Edit tour

Windows Analysis Report
aria2c.exe

Overview

General Information

Sample Name:aria2c.exe
Analysis ID:1306018
MD5:b95dbde252cc8ea490e1d9d04ec5fe0d
SHA1:edd746c496ea8564367b3108736490dcfc14c360
SHA256:0ae98794b3523634b0af362d6f8c04a9bbd32aeda959b72ca0e7fc24e84d2a66
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Creates a DirectInput object (often for capturing keystrokes)
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Program does not show much activity (idle)
PE file contains sections with non-standard names

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64
  • aria2c.exe (PID: 6388 cmdline: C:\Users\user\Desktop\aria2c.exe MD5: B95DBDE252CC8EA490E1D9D04EC5FE0D)
    • conhost.exe (PID: 6404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Snort rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: aria2c.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: aria2c.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT
Source: aria2c.exeString found in binary or memory: http://www.metalinker.org/
Source: aria2c.exeString found in binary or memory: http://www.metalinker.org/basic_string::_M_construct
Source: aria2c.exeString found in binary or memory: https://aria2.github.io/
Source: aria2c.exeString found in binary or memory: https://aria2.github.io/Usage:
Source: aria2c.exeString found in binary or memory: https://gcc.gnu.org/bugs/):
Source: aria2c.exeString found in binary or memory: https://github.com/aria2/aria2/issues
Source: aria2c.exeString found in binary or memory: https://github.com/aria2/aria2/issuesReport
Source: aria2c.exe, 00000000.00000002.371444958.00000000015DA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>memstr_135855b4-2
Source: aria2c.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: aria2c.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\aria2c.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: aria2c.exeString found in binary or memory: -h, --help[=TAG|KEYWORD] Print usage and exit. The help messages are classified with tags. A tag starts with "#". For example, type "--help=#http" to get the usage f
Source: aria2c.exeString found in binary or memory: -h, --help[=TAG|KEYWORD] Print usage and exit. The help messages are classified with tags. A tag starts with "#". For example, type "--help=#http" to get the usage f
Source: aria2c.exeString found in binary or memory: pBGID#%s Stop downloading torrent due to --bt-stop-timeout option.
Source: aria2c.exeString found in binary or memory: --on-download-complete=COMMAND Set the command to be executed after download completed. See --on-download-start option for the requirement of COMMAND.
Source: aria2c.exeString found in binary or memory: --on-download-error=COMMAND Set the command to be executed after download aborted due to error. See --on-download-start option for the requirement of COMMAND.
Source: aria2c.exeString found in binary or memory: See also --on-download-stop option.
Source: aria2c.exeString found in binary or memory: See also --on-download-stop option.
Source: aria2c.exeString found in binary or memory: --on-download-pause=COMMAND Set the command to be executed after download was paused. See --on-download-start option for the requirement of COMMAND.
Source: aria2c.exeString found in binary or memory: --on-download-start=COMMAND Set the command to be executed after download got started. aria2 passes 3 arguments to COMMAND: GID, the number of files and file path. See Event
Source: aria2c.exeString found in binary or memory: --on-download-stop=COMMAND Set the command to be executed after download stopped. You can override the command to be executed for particular download result using --on
Source: aria2c.exeString found in binary or memory: download-complete and --on-download-error. If they are specified, command specified in this option is not executed. See --on-download-start option for the
Source: aria2c.exeString found in binary or memory: --bt-stop-timeout=SEC Stop BitTorrent download if download speed is 0 in consecutive SEC seconds. If 0 is given, this feature is disabled.
Source: aria2c.exeString found in binary or memory: --dht-listen-addr6=ADDR Specify address to bind socket for IPv6 DHT. It should be a global unicast IPv6 address of the host.
Source: aria2c.exeString found in binary or memory: --enable-dht6[=true|false] Enable IPv6 DHT functionality. Use --dht-listen-port option to specify port number to listen on. See also --dht-listen-addr6 option.
Source: aria2c.exeString found in binary or memory: on-download-stop
Source: aria2c.exeString found in binary or memory: on-download-start
Source: aria2c.exeString found in binary or memory: --stop=SEC Stop application after SEC seconds has passed. If 0 is given, this feature is disabled.
Source: aria2c.exeString found in binary or memory: --stop-with-process=PID Stop application when process PID is not running. This is useful if aria2 process is forked from a parent process. The parent process can fork aria2
Source: aria2c.exeString found in binary or memory: this option sets the command to be executed after download completed but before seeding. See --on-download-start option for the requirement of COMMAND.
Source: aria2c.exeString found in binary or memory: dht-listen-addr
Source: aria2c.exeString found in binary or memory: dht-listen-addr6
Source: aria2c.exeString found in binary or memory: bt-stop-timeout
Source: aria2c.exeString found in binary or memory: on-download-start
Source: aria2c.exeString found in binary or memory: on-download-stop
Source: aria2c.exeString found in binary or memory: dht-listen-addr
Source: aria2c.exeString found in binary or memory: dht-listen-addr6
Source: aria2c.exeString found in binary or memory: bt-stop-timeout
Source: aria2c.exeString found in binary or memory: pBGID#%s Stop downloading torrent due to --bt-stop-timeout option.
Source: aria2c.exeString found in binary or memory: BtSetup.ccInitializing LpdMessageReceiver.LpdMessageReceiver initialized. multicastAddr=%s:%u, localAddr=%sLpdMessageReceiver not initialized.Initializing LpdMessageDispatcher.basic_string::_M_construct null not validLpdMessageDispatcher initialized.LpdMessageDispatcher not initialized.239.192.152.143pBGID#%s Stop downloading torrent due to --bt-stop-timeout option.BtStopDownloadCommand.ccbasic_string::_M_construct null not valid&?basic_string::appendinfo_hash=%s&peer_id=%s&uploaded=%lld&downloaded=%lld&left=%lld&compact=1&key=%s&numwant=%d&no_peer_id=1&port=%u&event=&trackerid=&supportcrypto=1&requirecrypto=1&ip=Now processing tracker response.DefaultBtAnnounce.ccTracker returned null data.Tracker returned failure reason: %sTracker returned warning message: %sTracker ID:%sInterval:%ldMin interval:%ldComplete:%dIncomplete:%dNo peer list received.No peers6 received.vector::_M_realloc_insertipportNow processing UDP tracker response.basic_string::_M_construct null not validDefaultPeerStorage.ccuniqPeers_.size() == unusedPeers_.size() + usedPeers_.size()CUID#%lld is already set for peer %s:%uCheckout peer %s:%u to CUID#%lldRemove peer %s:%ucannot create std::deque larger than max_size()Adding %s:%u is rejected, since unused peer list is full (%lu peers > %lu)Adding %s:%u is rejected because it has been already added.Adding %s:%u is rejected because it is marked bad.Now unused peer list contains %lu peersAdding peer %s:%dPurge %s from bad peerAdded %s as bad peerPeer %s:%u returned from CUID#%lldCannot find peer %s:%u in usedPeers_basic_string::_M_construct null not validCUID#%lld - Name resolution for %s failed:%sDHTEntryPointNameResolveCommand.ccNo address returnedCUID#%lld - Name resolution complete: %s -> %sException caughtcannot create std::deque larger than max_size()Issuing PeerLookup for infoHash=%sDHTGetPeersCommand.cctask finished detectedToo few peers. peers=%lu, max_peers=%d. Try again(%d)DHTNode ID=%s, Host=%s(%u), Condition=%d, RTT=%ldTrying to add node:%sDHTRoutingTable.ccAdding node with the same ID with localnode is not allowed.Added DHTNode.Splitting bucket. Range:%s-%sCached node=%sbasic_string::_M_construct null not validvector::_M_realloc_insertError occurred while binding UDP port for DHTDHTSetup.ccInitialized local node ID=%sNo DHT entry point specified.Exception caught while loading DHT routing table from %sException caught while initializing DHT functionality. DHT is disabled.Updating periodicTaskQueue1DHTTaskQueueImpl.ccUpdating periodicTaskQueue2Updating immediateTaskQueuecannot create std::deque larger than max_size()Token generation failed: ipaddr=%s, port=%uDHTTokenTracker.ccException caughtDHTTokenUpdateCommand.ccDispatching LPD message for infohash=%sLpdDispatchMessageCommand.ccSending LPD message is complete.Sending LPD message %u times but all failed.Could not send LPD message, retry shortly.Failed to send LPD message.basic_string::_M_construct null not validSetting multicast outgoing interface=%sLpdMessageDispatcher.
Source: aria2c.exeString found in binary or memory: See --on-download-start option for the
Source: aria2c.exeString found in binary or memory: See also --on-download-stop option.
Source: aria2c.exeString found in binary or memory: --on-download-start=COMMAND Set the command to be executed after download
Source: aria2c.exeString found in binary or memory: --on-download-stop=COMMAND Set the command to be executed after download
Source: aria2c.exeString found in binary or memory: --stop=SEC Stop application after SEC seconds has passed.
Source: aria2c.exeString found in binary or memory: --stop-with-process=PID Stop application when process PID is not running.
Source: aria2c.exeString found in binary or memory: --bt-stop-timeout=SEC Stop BitTorrent download if download speed is 0 in
Source: aria2c.exeString found in binary or memory: --dht-listen-addr6=ADDR Specify address to bind socket for IPv6 DHT.
Source: aria2c.exeString found in binary or memory: number to listen on. See also --dht-listen-addr6
Source: aria2c.exeString found in binary or memory: -h, --help[=TAG|KEYWORD] Print usage and exit.
Source: aria2c.exeString found in binary or memory: -h, --help[=TAG|KEYWORD] Print usage and exit.
Source: aria2c.exeString found in binary or memory: starts with "#". For example, type "--help=#http"
Source: aria2c.exeString found in binary or memory: starts with "#". For example, type "--help=#http"
Source: aria2c.exeString found in binary or memory: See also --on-download-stop option. --on-download-error=COMMAND Set the command to be executed after download
Source: aria2c.exeString found in binary or memory: See also --on-download-stop option. --on-download-pause=COMMAND Set the command to be executed after download
Source: aria2c.exeString found in binary or memory: requirement of COMMAND. --on-download-start=COMMAND Set the command to be executed after download
Source: aria2c.exeString found in binary or memory: Hook in man page for more details. --on-download-stop=COMMAND Set the command to be executed after download
Source: aria2c.exeString found in binary or memory: otherwise printed in stdout to stderr. --stop=SEC Stop application after SEC seconds has passed.
Source: aria2c.exeString found in binary or memory: If 0 is given, this feature is disabled. --stop-with-process=PID Stop application when process PID is not running.
Source: aria2c.exeString found in binary or memory: See also --bt-metadata-only option. --bt-stop-timeout=SEC Stop BitTorrent download if download speed is 0 in
Source: aria2c.exeString found in binary or memory: network. --dht-file-path=PATH Change the IPv4 DHT routing table file to PATH. --dht-file-path6=PATH Change the IPv6 DHT routing table file to PATH. --dht-listen-addr6=ADDR Specify address to bind socket for IPv6 DHT.
Source: aria2c.exeString found in binary or memory: if you don't have any preferred protocol. --metalink-version=VERSION The version of the file to download. -v, --version Print the version number and exit., #all -h, --help[=TAG|KEYWORD] Print usage and exit.
Source: aria2c.exeString found in binary or memory: if you don't have any preferred protocol. --metalink-version=VERSION The version of the file to download. -v, --version Print the version number and exit., #all -h, --help[=TAG|KEYWORD] Print usage and exit.
Source: aria2c.exeString found in binary or memory: Unable to complete request for channel-process-startup
Source: aria2c.exeString found in binary or memory: %lu.%lu.%lu.%lu.in-addr.arpa
Source: aria2c.exeString found in binary or memory: mCARES_HOSTSSystem\CurrentControlSet\Services\Tcpip\ParametersDatabasePathrares_getaddrinfo.c!hquery->ai->nodestcp%lu.%lu.%lu.%lu.in-addr.arpa%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.ip6.arpaSystem\CurrentControlSet\Services\Tcpip\ParametersDatabasePathrares__sortaddrinfo.ccur != NULLwslay_event.coff <= lenlen == off(size_t)r <= buflen
Source: classification engineClassification label: clean2.winEXE@2/0@0/0
Source: unknownProcess created: C:\Users\user\Desktop\aria2c.exe C:\Users\user\Desktop\aria2c.exe
Source: C:\Users\user\Desktop\aria2c.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6404:120:WilError_01
Source: aria2c.exe, 00000000.00000002.371338711.00000000006BD000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: aria2c.exe, aria2c.exe, 00000000.00000002.371338711.00000000006BD000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: aria2c.exe, aria2c.exe, 00000000.00000002.371338711.00000000006BD000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: aria2c.exe, aria2c.exe, 00000000.00000002.371338711.00000000006BD000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: aria2c.exe, aria2c.exe, 00000000.00000002.371338711.00000000006BD000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: aria2c.exe, aria2c.exe, 00000000.00000002.371338711.00000000006BD000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: aria2c.exe, aria2c.exe, 00000000.00000002.371338711.00000000006BD000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: aria2c.exeStatic file information: File size 5949966 > 1048576
Source: aria2c.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: aria2c.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x447400
Source: aria2c.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT
Source: aria2c.exeStatic PE information: section name: /4
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: aria2c.exe, 00000000.00000002.371444958.00000000015DA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts2
Command and Scripting Interpreter
Path Interception1
Process Injection
1
Process Injection
1
Input Capture
1
Security Software Discovery
Remote Services1
Input Capture
Exfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
System Information Discovery
Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1306018 Sample: aria2c.exe Startdate: 08/09/2023 Architecture: WINDOWS Score: 2 5 aria2c.exe 1 2->5         started        process3 7 conhost.exe 5->7         started       
SourceDetectionScannerLabelLink
aria2c.exe0%ReversingLabs
No Antivirus matches
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
http://www.metalinker.org/0%URL Reputationsafe
http://www.metalinker.org/basic_string::_M_construct0%Avira URL Cloudsafe
https://aria2.github.io/0%Avira URL Cloudsafe
https://aria2.github.io/Usage:0%Avira URL Cloudsafe
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
https://aria2.github.io/Usage:aria2c.exefalse
  • Avira URL Cloud: safe
unknown
https://gcc.gnu.org/bugs/):aria2c.exefalse
    high
    https://github.com/aria2/aria2/issuesReportaria2c.exefalse
      high
      http://www.metalinker.org/aria2c.exefalse
      • URL Reputation: safe
      unknown
      https://aria2.github.io/aria2c.exefalse
      • Avira URL Cloud: safe
      unknown
      https://github.com/aria2/aria2/issuesaria2c.exefalse
        high
        http://www.metalinker.org/basic_string::_M_constructaria2c.exefalse
        • Avira URL Cloud: safe
        unknown
        No contacted IP infos
        Joe Sandbox Version:38.0.0 Beryl
        Analysis ID:1306018
        Start date and time:2023-09-08 11:17:48 +02:00
        Joe Sandbox Product:CloudBasic
        Overall analysis duration:0h 3m 27s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:default.jbs
        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
        Number of analysed new started processes analysed:2
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample file name:aria2c.exe
        Detection:CLEAN
        Classification:clean2.winEXE@2/0@0/0
        EGA Information:Failed
        HCA Information:Failed
        Cookbook Comments:
        • Found application associated with file extension: .exe
        • Stop behavior analysis, all processes terminated
        • Execution Graph export aborted for target aria2c.exe, PID 6388 because there are no executed function
        • Not all processes where analyzed, report is missing behavior information
        • VT rate limit hit for: aria2c.exe
        No simulations
        No context
        No context
        No context
        No context
        No context
        No created / dropped files found
        File type:PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
        Entropy (8bit):6.443448262854648
        TrID:
        • Win32 Executable (generic) a (10002005/4) 99.96%
        • Generic Win/DOS Executable (2004/3) 0.02%
        • DOS Executable Generic (2002/1) 0.02%
        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
        File name:aria2c.exe
        File size:5'949'966 bytes
        MD5:b95dbde252cc8ea490e1d9d04ec5fe0d
        SHA1:edd746c496ea8564367b3108736490dcfc14c360
        SHA256:0ae98794b3523634b0af362d6f8c04a9bbd32aeda959b72ca0e7fc24e84d2a66
        SHA512:d2df384b979f01fbf77067b2d68879221684ffcbfc270000a50be972c8c6bc8f3cc3c1f03ea79216b7b0b296ea27581d38b311472281571bc20d47e61d7cca47
        SSDEEP:98304:YkGkHBfhGbdvHp+PTwHbQApPCNmQ5U7dI/v4GW/F/P9w9Teai3qAiaOdH3qXYFE9:YvkhfO/7QyOU7XGW/F/P9w9xiXGqXCd8
        TLSH:54567D59EE8314F1FA2351B1818FE7BF96246B128021EDBBFF4ED949F7336112909216
        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........Z............#.tD...Z..0............D...@..........................P[......W[...@... ............................
        Icon Hash:90cececece8e8eb0
        Entrypoint:0x4014c0
        Entrypoint Section:.text
        Digitally signed:false
        Imagebase:0x400000
        Subsystem:windows cui
        Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
        Time Stamp:0x0 [Thu Jan 1 00:00:00 1970 UTC]
        TLS Callbacks:0x6e9130, 0x6e90e0
        CLR (.Net) Version:
        OS Version Major:4
        OS Version Minor:0
        File Version Major:4
        File Version Minor:0
        Subsystem Version Major:4
        Subsystem Version Minor:0
        Import Hash:2a3472599d3319861edd3c59c3b538b6
        Instruction
        mov dword ptr [0098E374h], 00000000h
        jmp 00007F80B4A38E96h
        nop
        sub esp, 1Ch
        mov eax, dword ptr [esp+20h]
        mov dword ptr [esp], eax
        call 00007F80B4D37886h
        test eax, eax
        sete al
        add esp, 1Ch
        movzx eax, al
        neg eax
        ret
        nop
        nop
        nop
        push ebp
        mov ebp, esp
        push edi
        push esi
        push ebx
        sub esp, 1Ch
        mov dword ptr [esp], 0084D000h
        call dword ptr [0098F724h]
        sub esp, 04h
        test eax, eax
        je 00007F80B4A39265h
        mov ebx, eax
        mov dword ptr [esp], 0084D000h
        call dword ptr [0098F790h]
        mov edi, dword ptr [0098F72Ch]
        sub esp, 04h
        mov dword ptr [0098C028h], eax
        mov dword ptr [esp+04h], 0084D013h
        mov dword ptr [esp], ebx
        call edi
        sub esp, 08h
        mov esi, eax
        mov dword ptr [esp+04h], 0084D029h
        mov dword ptr [esp], ebx
        call edi
        mov dword ptr [00849004h], eax
        sub esp, 08h
        test esi, esi
        je 00007F80B4A39203h
        mov dword ptr [esp+04h], 0098C02Ch
        mov dword ptr [esp], 008B9000h
        call esi
        mov dword ptr [esp], 004015A0h
        call 00007F80B4A39153h
        lea esp, dword ptr [ebp-0Ch]
        pop ebx
        pop esi
        pop edi
        pop ebp
        ret
        lea esi, dword ptr [esi+00000000h]
        mov dword ptr [00849004h], 0000EE20h
        NameVirtual AddressVirtual Size Is in Section
        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IMPORT0x58f0000x22dc.idata
        IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
        IMAGE_DIRECTORY_ENTRY_BASERELOC0x5940000x20fd8.reloc
        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
        IMAGE_DIRECTORY_ENTRY_TLS0x49c73c0x18.rdata
        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IAT0x58f5f80x51c.idata
        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
        .text0x10000x4473480x447400unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .data0x4490000x3ef40x4000False0.16998291015625DIY-Thermocam raw data (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 8619896832.0000002.14305710973823IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .rdata0x44d0000x6b3a00x6b400False0.3356529538170163data6.0491285911051IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
        /40x4b90000xd249c0xd2600False0.2440048462566845data5.055869401118246IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
        .bss0x58c0000x2eb80x0False0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .idata0x58f0000x22dc0x2400False0.3651258680555556data5.446611665474483IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .CRT0x5920000x340x200False0.072265625Matlab v4 mat-file (little endian) \300\220n, numeric, rows 4198704, columns 00.2804011676589459IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .tls0x5930000x80x200False0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .reloc0x5940000x20fd80x21000False0.5849905303030303data6.681867726431836IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
        DLLImport
        ADVAPI32.dllAdjustTokenPrivileges, CryptAcquireContextA, CryptGenRandom, CryptReleaseContext, GetTokenInformation, LookupPrivilegeValueA, OpenProcessToken, RegCloseKey, RegEnumKeyExA, RegOpenKeyExA, RegQueryValueExA
        bcrypt.dllBCryptCloseAlgorithmProvider, BCryptCreateHash, BCryptDecrypt, BCryptDestroyHash, BCryptDestroyKey, BCryptEncrypt, BCryptFinishHash, BCryptGenRandom, BCryptGetProperty, BCryptHashData, BCryptImportKey, BCryptImportKeyPair, BCryptOpenAlgorithmProvider, BCryptSetProperty, BCryptSignHash, BCryptVerifySignature
        CRYPT32.dllCertCloseStore, CertEnumCertificatesInStore, CertFreeCertificateContext, CryptDecodeObjectEx, PFXImportCertStore, PFXIsPFXBlob
        IPHLPAPI.DLLGetAdaptersAddresses
        KERNEL32.dllAreFileApisANSI, CloseHandle, CreateFileA, CreateFileMappingA, CreateFileMappingW, CreateFileW, CreateMutexW, CreateProcessW, CreateSemaphoreW, DeleteCriticalSection, DeleteFileA, DeleteFileW, DeviceIoControl, EnterCriticalSection, ExpandEnvironmentStringsA, FlushFileBuffers, FlushViewOfFile, FormatMessageA, FormatMessageW, FreeLibrary, GetCommandLineW, GetConsoleMode, GetConsoleScreenBufferInfo, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetDiskFreeSpaceA, GetDiskFreeSpaceW, GetEnvironmentVariableW, GetFileAttributesA, GetFileAttributesExW, GetFileAttributesW, GetFileSize, GetFileSizeEx, GetFullPathNameA, GetFullPathNameW, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetProcessHeap, GetStartupInfoA, GetStdHandle, GetSystemInfo, GetSystemTime, GetSystemTimeAsFileTime, GetTempPathA, GetTempPathW, GetTickCount, GetTimeZoneInformation, GetVersionExA, GetVersionExW, GetWindowsDirectoryA, HeapAlloc, HeapCompact, HeapCreate, HeapDestroy, HeapFree, HeapReAlloc, HeapSize, HeapValidate, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadLibraryW, LocalFree, LockFile, LockFileEx, MapViewOfFile, MoveFileExW, MultiByteToWideChar, OpenProcess, OutputDebugStringA, OutputDebugStringW, QueryPerformanceCounter, ReadFile, ReleaseSemaphore, SetConsoleCtrlHandler, SetConsoleTextAttribute, SetEndOfFile, SetFilePointer, SetFilePointerEx, SetFileTime, SetFileValidData, SetLastError, SetUnhandledExceptionFilter, Sleep, SystemTimeToFileTime, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryEnterCriticalSection, UnlockFile, UnlockFileEx, UnmapViewOfFile, VirtualProtect, VirtualQuery, WaitForSingleObject, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFile
        msvcrt.dll__getmainargs, __initenv, __lconv_init, __mb_cur_max, __p___argv, __p__acmdln, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _assert, _beginthreadex, _cexit, _endthreadex, _errno, _commit, _filelengthi64, _fileno, _fstat64, _initterm, _iob, _lock, _lseeki64, _onexit, _setmode, _unlock, _wfopen, _wfsopen, _wgetcwd, _wgetenv, _wmkdir, _wopen, _wrmdir, _wsopen, _wunlink, abort, acos, asctime, asin, atan, atoi, calloc, cosh, exit, fclose, feof, ferror, fflush, fgetpos, fgets, fopen, fprintf, fputc, fputs, fread, free, fsetpos, fwrite, getc, getenv, getwc, islower, isspace, isupper, iswctype, isxdigit, ldiv, localeconv, log10, malloc, memchr, memcmp, memcpy, memmove, memset, localtime, gmtime, difftime, perror, putc, putwc, qsort, raise, rand, realloc, rewind, setlocale, setvbuf, signal, sinh, strchr, strcmp, strcoll, strcpy, strcspn, strerror, strftime, strlen, strncat, strncmp, strncpy, strrchr, strtol, strtoul, strxfrm, tan, tanh, tolower, towlower, towupper, ungetc, ungetwc, vfprintf, time, _stricmp, _strnicmp, wcscoll, wcsftime, wcslen, wcstombs, wcsxfrm, _wstati64, _tzname, _write, _tzset, _strnicmp, _strdup, _read, _open, _lseek, _isatty, _fileno, _fdopen, _dup, _close
        Secur32.dllAcceptSecurityContext, AcquireCredentialsHandleW, ApplyControlToken, DecryptMessage, DeleteSecurityContext, EncryptMessage, FreeContextBuffer, FreeCredentialsHandle, InitializeSecurityContextA, QueryContextAttributesA
        SHELL32.dllCommandLineToArgvW
        WS2_32.dllWSASend, freeaddrinfo, getaddrinfo, gethostname, getnameinfo, getservbyname, getservbyport
        WSOCK32.DLLWSACleanup, WSAGetLastError, WSAStartup, __WSAFDIsSet, accept, bind, closesocket, connect, getpeername, getsockname, getsockopt, htonl, htons, ioctlsocket, listen, ntohl, ntohs, recv, recvfrom, select, send, sendto, setsockopt, shutdown, socket
        No network behavior found
        0246s020406080100

        Click to jump to process

        Click to jump to process

        Click to jump to process

        Target ID:0
        Start time:11:18:43
        Start date:08/09/2023
        Path:C:\Users\user\Desktop\aria2c.exe
        Wow64 process (32bit):true
        Commandline:C:\Users\user\Desktop\aria2c.exe
        Imagebase:0x270000
        File size:5'949'966 bytes
        MD5 hash:B95DBDE252CC8EA490E1D9D04EC5FE0D
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:true

        Target ID:1
        Start time:11:18:43
        Start date:08/09/2023
        Path:C:\Windows\System32\conhost.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Imagebase:0x7ff766460000
        File size:625'664 bytes
        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:true

        No disassembly