File name:

LEGO City Undercover (Steam) Trainer Setup.exe

Full analysis: https://app.any.run/tasks/6a205fb0-cce4-4584-a8b8-3af12bad44ca
Verdict: Malicious activity
Analysis date: February 14, 2024, 23:07:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

D958E5C661CB7D8495FE0ACA260F34AF

SHA1:

19A3A200EBEB9FA782AF77061262618F6B903087

SHA256:

7980105D53F154B0482514D0B5014DF1CDE4434FB2700C690B1BBC1F659761D9

SSDEEP:

1536:mBll12iut9nk7RBog5KG6JkOiVPL+09ME5LBtJD64uQgCANR9HEdOyJkNRBog5KZ:Q12ioE57miVj+J6pHdokdOp57N/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)
      • WeMod-Setup-638435488526536250.exe (PID: 3996)
      • Update.exe (PID: 2408)

    • Actions looks like stealing of personal data

      • WeMod.exe (PID: 3556)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)
      • Update.exe (PID: 2408)
      • Update.exe (PID: 2780)

    • Reads settings of System Certificates

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)
      • Update.exe (PID: 2408)
      • WeMod.exe (PID: 1848)
      • Update.exe (PID: 3132)

    • Checks Windows Trust Settings

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)

    • Reads Microsoft Outlook installation path

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)

    • Reads the Internet Settings

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)
      • Update.exe (PID: 2408)
      • Update.exe (PID: 2780)
      • WeMod.exe (PID: 1848)
      • Update.exe (PID: 3132)

    • Reads Internet Explorer settings

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)

    • Executable content was dropped or overwritten

      • WeMod-Setup-638435488526536250.exe (PID: 3996)
      • Update.exe (PID: 2408)

    • Process drops legitimate windows executable

      • Update.exe (PID: 2408)

    • Creates a software uninstall entry

      • Update.exe (PID: 2408)

    • Searches for installed software

      • Update.exe (PID: 2408)

    • Application launched itself

      • WeMod.exe (PID: 1848)

    • Adds/modifies Windows certificates

      • WeMod.exe (PID: 1848)

  • INFO

    • Checks supported languages

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)
      • WeMod-Setup-638435488526536250.exe (PID: 3996)
      • Update.exe (PID: 2408)
      • Update.exe (PID: 2156)
      • squirrel.exe (PID: 2256)
      • WeMod.exe (PID: 2440)
      • Update.exe (PID: 2780)
      • WeMod.exe (PID: 1848)
      • WeMod.exe (PID: 1784)
      • WeMod.exe (PID: 1728)
      • Update.exe (PID: 3132)
      • WeMod.exe (PID: 1020)
      • WeMod.exe (PID: 3556)
      • WeModAuxiliaryService.exe (PID: 1264)
      • WeMod.exe (PID: 2448)
      • WeMod.exe (PID: 3768)
      • WeMod.exe (PID: 3376)
      • WeMod.exe (PID: 3644)
      • WeMod.exe (PID: 3320)
      • WeMod.exe (PID: 2948)
      • WeMod.exe (PID: 2940)
      • WeMod.exe (PID: 3040)
      • WeMod.exe (PID: 3244)
      • WeMod.exe (PID: 3928)
      • WeMod.exe (PID: 2452)
      • WeMod.exe (PID: 3084)
      • WeMod.exe (PID: 3416)
      • WeMod.exe (PID: 4024)
      • WeMod.exe (PID: 2580)
      • WeMod.exe (PID: 4000)
      • WeMod.exe (PID: 1836)
      • WeMod.exe (PID: 3672)
      • WeMod.exe (PID: 3680)
      • WeMod.exe (PID: 2980)
      • WeMod.exe (PID: 2968)
      • WeMod.exe (PID: 2108)
      • WeMod.exe (PID: 668)
      • WeMod.exe (PID: 3132)
      • WeMod.exe (PID: 2908)
      • WeMod.exe (PID: 3024)
      • WeMod.exe (PID: 4332)
      • WeMod.exe (PID: 4400)
      • WeMod.exe (PID: 4296)
      • WeMod.exe (PID: 4888)
      • WeMod.exe (PID: 4308)
      • WeMod.exe (PID: 4324)
      • WeMod.exe (PID: 4316)
      • WeMod.exe (PID: 4944)
      • WeMod.exe (PID: 5016)
      • WeMod.exe (PID: 5120)
      • WeMod.exe (PID: 5208)
      • WeMod.exe (PID: 5304)
      • WeMod.exe (PID: 5312)
      • WeMod.exe (PID: 5248)
      • WeMod.exe (PID: 4772)
      • WeMod.exe (PID: 4568)
      • WeMod.exe (PID: 4896)
      • WeMod.exe (PID: 4932)

    • Checks proxy server information

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)

    • Reads the computer name

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)
      • Update.exe (PID: 2408)
      • squirrel.exe (PID: 2256)
      • Update.exe (PID: 2156)
      • Update.exe (PID: 2780)
      • WeMod.exe (PID: 1848)
      • WeMod.exe (PID: 1728)
      • WeMod.exe (PID: 1020)
      • WeMod.exe (PID: 1784)
      • WeModAuxiliaryService.exe (PID: 1264)
      • Update.exe (PID: 3132)
      • WeMod.exe (PID: 2108)

    • Reads the machine GUID from the registry

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)
      • Update.exe (PID: 2408)
      • squirrel.exe (PID: 2256)
      • Update.exe (PID: 2156)
      • Update.exe (PID: 2780)
      • WeMod.exe (PID: 1848)
      • Update.exe (PID: 3132)
      • WeModAuxiliaryService.exe (PID: 1264)

    • Reads the software policy settings

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)
      • Update.exe (PID: 2408)
      • WeMod.exe (PID: 1848)
      • Update.exe (PID: 3132)

    • Creates files or folders in the user directory

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)
      • WeMod-Setup-638435488526536250.exe (PID: 3996)
      • squirrel.exe (PID: 2256)
      • Update.exe (PID: 2156)
      • Update.exe (PID: 2408)
      • Update.exe (PID: 2780)
      • WeMod.exe (PID: 1728)
      • WeMod.exe (PID: 1848)
      • Update.exe (PID: 3132)

    • Reads Environment values

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)
      • WeMod.exe (PID: 2440)
      • WeMod.exe (PID: 1848)
      • Update.exe (PID: 2408)
      • Update.exe (PID: 3132)

    • Create files in a temporary directory

      • LEGO City Undercover (Steam) Trainer Setup.exe (PID: 3668)
      • Update.exe (PID: 2408)
      • WeMod.exe (PID: 1848)
      • Update.exe (PID: 3132)

    • Reads product name

      • WeMod.exe (PID: 2440)
      • WeMod.exe (PID: 1848)

    • Process checks computer location settings

      • WeMod.exe (PID: 1848)
      • WeMod.exe (PID: 3556)
      • WeMod.exe (PID: 3376)
      • WeMod.exe (PID: 2448)
      • WeMod.exe (PID: 3768)
      • WeMod.exe (PID: 2948)
      • WeMod.exe (PID: 2940)
      • WeMod.exe (PID: 3644)
      • WeMod.exe (PID: 3320)
      • WeMod.exe (PID: 3040)
      • WeMod.exe (PID: 2452)
      • WeMod.exe (PID: 3416)
      • WeMod.exe (PID: 4024)
      • WeMod.exe (PID: 3244)
      • WeMod.exe (PID: 3928)
      • WeMod.exe (PID: 3084)
      • WeMod.exe (PID: 4000)
      • WeMod.exe (PID: 2580)
      • WeMod.exe (PID: 3672)
      • WeMod.exe (PID: 1836)
      • WeMod.exe (PID: 3680)
      • WeMod.exe (PID: 2980)
      • WeMod.exe (PID: 2908)
      • WeMod.exe (PID: 668)
      • WeMod.exe (PID: 3024)
      • WeMod.exe (PID: 3132)
      • WeMod.exe (PID: 2968)
      • WeMod.exe (PID: 4308)
      • WeMod.exe (PID: 4316)
      • WeMod.exe (PID: 4324)
      • WeMod.exe (PID: 4332)
      • WeMod.exe (PID: 4296)
      • WeMod.exe (PID: 4400)
      • WeMod.exe (PID: 4568)
      • WeMod.exe (PID: 4772)
      • WeMod.exe (PID: 4932)
      • WeMod.exe (PID: 4944)
      • WeMod.exe (PID: 5016)
      • WeMod.exe (PID: 5120)
      • WeMod.exe (PID: 5208)
      • WeMod.exe (PID: 5248)
      • WeMod.exe (PID: 4888)
      • WeMod.exe (PID: 4896)
      • WeMod.exe (PID: 5312)

    • Reads CPU info

      • WeMod.exe (PID: 1848)

    • Application launched itself

      • msedge.exe (PID: 2328)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 2328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2059:09:10 14:56:13+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 105472
InitializedDataSize: 28160
UninitializedDataSize: -
EntryPoint: 0x1ba0e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 8.0.0.0
ProductVersionNumber: 8.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: WeMod Setup
CompanyName: WeMod LLC
FileDescription: WeMod Setup
FileVersion: 8.0.0.0
InternalName: WeMod-Setup.exe
LegalCopyright: Copyright © WeMod LLC 2022
LegalTrademarks: -
OriginalFileName: WeMod-Setup.exe
ProductName: WeMod
ProductVersion: 8.0.0.0
AssemblyVersion: 8.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
107
Monitored processes
68
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start lego city undercover (steam) trainer setup.exe wemod-setup-638435488526536250.exe update.exe squirrel.exe no specs wemod.exe no specs update.exe no specs update.exe no specs wemod.exe wemod.exe no specs wemod.exe wemod.exe wemod.exe no specs update.exe wemodauxiliaryservice.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs msedge.exe msedge.exe no specs wemod.exe no specs msedge.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs msedge.exe wemod.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs msedge.exe no specs msedge.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs msedge.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
668"C:\Users\admin\AppData\Local\WeMod\app-8.13.12\WeMod.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\admin\AppData\Local\WeMod\app-8.13.12\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=4512 --field-trial-handle=1072,i,16781229493290181281,17278150106255099832,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1C:\Users\admin\AppData\Local\WeMod\app-8.13.12\WeMod.exe—WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
LOW
Description:
WeMod - Cheats and Mods
Exit code:
0
Version:
8.13.12
Modules
Images
c:\users\admin\appdata\local\wemod\app-8.13.12\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\wemod\app-8.13.12\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
864"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6a4df598,0x6a4df5a8,0x6a4df5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Users\admin\AppData\Local\WeMod\app-8.13.12\WeMod.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1276 --field-trial-handle=1072,i,16781229493290181281,17278150106255099832,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Users\admin\AppData\Local\WeMod\app-8.13.12\WeMod.exe—WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
LOW
Description:
WeMod - Cheats and Mods
Exit code:
0
Version:
8.13.12
Modules
Images
c:\users\admin\appdata\local\wemod\app-8.13.12\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\wemod\app-8.13.12\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1264C:\Users\admin\AppData\Local\WeMod\app-8.13.12\resources\app.asar.unpacked\static\unpacked\auxiliary\WeModAuxiliaryService.exe WeMod\Support_1707952129745_OutC:\Users\admin\AppData\Local\WeMod\app-8.13.12\resources\app.asar.unpacked\static\unpacked\auxiliary\WeModAuxiliaryService.exe—WeMod.exe
User:
admin
Company:
WeMod LLC
Integrity Level:
MEDIUM
Description:
WeMod
Exit code:
0
Version:
7.2.0.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-8.13.12\resources\app.asar.unpacked\static\unpacked\auxiliary\wemodauxiliaryservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1572"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1664 --field-trial-handle=1264,i,13309853625084325879,1394022633960749800,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1728"C:\Users\admin\AppData\Local\WeMod\app-8.13.12\WeMod.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-ui-direction=ltr --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --mojo-platform-channel-handle=1328 --field-trial-handle=1072,i,16781229493290181281,17278150106255099832,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Users\admin\AppData\Local\WeMod\app-8.13.12\WeMod.exe
WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Cheats and Mods
Exit code:
0
Version:
8.13.12
Modules
Images
c:\users\admin\appdata\local\wemod\app-8.13.12\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\wemod\app-8.13.12\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1784"C:\Users\admin\AppData\Local\WeMod\app-8.13.12\WeMod.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1008 --field-trial-handle=1072,i,16781229493290181281,17278150106255099832,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Users\admin\AppData\Local\WeMod\app-8.13.12\WeMod.exe—WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
LOW
Description:
WeMod - Cheats and Mods
Exit code:
0
Version:
8.13.12
Modules
Images
c:\users\admin\appdata\local\wemod\app-8.13.12\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\wemod\app-8.13.12\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1836"C:\Users\admin\AppData\Local\WeMod\app-8.13.12\WeMod.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\admin\AppData\Local\WeMod\app-8.13.12\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3800 --field-trial-handle=1072,i,16781229493290181281,17278150106255099832,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1C:\Users\admin\AppData\Local\WeMod\app-8.13.12\WeMod.exe—WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
LOW
Description:
WeMod - Cheats and Mods
Exit code:
0
Version:
8.13.12
Modules
Images
c:\users\admin\appdata\local\wemod\app-8.13.12\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\wemod\app-8.13.12\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1848"C:\Users\admin\AppData\Local\WeMod\app-8.13.12\WeMod.exe" wemod://titles/14751?gameId=14751&_inst=26kvybgP4SBISQdQC:\Users\admin\AppData\Local\WeMod\app-8.13.12\WeMod.exe
Update.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Cheats and Mods
Exit code:
0
Version:
8.13.12
Modules
Images
c:\users\admin\appdata\local\wemod\app-8.13.12\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\wemod\app-8.13.12\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2108"C:\Users\admin\AppData\Local\WeMod\app-8.13.12\WeMod.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-ui-direction=ltr --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --mojo-platform-channel-handle=4332 --field-trial-handle=1072,i,16781229493290181281,17278150106255099832,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Users\admin\AppData\Local\WeMod\app-8.13.12\WeMod.exe—WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
LOW
Description:
WeMod - Cheats and Mods
Exit code:
0
Version:
8.13.12
Modules
Images
c:\users\admin\appdata\local\wemod\app-8.13.12\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\wemod\app-8.13.12\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
Total events
60 482
Read events
60 303
Write events
164
Delete events
15

Modification events

(PID) Process:(3668) LEGO City Undercover (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3668) LEGO City Undercover (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3668) LEGO City Undercover (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3668) LEGO City Undercover (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3668) LEGO City Undercover (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3668) LEGO City Undercover (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(3668) LEGO City Undercover (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(3668) LEGO City Undercover (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(3668) LEGO City Undercover (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(3668) LEGO City Undercover (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
22
Suspicious files
267
Text files
104
Unknown types
132

Dropped files

PID
Process
Filename
Type
3668LEGO City Undercover (Steam) Trainer Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:68A60F4F0F4C8CA9986E2C97319505A7
SHA256:802BDA88B95C7A685848CBB9A57E6EFF2864F2B62DF5090DC3687249268F6BA6
3668LEGO City Undercover (Steam) Trainer Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:08488DB16DA9BF3C657B81CCB925AA98
SHA256:74BAAB59FF1F040FB49C9F578A720329A7C279A6683C4EB0C2354C0899C23381
3668LEGO City Undercover (Steam) Trainer Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:05D73914B2F4EB29A85F8CBA7FABE73F
SHA256:FFE5B9AEEE6E179C753993E97A09F37DE888C5AA1D61A47D73934DC8CECB7DB8
3668LEGO City Undercover (Steam) Trainer Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:96CBF30EAE2B5B28292E19B37E405CDB
SHA256:E4EC5C5DDE74232C0DFBC58FBF5CBDEE73C35B880E0B5474BE20896FF5501582
3668LEGO City Undercover (Steam) Trainer Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\Inter-Thin-0f080c40c6[1].woffwoff
MD5:0F080C40C639962E1CAD093AA58192DC
SHA256:E9DA5A64A6A8EB87A2C6D475327F072B5CA25731DF07119F576C10C50AA9554D
3668LEGO City Undercover (Steam) Trainer Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Inter-Light-0f0118feb7[1].woffwoff
MD5:0F0118FEB71664927EA7FB8015778795
SHA256:CB671D0DBC9A61EC80BFC91D5879E8635A09B7F309F5EE57810D4C6B7A26EE0C
3668LEGO City Undercover (Steam) Trainer Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:35765269EEF067278CE0F318EA14D994
SHA256:A0A400500BCAB643A141C820697066AE047FA58306F768EDEE0FA796E1150735
3668LEGO City Undercover (Steam) Trainer Setup.exeC:\Users\admin\AppData\Local\Temp\WeMod-Setup-638435488526536250.exe —
MD5:—
SHA256:—
3668LEGO City Undercover (Steam) Trainer Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Inter-ExtraLight-7d759358c1[1].woffwoff
MD5:7D759358C1372FA6ACAE4CB22F93DEFA
SHA256:07F5B5F734793F48613D8DA246F4DB2B564BFA7149F62526326BE9CB8BB94841
3668LEGO City Undercover (Steam) Trainer Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
249
DNS requests
174
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3668
LEGO City Undercover (Steam) Trainer Setup.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8716306717c4f8b4
unknown
—
—
unknown
3668
LEGO City Undercover (Steam) Trainer Setup.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
3668
LEGO City Undercover (Steam) Trainer Setup.exe
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3668
LEGO City Undercover (Steam) Trainer Setup.exe
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
3668
LEGO City Undercover (Steam) Trainer Setup.exe
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCG5mYmc5exBwr3zurLpXnC
unknown
binary
472 b
unknown
3668
LEGO City Undercover (Steam) Trainer Setup.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEGfe9D7xe9riT%2FWUBgbSwIQ%3D
unknown
binary
1.42 Kb
unknown
3668
LEGO City Undercover (Steam) Trainer Setup.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc%3D
unknown
binary
2.18 Kb
unknown
3668
LEGO City Undercover (Steam) Trainer Setup.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR64T7ooMQqLLQoy%2BemBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEGO2IkqWfxOGk0NWE9vukyQ%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e2ddf83a2417bb20
unknown
compressed
65.2 Kb
unknown
1080
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0754c686571bd23f
unknown
compressed
65.2 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3668
LEGO City Undercover (Steam) Trainer Setup.exe
104.22.43.75:443
api.wemod.com
CLOUDFLARENET
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3668
LEGO City Undercover (Steam) Trainer Setup.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3668
LEGO City Undercover (Steam) Trainer Setup.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3668
LEGO City Undercover (Steam) Trainer Setup.exe
142.250.184.227:80
ocsp.pki.goog
GOOGLE
US
whitelisted
3668
LEGO City Undercover (Steam) Trainer Setup.exe
142.250.186.142:443
www.google-analytics.com
GOOGLE
US
whitelisted
3668
LEGO City Undercover (Steam) Trainer Setup.exe
34.218.98.67:443
api2.amplitude.com
AMAZON-02
US
unknown
3668
LEGO City Undercover (Steam) Trainer Setup.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
api.wemod.com
  • 63.215.202.172
  • 104.22.43.75
  • 104.22.42.75
  • 172.67.25.118
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.google-analytics.com
  • 142.250.186.142
whitelisted
api2.amplitude.com
  • 34.218.98.67
  • 35.165.184.231
  • 52.41.61.200
  • 44.228.71.34
  • 54.188.10.32
  • 52.38.150.161
  • 50.112.211.62
  • 54.214.48.176
  • 44.225.255.207
  • 54.186.119.37
  • 52.27.21.18
  • 34.218.158.138
  • 44.238.152.47
  • 54.184.113.98
  • 54.184.173.212
whitelisted
ocsp.pki.goog
  • 142.250.184.227
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
storage-cdn.wemod.com
  • 172.67.25.118
  • 104.22.42.75
  • 104.22.43.75
unknown
redirector.gvt1.com
  • 142.250.186.142
whitelisted
r2---sn-4g5ednsk.gvt1.com
  • 173.194.188.231
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LEGO City Undercover (Steam) Trainer Setup.exe