File name:

AweSun_1.6.0.34643.exe

Full analysis: https://app.any.run/tasks/09ec264d-b906-42fb-ae19-8bfc087544cc
Verdict: Malicious activity
Analysis date: June 28, 2021, 05:27:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

3EF4CD79021FB36FCC4780732A1517FA

SHA1:

BD13DC9EDB06E58581E232DCA3E4504242A1899C

SHA256:

B62D850F3FE134226475889841F260EC8314E21702E8917AA99ADDD14A86DD96

SSDEEP:

98304:JGFMxsvzuzqS1RNNAlRKkm4qdpg8UX1GJwTO7hUootbGppjjhnCADr0WGr8WTDBX:bmun52ODg5cJPhaorzlCXpGmyg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • AweSun_1.6.0.34643.exe (PID: 1692)

    • Changes settings of System certificates

      • devcon.exe (PID: 2708)

    • Application was dropped or rewritten from another process

      • devcon.exe (PID: 2708)

  • SUSPICIOUS

    • Application launched itself

      • AweSun_1.6.0.34643.exe (PID: 3344)
      • cmd.exe (PID: 2876)
      • AweSun.exe (PID: 3036)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2660)

    • Starts CMD.EXE for commands execution

      • AweSun_1.6.0.34643.exe (PID: 1692)
      • cmd.exe (PID: 2876)

    • Creates a directory in Program Files

      • AweSun_1.6.0.34643.exe (PID: 1692)
      • AweSun.exe (PID: 3036)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 2384)
      • cmd.exe (PID: 2776)
      • cmd.exe (PID: 2840)
      • cmd.exe (PID: 3388)
      • cmd.exe (PID: 872)
      • cmd.exe (PID: 3620)
      • cmd.exe (PID: 3928)

    • Creates files in the program directory

      • AweSun_1.6.0.34643.exe (PID: 1692)
      • AweSun.exe (PID: 3036)
      • AweSun.exe (PID: 2092)
      • AweSun.exe (PID: 4040)

    • Executable content was dropped or overwritten

      • AweSun_1.6.0.34643.exe (PID: 1692)
      • devcon.exe (PID: 2708)
      • DrvInst.exe (PID: 352)
      • DrvInst.exe (PID: 1388)

    • Drops a file that was compiled in debug mode

      • AweSun_1.6.0.34643.exe (PID: 1692)
      • devcon.exe (PID: 2708)
      • DrvInst.exe (PID: 352)
      • DrvInst.exe (PID: 1388)

    • Drops a file with too old compile date

      • AweSun_1.6.0.34643.exe (PID: 1692)

    • Creates a software uninstall entry

      • AweSun_1.6.0.34643.exe (PID: 1692)

    • Executed as Windows Service

      • AweSun.exe (PID: 3036)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 1388)
      • DrvInst.exe (PID: 352)

    • Adds / modifies Windows certificates

      • devcon.exe (PID: 2708)

    • Executed via COM

      • DrvInst.exe (PID: 1388)
      • DrvInst.exe (PID: 352)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 1388)
      • DrvInst.exe (PID: 352)

    • Creates files in the Windows directory

      • DrvInst.exe (PID: 1388)
      • DrvInst.exe (PID: 352)

    • Starts itself from another location

      • AweSun_1.6.0.34643.exe (PID: 1692)

    • Drops a file with a compile date too recent

      • DrvInst.exe (PID: 352)
      • DrvInst.exe (PID: 1388)
      • devcon.exe (PID: 2708)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (43.5)
.exe | Win32 EXE Yoda's Crypter (42.7)
.exe | Win32 Executable (generic) (7.2)
.exe | Generic Win/DOS Executable (3.2)
.exe | DOS Executable Generic (3.2)

EXIF

EXE

ProductVersion: 1.6.0.34643
ProductName: AweSun
OriginalFileName: AweSun.exe
LegalCopyright: AweRay. All Rights Reserved.
InternalName: AweSun
FileVersion: 1.6.0.34643
FileDescription: AweSun
CompanyName: AweRay Limited
CharacterSet: Unicode
LanguageCode: Chinese (Traditional)
FileSubtype: -
ObjectFileType: Unknown
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.6.0.34643
FileVersionNumber: 1.6.0.34643
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x16066d0
UninitializedDataSize: 15753216
InitializedDataSize: 135168
CodeSize: 7340032
LinkerVersion: 14
PEType: PE32
TimeStamp: 2020:12:16 03:15:24+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 16-Dec-2020 02:15:24

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000158

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 16-Dec-2020 02:15:24
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x00F06000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x00F07000
0x00700000
0x006FFA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.9316
.rsrc
0x01607000
0x00021000
0x00020800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.70197

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
HID.DLL
IMM32.dll
IPHLPAPI.DLL
KERNEL32.DLL
MSIMG32.dll
NETAPI32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
28
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start awesun_1.6.0.34643.exe no specs awesun_1.6.0.34643.exe cmd.exe no specs taskkill.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs awesun.exe no specs devcon.exe awesun.exe awesun.exe drvinst.exe drvinst.exe awesun.exe awesun.exe

Process information

PID
CMD
Path
Indicators
Parent process
352DrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\INF\oem4.inf" "oraymir.inf:Oray:OrayMir_Inst:1.0.1.17485:c50b00d7-ae62-4936-8bc8-20e0b9f0befb" "6e6179ed3" "00000554" "000005DC" "000005E0"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
872cmd /c netsh advfirewall firewall add rule name="AweSun" dir=in action=allow program="C:\Program Files\Aweray\AweSun\AweSun.exe" protocol=tcp enable=yes profile=privateC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
952netsh advfirewall firewall delete rule name="AweSun"C:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1388DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{56051300-b313-7e91-344c-57658bd58f50}\oraymir.inf" "0" "6e6179ed3" "00000550" "WinSta0\Default" "00000554" "208" "c:\program files\aweray\awesun\driver\mirror"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1692"C:\Users\admin\AppData\Local\Temp\AweSun_1.6.0.34643.exe" --mod=installC:\Users\admin\AppData\Local\Temp\AweSun_1.6.0.34643.exe
AweSun_1.6.0.34643.exe
User:
admin
Company:
AweRay Limited
Integrity Level:
HIGH
Description:
AweSun
Exit code:
1
Version:
1.6.0.34643
Modules
Images
c:\users\admin\appdata\local\temp\awesun_1.6.0.34643.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\gdi32.dll
1896netsh advfirewall firewall add rule name="AweSun" dir=in action=allow program="C:\Program Files\Aweray\AweSun\AweSun.exe" protocol=tcp enable=yes profile=domainC:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2012C:\Windows\system32\cmd.exe /c verC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2092"C:\Program Files\Aweray\AweSun\AweSun.exe" C:\Program Files\Aweray\AweSun\AweSun.exe
AweSun_1.6.0.34643.exe
User:
admin
Company:
AweRay Limited
Integrity Level:
HIGH
Description:
AweSun
Exit code:
0
Version:
1.6.0.34643
Modules
Images
c:\program files\aweray\awesun\awesun.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\gdi32.dll
2384cmd /c netsh advfirewall firewall delete rule name="AweSun"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2660"C:\Windows\System32\cmd.exe" cmd.exe /c TASKKILL /PID 0 /PID 0 /FC:\Windows\System32\cmd.exe—AweSun_1.6.0.34643.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 156
Read events
759
Write events
395
Delete events
2

Modification events

(PID) Process:(3344) AweSun_1.6.0.34643.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3344) AweSun_1.6.0.34643.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1692) AweSun_1.6.0.34643.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1692) AweSun_1.6.0.34643.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1692) AweSun_1.6.0.34643.exeKey:HKEY_CURRENT_USER\Software\AweSun\SunLogin\SunloginClient
Operation:writeName:1.6.0.34643_IsInstalling
Value:
1
(PID) Process:(1692) AweSun_1.6.0.34643.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:AweSun
Value:
"C:\Program Files\Aweray\AweSun\AweSun.exe" --cmd=autorun
(PID) Process:(952) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(952) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-100
Value:
DHCP Quarantine Enforcement Client
(PID) Process:(952) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-101
Value:
Provides DHCP based enforcement for NAP
(PID) Process:(952) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-103
Value:
1.0
Executable files
27
Suspicious files
21
Text files
135
Unknown types
16

Dropped files

PID
Process
Filename
Type
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\SunloginClient_Test.zip —
MD5:—
SHA256:—
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\AweSun.exeexecutable
MD5:—
SHA256:—
1692AweSun_1.6.0.34643.exeC:\ProgramData\AweSun\sensors\distinctbinary
MD5:—
SHA256:—
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\driver\DpmsMonitor\devcon.exeexecutable
MD5:CA05A5B049F6F7F1F2629C89997E0ACE
SHA256:A0292A7DE955BFBC7A8DFFECB6D28E296D7F1E897E47BD696CDF7F4B02CEF3A1
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\driver\DpmsMonitor64\devcon.exeexecutable
MD5:B8E0122738D513986F804C322D8F28BE
SHA256:B399D41FC4BB35315D1979215E8A64720EB7CB42983C03125A6B636C5C019D79
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\driver\DpmsMonitor\oraydpms.infbinary
MD5:E83920982575A11EFC8A5520887535EA
SHA256:EC07226BD82CD2F89BAE5B36BBCE088C29C4A89F25E6E82AF8877EE1823AE9A9
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\driver\DpmsMonitor\oraydpmsx86.catcat
MD5:A6F9DFFA6DC0257349DE76355A22D87E
SHA256:8A4504DBCBEB53421314A6F4E15C1994CEFE0C8FC881EB5A2C9D70A3596E5817
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\driver\DpmsMonitor\oraydpms.sysexecutable
MD5:6188FAF23BEC90703A917ED5FED57735
SHA256:8DEC5AAA259C42C40FA241FCA25D5447C53139B772A1AAE6BA4655D237007577
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\driver\Mirror\omirhelp.dllexecutable
MD5:A4D024A4AB74C8C64F279B3736673ED3
SHA256:99B06FFA96D517A142173D8B2C9553ABFF6557813C628F9A89927F0209C0A70D
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\driver\DpmsMonitor64\oraydpms.infbinary
MD5:2B2D625BB68ADCB735E20C4918DB4E31
SHA256:63B9E482815FFD78D6AFE1272CEF19E74241BD0C0A96BE8FCC92ED0F09092D6C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
10
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1692
AweSun_1.6.0.34643.exe
142.250.185.142:80
www.google-analytics.com
Google Inc.
US
whitelisted
1692
AweSun_1.6.0.34643.exe
34.85.64.198:443
asapi.aweray.net
—
US
suspicious
3036
AweSun.exe
34.85.64.198:443
asapi.aweray.net
—
US
suspicious
2792
AweSun.exe
35.230.49.123:443
client-api.aweray.com
—
US
suspicious
2092
AweSun.exe
142.250.185.142:80
www.google-analytics.com
Google Inc.
US
whitelisted
2092
AweSun.exe
34.85.64.198:443
asapi.aweray.net
—
US
suspicious
3036
AweSun.exe
34.94.63.51:443
asapi-us.aweray.net
—
US
unknown
—
—
192.168.100.123:137
—
—
—
malicious

DNS requests

Domain
IP
Reputation
www.google-analytics.com
  • 142.250.185.142
whitelisted
sl-tk.aweray.com
  • —
unknown
asapi.aweray.net
  • 34.85.64.198
suspicious
client-api.aweray.com
  • 35.230.49.123
suspicious
asapi-us.aweray.net
  • 34.94.63.51
unknown

Threats

No threats detected
Process
Message
AweSun.exe
2021-06-28 06:27:47.567 = Debug = [monitor]PRIMARY, left=0, top=0
AweSun.exe
CLocalServer::InitConfig @ 676
AweSun.exe
2021-06-28 06:27:48.321 = Debug = [monitor]PRIMARY, left=0, top=0
AweSun.exe
2021-06-28 06:27:50.082 = Debug = [monitor]PRIMARY, left=0, top=0
AweSun.exe
2021-06-28 06:27:50.093 - Info - [http call3] new call id:1, url:https://client-api.aweray.com/softwares/AWESUN_WINDOWS/publish
AweSun.exe
2021-06-28 06:27:50.094 - Info - [http call3] id:1 create new connection : https://client-api.aweray.com:443
AweSun.exe
2021-06-28 06:27:50.094 - Info - [async dns] start resolve dns client-api.aweray.com
AweSun.exe
2021-06-28 06:27:50.180 - Info - attempt to connect server client-api.aweray.com:443(35.230.49.123:443)
AweSun.exe
2021-06-28 06:27:51.685 = Debug = ! This certificate has no flags
AweSun.exe
2021-06-28 06:27:51.685 = Debug = ! This certificate has no flags
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AweSun_1.6.0.34643.exe