Malware Analysis Report

2025-04-03 09:54

Sample ID 250207-2jwy7aspen
Target 12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe
SHA256 12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6
Tags
netwire botnet discovery persistence rat stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6

Threat Level: Known bad

The file 12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe was found to be: Known bad.

Malicious Activity Summary

netwire botnet discovery persistence rat stealer

Netwire

Netwire family

NetWire RAT payload

Boot or Logon Autostart Execution: Active Setup

Downloads MZ/PE file

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Network Configuration Discovery: Internet Connection Discovery

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-07 22:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-07 22:37

Reported

2025-02-07 23:23

Platform

win7-20241010-en

Max time kernel

117s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{377W0J1T-0EJ3-2F64-B3NB-C83LV855G7TB} C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{377W0J1T-0EJ3-2F64-B3NB-C83LV855G7TB}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Defrg = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2168 set thread context of 3032 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2804 set thread context of 1372 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2396 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2396 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2396 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2396 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2396 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2396 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2396 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2168 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2168 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2168 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2168 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2168 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2168 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2168 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2168 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2168 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2168 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2168 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2168 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 3032 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3032 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3032 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3032 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3032 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3032 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3032 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2804 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2804 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2804 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2804 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2804 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2804 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2804 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2804 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2804 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2804 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2804 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2804 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe

Processes

C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe

"C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe"

C:\Users\Admin\AppData\Roaming\Install\Host.exe

"C:\Users\Admin\AppData\Roaming\Install\Host.exe"

C:\Users\Admin\AppData\Roaming\Install\Host.exe

"C:\Users\Admin\AppData\Roaming\Install\Host.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 adidogoo.duckdns.org udp
DE 82.165.135.21:49523 adidogoo.duckdns.org tcp
DE 82.165.135.21:49523 adidogoo.duckdns.org tcp
US 8.8.8.8:53 adidogoo.duckdns.org udp
DE 82.165.135.21:49523 adidogoo.duckdns.org tcp

Files

memory/2168-18-0x0000000073FB1000-0x0000000073FB2000-memory.dmp

memory/2168-19-0x0000000073FB0000-0x000000007455B000-memory.dmp

memory/2168-20-0x0000000073FB0000-0x000000007455B000-memory.dmp

memory/2168-21-0x0000000073FB0000-0x000000007455B000-memory.dmp

memory/2168-22-0x0000000073FB0000-0x000000007455B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fmvenagxeh.xml

MD5 18fbd2e5ef9c0e2d91c5e6c05d5148cd
SHA1 7db55e7ef047a159f4803aa29f4e091d24d0ce2c
SHA256 5ea1e5ee74977b5b215d0a8a64f4b83d81a0a81ad880d9a58893c684809e11a3
SHA512 a352998bbfd3477e2242a96a10c72895c34770e87f812b37c079931f6741d6999f33c7e08b1875a0b2cf150bdb5819018450a36a0eb547626694fed61265f6a0

memory/3032-27-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3032-33-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3032-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3032-25-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3032-29-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3032-30-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3032-36-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3032-39-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2168-38-0x0000000073FB0000-0x000000007455B000-memory.dmp

memory/1372-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1372-60-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1372-58-0x0000000000400000-0x000000000041F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-07 22:37

Reported

2025-02-09 12:41

Platform

win10v2004-20250207-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{377W0J1T-0EJ3-2F64-B3NB-C83LV855G7TB} C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{377W0J1T-0EJ3-2F64-B3NB-C83LV855G7TB}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-194335498-2604837297-537231065-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-194335498-2604837297-537231065-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Defrg = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2136 set thread context of 3024 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 1636 set thread context of 4740 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4808 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 4808 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 4808 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2136 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2136 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2136 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2136 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2136 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2136 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2136 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 2136 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe
PID 3024 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3024 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3024 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 1636 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 1636 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 1636 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 1636 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 1636 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 1636 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 1636 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 1636 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe

Processes

C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe

"C:\Users\Admin\AppData\Local\Temp\12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fslpju.exe"

C:\Users\Admin\AppData\Roaming\Install\Host.exe

"C:\Users\Admin\AppData\Roaming\Install\Host.exe"

C:\Users\Admin\AppData\Roaming\Install\Host.exe

"C:\Users\Admin\AppData\Roaming\Install\Host.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjFFNzg0QTYtNUMyMS00MTMwLUI3NEMtNzQyRUQ4RTJGREI2fSIgdXNlcmlkPSJ7QkE2OTVDN0YtOEFFOC00Nzc2LTlFRjEtOTZBMDUwMkRFODIzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NkRCQTE4NzktNUU2Qi00NzVFLTkzNjYtMkVEMzhBRjM3NUI0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDcxNzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTY4MDM3MTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjQ1MzgyMjEzIi8-PC9hcHA-PC9yZXF1ZXN0Pg

Network

Country Destination Domain Proto
US 8.8.8.8:53 adidogoo.duckdns.org udp
DE 82.165.135.21:49523 adidogoo.duckdns.org tcp
US 8.8.8.8:53 msedge.api.cdp.microsoft.com udp
NL 4.175.87.113:443 msedge.api.cdp.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 199.232.210.172:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
DE 82.165.135.21:49523 adidogoo.duckdns.org tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 adidogoo.duckdns.org udp

Files

memory/2136-14-0x00000000723F2000-0x00000000723F3000-memory.dmp

memory/2136-15-0x00000000723F0000-0x00000000729A1000-memory.dmp

memory/2136-16-0x00000000723F0000-0x00000000729A1000-memory.dmp

memory/2136-17-0x00000000723F0000-0x00000000729A1000-memory.dmp

memory/2136-18-0x00000000723F0000-0x00000000729A1000-memory.dmp

memory/2136-19-0x00000000723F2000-0x00000000723F3000-memory.dmp

memory/2136-20-0x00000000723F0000-0x00000000729A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Fmvenagxeh.xml

MD5 18fbd2e5ef9c0e2d91c5e6c05d5148cd
SHA1 7db55e7ef047a159f4803aa29f4e091d24d0ce2c
SHA256 5ea1e5ee74977b5b215d0a8a64f4b83d81a0a81ad880d9a58893c684809e11a3
SHA512 a352998bbfd3477e2242a96a10c72895c34770e87f812b37c079931f6741d6999f33c7e08b1875a0b2cf150bdb5819018450a36a0eb547626694fed61265f6a0

memory/3024-22-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3024-26-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3024-28-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2136-30-0x00000000723F0000-0x00000000729A1000-memory.dmp

memory/4740-39-0x0000000000400000-0x000000000041F000-memory.dmp