Safe
Legitimate Houdini license server binary from Side Effects Software with only a single low-trust detection.
2cd2b98b9f8b0e1ab1…c769850a0cThe verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The engine distribution is textbook low-trust-only false-positive shape. Prevalence data and the Side Effects signer strongly indicate the file is the official sesinetd license server shipped with Houdini. Sandbox and child-file results are clean. The two triggered heuristics (DirectIpC2 and yaraify) are outweighed by the aggregate benign signals.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines.onlyLowTrustFlagging=true with 1/71 malicious (Trapmine)
prevalence.classification=common_old (1000 submitters)
signing.signer=Side Effects Software Inc.
triggeredHeuristics[0].rule=MalwareTips.Synth.DirectIpC2
externalIntel.yaraify.ruleCount=14
- 17 tier-1 engines clean
- common_old prevalence (1000 sources)
- signed by Side Effects Software Inc.
- no malicious children or sandbox verdicts
- Direct IP connections without DNS (heuristic)
Treat as safe; the single low-trust flag is a false positive on this widely distributed Houdini component.
BLOWFISH Constants corroborated by 1 source
- 14 YARA rulesBLOWFISH_Constants, Check_OutputDebugStringA_iat, DebuggerCheck__API
1 contradiction resolved by the scoring engine
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 204.79.197.203
- 20.99.186.246
- 192.229.211.108
- 23.216.147.67
- 20.99.133.109
- 20.99.185.48
- 23.216.147.76
- 23.216.147.64
- 20.99.184.37
- 23.6.103.183
- C:\Users\<USER>\Documents\houdini20.0\houdini.env
- C:\Users\user\AppData\Local\Temp\houdini_temp
- C:\Users\user\Documents\houdini20.0
- C:\Users\user\Documents\houdini20.0\houdini.env
- \Device\ConDrv
- C:\Windows\System32\spp\store\2.0\cache\cache.dat
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FD5.tmp.WERInternalMetadata.xml
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FE6.tmp.csv
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FE7.tmp.txt
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER13C1.tmp.WERInternalMetadata.xml
- DBWinMutex
- \Sessions\1\BaseNamedObjects\DBWinMutex
Files this sample writes at runtime
This file drops 4 children at runtime. None are currently flagged malicious in our cache.
- 3fdf522ee115295ca9d4…844f9dNever scannednever seen before
- c6456e12e5e53287a547…3d144dNever scannednever seen before
- 570ae52615fb6f41a690…a925aaNever scannednever seen before
- b420f67419ac45b50918…41c230Never scannednever seen before
1 corroborating signal from researcher-curated sources
- BLOWFISH_Constantsby phoul (@phoul)Look for Blowfish constants
- Check_OutputDebugStringA_iat
- DebuggerCheck__API
- DebuggerException__SetConsoleCtrl
- MD5_Constantsby phoul (@phoul)Look for MD5 constants
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
- BLOWFISH_Constants
- Check_OutputDebugStringA_iat
- DebuggerCheck__API
- DebuggerException__SetConsoleCtrl
- MD5_Constants
Sample contacted 17 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence204.79.197.203 · 20.99.186.246 · 192.229.211.108
1 detection across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Forensic fingerprint
- File name
- sesinetd.exe
- Size
- 12.10 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- 2cd2b98b9f8b0e1ab1d554e28671b080d214412388ce10092e3a2dc769850a0c
- MD5
- 3a73e0a6186a323af03bcbdc75e3c30d
- SHA-1
- 0de541955d9cdee859f9f207154dfb288a400c88
- PE imphash
- 8602fc263836e71ccfea4afb98d6c01a
- First seen (VT)
- 12/7/2023, 6:49:34 AM
- Last analysis (VT)
- 5/13/2026, 12:29:35 AM
- First scan (MalwareTips)
- 6/4/2026, 9:18:00 AM
- Last scan (MalwareTips)
- 6/4/2026, 9:18:00 AM
- Code signer
- Side Effects Software Inc.invalid
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.