File name:

WeMod-Setup.exe

Full analysis: https://app.any.run/tasks/493a8b86-20c0-4a66-8b1b-c61e9b2e7003
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: August 08, 2024, 10:03:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
crypto-regex
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

D546816442DF146BA228DE1A69E634D8

SHA1:

82F22C5949D7A08F6D10AA88DBF32105BE0B0AC5

SHA256:

ADC3B2660D09F1A2DC331EF8AFE71DBF8BE5BAD39251E9064D44E004492E4F36

SSDEEP:

1536:Q668Dtf9nk7RBog5KG6JkOiVPL+09ME5LBtJD64uQgCYO6+YFyHA7OqCkNRBog5m:w8DvE57miVj+J6pHdHg7OA57N/u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WeMod-Setup.exe (PID: 6404)
      • WeMod-Setup-638587082393042375.exe (PID: 3864)
      • Update.exe (PID: 5656)

    • Scans artifacts that could help determine the target

      • WeMod-Setup.exe (PID: 6404)

    • Actions looks like stealing of personal data

      • WeMod.exe (PID: 5464)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WeMod-Setup.exe (PID: 6404)
      • Update.exe (PID: 5656)
      • Update.exe (PID: 6900)
      • WeModAuxiliaryService.exe (PID: 6372)

    • Reads Microsoft Outlook installation path

      • WeMod-Setup.exe (PID: 6404)

    • Checks Windows Trust Settings

      • WeMod-Setup.exe (PID: 6404)
      • WeModAuxiliaryService.exe (PID: 6372)

    • Reads Internet Explorer settings

      • WeMod-Setup.exe (PID: 6404)

    • Executable content was dropped or overwritten

      • WeMod-Setup-638587082393042375.exe (PID: 3864)
      • Update.exe (PID: 5656)

    • Process drops legitimate windows executable

      • Update.exe (PID: 5656)

    • Reads the date of Windows installation

      • Update.exe (PID: 5656)
      • WeMod-Setup.exe (PID: 6404)
      • Update.exe (PID: 6900)

    • Searches for installed software

      • Update.exe (PID: 5656)

    • Creates a software uninstall entry

      • Update.exe (PID: 5656)

    • Application launched itself

      • WeMod.exe (PID: 640)

    • Found regular expressions for crypto-addresses (YARA)

      • WeMod.exe (PID: 5464)

  • INFO

    • Reads the computer name

      • WeMod-Setup.exe (PID: 6404)
      • Update.exe (PID: 5656)
      • squirrel.exe (PID: 4692)
      • Update.exe (PID: 6900)
      • Update.exe (PID: 2992)
      • WeMod.exe (PID: 640)
      • WeMod.exe (PID: 6480)
      • WeMod.exe (PID: 2212)
      • Update.exe (PID: 6420)
      • WeModAuxiliaryService.exe (PID: 6372)
      • TextInputHost.exe (PID: 5880)

    • Reads the machine GUID from the registry

      • WeMod-Setup.exe (PID: 6404)
      • Update.exe (PID: 5656)
      • squirrel.exe (PID: 4692)
      • Update.exe (PID: 2992)
      • Update.exe (PID: 6900)
      • WeMod.exe (PID: 640)
      • Update.exe (PID: 6420)
      • WeModAuxiliaryService.exe (PID: 6372)

    • Checks proxy server information

      • WeMod-Setup.exe (PID: 6404)
      • Update.exe (PID: 5656)
      • WeMod.exe (PID: 640)
      • Update.exe (PID: 6420)
      • WeModAuxiliaryService.exe (PID: 6372)

    • Checks supported languages

      • WeMod-Setup.exe (PID: 6404)
      • WeMod-Setup-638587082393042375.exe (PID: 3864)
      • Update.exe (PID: 5656)
      • squirrel.exe (PID: 4692)
      • WeMod.exe (PID: 7024)
      • Update.exe (PID: 6900)
      • Update.exe (PID: 2992)
      • WeMod.exe (PID: 640)
      • WeMod.exe (PID: 6480)
      • WeMod.exe (PID: 2212)
      • WeMod.exe (PID: 5464)
      • WeModAuxiliaryService.exe (PID: 6372)
      • Update.exe (PID: 6420)
      • TextInputHost.exe (PID: 5880)

    • Reads the software policy settings

      • WeMod-Setup.exe (PID: 6404)
      • Update.exe (PID: 5656)
      • Update.exe (PID: 6420)
      • WeModAuxiliaryService.exe (PID: 6372)

    • Creates files or folders in the user directory

      • WeMod-Setup.exe (PID: 6404)
      • WeMod-Setup-638587082393042375.exe (PID: 3864)
      • Update.exe (PID: 5656)
      • squirrel.exe (PID: 4692)
      • Update.exe (PID: 6900)
      • Update.exe (PID: 2992)
      • WeMod.exe (PID: 640)
      • WeMod.exe (PID: 2212)
      • Update.exe (PID: 6420)
      • WeModAuxiliaryService.exe (PID: 6372)

    • Process checks Internet Explorer phishing filters

      • WeMod-Setup.exe (PID: 6404)

    • Reads Environment values

      • WeMod-Setup.exe (PID: 6404)
      • Update.exe (PID: 5656)
      • WeMod.exe (PID: 7024)
      • WeMod.exe (PID: 640)
      • Update.exe (PID: 6420)
      • WeMod.exe (PID: 5464)

    • Disables trace logs

      • WeMod-Setup.exe (PID: 6404)
      • Update.exe (PID: 5656)
      • Update.exe (PID: 6420)

    • Create files in a temporary directory

      • WeMod-Setup.exe (PID: 6404)
      • Update.exe (PID: 5656)
      • WeMod.exe (PID: 640)
      • Update.exe (PID: 6420)

    • Process checks computer location settings

      • Update.exe (PID: 5656)
      • WeMod-Setup.exe (PID: 6404)
      • Update.exe (PID: 6900)
      • WeMod.exe (PID: 640)
      • WeMod.exe (PID: 5464)

    • Reads product name

      • WeMod.exe (PID: 7024)
      • WeMod.exe (PID: 640)
      • WeMod.exe (PID: 5464)

    • Reads CPU info

      • WeMod.exe (PID: 640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2076:12:06 19:29:50+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 105984
InitializedDataSize: 28160
UninitializedDataSize: -
EntryPoint: 0x1bcfe
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 8.0.0.0
ProductVersionNumber: 8.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: WeMod Setup
CompanyName: WeMod LLC
FileDescription: WeMod Setup
FileVersion: 8.0.0.0
InternalName: WeMod-Setup.exe
LegalCopyright: Copyright © WeMod LLC 2022
LegalTrademarks: -
OriginalFileName: WeMod-Setup.exe
ProductName: WeMod
ProductVersion: 8.0.0.0
AssemblyVersion: 8.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
14
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wemod-setup.exe wemod-setup-638587082393042375.exe update.exe squirrel.exe no specs wemod.exe no specs update.exe no specs update.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe THREAT wemod.exe update.exe wemodauxiliaryservice.exe textinputhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
640"C:\Users\admin\AppData\Local\WeMod\app-9.8.0\WeMod.exe" wemod://?_inst=uTjwNb3XrOR5HoMhC:\Users\admin\AppData\Local\WeMod\app-9.8.0\WeMod.exe—Update.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Cheats and Mods
Version:
9.8.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-9.8.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2212"C:\Users\admin\AppData\Local\WeMod\app-9.8.0\WeMod.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-ui-direction=ltr --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --field-trial-handle=2116,i,9119684037960465881,11115334789258396996,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:3C:\Users\admin\AppData\Local\WeMod\app-9.8.0\WeMod.exe
WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Cheats and Mods
Version:
9.8.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-9.8.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2992C:\Users\admin\AppData\Local\WeMod\Update.exe --createShortcut WeMod.exeC:\Users\admin\AppData\Local\WeMod\Update.exe—WeMod.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
2.0.1.53
Modules
Images
c:\users\admin\appdata\local\wemod\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3864"C:\Users\admin\AppData\Local\Temp\WeMod-Setup-638587082393042375.exe" --silentC:\Users\admin\AppData\Local\Temp\WeMod-Setup-638587082393042375.exe
WeMod-Setup.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Ultimate Gaming Companion
Exit code:
0
Version:
9.8.0
Modules
Images
c:\users\admin\appdata\local\temp\wemod-setup-638587082393042375.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4692"C:\Users\admin\AppData\Local\WeMod\app-9.8.0\Squirrel.exe" --updateSelf=C:\Users\admin\AppData\Local\SquirrelTemp\Update.exeC:\Users\admin\AppData\Local\WeMod\app-9.8.0\squirrel.exe—Update.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\wemod\app-9.8.0\squirrel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5464"C:\Users\admin\AppData\Local\WeMod\app-9.8.0\WeMod.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --app-user-model-id=com.squirrel.WeMod.WeMod --app-path="C:\Users\admin\AppData\Local\WeMod\app-9.8.0\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2524,i,9119684037960465881,11115334789258396996,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:1C:\Users\admin\AppData\Local\WeMod\app-9.8.0\WeMod.exe
WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Cheats and Mods
Version:
9.8.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-9.8.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5656"C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . --silentC:\Users\admin\AppData\Local\SquirrelTemp\Update.exe
WeMod-Setup-638587082393042375.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
2.0.1.53
Modules
Images
c:\users\admin\appdata\local\squirreltemp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5880"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
6372C:\Users\admin\AppData\Local\WeMod\app-9.8.0\resources\app.asar.unpacked\static\unpacked\auxiliary\WeModAuxiliaryService.exe WeMod\Support_1723111525226_OutC:\Users\admin\AppData\Local\WeMod\app-9.8.0\resources\app.asar.unpacked\static\unpacked\auxiliary\WeModAuxiliaryService.exe
WeMod.exe
User:
admin
Company:
WeMod LLC
Integrity Level:
MEDIUM
Description:
WeMod
Version:
7.2.0.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-9.8.0\resources\app.asar.unpacked\static\unpacked\auxiliary\wemodauxiliaryservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6404"C:\Users\admin\AppData\Local\Temp\WeMod-Setup.exe" C:\Users\admin\AppData\Local\Temp\WeMod-Setup.exe
explorer.exe
User:
admin
Company:
WeMod LLC
Integrity Level:
MEDIUM
Description:
WeMod Setup
Exit code:
0
Version:
8.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\wemod-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
33 442
Read events
33 353
Write events
69
Delete events
20

Modification events

(PID) Process:(6404) WeMod-Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6404) WeMod-Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6404) WeMod-Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6404) WeMod-Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6404) WeMod-Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6404) WeMod-Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6404) WeMod-Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6404) WeMod-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WeMod-Setup_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6404) WeMod-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WeMod-Setup_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6404) WeMod-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WeMod-Setup_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
23
Suspicious files
143
Text files
43
Unknown types
1

Dropped files

PID
Process
Filename
Type
6404WeMod-Setup.exeC:\Users\admin\AppData\Local\Temp\WeMod-Setup-638587082393042375.exe —
MD5:—
SHA256:—
3864WeMod-Setup-638587082393042375.exeC:\Users\admin\AppData\Local\SquirrelTemp\WeMod-9.8.0-full.nupkg —
MD5:—
SHA256:—
5656Update.exeC:\Users\admin\AppData\Local\WeMod\packages\WeMod-9.8.0-full.nupkg —
MD5:—
SHA256:—
6404WeMod-Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\Inter-Medium-5ce3e4db96[1].woffwoff
MD5:5CE3E4DB9634913232403F166B2447DE
SHA256:68D52E74E8171DDB2C94CA60A2596DC8A46407320449881FD09369DBC317624C
6404WeMod-Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:9729642C4B4651829268982D94ED88F8
SHA256:1EF5A6923CA603197C616E65EE8415B739D1656C6E3D60E07DCFA00F2813EA47
5656Update.exeC:\Users\admin\AppData\Local\WeMod\app-9.8.0\icudtl.dat —
MD5:—
SHA256:—
6404WeMod-Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\Inter-ExtraLight-7d759358c1[1].woffwoff
MD5:7D759358C1372FA6ACAE4CB22F93DEFA
SHA256:07F5B5F734793F48613D8DA246F4DB2B564BFA7149F62526326BE9CB8BB94841
6404WeMod-Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\Inter-Light-0f0118feb7[1].woffbinary
MD5:0F0118FEB71664927EA7FB8015778795
SHA256:CB671D0DBC9A61EC80BFC91D5879E8635A09B7F309F5EE57810D4C6B7A26EE0C
5656Update.exeC:\Users\admin\AppData\Local\WeMod\Update.exeexecutable
MD5:807A97BA81B43E0D8B4D4FBE21937398
SHA256:08B481219F081C6F4358DB776D4A273DB280EF29B8D50B8E81875FFDB860BAF9
6404WeMod-Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\Inter-Bold-45e58f4054[1].woffwoff
MD5:45E58F4054A3AD886E4582E1D43056FE
SHA256:57027B1C72507C75CF9FC21DCBBBD4366F01901B598764CB8703DFA4988A60CA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
70
DNS requests
47
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6404
WeMod-Setup.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3900
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6992
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7028
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6372
WeModAuxiliaryService.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
6372
WeModAuxiliaryService.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
6372
WeModAuxiliaryService.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEA2LpfdFcSPbdVFa0X9jdfU%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5240
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5600
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6404
WeMod-Setup.exe
104.22.43.75:443
api.wemod.com
CLOUDFLARENET
—
unknown
6404
WeMod-Setup.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5600
svchost.exe
40.119.249.228:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
unknown
5336
SearchApp.exe
184.86.251.20:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
api.wemod.com
  • 104.22.43.75
  • 104.22.42.75
  • 172.67.25.118
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
storage-cdn.wemod.com
  • 104.22.43.75
  • 172.67.25.118
  • 104.22.42.75
whitelisted
settings-win.data.microsoft.com
  • 40.119.249.228
  • 51.124.78.146
  • 40.127.240.158
whitelisted
www.bing.com
  • 184.86.251.20
  • 184.86.251.11
  • 184.86.251.21
  • 184.86.251.17
  • 184.86.251.13
  • 184.86.251.22
  • 184.86.251.16
  • 184.86.251.19
  • 184.86.251.14
  • 2.23.209.192
  • 2.23.209.187
  • 2.23.209.186
  • 2.23.209.180
  • 2.23.209.191
  • 2.23.209.188
  • 2.23.209.185
  • 2.23.209.182
  • 2.23.209.183
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.73
  • 20.190.159.0
  • 20.190.159.73
  • 40.126.31.71
  • 20.190.159.68
  • 20.190.159.75
  • 20.190.159.23
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
th.bing.com
  • 2.23.209.135
  • 2.23.209.131
  • 2.23.209.132
  • 2.23.209.140
  • 2.23.209.133
  • 2.23.209.142
  • 2.23.209.143
  • 2.23.209.141
  • 2.23.209.136
whitelisted
fd.api.iris.microsoft.com
  • 20.24.125.47
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WeMod-Setup.exe