459bb35b47d71971fd34877c6ddf00be5a6ccd343856ae57098b5f67b7660ec3

Interactive malware hunting service

General Info

File name: a201dfd1858dd7beb422165ff251381b

Full analysis: https://app.any.run/tasks/8e7519ad-ae8f-48ce-a882-9bee019c415f

Verdict: Malicious activity

Analysis date: 7/18/2019, 16:42:12

OS:: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)

Tags:: installer

latentbot

Indicators:

MIME:: application/x-dosexec

File info:: PE32 executable (GUI) Intel 80386, for MS Windows

MD5: a201dfd1858dd7beb422165ff251381b

SHA1: 5c5533b5b4743a44cb28e2bc2d9a8352c75c4a5d

SHA256: 459bb35b47d71971fd34877c6ddf00be5a6ccd343856ae57098b5f67b7660ec3

SSDEEP: 49152:xl5RG4uLduaZPSslCN7crGdDsFgiHHROTAXU:xlTGVk7crIwFZX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration: 300 seconds

Additional time used: 240 seconds

Fakenet option: off

Heavy Evaision option: off

MITM proxy: off

Route via Tor: off

Network geolocation: off

Privacy: Public submission

Autoconfirmation of UAC: on

Software preset

Internet Explorer 8.0.7601.17514
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 67.0.4 (x86 en-US) (67.0.4)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Behavior activities

MALICIOUS	SUSPICIOUS	INFO
Connects to CnC server a201dfd1858dd7beb422165ff251381b.exe (PID: 3208) LATENTBOT was detected a201dfd1858dd7beb422165ff251381b.exe (PID: 3208)	No suspicious indicators.	No info indicators.

MALICIOUS

SUSPICIOUS

INFO

Connects to CnC server

a201dfd1858dd7beb422165ff251381b.exe (PID: 3208)

LATENTBOT was detected

a201dfd1858dd7beb422165ff251381b.exe (PID: 3208)

No suspicious indicators.

No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD

.exe

| Inno Setup installer (67.7%)

.exe

| Win32 EXE PECompact compressed (generic) (25.6%)

.exe

| Win32 Executable (generic) (2.7%)

.exe

| Win16/32 Executable Delphi generic (1.2%)

.exe

| Generic Win/DOS Executable (1.2%)

EXIF

MachineType:

Intel 386 or later, and compatibles

TimeStamp:

2019:07:15 05:14:22+02:00

PEType:

PE32

LinkerVersion:

2.25

CodeSize:

2846720

InitializedDataSize:

556544

UninitializedDataSize:

null

EntryPoint:

0x2b7c78

OSVersion:

ImageVersion:

null

SubsystemVersion:

Subsystem:

Windows GUI

FileVersionNumber:

59.0.0.0

ProductVersionNumber:

7.24.0.104

FileFlagsMask:

0x003f

FileFlags:

(none)

FileOS:

Win32

ObjectFileType:

Executable application

FileSubtype:

null

LanguageCode:

English (U.S.)

CharacterSet:

Windows, Latin1

FileDescription:

koglpwed Serviços do Windows

FileVersion:

59.0.0.0

ProductVersion:

7.24.0.104

Summary

Architecture:

IMAGE_FILE_MACHINE_I386

Subsystem:

IMAGE_SUBSYSTEM_WINDOWS_GUI

Compilation Date:

15-Jul-2019 03:14:22

Detected languages

English - United States

German - Germany

Portuguese - Brazil

FileDescription:

koglpwed Serviços do Windows

FileVersion:

59.0.0.0

ProductVersion:

7.24.0.104

DOS Header

Magic number:

Bytes on last page of file:

0x0050

Pages in file:

0x0002

Relocations:

0x0000

Size of header:

0x0004

Min extra paragraphs:

0x000F

Max extra paragraphs:

0xFFFF

Initial SS value:

0x0000

Initial SP value:

0x00B8

Checksum:

0x0000

Initial IP value:

0x0000

Initial CS value:

0x0000

Overlay number:

0x001A

OEM identifier:

0x0000

OEM information:

0x0000

Address of NE header:

0x00000100

PE Headers

Signature:

Machine:

IMAGE_FILE_MACHINE_I386

Number of sections:

Time date stamp:

15-Jul-2019 03:14:22

Pointer to Symbol Table:

0x00000000

Number of symbols:

Size of Optional Header:

0x00E0

Characteristics

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_BYTES_REVERSED_HI

IMAGE_FILE_BYTES_REVERSED_LO

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name	Virtual Address	Virtual Size	Raw Size	Charateristics	Entropy
.text	0x00001000	0x002B4B8C	0x002B4C00	IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ	6.35036
.itext	0x002B6000	0x00002220	0x00002400	IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ	6.08773
.data	0x002B9000	0x0000B318	0x0000B400	IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE	5.96419
.bss	0x002C5000	0x00005ADC	0x00000000	IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE	0
.idata	0x002CB000	0x0000430A	0x00004400	IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE	5.23088
.didata	0x002D0000	0x0000088A	0x00000A00	IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE	3.74949
.tls	0x002D1000	0x00000040	0x00000000	IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE	0
.rdata	0x002D2000	0x00000018	0x00000200	IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ	0.205446
.reloc	0x002D3000	0x00034760	0x00034800	IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_DISCARDABLE,IMAGE_SCN_MEM_READ	6.73762
.rsrc	0x00308000	0x00043200	0x00043200	IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ	5.80643

Resources

4070

4071

4072

4073

4074

4075

4076

4077

4078

4079

4080

4081

4082

4083

4084

4085

4086

4087

4088

4089

4090

4091

4092

4093

4094

4095

4096

32761

32762

32763

32764

32765

32766

32767

BBABORT

BBALL

BBCANCEL

BBCLOSE

BBHELP

BBIGNORE

BBNO

BBOK

BBRETRY

BBYES

SPINDOWN

SPINUP

DVCLAL

PACKAGEINFO

PLATFORMTARGETS

TDMSELECTREGION

TMAINFORM

TRDCHATFORM

TRDCLIENTSETTINGS

TRDDESKTOPSAVER

TRDDESKTOPVIEWER

TRDFILEBROWSER

TRDFILETRANSFER

TRDHOSTSETTINGS

TRTC_HOSTSERVICE

POINT_CURSOR

MAINICON

Imports

oleaut32.dll

advapi32.dll

user32.dll

kernel32.dll

msimg32.dll

gdi32.dll

version.dll

mpr.dll

ole32.dll

comctl32.dll

msvcrt.dll

shell32.dll

comdlg32.dll

winspool.drv

kernel32.dll (delay-loaded)

Exports

No exports.

Screenshots

Screenshot of 459bb35b47d71971fd34877c6ddf00be5a6ccd343856ae57098b5f67b7660ec3 taken from 20078 ms from task started

Screenshot of 459bb35b47d71971fd34877c6ddf00be5a6ccd343856ae57098b5f67b7660ec3 taken from 131690 ms from task started

Processes

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

–

Specs description

Program did not start

Integrity level elevation

Task сontains an error or was rebooted

Process has crashed

Task contains several apps running

Executable file was dropped

Debug information is available

Process was injected

Network attacks were detected

Application downloaded the executable file

Actions similar to stealing personal data

Behavior similar to exploiting the vulnerability

Inspected object has sucpicious PE structure

File is detected by antivirus software

CPU overrun

RAM overrun

Process starts the services

Process was added to the startup

Behavior similar to spam

Low-level access to the HDD

Probably Tor was used

System was rebooted

Connects to the network

Known threat

Process information

Click at the process to see the details.

PID: 3208

CMD: "C:\Users\admin\Desktop\a201dfd1858dd7beb422165ff251381b.exe"

Path: C:\Users\admin\Desktop\a201dfd1858dd7beb422165ff251381b.exe

Indicators

Parent process: ––

User: admin

Integrity Level: MEDIUM

Version:

Company

Description: koglpwed Serviços do Windows

Version: 59.0.0.0

Modules

Image
c:\users\admin\desktop\a201dfd1858dd7beb422165ff251381b.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\version.dll
c:\windows\system32\mpr.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\winspool.drv
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\winsta.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\profapi.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\wship6.dll
c:\windows\system32\wshtcpip.dll

Registry activity

Total events

Read events

Write events

Delete events

Modification events

No registry activity.

Files activity

Executable files

Suspicious files

Text files

Unknown types

Dropped files

No files activity.

Network activity

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ACTION=HELLO	US	binary binary	27 b 26 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ACTION=START&ID=80565951307F4245A6D82A0E3A1BBCCA	US	binary binary	27 b 26 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=80565951307F4245A6D82A0E3A1BBCCA	US	binary binary	151 b 14 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=80565951307F4245A6D82A0E3A1BBCCA	US	binary binary	31 b 41 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ACTION=HELLO	US	binary binary	30 b 29 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ACTION=START&ID=71C6CBA281064179AEFB86C2DC8D90E6	US	binary binary	28 b 27 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=71C6CBA281064179AEFB86C2DC8D90E6	US	binary binary	149 b 12 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=71C6CBA281064179AEFB86C2DC8D90E6	US	binary text	31 b 13 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=71C6CBA281064179AEFB86C2DC8D90E6	US	binary binary	31 b 15 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=71C6CBA281064179AEFB86C2DC8D90E6	US	binary text	29 b 13 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	410	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=71C6CBA281064179AEFB86C2DC8D90E6	US	binary text	28 b 13 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ACTION=HELLO	US	binary binary	29 b 28 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ACTION=START&ID=5A98768D6D6444D0A86D00D7F5F80464	US	binary binary	30 b 29 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=5A98768D6D6444D0A86D00D7F5F80464	US	binary binary	153 b 14 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	––	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=5A98768D6D6444D0A86D00D7F5F80464	US	binary ––	31 b ––	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	410	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ACTION=HELLO&ID=5A98768D6D6444D0A86D00D7F5F80464	US	binary ––	28 b ––	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ACTION=HELLO&ID=	US	binary binary	29 b 28 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ACTION=START&ID=8180BACBCD22481A8326EC6AABCCC04B	US	binary binary	27 b 26 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=8180BACBCD22481A8326EC6AABCCC04B	US	binary binary	151 b 12 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=8180BACBCD22481A8326EC6AABCCC04B	US	binary binary	32 b 16 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=8180BACBCD22481A8326EC6AABCCC04B	US	binary binary	31 b 15 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=8180BACBCD22481A8326EC6AABCCC04B	US	binary binary	28 b 12 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	410	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=8180BACBCD22481A8326EC6AABCCC04B	US	binary binary	30 b 12 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ACTION=HELLO	US	binary binary	26 b 25 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ACTION=START&ID=432EB41F4CAE443D913D08B82DEC1A14	US	binary binary	29 b 28 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=432EB41F4CAE443D913D08B82DEC1A14	US	binary binary	151 b 12 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	200	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=432EB41F4CAE443D913D08B82DEC1A14	US	binary binary	30 b 14 b	suspicious
3208	a201dfd1858dd7beb422165ff251381b.exe	POST	––	18.218.52.120:1992	http://18.218.52.120:1992/$rdgate?ID=432EB41F4CAE443D913D08B82DEC1A14	US	binary ––	31 b ––	suspicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	ASN	CN	Reputation
3208	a201dfd1858dd7beb422165ff251381b.exe	18.218.52.120:1992	Amazon.com, Inc.	US	suspicious

DNS requests

Domain	IP	Reputation
recomeco2020.zapto.org	18.218.52.120	malicious

Threats

PID	Process	Class	Message
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	MALWARE [PTsecurity] LatentBot HTTP POST Checkin
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	MALWARE [PTsecurity] LatentBot HTTP POST Checkin
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	MALWARE [PTsecurity] LatentBot HTTP POST Checkin
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	MALWARE [PTsecurity] LatentBot HTTP POST Checkin
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	MALWARE [PTsecurity] LatentBot HTTP POST Checkin
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	MALWARE [PTsecurity] LatentBot HTTP POST Checkin
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop
3208	a201dfd1858dd7beb422165ff251381b.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] eStream SQL Remote Desktop

17 ETPRO signatures available at the full report

Debug output strings

No debug info.

General Info

a201dfd1858dd7beb422165ff251381b

installer

latentbot

Take your security to the next level

a201dfd1858dd7beb422165ff251381b

5c5533b5b4743a44cb28e2bc2d9a8352c75c4a5d

459bb35b47d71971fd34877c6ddf00be5a6ccd343856ae57098b5f67b7660ec3

49152:xl5RG4uLduaZPSslCN7crGdDsFgiHHROTAXU:xlTGVk7crIwFZX

Launch configuration

Software preset

Hotfixes

Behavior activities

Static information

Screenshots

Processes

Behavior graph

Process information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings

Take your security
to the next level