| File name: | Forza Horizon 4 Trainer.exe |
| Full analysis: | https://app.any.run/tasks/5a83e538-baec-467b-ac7c-67474ec6284b |
| Verdict: | Malicious activity |
| Analysis date: | October 26, 2024, 20:50:29 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 23C9739F32E59B9A824821679CEC0132 |
| SHA1: | 2F2C2CFDC72B396EA7E4F0B6B5243563BE83E5BB |
| SHA256: | 08EB3F1707C7C9645A39EB3E2B5E1D32D7E18B876B8A8288AE79AAC443993B1C |
| SSDEEP: | 1536:Q668Dtf9nk7RBog5KG6JkOiVPL+09ME5LBtJD64uQgCYO6+YFyHA7OqCkNRBog5m:w8DvE57miVj+J6pHdHg7OA57N/u |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads security settings of Internet Explorer
- Forza Horizon 4 Trainer.exe (PID: 4548)
- Update.exe (PID: 3772)
- Update.exe (PID: 5592)
Executable content was dropped or overwritten
- WeMod-Setup-638655726416394067.exe (PID: 7140)
- Update.exe (PID: 3772)
Reads Microsoft Outlook installation path
- Forza Horizon 4 Trainer.exe (PID: 4548)
Checks Windows Trust Settings
- Forza Horizon 4 Trainer.exe (PID: 4548)
Reads Internet Explorer settings
- Forza Horizon 4 Trainer.exe (PID: 4548)
Process drops legitimate windows executable
- Update.exe (PID: 3772)
Reads the date of Windows installation
- Update.exe (PID: 3772)
- Forza Horizon 4 Trainer.exe (PID: 4548)
- Update.exe (PID: 5592)
Searches for installed software
- Update.exe (PID: 3772)
Creates a software uninstall entry
- Update.exe (PID: 3772)
Application launched itself
- WeMod.exe (PID: 6720)
INFO
Reads Environment values
- Forza Horizon 4 Trainer.exe (PID: 4548)
- WeMod.exe (PID: 6888)
- Update.exe (PID: 3772)
- WeMod.exe (PID: 6720)
Creates files or folders in the user directory
- WeMod-Setup-638655726416394067.exe (PID: 7140)
- Update.exe (PID: 3772)
- Forza Horizon 4 Trainer.exe (PID: 4548)
- squirrel.exe (PID: 4812)
- Update.exe (PID: 2360)
- Update.exe (PID: 5592)
- WeMod.exe (PID: 6720)
Disables trace logs
- Forza Horizon 4 Trainer.exe (PID: 4548)
- Update.exe (PID: 3772)
Checks supported languages
- WeMod-Setup-638655726416394067.exe (PID: 7140)
- Update.exe (PID: 3772)
- Forza Horizon 4 Trainer.exe (PID: 4548)
- squirrel.exe (PID: 4812)
- WeMod.exe (PID: 6888)
- Update.exe (PID: 2360)
- Update.exe (PID: 5592)
- WeMod.exe (PID: 6720)
- WeMod.exe (PID: 5952)
- WeMod.exe (PID: 6204)
Reads the machine GUID from the registry
- Update.exe (PID: 3772)
- Forza Horizon 4 Trainer.exe (PID: 4548)
- squirrel.exe (PID: 4812)
- Update.exe (PID: 5592)
- Update.exe (PID: 2360)
Reads the computer name
- Update.exe (PID: 3772)
- Forza Horizon 4 Trainer.exe (PID: 4548)
- squirrel.exe (PID: 4812)
- Update.exe (PID: 2360)
- Update.exe (PID: 5592)
- WeMod.exe (PID: 6204)
- WeMod.exe (PID: 6720)
- WeMod.exe (PID: 5952)
Create files in a temporary directory
- Forza Horizon 4 Trainer.exe (PID: 4548)
- Update.exe (PID: 3772)
Reads the software policy settings
- Forza Horizon 4 Trainer.exe (PID: 4548)
- Update.exe (PID: 3772)
Checks proxy server information
- Forza Horizon 4 Trainer.exe (PID: 4548)
- Update.exe (PID: 3772)
- WeMod.exe (PID: 6720)
Process checks computer location settings
- Update.exe (PID: 3772)
- Forza Horizon 4 Trainer.exe (PID: 4548)
- Update.exe (PID: 5592)
- WeMod.exe (PID: 6720)
Reads product name
- WeMod.exe (PID: 6888)
- WeMod.exe (PID: 6720)
The process uses the downloaded file
- Update.exe (PID: 3772)
- Forza Horizon 4 Trainer.exe (PID: 4548)
- Update.exe (PID: 5592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2076:12:06 19:29:50+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 8 |
| CodeSize: | 105984 |
| InitializedDataSize: | 28160 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1bcfe |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 8.0.0.0 |
| ProductVersionNumber: | 8.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | WeMod Setup |
| CompanyName: | WeMod LLC |
| FileDescription: | WeMod Setup |
| FileVersion: | 8.0.0.0 |
| InternalName: | WeMod-Setup.exe |
| LegalCopyright: | Copyright © WeMod LLC 2022 |
| LegalTrademarks: | - |
| OriginalFileName: | WeMod-Setup.exe |
| ProductName: | WeMod |
| ProductVersion: | 8.0.0.0 |
| AssemblyVersion: | 8.0.0.0 |
Total processes
149
Monitored processes
14
Malicious processes
3
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2360 | C:\Users\admin\AppData\Local\WeMod\Update.exe --createShortcut WeMod.exe | C:\Users\admin\AppData\Local\WeMod\Update.exe | — | WeMod.exe | |||||||||||
User: admin Company: GitHub Integrity Level: MEDIUM Description: Update Exit code: 0 Version: 2.0.1.53 Modules
| |||||||||||||||
| 3772 | "C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . --silent | C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe | WeMod-Setup-638655726416394067.exe | ||||||||||||
User: admin Company: GitHub Integrity Level: MEDIUM Description: Update Exit code: 0 Version: 2.0.1.53 Modules
| |||||||||||||||
| 3864 | "C:\Users\admin\AppData\Local\WeMod\app-9.10.7\WeMod.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\admin\AppData\Local\WeMod\app-9.10.7\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2512,i,2321843957885744017,13032787387428395261,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:1 | C:\Users\admin\AppData\Local\WeMod\app-9.10.7\WeMod.exe | — | WeMod.exe | |||||||||||
User: admin Company: WeMod Integrity Level: MEDIUM Description: WeMod - Cheats and Mods Version: 9.10.7 Modules
| |||||||||||||||
| 4040 | C:\Users\admin\AppData\Local\WeMod\Update.exe --checkForUpdate https://api.wemod.com/client/channels/stable?osVersion=10.0.19045 | C:\Users\admin\AppData\Local\WeMod\Update.exe | WeMod.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 4548 | "C:\Users\admin\AppData\Local\Temp\Forza Horizon 4 Trainer.exe" | C:\Users\admin\AppData\Local\Temp\Forza Horizon 4 Trainer.exe | explorer.exe | ||||||||||||
User: admin Company: WeMod LLC Integrity Level: MEDIUM Description: WeMod Setup Exit code: 0 Version: 8.0.0.0 Modules
| |||||||||||||||
| 4812 | "C:\Users\admin\AppData\Local\WeMod\app-9.10.7\Squirrel.exe" --updateSelf=C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe | C:\Users\admin\AppData\Local\WeMod\app-9.10.7\squirrel.exe | — | Update.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 5524 | C:\Users\admin\AppData\Local\WeMod\app-9.10.7\resources\app.asar.unpacked\static\unpacked\auxiliary\WeModAuxiliaryService.exe WeMod\Support_1729975883856_Out | C:\Users\admin\AppData\Local\WeMod\app-9.10.7\resources\app.asar.unpacked\static\unpacked\auxiliary\WeModAuxiliaryService.exe | WeMod.exe | ||||||||||||
User: admin Company: WeMod LLC Integrity Level: MEDIUM Description: WeMod Version: 7.2.0.0 Modules
| |||||||||||||||
| 5532 | "C:\Users\admin\AppData\Local\WeMod\app-9.10.7\WeMod.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\admin\AppData\Local\WeMod\app-9.10.7\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4276,i,2321843957885744017,13032787387428395261,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1 | C:\Users\admin\AppData\Local\WeMod\app-9.10.7\WeMod.exe | — | WeMod.exe | |||||||||||
User: admin Company: WeMod Integrity Level: LOW Description: WeMod - Cheats and Mods Version: 9.10.7 Modules
| |||||||||||||||
| 5592 | "C:\Users\admin\AppData\Local\WeMod\Update.exe" --processStart "WeMod.exe" --process-start-args "wemod://titles/29628?gameId=51946&_inst=JgH0gjgq7bobVSSg" | C:\Users\admin\AppData\Local\WeMod\Update.exe | — | Forza Horizon 4 Trainer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 5952 | "C:\Users\admin\AppData\Local\WeMod\app-9.10.7\WeMod.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1748,i,2321843957885744017,13032787387428395261,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:2 | C:\Users\admin\AppData\Local\WeMod\app-9.10.7\WeMod.exe | — | WeMod.exe | |||||||||||
User: admin Company: WeMod Integrity Level: LOW Description: WeMod - Cheats and Mods Version: 9.10.7 Modules
| |||||||||||||||
Total events
10 503
Read events
10 436
Write events
47
Delete events
20
Modification events
| (PID) Process: | (4548) Forza Horizon 4 Trainer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4548) Forza Horizon 4 Trainer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4548) Forza Horizon 4 Trainer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4548) Forza Horizon 4 Trainer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com |
| Operation: | write | Name: | NumberOfSubdomains |
Value: 1 | |||
| (PID) Process: | (4548) Forza Horizon 4 Trainer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com |
| Operation: | write | Name: | Total |
Value: 35 | |||
| (PID) Process: | (4548) Forza Horizon 4 Trainer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 4 Trainer_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (4548) Forza Horizon 4 Trainer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 4 Trainer_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (4548) Forza Horizon 4 Trainer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 4 Trainer_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (4548) Forza Horizon 4 Trainer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 4 Trainer_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (4548) Forza Horizon 4 Trainer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 4 Trainer_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
Executable files
23
Suspicious files
140
Text files
35
Unknown types
6
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4548 | Forza Horizon 4 Trainer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 | der | |
MD5:67E486B2F148A3FCA863728242B6273E | SHA256:FACAF1C3A4BF232ABCE19A2D534E495B0D3ADC7DBE3797D336249AA6F70ADCFB | |||
| 4548 | Forza Horizon 4 Trainer.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\Inter-ExtraLight-7d759358c1[1].woff | woff | |
MD5:7D759358C1372FA6ACAE4CB22F93DEFA | SHA256:07F5B5F734793F48613D8DA246F4DB2B564BFA7149F62526326BE9CB8BB94841 | |||
| 4548 | Forza Horizon 4 Trainer.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\Inter-Thin-0f080c40c6[1].woff | binary | |
MD5:0F080C40C639962E1CAD093AA58192DC | SHA256:E9DA5A64A6A8EB87A2C6D475327F072B5CA25731DF07119F576C10C50AA9554D | |||
| 4548 | Forza Horizon 4 Trainer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 | binary | |
MD5:92E8F9043FAECE408BA333CA97721A0B | SHA256:63E5DDE8B43EAF73B5A345882680EE16D892A253B3DE61BC6FBC2A5764D0B639 | |||
| 4548 | Forza Horizon 4 Trainer.exe | C:\Users\admin\AppData\Local\Temp\WeMod-Setup-638655726416394067.exe | — | |
MD5:— | SHA256:— | |||
| 4548 | Forza Horizon 4 Trainer.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\Inter-Regular-14d1275c67[1].woff | binary | |
MD5:14D1275C67676CC5D911232D0C890D97 | SHA256:3710E2CE073EC0EB39274DECC63768B52091A27E35F5C28D6ABB7A5FCEF0B7FC | |||
| 4548 | Forza Horizon 4 Trainer.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\Inter-Medium-5ce3e4db96[1].woff | binary | |
MD5:5CE3E4DB9634913232403F166B2447DE | SHA256:68D52E74E8171DDB2C94CA60A2596DC8A46407320449881FD09369DBC317624C | |||
| 4548 | Forza Horizon 4 Trainer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 | binary | |
MD5:98416D193E166C2C48CF1F8BED37A5A9 | SHA256:90F1E16CB206057E0D0C629C55B8CF9D5B5FD3A42993DB3C3A47C0289DC4F770 | |||
| 4548 | Forza Horizon 4 Trainer.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\5U9AEGUE\api.wemod[1].xml | text | |
MD5:C1DDEA3EF6BBEF3E7060A1A9AD89E4C5 | SHA256:B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB | |||
| 7140 | WeMod-Setup-638655726416394067.exe | C:\Users\admin\AppData\Local\SquirrelTemp\WeMod-9.10.7-full.nupkg | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
64
DNS requests
50
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4548 | Forza Horizon 4 Trainer.exe | GET | 200 | 142.250.185.163:80 | http://c.pki.goog/r/gsr1.crl | unknown | — | — | whitelisted |
4548 | Forza Horizon 4 Trainer.exe | GET | 200 | 142.250.185.163:80 | http://c.pki.goog/r/r4.crl | unknown | — | — | whitelisted |
4548 | Forza Horizon 4 Trainer.exe | GET | 200 | 142.250.185.163:80 | http://c.pki.goog/r/r1.crl | unknown | — | — | whitelisted |
4548 | Forza Horizon 4 Trainer.exe | GET | 200 | 142.250.185.67:80 | http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDkGIO6g6XzohJ3Fub52e6y | unknown | — | — | whitelisted |
4548 | Forza Horizon 4 Trainer.exe | GET | 200 | 172.64.149.23:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc%3D | unknown | — | — | whitelisted |
4548 | Forza Horizon 4 Trainer.exe | GET | 200 | 172.64.149.23:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR64T7ooMQqLLQoy%2BemBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEGO2IkqWfxOGk0NWE9vukyQ%3D | unknown | — | — | whitelisted |
6944 | svchost.exe | GET | 200 | 23.48.23.164:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6944 | svchost.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4360 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
4700 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
6944 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1248 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5488 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4548 | Forza Horizon 4 Trainer.exe | 104.22.42.75:443 | api.wemod.com | CLOUDFLARENET | — | whitelisted |
4548 | Forza Horizon 4 Trainer.exe | 142.250.185.163:80 | c.pki.goog | GOOGLE | US | whitelisted |
4548 | Forza Horizon 4 Trainer.exe | 142.250.185.142:443 | www.google-analytics.com | GOOGLE | US | whitelisted |
4548 | Forza Horizon 4 Trainer.exe | 54.149.191.67:443 | api2.amplitude.com | AMAZON-02 | US | whitelisted |
4548 | Forza Horizon 4 Trainer.exe | 142.250.185.67:80 | o.pki.goog | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
api.wemod.com |
| whitelisted |
c.pki.goog |
| whitelisted |
www.google-analytics.com |
| whitelisted |
api2.amplitude.com |
| whitelisted |
o.pki.goog |
| whitelisted |
ocsp.comodoca.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |