2.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0A2.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA140.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA140.tmp.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER961.tmp.mdmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF6D.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC90.tmp.mdmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER79.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER15A6.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER15B6.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER15D7.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER15E7.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER15F9.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER15F8.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6358.tmp.mdmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER65F9.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3AA2.tmp.mdmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D05.tmp.WERInternalMetadata.xml
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Direct3D\MostRecentApplication\Name - Set
HKEY_CURRENT_USER\Software\Activision - Set
HKEY_CURRENT_USER\Software\Activision\The Amazing Spider-Man 2 (TM) - Set
HKEY_CURRENT_USER\Software\Activision\The Amazing Spider-Man 2 (TM)\Settings - Set
HKEY_CURRENT_USER\Software\Activision\The Amazing Spider-Man 2 (TM)\Settings\Display - Set
HKEY_CURRENT_USER\Software\Activision\The Amazing Spider-Man 2 (TM)\Install
Show all 15 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\Software\Activision\The Amazing Spider-Man 2 (TM)\GameConfig - Set
HKEY_CURRENT_USER\Software\GRE - Set
\REGISTRY\A\{962ccd36-147b-f11f-cc65-14cf042ae8bc}\Root\InventoryApplicationFile\PermissionsCheckTestKey - Set
\REGISTRY\A\{962ccd36-147b-f11f-cc65-14cf042ae8bc}\Root\InventoryApplicationFile\executable.exe|83c770cda7bf1166 - Set
HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\IdentityCRL\ClockData - Set
HKEY_CURRENT_USER\Software\GRE\Default - Set
HKEY_CURRENT_USER\Software\Activision\The Amazing Spider-Man 2 (TM)\Settings\Display\AspectRatio - Set
HKEY_CURRENT_USER\Software\Activision\The Amazing Spider-Man 2 (TM)\Settings\Display\Fullscreen - Set
HKEY_CURRENT_USER\Software\Activision\The Amazing Spider-Man 2 (TM)\Settings\Display\Width
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 10 entries for mutexes
ASM2GameLauncherAdministratorZonesCounterMutexZonesCacheCounterMutexZonesLockedCacheCounterMutex
Sandbox background — not the file
16The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p - VM process
DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{338B40F9-9D68-4B53-A793-6B9AA0C5F63B} - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager - VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe
Show all 16 entries for sandbox background — not the file
- VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE - VM injection target
C:\Program Files\Google4072_1385193188\bin\updater.exe - VM injection target
C:\Program Files\Google3856_1383958593\bin\updater.exe - VM injection target
C:\Program Files\Google1412_442042208\bin\updater.exe - VM injection target
C:\Program Files\Google280_598347314\bin\updater.exe - VM host
query.prod.cms.rt.microsoft.com - VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM host
25.140.123.92.in-addr.arpa - VM host
1.214.248.87.in-addr.arpa
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 4d95e550b47c0122b96c…269379Cleantrust 85known-software reference set · not scanned here
- 91917667236d097f90a0…2a7787Not checkedno saved verdict
- ba2e116461fdd97763fe…e78649Not checkedno saved verdict
- b9f9c1a032fa62bc8288…8687d9Not checkedno saved verdict
- ff35af12565086612eed…bdfb65Not checkedno saved verdict
- 63a962fc9c399fec7ce7…6b0cd1Not checkedno saved verdict
- c682ed3f031665de5e30…61ce2cNot checkedno saved verdict
- 3c3d613ce6f20378f64c…8d3744Not checkedno saved verdict
- 790a8b457ca8cb192d69…b07829Not checkedno saved verdict
- 038bc431d6ccdcbf6f79…72a026Not checkedno saved verdict
Chapter 04
Technical details
2 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The saved verdict treats these detections as likely false positives.
- APEXMalicious
- MaxSecureTrojan.Malware.300983.susgen
File fingerprint
- Last analyzed
- Nov 4, 2026, 5:04 AM UTC
- SHA-256
d74e869e744a5fc36271cedc97e0658e6d7bb5c16828c8cc854213ddc93ae84d- SHA-1
48370847debee700c318f615ec1f571531e8a438- MD5
da43873d2f9097682e8d8cb6085a4ed8
About this file
ASM2Launcher.exe says it is The Amazing Spider-Man 2 (TM) Launcher, 5.0 MB.
- Claims to be
- The Amazing Spider-Man 2 (TM) LauncherFrom the file's own version information, written by whoever built it.
- Original name
- ASM2Launcher.exeMatches the shared file name.
- Type and size
- Win32 EXE · 5.0 MB
- Signer
- UnsignedNo code signature.
- First seen
- Apr 30, 2014On VirusTotal.
- Submitted by
- 1,266 distinct sources
- Packer
- None detected
- Entropy
- 3.67 of 8
First scanned
Antivirus consensus
2 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines2flagged
View all 75 engine results
- APEXMalicious: Malicious
- MaxSecureMalicious: Trojan.Malware.300983.susgen
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
These identify the compiler, runtime or installer used to build the file. They are not packing and are not a risk signal on their own.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ASM2Launcher.exe safe?
What is ASM2Launcher.exe?
How many antivirus engines detected ASM2Launcher.exe?
What is the SHA-256 hash of ASM2Launcher.exe?
Is it safe to run ASM2Launcher.exe?
How up to date is this analysis of ASM2Launcher.exe?
Community
Member reviews and reports for this exact file hash.