File name:

Forza Horizon 5 Trainer.exe

Full analysis: https://app.any.run/tasks/48907393-cf86-4b77-9a17-e96564751ac1
Verdict: Malicious activity
Analysis date: June 30, 2024, 17:04:52
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

D445C7C04C2C9384C6128AAD7BBCF69B

SHA1:

80EEF4167F107A40E4754D1B28DE11F0B4CF8CF9

SHA256:

C87B1E326C07962EC939DE82B61C6CE4059B6AE42BF2262080787218F666E10D

SSDEEP:

1536:mbl7ltYskm5qsCn5xJ6rrk7RBog5KG6zmgrzezHuLZIQ7F3cXBE7votPkNRBog5D:m57ltN8sCn5j57WDrze2DwM57Nvtn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Forza Horizon 5 Trainer.exe (PID: 2856)
      • WeMod-Setup-638553639091447289.exe (PID: 4180)
      • Update.exe (PID: 692)

    • Actions looks like stealing of personal data

      • WeMod.exe (PID: 5604)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Update.exe (PID: 692)
      • WeMod-Setup-638553639091447289.exe (PID: 4180)

    • Process drops legitimate windows executable

      • Update.exe (PID: 692)

    • Reads security settings of Internet Explorer

      • Update.exe (PID: 692)
      • Forza Horizon 5 Trainer.exe (PID: 2856)
      • Update.exe (PID: 4284)
      • WeModAuxiliaryService.exe (PID: 5736)

    • Reads the date of Windows installation

      • Update.exe (PID: 692)
      • Forza Horizon 5 Trainer.exe (PID: 2856)
      • Update.exe (PID: 4284)

    • Creates a software uninstall entry

      • Update.exe (PID: 692)

    • Searches for installed software

      • Update.exe (PID: 692)

    • Application launched itself

      • WeMod.exe (PID: 3836)

    • Checks Windows Trust Settings

      • WeModAuxiliaryService.exe (PID: 5736)

  • INFO

    • Reads the machine GUID from the registry

      • Forza Horizon 5 Trainer.exe (PID: 2856)
      • squirrel.exe (PID: 3640)
      • Update.exe (PID: 5952)
      • Update.exe (PID: 4284)
      • WeMod.exe (PID: 3836)
      • Update.exe (PID: 3688)
      • WeModAuxiliaryService.exe (PID: 5736)
      • WeMod.exe (PID: 240)
      • Update.exe (PID: 692)

    • Checks supported languages

      • Forza Horizon 5 Trainer.exe (PID: 2856)
      • WeMod-Setup-638553639091447289.exe (PID: 4180)
      • squirrel.exe (PID: 3640)
      • Update.exe (PID: 692)
      • Update.exe (PID: 5952)
      • WeMod.exe (PID: 2968)
      • WeMod.exe (PID: 3836)
      • WeMod.exe (PID: 1776)
      • WeMod.exe (PID: 4044)
      • Update.exe (PID: 4284)
      • WeMod.exe (PID: 5604)
      • Update.exe (PID: 3688)
      • WeModAuxiliaryService.exe (PID: 5736)
      • TextInputHost.exe (PID: 3992)
      • WeMod.exe (PID: 240)

    • Reads the computer name

      • Forza Horizon 5 Trainer.exe (PID: 2856)
      • squirrel.exe (PID: 3640)
      • Update.exe (PID: 692)
      • Update.exe (PID: 5952)
      • WeMod.exe (PID: 3836)
      • WeMod.exe (PID: 1776)
      • Update.exe (PID: 4284)
      • Update.exe (PID: 3688)
      • WeModAuxiliaryService.exe (PID: 5736)
      • WeMod.exe (PID: 4044)
      • TextInputHost.exe (PID: 3992)
      • WeMod.exe (PID: 240)

    • Reads Environment values

      • Forza Horizon 5 Trainer.exe (PID: 2856)
      • Update.exe (PID: 692)
      • WeMod.exe (PID: 2968)
      • WeMod.exe (PID: 3836)
      • WeMod.exe (PID: 5604)
      • Update.exe (PID: 3688)

    • Disables trace logs

      • Forza Horizon 5 Trainer.exe (PID: 2856)
      • Update.exe (PID: 692)
      • Update.exe (PID: 3688)

    • Checks proxy server information

      • Forza Horizon 5 Trainer.exe (PID: 2856)
      • Update.exe (PID: 692)
      • WeMod.exe (PID: 3836)
      • WeModAuxiliaryService.exe (PID: 5736)
      • Update.exe (PID: 3688)

    • Create files in a temporary directory

      • Forza Horizon 5 Trainer.exe (PID: 2856)
      • Update.exe (PID: 692)
      • WeMod.exe (PID: 3836)
      • Update.exe (PID: 3688)

    • Reads the software policy settings

      • Forza Horizon 5 Trainer.exe (PID: 2856)
      • Update.exe (PID: 692)
      • WeModAuxiliaryService.exe (PID: 5736)
      • Update.exe (PID: 3688)

    • Process checks computer location settings

      • Update.exe (PID: 692)
      • Forza Horizon 5 Trainer.exe (PID: 2856)
      • Update.exe (PID: 4284)
      • WeMod.exe (PID: 3836)
      • WeMod.exe (PID: 5604)

    • Creates files or folders in the user directory

      • squirrel.exe (PID: 3640)
      • Update.exe (PID: 692)
      • Update.exe (PID: 5952)
      • Update.exe (PID: 4284)
      • WeMod.exe (PID: 3836)
      • WeMod.exe (PID: 4044)
      • Update.exe (PID: 3688)
      • WeModAuxiliaryService.exe (PID: 5736)
      • WeMod.exe (PID: 240)
      • WeMod-Setup-638553639091447289.exe (PID: 4180)

    • Reads product name

      • WeMod.exe (PID: 2968)
      • WeMod.exe (PID: 3836)
      • WeMod.exe (PID: 5604)

    • Reads CPU info

      • WeMod.exe (PID: 3836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2042:10:10 23:35:31+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 96256
InitializedDataSize: 28160
UninitializedDataSize: -
EntryPoint: 0x197de
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 7.0.0.0
ProductVersionNumber: 7.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: WeMod Setup
CompanyName: WeMod LLC
FileDescription: WeMod Setup
FileVersion: 7.0.0.0
InternalName: WeMod-Setup.exe
LegalCopyright: Copyright © WeMod LLC 2021
LegalTrademarks: -
OriginalFileName: WeMod-Setup.exe
ProductName: WeMod
ProductVersion: 7.0.0.0
AssemblyVersion: 7.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
15
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start forza horizon 5 trainer.exe wemod-setup-638553639091447289.exe update.exe squirrel.exe no specs wemod.exe no specs update.exe no specs update.exe no specs wemod.exe no specs wemod.exe no specs wemod.exe wemod.exe update.exe wemodauxiliaryservice.exe textinputhost.exe no specs wemod.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Users\admin\AppData\Local\WeMod\app-9.5.0\WeMod.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4220,i,14485584753212244620,13817396915086266700,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8C:\Users\admin\AppData\Local\WeMod\app-9.5.0\WeMod.exe—WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Cheats and Mods
Exit code:
0
Version:
9.5.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-9.5.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\wemod\app-9.5.0\ffmpeg.dll
c:\windows\system32\combase.dll
692"C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . --silentC:\Users\admin\AppData\Local\SquirrelTemp\Update.exe
WeMod-Setup-638553639091447289.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
2.0.1.53
Modules
Images
c:\users\admin\appdata\local\squirreltemp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1776"C:\Users\admin\AppData\Local\WeMod\app-9.5.0\WeMod.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1704,i,14485584753212244620,13817396915086266700,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2C:\Users\admin\AppData\Local\WeMod\app-9.5.0\WeMod.exe—WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
LOW
Description:
WeMod - Cheats and Mods
Version:
9.5.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-9.5.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2856"C:\Users\admin\Desktop\Forza Horizon 5 Trainer.exe" C:\Users\admin\Desktop\Forza Horizon 5 Trainer.exe
explorer.exe
User:
admin
Company:
WeMod LLC
Integrity Level:
MEDIUM
Description:
WeMod Setup
Exit code:
0
Version:
7.0.0.0
Modules
Images
c:\users\admin\desktop\forza horizon 5 trainer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2968"C:\Users\admin\AppData\Local\WeMod\app-9.5.0\WeMod.exe" --squirrel-install 9.5.0C:\Users\admin\AppData\Local\WeMod\app-9.5.0\WeMod.exe—Update.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Cheats and Mods
Exit code:
0
Version:
9.5.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-9.5.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3640"C:\Users\admin\AppData\Local\WeMod\app-9.5.0\Squirrel.exe" --updateSelf=C:\Users\admin\AppData\Local\SquirrelTemp\Update.exeC:\Users\admin\AppData\Local\WeMod\app-9.5.0\squirrel.exe—Update.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\wemod\app-9.5.0\squirrel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3688C:\Users\admin\AppData\Local\WeMod\Update.exe --checkForUpdate https://api.wemod.com/client/channels/stable?osVersion=10.0.19045C:\Users\admin\AppData\Local\WeMod\Update.exe
WeMod.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\wemod\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3836"C:\Users\admin\AppData\Local\WeMod\app-9.5.0\WeMod.exe" wemod://titles/50864?gameId=54527&_inst=zOoUbIFh2MC4gH9CC:\Users\admin\AppData\Local\WeMod\app-9.5.0\WeMod.exe—Update.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Cheats and Mods
Version:
9.5.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-9.5.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\users\admin\appdata\local\wemod\app-9.5.0\ffmpeg.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3992"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
4044"C:\Users\admin\AppData\Local\WeMod\app-9.5.0\WeMod.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-ui-direction=ltr --user-data-dir="C:\Users\admin\AppData\Roaming\WeMod" --field-trial-handle=2128,i,14485584753212244620,13817396915086266700,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:3C:\Users\admin\AppData\Local\WeMod\app-9.5.0\WeMod.exe
WeMod.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Cheats and Mods
Version:
9.5.0
Modules
Images
c:\users\admin\appdata\local\wemod\app-9.5.0\wemod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
56 096
Read events
56 012
Write events
66
Delete events
18

Modification events

(PID) Process:(2856) Forza Horizon 5 Trainer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 5 Trainer_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2856) Forza Horizon 5 Trainer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 5 Trainer_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2856) Forza Horizon 5 Trainer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 5 Trainer_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2856) Forza Horizon 5 Trainer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 5 Trainer_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2856) Forza Horizon 5 Trainer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 5 Trainer_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2856) Forza Horizon 5 Trainer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 5 Trainer_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2856) Forza Horizon 5 Trainer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 5 Trainer_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2856) Forza Horizon 5 Trainer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 5 Trainer_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2856) Forza Horizon 5 Trainer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 5 Trainer_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2856) Forza Horizon 5 Trainer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Forza Horizon 5 Trainer_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
23
Suspicious files
124
Text files
45
Unknown types
12

Dropped files

PID
Process
Filename
Type
2856Forza Horizon 5 Trainer.exeC:\Users\admin\AppData\Local\Temp\WeMod-Setup-638553639091447289.exe —
MD5:—
SHA256:—
4180WeMod-Setup-638553639091447289.exeC:\Users\admin\AppData\Local\SquirrelTemp\WeMod-9.5.0-full.nupkg —
MD5:—
SHA256:—
692Update.exeC:\Users\admin\AppData\Local\WeMod\packages\WeMod-9.5.0-full.nupkg —
MD5:—
SHA256:—
692Update.exeC:\Users\admin\AppData\Local\WeMod\app-9.5.0\icudtl.dat —
MD5:—
SHA256:—
692Update.exeC:\Users\admin\AppData\Local\WeMod\Update.exeexecutable
MD5:2ACD6BA2ADAC7357F019C6A4AD2A64DE
SHA256:847BCC8CB5D566BC393AF8297A914AF7B5ED8AF08A1B426E1AD76560FDED263D
692Update.exeC:\Users\admin\AppData\Local\WeMod\app-9.5.0\locales\af.pakbinary
MD5:94AF96B7F60A4CFB9D596CD8927BA37D
SHA256:716E296C2F663AD90CDDE85C5134582FC2305E5EBE10649FC9653BEA533500A6
4180WeMod-Setup-638553639091447289.exeC:\Users\admin\AppData\Local\SquirrelTemp\Update.exeexecutable
MD5:2ACD6BA2ADAC7357F019C6A4AD2A64DE
SHA256:847BCC8CB5D566BC393AF8297A914AF7B5ED8AF08A1B426E1AD76560FDED263D
692Update.exeC:\Users\admin\AppData\Local\WeMod\app-9.5.0\chrome_100_percent.pakbinary
MD5:6C2827FE702F454C8452A72EA0FAF53C
SHA256:2FB9826A1B43C84C08F26C4B4556C6520F8F5EEF8AB1C83011031EB2D83D6663
4180WeMod-Setup-638553639091447289.exeC:\Users\admin\AppData\Local\SquirrelTemp\setupIcon.icoimage
MD5:E2FC5F7C4E479982F270A6D9DAEAA7B9
SHA256:9BE0F7268DB367235D785653B7DA1CEC8374BEE92C42732299F7193F430EDB1C
692Update.exeC:\Users\admin\AppData\Local\WeMod\app-9.5.0\ffmpeg.dllexecutable
MD5:8E0AA0F25EA333F83CB7E4D641357DEF
SHA256:FBA8C568EE69C7ACF7BE0E725187210E29F876D49DBA673C7AF9FD4A70C89115
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
107
DNS requests
53
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2568
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
2568
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
2968
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
2968
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
3848
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
5736
WeModAuxiliaryService.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
unknown
3652
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4656
SearchApp.exe
104.126.37.171:443
—
Akamai International B.V.
DE
unknown
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2336
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2568
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3172
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2568
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
2568
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
3040
OfficeClickToRun.exe
40.79.167.8:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
AU
unknown
2856
Forza Horizon 5 Trainer.exe
104.22.42.75:443
api.wemod.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
self.events.data.microsoft.com
  • 40.79.167.8
whitelisted
api.wemod.com
  • 104.22.42.75
  • 104.22.43.75
  • 172.67.25.118
unknown
storage-cdn.wemod.com
  • 104.22.42.75
  • 172.67.25.118
  • 104.22.43.75
unknown
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r.bing.com
  • 2.23.209.176
  • 2.23.209.160
  • 2.23.209.150
  • 2.23.209.135
  • 2.23.209.158
  • 2.23.209.140
  • 2.23.209.141
  • 2.23.209.161
  • 2.23.209.177
  • 2.23.209.187
  • 2.23.209.181
  • 2.23.209.133
  • 2.23.209.179
  • 2.23.209.185
  • 2.23.209.189
whitelisted
login.live.com
  • 20.190.160.22
  • 40.126.32.76
  • 40.126.32.138
  • 40.126.32.134
  • 40.126.32.133
  • 40.126.32.68
  • 20.190.160.17
  • 40.126.32.74
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Forza Horizon 5 Trainer.exe