File name:

One-armed robber (Steam) Trainer Setup.exe

Full analysis: https://app.any.run/tasks/efd9124e-2532-4a0d-89cf-fc64489dd4fe
Verdict: Malicious activity
Analysis date: December 25, 2023, 22:42:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

4562236A3E10B3C90DA1525D355AB15D

SHA1:

4E6185B6E10C8A8040302DDA7EC9E680B2A7C621

SHA256:

BC5EDC1E5FB3FB9AA0A6550C31E834AA9103BDBB1676B1B61B28EFB685760153

SSDEEP:

1536:mBll12iut9nk7RBog5KG6JkOiVPL+09ME5LBtJD64uQgCANR9HEdOyJkNRBog5KZ:Q12ioE57miVj+J6pHdokdOp57N/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • One-armed robber (Steam) Trainer Setup.exe (PID: 120)

    • Checks Windows Trust Settings

      • One-armed robber (Steam) Trainer Setup.exe (PID: 120)

    • Reads settings of System Certificates

      • One-armed robber (Steam) Trainer Setup.exe (PID: 120)

    • Reads Microsoft Outlook installation path

      • One-armed robber (Steam) Trainer Setup.exe (PID: 120)

    • Reads security settings of Internet Explorer

      • One-armed robber (Steam) Trainer Setup.exe (PID: 120)

    • Reads Internet Explorer settings

      • One-armed robber (Steam) Trainer Setup.exe (PID: 120)

  • INFO

    • Drops the executable file immediately after the start

      • One-armed robber (Steam) Trainer Setup.exe (PID: 120)

    • Checks supported languages

      • One-armed robber (Steam) Trainer Setup.exe (PID: 120)

    • Reads the machine GUID from the registry

      • One-armed robber (Steam) Trainer Setup.exe (PID: 120)

    • Checks proxy server information

      • One-armed robber (Steam) Trainer Setup.exe (PID: 120)

    • Creates files or folders in the user directory

      • One-armed robber (Steam) Trainer Setup.exe (PID: 120)

    • Reads Environment values

      • One-armed robber (Steam) Trainer Setup.exe (PID: 120)

    • Create files in a temporary directory

      • One-armed robber (Steam) Trainer Setup.exe (PID: 120)

    • Reads the computer name

      • One-armed robber (Steam) Trainer Setup.exe (PID: 120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2059:09:10 16:56:13+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 105472
InitializedDataSize: 28160
UninitializedDataSize: -
EntryPoint: 0x1ba0e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 8.0.0.0
ProductVersionNumber: 8.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: WeMod Setup
CompanyName: WeMod LLC
FileDescription: WeMod Setup
FileVersion: 8.0.0.0
InternalName: WeMod-Setup.exe
LegalCopyright: Copyright © WeMod LLC 2022
LegalTrademarks: -
OriginalFileName: WeMod-Setup.exe
ProductName: WeMod
ProductVersion: 8.0.0.0
AssemblyVersion: 8.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start one-armed robber (steam) trainer setup.exe

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Users\admin\AppData\Local\Temp\One-armed robber (Steam) Trainer Setup.exe" C:\Users\admin\AppData\Local\Temp\One-armed robber (Steam) Trainer Setup.exe
explorer.exe
User:
admin
Company:
WeMod LLC
Integrity Level:
MEDIUM
Description:
WeMod Setup
Exit code:
0
Version:
8.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\one-armed robber (steam) trainer setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
4 370
Read events
4 344
Write events
26
Delete events
0

Modification events

(PID) Process:(120) One-armed robber (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(120) One-armed robber (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(120) One-armed robber (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(120) One-armed robber (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(120) One-armed robber (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(120) One-armed robber (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(120) One-armed robber (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(120) One-armed robber (Steam) Trainer Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(120) One-armed robber (Steam) Trainer Setup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
0
Suspicious files
25
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
120One-armed robber (Steam) Trainer Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\Inter-ExtraLight-7d759358c1[1].woffbinary
MD5:7D759358C1372FA6ACAE4CB22F93DEFA
SHA256:07F5B5F734793F48613D8DA246F4DB2B564BFA7149F62526326BE9CB8BB94841
120One-armed robber (Steam) Trainer Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Inter-Thin-0f080c40c6[1].woffbinary
MD5:0F080C40C639962E1CAD093AA58192DC
SHA256:E9DA5A64A6A8EB87A2C6D475327F072B5CA25731DF07119F576C10C50AA9554D
120One-armed robber (Steam) Trainer Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:9ADAA6F9F8029435BAD6703447940A36
SHA256:3D775D40AB1D7F65450722B20FD3E9E8AA3D58D2D170AA6DA95B80FD0BCB21BC
120One-armed robber (Steam) Trainer Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\setup[1].htmhtml
MD5:5CB03D5570F3A52889BF9C5E09B0D97E
SHA256:6A4CB485090061F03A56F722BCDAA0F9C7FD1B0FB399FA9044C20D90CF128BC7
120One-armed robber (Steam) Trainer Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:810E05EDF7AC575636AB6E6C8EB6401D
SHA256:7043BBAB14E20628FB7AC5FE3E54C1023EF0FC580CC6AF3BB305D5CFCE449A07
120One-armed robber (Steam) Trainer Setup.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SBNY5O29\api.wemod[1].xmltext
MD5:C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA256:B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
120One-armed robber (Steam) Trainer Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\Inter-Light-0f0118feb7[1].woffbinary
MD5:0F0118FEB71664927EA7FB8015778795
SHA256:CB671D0DBC9A61EC80BFC91D5879E8635A09B7F309F5EE57810D4C6B7A26EE0C
120One-armed robber (Steam) Trainer Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Inter-SemiBold-1d5bb5c64d[1].woffbinary
MD5:1D5BB5C64DC15405BDB04145DAB7B436
SHA256:807D56B95FCC04CD1C26FCA043DDF19E300C8AE156747458BD025A2B21CF54B4
120One-armed robber (Steam) Trainer Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:E16AADCC1FF15DD971AC043B830C12AE
SHA256:BBD97955ECD332AD60B2B3A4CD5891F9AE5B2C377DAC24B077CC4F1C1C4D91F2
120One-armed robber (Steam) Trainer Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_BB0E5383BB6E3CF78C8AC8388DB6A7BFbinary
MD5:F9B9ABC7DAD25E5E66B24B87C834A276
SHA256:63718F815114B60476988D01062B3564C6C3A1836596B93C05A0383994D1BE44
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
17
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
120
One-armed robber (Steam) Trainer Setup.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
binary
1.47 Kb
unknown
120
One-armed robber (Steam) Trainer Setup.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc
US
binary
472 b
unknown
120
One-armed robber (Steam) Trainer Setup.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEGfe9D7xe9riT%2FWUBgbSwIQ%3D
US
binary
1.42 Kb
unknown
120
One-armed robber (Steam) Trainer Setup.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR64T7ooMQqLLQoy%2BemBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEQC1yHFEAZznSpAqtnZXvuqa
US
binary
472 b
unknown
120
One-armed robber (Steam) Trainer Setup.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
binary
1.41 Kb
unknown
1080
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3e412f7b4eff0943
GB
—
—
unknown
120
One-armed robber (Steam) Trainer Setup.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
binary
724 b
unknown
120
One-armed robber (Steam) Trainer Setup.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc%3D
US
binary
2.18 Kb
unknown
120
One-armed robber (Steam) Trainer Setup.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?69e75cc372bd463a
GB
compressed
4.66 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
120
One-armed robber (Steam) Trainer Setup.exe
172.67.25.118:443
api.wemod.com
CLOUDFLARENET
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
120
One-armed robber (Steam) Trainer Setup.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
120
One-armed robber (Steam) Trainer Setup.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
120
One-armed robber (Steam) Trainer Setup.exe
142.250.185.174:443
www.google-analytics.com
GOOGLE
US
whitelisted
120
One-armed robber (Steam) Trainer Setup.exe
34.213.168.224:443
api2.amplitude.com
AMAZON-02
US
unknown
120
One-armed robber (Steam) Trainer Setup.exe
172.217.18.99:80
ocsp.pki.goog
GOOGLE
US
whitelisted
120
One-armed robber (Steam) Trainer Setup.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
api.wemod.com
  • 172.67.25.118
  • 104.22.43.75
  • 104.22.42.75
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.google-analytics.com
  • 142.250.185.174
whitelisted
api2.amplitude.com
  • 34.213.168.224
  • 54.149.209.156
  • 44.230.163.60
  • 35.167.129.182
  • 35.167.19.41
  • 34.216.127.37
  • 35.160.76.86
  • 44.235.182.178
whitelisted
ocsp.pki.goog
  • 172.217.18.99
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
storage-cdn.wemod.com
  • 172.67.25.118
  • 104.22.42.75
  • 104.22.43.75
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
One-armed robber (Steam) Trainer Setup.exe