File name:

WeMod-Setup.exe

Full analysis: https://app.any.run/tasks/7da563bc-b4eb-4cf7-92c3-c518d533e884
Verdict: Malicious activity
Analysis date: May 12, 2024, 09:46:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

0F92932E3D228414BCDB10E813221D1C

SHA1:

52BF7531AF783E74E2450E85C21FF19F15280AC8

SHA256:

0ED8B1AE4816553389404BF9F7961B0A1CB3632B3403F8FCE8DE93F154C36575

SSDEEP:

1536:mBll12iut9nk7RBog5KG6JkOiVPL+09ME5LBtJD64uQgCANR9HEdOyJkNRBog5KZ:Q12ioE57miVj+J6pHdokdOp57N/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WeMod-Setup.exe (PID: 3968)
      • WeMod-Setup-638511040038411250.exe (PID: 1588)
      • Update.exe (PID: 1704)

    • Actions looks like stealing of personal data

      • WeMod.exe (PID: 2692)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WeMod-Setup.exe (PID: 3968)
      • Update.exe (PID: 1704)
      • Update.exe (PID: 2448)

    • Reads the Internet Settings

      • WeMod-Setup.exe (PID: 3968)
      • Update.exe (PID: 1704)
      • Update.exe (PID: 2448)
      • WeMod.exe (PID: 1612)
      • Update.exe (PID: 2916)

    • Reads Microsoft Outlook installation path

      • WeMod-Setup.exe (PID: 3968)

    • Reads settings of System Certificates

      • WeMod-Setup.exe (PID: 3968)
      • Update.exe (PID: 1704)
      • WeMod.exe (PID: 1612)
      • Update.exe (PID: 2916)

    • Checks Windows Trust Settings

      • WeMod-Setup.exe (PID: 3968)

    • Reads Internet Explorer settings

      • WeMod-Setup.exe (PID: 3968)

    • Executable content was dropped or overwritten

      • WeMod-Setup-638511040038411250.exe (PID: 1588)
      • Update.exe (PID: 1704)

    • Process drops legitimate windows executable

      • Update.exe (PID: 1704)

    • Searches for installed software

      • Update.exe (PID: 1704)

    • Creates a software uninstall entry

      • Update.exe (PID: 1704)

    • Application launched itself

      • WeMod.exe (PID: 1612)

  • INFO

    • Reads the computer name

      • WeMod-Setup.exe (PID: 3968)
      • wmpnscfg.exe (PID: 1184)
      • Update.exe (PID: 1704)
      • squirrel.exe (PID: 1836)
      • Update.exe (PID: 2448)
      • Update.exe (PID: 2268)
      • WeMod.exe (PID: 1612)
      • WeMod.exe (PID: 936)
      • Update.exe (PID: 2916)
      • WeModAuxiliaryService.exe (PID: 2788)
      • WeMod.exe (PID: 916)
      • WeMod.exe (PID: 1848)

    • Checks supported languages

      • WeMod-Setup.exe (PID: 3968)
      • wmpnscfg.exe (PID: 1184)
      • WeMod-Setup-638511040038411250.exe (PID: 1588)
      • Update.exe (PID: 1704)
      • WeMod.exe (PID: 1548)
      • squirrel.exe (PID: 1836)
      • Update.exe (PID: 2448)
      • WeMod.exe (PID: 1612)
      • Update.exe (PID: 2268)
      • WeMod.exe (PID: 936)
      • WeMod.exe (PID: 1848)
      • WeMod.exe (PID: 916)
      • WeModAuxiliaryService.exe (PID: 2788)
      • Update.exe (PID: 2916)
      • WeMod.exe (PID: 2692)

    • Checks proxy server information

      • WeMod-Setup.exe (PID: 3968)

    • Reads the machine GUID from the registry

      • WeMod-Setup.exe (PID: 3968)
      • Update.exe (PID: 1704)
      • squirrel.exe (PID: 1836)
      • Update.exe (PID: 2268)
      • Update.exe (PID: 2448)
      • Update.exe (PID: 2916)
      • WeModAuxiliaryService.exe (PID: 2788)
      • WeMod.exe (PID: 1612)

    • Reads the software policy settings

      • WeMod-Setup.exe (PID: 3968)
      • Update.exe (PID: 1704)
      • Update.exe (PID: 2916)
      • WeMod.exe (PID: 1612)

    • Creates files or folders in the user directory

      • WeMod-Setup.exe (PID: 3968)
      • WeMod-Setup-638511040038411250.exe (PID: 1588)
      • Update.exe (PID: 1704)
      • squirrel.exe (PID: 1836)
      • Update.exe (PID: 2268)
      • Update.exe (PID: 2448)
      • WeMod.exe (PID: 1612)
      • WeMod.exe (PID: 936)
      • Update.exe (PID: 2916)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1184)
      • taskmgr.exe (PID: 660)
      • control.exe (PID: 3280)

    • Reads Environment values

      • WeMod-Setup.exe (PID: 3968)
      • Update.exe (PID: 1704)
      • WeMod.exe (PID: 1548)
      • WeMod.exe (PID: 1612)
      • Update.exe (PID: 2916)

    • Create files in a temporary directory

      • WeMod-Setup.exe (PID: 3968)
      • Update.exe (PID: 1704)
      • Update.exe (PID: 2916)
      • WeMod.exe (PID: 1612)

    • Reads product name

      • WeMod.exe (PID: 1612)
      • WeMod.exe (PID: 1548)

    • Process checks computer location settings

      • WeMod.exe (PID: 2692)
      • WeMod.exe (PID: 1612)

    • Reads CPU info

      • WeMod.exe (PID: 1612)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2059:09:10 14:56:13+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 105472
InitializedDataSize: 28160
UninitializedDataSize: -
EntryPoint: 0x1ba0e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 8.0.0.0
ProductVersionNumber: 8.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: WeMod Setup
CompanyName: WeMod LLC
FileDescription: WeMod Setup
FileVersion: 8.0.0.0
InternalName: WeMod-Setup.exe
LegalCopyright: Copyright © WeMod LLC 2022
LegalTrademarks: -
OriginalFileName: WeMod-Setup.exe
ProductName: WeMod
ProductVersion: 8.0.0.0
AssemblyVersion: 8.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
17
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wemod-setup.exe wmpnscfg.exe no specs taskmgr.exe no specs wemod-setup-638511040038411250.exe update.exe squirrel.exe no specs wemod.exe no specs update.exe no specs update.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe wemod.exe wemod.exe no specs update.exe wemodauxiliaryservice.exe no specs control.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Windows\system32\taskmgr.exe" /4C:\Windows\System32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
916"C:\Users\admin\AppData\Local\WeMod\app-8.19.0\WeMod.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1272 --field-trial-handle=1036,i,3792157113076425664,11000871268014293886,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Users\admin\AppData\Local\WeMod\app-8.19.0\WeMod.exe—WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
LOW
Description:
WeMod - Cheats and Mods
Version:
8.19.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-8.19.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\wemod\app-8.19.0\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
936"C:\Users\admin\AppData\Local\WeMod\app-8.19.0\WeMod.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-ui-direction=ltr --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --mojo-platform-channel-handle=1296 --field-trial-handle=1036,i,3792157113076425664,11000871268014293886,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Users\admin\AppData\Local\WeMod\app-8.19.0\WeMod.exe
WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Cheats and Mods
Version:
8.19.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-8.19.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\wemod\app-8.19.0\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1184"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1548"C:\Users\admin\AppData\Local\WeMod\app-8.19.0\WeMod.exe" --squirrel-install 8.19.0C:\Users\admin\AppData\Local\WeMod\app-8.19.0\WeMod.exe—Update.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Cheats and Mods
Exit code:
0
Version:
8.19.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-8.19.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\wemod\app-8.19.0\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1588"C:\Users\admin\AppData\Local\Temp\WeMod-Setup-638511040038411250.exe" --silentC:\Users\admin\AppData\Local\Temp\WeMod-Setup-638511040038411250.exe
WeMod-Setup.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Ultimate Gaming Companion
Exit code:
0
Version:
8.19.0
Modules
Images
c:\users\admin\appdata\local\temp\wemod-setup-638511040038411250.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1612"C:\Users\admin\AppData\Local\WeMod\app-8.19.0\WeMod.exe" wemod://?_inst=JaMhq9Tcejl5N1lkC:\Users\admin\AppData\Local\WeMod\app-8.19.0\WeMod.exe—Update.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Cheats and Mods
Version:
8.19.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-8.19.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\wemod\app-8.19.0\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1704"C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . --silentC:\Users\admin\AppData\Local\SquirrelTemp\Update.exe
WeMod-Setup-638511040038411250.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
2.0.1.23
Modules
Images
c:\users\admin\appdata\local\squirreltemp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1836"C:\Users\admin\AppData\Local\WeMod\app-8.19.0\Squirrel.exe" --updateSelf=C:\Users\admin\AppData\Local\SquirrelTemp\Update.exeC:\Users\admin\AppData\Local\WeMod\app-8.19.0\squirrel.exe—Update.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\wemod\app-8.19.0\squirrel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1848"C:\Users\admin\AppData\Local\WeMod\app-8.19.0\WeMod.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=992 --field-trial-handle=1036,i,3792157113076425664,11000871268014293886,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Users\admin\AppData\Local\WeMod\app-8.19.0\WeMod.exe—WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
LOW
Description:
WeMod - Cheats and Mods
Exit code:
0
Version:
8.19.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-8.19.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\wemod\app-8.19.0\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
Total events
40 136
Read events
39 991
Write events
137
Delete events
8

Modification events

(PID) Process:(3968) WeMod-Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3968) WeMod-Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3968) WeMod-Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3968) WeMod-Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3968) WeMod-Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3968) WeMod-Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(3968) WeMod-Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(3968) WeMod-Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(3968) WeMod-Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(3968) WeMod-Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
22
Suspicious files
139
Text files
39
Unknown types
0

Dropped files

PID
Process
Filename
Type
3968WeMod-Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:70732AF1880AAED47FD3BE29D9D084BD
SHA256:55B5327FFA4B60F59B03E1DCEB432E17703FEC0291D39A03D47A85D0F1357D4E
3968WeMod-Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\Inter-Thin-0f080c40c6[1].woffbinary
MD5:0F080C40C639962E1CAD093AA58192DC
SHA256:E9DA5A64A6A8EB87A2C6D475327F072B5CA25731DF07119F576C10C50AA9554D
3968WeMod-Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\setup[1].htmhtml
MD5:1801E70DD5B76D7BE6BE0821ECAD56ED
SHA256:E108B0BAB274C5223FC28D33BFCBA3E1011ADC266AF40E9B850DA574BA28BCF4
3968WeMod-Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Inter-Regular-14d1275c67[1].woffbinary
MD5:14D1275C67676CC5D911232D0C890D97
SHA256:3710E2CE073EC0EB39274DECC63768B52091A27E35F5C28D6ABB7A5FCEF0B7FC
3968WeMod-Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Inter-Bold-45e58f4054[1].woffbinary
MD5:45E58F4054A3AD886E4582E1D43056FE
SHA256:57027B1C72507C75CF9FC21DCBBBD4366F01901B598764CB8703DFA4988A60CA
3968WeMod-Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Inter-Light-0f0118feb7[1].woffwoff
MD5:0F0118FEB71664927EA7FB8015778795
SHA256:CB671D0DBC9A61EC80BFC91D5879E8635A09B7F309F5EE57810D4C6B7A26EE0C
3968WeMod-Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Inter-Medium-5ce3e4db96[1].woffbinary
MD5:5CE3E4DB9634913232403F166B2447DE
SHA256:68D52E74E8171DDB2C94CA60A2596DC8A46407320449881FD09369DBC317624C
3968WeMod-Setup.exeC:\Users\admin\AppData\Local\Temp\WeMod-Setup-638511040038411250.exe —
MD5:—
SHA256:—
3968WeMod-Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:EFB4234DD6DF7701AE5A7294B3052DC4
SHA256:315E3D9155DB37818B7A5FF0852EFE250EE5A86017C9539F021C88BD28C71FDC
3968WeMod-Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Inter-SemiBold-1d5bb5c64d[1].woffbinary
MD5:1D5BB5C64DC15405BDB04145DAB7B436
SHA256:807D56B95FCC04CD1C26FCA043DDF19E300C8AE156747458BD025A2B21CF54B4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
48
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3968
WeMod-Setup.exe
GET
304
23.204.115.113:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?cc1fd6eba5c377fe
unknown
—
—
unknown
3968
WeMod-Setup.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
3968
WeMod-Setup.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
—
—
unknown
3968
WeMod-Setup.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
—
—
unknown
3968
WeMod-Setup.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEAFWoeiRoD5nEA9wbC%2FqWOc%3D
unknown
—
—
unknown
3968
WeMod-Setup.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEGfe9D7xe9riT%2FWUBgbSwIQ%3D
unknown
—
—
unknown
3968
WeMod-Setup.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc%3D
unknown
—
—
unknown
3968
WeMod-Setup.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR64T7ooMQqLLQoy%2BemBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEGO2IkqWfxOGk0NWE9vukyQ%3D
unknown
—
—
unknown
1088
svchost.exe
GET
304
23.204.115.113:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?83bdd76cfa43776c
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
3968
WeMod-Setup.exe
104.22.43.75:443
api.wemod.com
CLOUDFLARENET
—
unknown
3968
WeMod-Setup.exe
23.204.115.113:80
ctldl.windowsupdate.com
AKAMAI-AS
US
unknown
3968
WeMod-Setup.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3968
WeMod-Setup.exe
52.26.41.155:443
api2.amplitude.com
AMAZON-02
US
unknown
3968
WeMod-Setup.exe
142.250.185.174:443
www.google-analytics.com
GOOGLE
US
whitelisted
3968
WeMod-Setup.exe
142.250.181.227:80
ocsp.pki.goog
GOOGLE
US
whitelisted
3968
WeMod-Setup.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
api.wemod.com
  • 104.22.43.75
  • 172.67.25.118
  • 104.22.42.75
unknown
ctldl.windowsupdate.com
  • 23.204.115.113
  • 23.204.115.101
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.google-analytics.com
  • 142.250.185.174
whitelisted
api2.amplitude.com
  • 52.26.41.155
  • 100.20.17.100
  • 54.244.90.16
  • 52.43.101.88
  • 34.223.176.122
  • 52.40.173.170
  • 54.69.199.187
  • 35.164.237.130
  • 52.39.190.55
  • 34.210.107.208
  • 52.88.148.246
  • 54.187.179.230
  • 52.43.96.19
  • 54.213.195.160
  • 44.226.6.28
  • 54.71.17.134
whitelisted
ocsp.pki.goog
  • 142.250.181.227
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
storage-cdn.wemod.com
  • 172.67.25.118
  • 104.22.43.75
  • 104.22.42.75
unknown
redirector.gvt1.com
  • 142.250.185.174
whitelisted
r5---sn-4g5lzned.gvt1.com
  • 74.125.162.10
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WeMod-Setup.exe