Find similar analyses in TI Lookup

Analysis date (UTC): 21 May 2026, 04:37Analysis environment: Windows 10 Pro, build 19044, x64

Host.exe

MD5:C464D743248EDE83C611A5E7B7E318EE

SHA1:3262B85236A171685D71A01B0B74F902BB60823A

SHA256:E4B2CFA2A3D348C8A316186AD65D0554804E9C87D7DC4A9D85A714AB9E9F037F

Analysis result

Threat level:Malicious activity

Tags:

netwire

Full analysis:Analysis Host.exe (MD5: C464D743248EDE83C611A5E7B7E318EE) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Changes the autorun value in the registry

Host.exe (PID: 7196)

NETWIRE has been detected (YARA)

Host.exe (PID: 7196)

SUSPICIOUS

The process creates files with name similar to system file names

Host.exe (PID: 3580)

Executable content was dropped or overwritten

Host.exe (PID: 3580)

Starts itself from another location

Host.exe (PID: 3580)

The process executes files with name similar to system file names

Host.exe (PID: 3580)

INFO

Creates files or folders in the user directory

Host.exe (PID: 3580)

Reads security settings of Internet Explorer

Host.exe (PID: 3580)

Checks supported languages

Host.exe (PID: 3580)
Host.exe (PID: 7196)
Host.exe (PID: 7468)
Host.exe (PID: 736)

Reads the computer name

Host.exe (PID: 3580)
Host.exe (PID: 7196)

Process checks computer location settings

Host.exe (PID: 3580)

Launching a file from a Registry key

Host.exe (PID: 7196)

Manual execution by a user

Host.exe (PID: 7468)
Host.exe (PID: 736)

There is functionality for taking screenshot (YARA)

Host.exe (PID: 7196)

Threats

PID	Process	Class	Message
680	svchost.exe	Unknown Traffic	ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)