File name:

WeMod-Setup (1).exe

Full analysis: https://app.any.run/tasks/07a44bbe-272e-4517-bd4d-ad991c35543f
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 13, 2025, 22:42:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

EBFA6367B5EB7CC3C87DB40948DEA491

SHA1:

C541984D6046A348196A5F2252DDB5C2E86662CC

SHA256:

A4645B7F83847DF9D75F509F9F37F77AF6932D156CDEF1FD5922BD73E86AAFA6

SSDEEP:

1536:Q668Dtf9nk7RBog5KG6JkOiVPL+09ME5LBtJD64uQgCYO6+YFyHA7OqCkNRBog5m:w8DvE57miVj+J6pHdHg7OA57N/u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • WeMod.exe (PID: 2292)

  • SUSPICIOUS

    • Reads Internet Explorer settings

      • WeMod-Setup (1).exe (PID: 204)

    • Executable content was dropped or overwritten

      • WeMod-Setup-638750833713816336.exe (PID: 4932)
      • Update.exe (PID: 2132)

    • Reads Microsoft Outlook installation path

      • WeMod-Setup (1).exe (PID: 204)

    • Reads security settings of Internet Explorer

      • WeMod-Setup (1).exe (PID: 204)
      • Update.exe (PID: 2132)
      • WeModAuxiliaryService.exe (PID: 4976)
      • Update.exe (PID: 3816)

    • Checks Windows Trust Settings

      • WeMod-Setup (1).exe (PID: 204)
      • WeModAuxiliaryService.exe (PID: 4976)

    • Reads the date of Windows installation

      • Update.exe (PID: 2132)
      • WeMod-Setup (1).exe (PID: 204)
      • Update.exe (PID: 3816)

    • Process drops legitimate windows executable

      • Update.exe (PID: 2132)

    • Searches for installed software

      • Update.exe (PID: 2132)

    • Creates a software uninstall entry

      • Update.exe (PID: 2132)

    • Application launched itself

      • WeMod.exe (PID: 4188)

  • INFO

    • Checks supported languages

      • WeMod-Setup (1).exe (PID: 204)
      • WeMod-Setup-638750833713816336.exe (PID: 4932)
      • Update.exe (PID: 2132)
      • WeMod.exe (PID: 1760)
      • Update.exe (PID: 4468)
      • squirrel.exe (PID: 5040)
      • Update.exe (PID: 3816)
      • WeMod.exe (PID: 6952)
      • WeMod.exe (PID: 4188)
      • WeMod.exe (PID: 6808)
      • WeMod.exe (PID: 2292)
      • Update.exe (PID: 6368)
      • WeModAuxiliaryService.exe (PID: 4976)
      • WeMod.exe (PID: 2432)

    • Checks proxy server information

      • WeMod-Setup (1).exe (PID: 204)
      • Update.exe (PID: 2132)
      • WeMod.exe (PID: 4188)
      • WeModAuxiliaryService.exe (PID: 4976)
      • Update.exe (PID: 6368)

    • Create files in a temporary directory

      • WeMod-Setup (1).exe (PID: 204)
      • Update.exe (PID: 2132)
      • WeMod.exe (PID: 4188)
      • Update.exe (PID: 6368)

    • Creates files or folders in the user directory

      • Update.exe (PID: 2132)
      • WeMod-Setup (1).exe (PID: 204)
      • WeMod-Setup-638750833713816336.exe (PID: 4932)
      • Update.exe (PID: 4468)
      • squirrel.exe (PID: 5040)
      • Update.exe (PID: 3816)
      • WeMod.exe (PID: 4188)
      • Update.exe (PID: 6368)
      • WeMod.exe (PID: 6952)
      • WeModAuxiliaryService.exe (PID: 4976)
      • WeMod.exe (PID: 2432)

    • Reads the computer name

      • WeMod-Setup (1).exe (PID: 204)
      • Update.exe (PID: 2132)
      • squirrel.exe (PID: 5040)
      • Update.exe (PID: 4468)
      • WeMod.exe (PID: 4188)
      • Update.exe (PID: 3816)
      • WeMod.exe (PID: 6952)
      • WeMod.exe (PID: 6808)
      • Update.exe (PID: 6368)
      • WeModAuxiliaryService.exe (PID: 4976)
      • WeMod.exe (PID: 2432)

    • Reads Environment values

      • WeMod-Setup (1).exe (PID: 204)
      • WeMod.exe (PID: 1760)
      • Update.exe (PID: 2132)
      • WeMod.exe (PID: 4188)
      • Update.exe (PID: 6368)
      • WeMod.exe (PID: 2292)

    • Reads the machine GUID from the registry

      • WeMod-Setup (1).exe (PID: 204)
      • squirrel.exe (PID: 5040)
      • Update.exe (PID: 2132)
      • Update.exe (PID: 4468)
      • Update.exe (PID: 3816)
      • WeMod.exe (PID: 4188)
      • WeModAuxiliaryService.exe (PID: 4976)
      • Update.exe (PID: 6368)
      • WeMod.exe (PID: 2432)

    • The sample compiled with english language support

      • Update.exe (PID: 2132)

    • Reads the software policy settings

      • WeMod-Setup (1).exe (PID: 204)
      • Update.exe (PID: 6368)
      • WeModAuxiliaryService.exe (PID: 4976)
      • Update.exe (PID: 2132)

    • Disables trace logs

      • WeMod-Setup (1).exe (PID: 204)
      • Update.exe (PID: 2132)
      • Update.exe (PID: 6368)

    • Reads product name

      • WeMod.exe (PID: 1760)
      • WeMod.exe (PID: 4188)
      • WeMod.exe (PID: 2292)

    • Process checks computer location settings

      • Update.exe (PID: 2132)
      • WeMod-Setup (1).exe (PID: 204)
      • Update.exe (PID: 3816)
      • WeMod.exe (PID: 2292)
      • WeMod.exe (PID: 4188)

    • Reads CPU info

      • WeMod.exe (PID: 4188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2076:12:06 19:29:50+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 105984
InitializedDataSize: 28160
UninitializedDataSize: -
EntryPoint: 0x1bcfe
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 8.0.0.0
ProductVersionNumber: 8.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: WeMod Setup
CompanyName: WeMod LLC
FileDescription: WeMod Setup
FileVersion: 8.0.0.0
InternalName: WeMod-Setup.exe
LegalCopyright: Copyright © WeMod LLC 2022
LegalTrademarks: -
OriginalFileName: WeMod-Setup.exe
ProductName: WeMod
ProductVersion: 8.0.0.0
AssemblyVersion: 8.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
14
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wemod-setup (1).exe wemod-setup-638750833713816336.exe update.exe squirrel.exe no specs wemod.exe no specs update.exe no specs update.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe wemod.exe update.exe wemodauxiliaryservice.exe wemod.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
204"C:\Users\admin\AppData\Local\Temp\WeMod-Setup (1).exe" C:\Users\admin\AppData\Local\Temp\WeMod-Setup (1).exe
explorer.exe
User:
admin
Company:
WeMod LLC
Integrity Level:
MEDIUM
Description:
WeMod Setup
Exit code:
0
Version:
8.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\wemod-setup (1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1760"C:\Users\admin\AppData\Local\WeMod\app-10.2.0\WeMod.exe" --squirrel-install 10.2.0C:\Users\admin\AppData\Local\WeMod\app-10.2.0\WeMod.exe—Update.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - The Ultimate Game Companion
Exit code:
0
Version:
10.2.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-10.2.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\combase.dll
2132"C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . --silentC:\Users\admin\AppData\Local\SquirrelTemp\Update.exe
WeMod-Setup-638750833713816336.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
2.0.1.53
Modules
Images
c:\users\admin\appdata\local\squirreltemp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2292"C:\Users\admin\AppData\Local\WeMod\app-10.2.0\WeMod.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\admin\AppData\Local\WeMod\app-10.2.0\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2616,i,4588639511475717643,8444681885095034338,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:1C:\Users\admin\AppData\Local\WeMod\app-10.2.0\WeMod.exe
WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - The Ultimate Game Companion
Version:
10.2.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-10.2.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\users\admin\appdata\local\wemod\app-10.2.0\ffmpeg.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2432"C:\Users\admin\AppData\Local\WeMod\app-10.2.0\WeMod.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4176,i,4588639511475717643,8444681885095034338,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8C:\Users\admin\AppData\Local\WeMod\app-10.2.0\WeMod.exe—WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - The Ultimate Game Companion
Exit code:
0
Version:
10.2.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-10.2.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\wemod\app-10.2.0\ffmpeg.dll
c:\windows\system32\combase.dll
3816"C:\Users\admin\AppData\Local\WeMod\Update.exe" --processStart "WeMod.exe" --process-start-args "wemod://?_inst=OrBnIN9GNWbcrkDv"C:\Users\admin\AppData\Local\WeMod\Update.exe—WeMod-Setup (1).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\wemod\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4188"C:\Users\admin\AppData\Local\WeMod\app-10.2.0\WeMod.exe" wemod://?_inst=OrBnIN9GNWbcrkDvC:\Users\admin\AppData\Local\WeMod\app-10.2.0\WeMod.exe—Update.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - The Ultimate Game Companion
Version:
10.2.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-10.2.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\users\admin\appdata\local\wemod\app-10.2.0\ffmpeg.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\dbghelp.dll
4468C:\Users\admin\AppData\Local\WeMod\Update.exe --createShortcut WeMod.exeC:\Users\admin\AppData\Local\WeMod\Update.exe—WeMod.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
2.0.1.53
Modules
Images
c:\users\admin\appdata\local\wemod\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4932"C:\Users\admin\AppData\Local\Temp\WeMod-Setup-638750833713816336.exe" --silentC:\Users\admin\AppData\Local\Temp\WeMod-Setup-638750833713816336.exe
WeMod-Setup (1).exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - The Ultimate Gaming Companion
Exit code:
0
Version:
10.2.0
Modules
Images
c:\users\admin\appdata\local\temp\wemod-setup-638750833713816336.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4976C:\Users\admin\AppData\Local\WeMod\app-10.2.0\resources\app.asar.unpacked\static\unpacked\auxiliary\WeModAuxiliaryService.exe WeMod\Support_1739486628970_OutC:\Users\admin\AppData\Local\WeMod\app-10.2.0\resources\app.asar.unpacked\static\unpacked\auxiliary\WeModAuxiliaryService.exe
WeMod.exe
User:
admin
Company:
WeMod LLC
Integrity Level:
MEDIUM
Description:
WeMod
Version:
7.2.0.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-10.2.0\resources\app.asar.unpacked\static\unpacked\auxiliary\wemodauxiliaryservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
25 749
Read events
25 682
Write events
47
Delete events
20

Modification events

(PID) Process:(204) WeMod-Setup (1).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(204) WeMod-Setup (1).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(204) WeMod-Setup (1).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(204) WeMod-Setup (1).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com
Operation:writeName:NumberOfSubdomains
Value:
1
(PID) Process:(204) WeMod-Setup (1).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com
Operation:writeName:Total
Value:
35
(PID) Process:(204) WeMod-Setup (1).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WeMod-Setup (1)_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(204) WeMod-Setup (1).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WeMod-Setup (1)_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(204) WeMod-Setup (1).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WeMod-Setup (1)_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(204) WeMod-Setup (1).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WeMod-Setup (1)_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(204) WeMod-Setup (1).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WeMod-Setup (1)_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
Executable files
26
Suspicious files
165
Text files
41
Unknown types
1

Dropped files

PID
Process
Filename
Type
204WeMod-Setup (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:783EB0467F13F5F76BE54BCC60CAA26C
SHA256:15F6C39A493B4C320D16994C9121B6BB73589910CA436255D8D8D6D4B25CAA43
204WeMod-Setup (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:C9BE626E9715952E9B70F92F912B9787
SHA256:C13E8D22800C200915F87F71C31185053E4E60CA25DE2E41E160E09CD2D815D4
204WeMod-Setup (1).exeC:\Users\admin\AppData\Local\Temp\WeMod-Setup-638750833713816336.exe —
MD5:—
SHA256:—
204WeMod-Setup (1).exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\setup[1].htmhtml
MD5:9CBAD2402AEACCEE1D9F812B4B2D8CAA
SHA256:EF84CF7D0563287482BB8D994002D09C6AD1B83B03A73D9ADE52C334DA9E955C
204WeMod-Setup (1).exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\Inter-Regular-14d1275c67[1].woffbinary
MD5:14D1275C67676CC5D911232D0C890D97
SHA256:3710E2CE073EC0EB39274DECC63768B52091A27E35F5C28D6ABB7A5FCEF0B7FC
204WeMod-Setup (1).exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\Inter-Bold-45e58f4054[1].woffbinary
MD5:45E58F4054A3AD886E4582E1D43056FE
SHA256:57027B1C72507C75CF9FC21DCBBBD4366F01901B598764CB8703DFA4988A60CA
204WeMod-Setup (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:971C514F84BBA0785F80AA1C23EDFD79
SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895
4932WeMod-Setup-638750833713816336.exeC:\Users\admin\AppData\Local\SquirrelTemp\WeMod-10.2.0-full.nupkg —
MD5:—
SHA256:—
204WeMod-Setup (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220binary
MD5:A87E35D286CA1E4C5269ACD8257C7215
SHA256:9FD5C40E58BE2FB166134B70610F68AA3CD8BBC6BB21672A992703358EBC2BEE
2132Update.exeC:\Users\admin\AppData\Local\WeMod\packages\WeMod-10.2.0-full.nupkg —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
70
DNS requests
65
Threats
59

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
1.01 Kb
whitelisted
204
WeMod-Setup (1).exe
GET
200
216.58.206.35:80
http://c.pki.goog/r/gsr1.crl
US
binary
1.70 Kb
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
204
WeMod-Setup (1).exe
GET
200
216.58.206.35:80
http://c.pki.goog/r/r4.crl
US
binary
436 b
whitelisted
204
WeMod-Setup (1).exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR64T7ooMQqLLQoy%2BemBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEGO2IkqWfxOGk0NWE9vukyQ%3D
unknown
binary
471 b
whitelisted
1176
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
4976
WeModAuxiliaryService.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
DE
binary
727 b
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
408 b
whitelisted
4976
WeModAuxiliaryService.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
DE
binary
471 b
whitelisted
4976
WeModAuxiliaryService.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEA2LpfdFcSPbdVFa0X9jdfU%3D
DE
binary
727 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
204
WeMod-Setup (1).exe
104.22.42.75:443
api.wemod.com
CLOUDFLARENET
—
whitelisted
204
WeMod-Setup (1).exe
216.58.206.35:80
c.pki.goog
GOOGLE
US
whitelisted
204
WeMod-Setup (1).exe
142.250.185.142:443
www.google-analytics.com
GOOGLE
US
whitelisted
204
WeMod-Setup (1).exe
35.164.212.149:443
api2.amplitude.com
AMAZON-02
US
whitelisted
204
WeMod-Setup (1).exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
whitelisted
5064
SearchApp.exe
104.126.37.163:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.238
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
api.wemod.com
  • 104.22.42.75
  • 172.67.25.118
  • 104.22.43.75
whitelisted
c.pki.goog
  • 216.58.206.35
whitelisted
www.google-analytics.com
  • 142.250.185.142
whitelisted
api2.amplitude.com
  • 35.164.212.149
  • 54.190.114.184
  • 44.227.44.154
  • 54.68.195.168
  • 44.226.239.193
  • 52.89.158.242
  • 52.33.174.135
  • 52.12.72.217
  • 44.235.233.102
  • 52.27.43.83
  • 34.215.235.85
  • 44.225.2.56
  • 52.27.218.10
  • 35.164.226.114
  • 54.201.119.148
  • 52.27.79.73
  • 35.83.22.47
  • 54.191.140.91
  • 54.218.21.165
  • 52.35.35.25
  • 52.26.117.235
  • 34.215.246.73
whitelisted
o.pki.goog
  • 216.58.206.35
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted

Threats

PID
Process
Class
Message
6952
WeMod.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
6952
WeMod.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
6952
WeMod.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
6952
WeMod.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
6952
WeMod.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
6952
WeMod.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
6952
WeMod.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
6952
WeMod.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
6952
WeMod.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
6952
WeMod.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WeMod-Setup (1).exe