Technical Information
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'NetWire' = '%APPDATA%\Install\Host.exe'
- host.exe
- %APPDATA%\install\host.exe
- 'au####n.duckdns.org':3382
- http://www.me###fire.com/file/rjvd0sktezrv5tl/UPS_encrypted_78D9840.bin/file
- http://do######2261.mediafire.com/6cnhlkdao9fg/rjvd0sktezrv5tl/UPS_encrypted_78D9840.bin
- DNS ASK me###fire.com
- DNS ASK do######2261.mediafire.com
- DNS ASK au####n.duckdns.org
- '%APPDATA%\install\host.exe'