File name:

AweSun_1.6.0.34643.exe

Full analysis: https://app.any.run/tasks/09ec264d-b906-42fb-ae19-8bfc087544cc
Verdict: Malicious activity
Analysis date: June 28, 2021, 05:27:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

3EF4CD79021FB36FCC4780732A1517FA

SHA1:

BD13DC9EDB06E58581E232DCA3E4504242A1899C

SHA256:

B62D850F3FE134226475889841F260EC8314E21702E8917AA99ADDD14A86DD96

SSDEEP:

98304:JGFMxsvzuzqS1RNNAlRKkm4qdpg8UX1GJwTO7hUootbGppjjhnCADr0WGr8WTDBX:bmun52ODg5cJPhaorzlCXpGmyg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • devcon.exe (PID: 2708)

    • Changes the autorun value in the registry

      • AweSun_1.6.0.34643.exe (PID: 1692)

    • Changes settings of System certificates

      • devcon.exe (PID: 2708)

  • SUSPICIOUS

    • Application launched itself

      • AweSun_1.6.0.34643.exe (PID: 3344)
      • AweSun.exe (PID: 3036)
      • cmd.exe (PID: 2876)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 3620)
      • cmd.exe (PID: 2384)
      • cmd.exe (PID: 872)
      • cmd.exe (PID: 3928)
      • cmd.exe (PID: 2776)
      • cmd.exe (PID: 2840)
      • cmd.exe (PID: 3388)

    • Starts itself from another location

      • AweSun_1.6.0.34643.exe (PID: 1692)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2660)

    • Creates a directory in Program Files

      • AweSun_1.6.0.34643.exe (PID: 1692)
      • AweSun.exe (PID: 3036)

    • Drops a file with too old compile date

      • AweSun_1.6.0.34643.exe (PID: 1692)

    • Starts CMD.EXE for commands execution

      • AweSun_1.6.0.34643.exe (PID: 1692)
      • cmd.exe (PID: 2876)

    • Drops a file that was compiled in debug mode

      • AweSun_1.6.0.34643.exe (PID: 1692)
      • devcon.exe (PID: 2708)
      • DrvInst.exe (PID: 1388)
      • DrvInst.exe (PID: 352)

    • Executable content was dropped or overwritten

      • AweSun_1.6.0.34643.exe (PID: 1692)
      • devcon.exe (PID: 2708)
      • DrvInst.exe (PID: 352)
      • DrvInst.exe (PID: 1388)

    • Creates files in the program directory

      • AweSun_1.6.0.34643.exe (PID: 1692)
      • AweSun.exe (PID: 3036)
      • AweSun.exe (PID: 4040)
      • AweSun.exe (PID: 2092)

    • Creates a software uninstall entry

      • AweSun_1.6.0.34643.exe (PID: 1692)

    • Executed as Windows Service

      • AweSun.exe (PID: 3036)

    • Adds / modifies Windows certificates

      • devcon.exe (PID: 2708)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 1388)
      • DrvInst.exe (PID: 352)

    • Creates files in the Windows directory

      • DrvInst.exe (PID: 1388)
      • DrvInst.exe (PID: 352)

    • Executed via COM

      • DrvInst.exe (PID: 1388)
      • DrvInst.exe (PID: 352)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 1388)
      • DrvInst.exe (PID: 352)

    • Drops a file with a compile date too recent

      • DrvInst.exe (PID: 1388)
      • devcon.exe (PID: 2708)
      • DrvInst.exe (PID: 352)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (43.5)
.exe | Win32 EXE Yoda's Crypter (42.7)
.exe | Win32 Executable (generic) (7.2)
.exe | Generic Win/DOS Executable (3.2)
.exe | DOS Executable Generic (3.2)

EXIF

EXE

ProductVersion: 1.6.0.34643
ProductName: AweSun
OriginalFileName: AweSun.exe
LegalCopyright: AweRay. All Rights Reserved.
InternalName: AweSun
FileVersion: 1.6.0.34643
FileDescription: AweSun
CompanyName: AweRay Limited
CharacterSet: Unicode
LanguageCode: Chinese (Traditional)
FileSubtype: -
ObjectFileType: Unknown
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.6.0.34643
FileVersionNumber: 1.6.0.34643
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x16066d0
UninitializedDataSize: 15753216
InitializedDataSize: 135168
CodeSize: 7340032
LinkerVersion: 14
PEType: PE32
TimeStamp: 2020:12:16 03:15:24+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 16-Dec-2020 02:15:24

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000158

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 16-Dec-2020 02:15:24
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x00F06000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x00F07000
0x00700000
0x006FFA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.9316
.rsrc
0x01607000
0x00021000
0x00020800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.70197

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
HID.DLL
IMM32.dll
IPHLPAPI.DLL
KERNEL32.DLL
MSIMG32.dll
NETAPI32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
28
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start awesun_1.6.0.34643.exe no specs awesun_1.6.0.34643.exe cmd.exe no specs taskkill.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs awesun.exe no specs devcon.exe awesun.exe awesun.exe drvinst.exe drvinst.exe awesun.exe awesun.exe

Process information

PID
CMD
Path
Indicators
Parent process
352DrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\INF\oem4.inf" "oraymir.inf:Oray:OrayMir_Inst:1.0.1.17485:c50b00d7-ae62-4936-8bc8-20e0b9f0befb" "6e6179ed3" "00000554" "000005DC" "000005E0"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
872cmd /c netsh advfirewall firewall add rule name="AweSun" dir=in action=allow program="C:\Program Files\Aweray\AweSun\AweSun.exe" protocol=tcp enable=yes profile=privateC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
952netsh advfirewall firewall delete rule name="AweSun"C:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1388DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{56051300-b313-7e91-344c-57658bd58f50}\oraymir.inf" "0" "6e6179ed3" "00000550" "WinSta0\Default" "00000554" "208" "c:\program files\aweray\awesun\driver\mirror"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1692"C:\Users\admin\AppData\Local\Temp\AweSun_1.6.0.34643.exe" --mod=installC:\Users\admin\AppData\Local\Temp\AweSun_1.6.0.34643.exe
AweSun_1.6.0.34643.exe
User:
admin
Company:
AweRay Limited
Integrity Level:
HIGH
Description:
AweSun
Exit code:
1
Version:
1.6.0.34643
Modules
Images
c:\users\admin\appdata\local\temp\awesun_1.6.0.34643.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\gdi32.dll
1896netsh advfirewall firewall add rule name="AweSun" dir=in action=allow program="C:\Program Files\Aweray\AweSun\AweSun.exe" protocol=tcp enable=yes profile=domainC:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2012C:\Windows\system32\cmd.exe /c verC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2092"C:\Program Files\Aweray\AweSun\AweSun.exe" C:\Program Files\Aweray\AweSun\AweSun.exe
AweSun_1.6.0.34643.exe
User:
admin
Company:
AweRay Limited
Integrity Level:
HIGH
Description:
AweSun
Exit code:
0
Version:
1.6.0.34643
Modules
Images
c:\program files\aweray\awesun\awesun.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\gdi32.dll
2384cmd /c netsh advfirewall firewall delete rule name="AweSun"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2660"C:\Windows\System32\cmd.exe" cmd.exe /c TASKKILL /PID 0 /PID 0 /FC:\Windows\System32\cmd.exe—AweSun_1.6.0.34643.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 156
Read events
759
Write events
395
Delete events
2

Modification events

(PID) Process:(3344) AweSun_1.6.0.34643.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3344) AweSun_1.6.0.34643.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1692) AweSun_1.6.0.34643.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1692) AweSun_1.6.0.34643.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1692) AweSun_1.6.0.34643.exeKey:HKEY_CURRENT_USER\Software\AweSun\SunLogin\SunloginClient
Operation:writeName:1.6.0.34643_IsInstalling
Value:
1
(PID) Process:(1692) AweSun_1.6.0.34643.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:AweSun
Value:
"C:\Program Files\Aweray\AweSun\AweSun.exe" --cmd=autorun
(PID) Process:(952) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(952) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-100
Value:
DHCP Quarantine Enforcement Client
(PID) Process:(952) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-101
Value:
Provides DHCP based enforcement for NAP
(PID) Process:(952) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-103
Value:
1.0
Executable files
27
Suspicious files
21
Text files
135
Unknown types
16

Dropped files

PID
Process
Filename
Type
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\SunloginClient_Test.zip —
MD5:—
SHA256:—
1692AweSun_1.6.0.34643.exeC:\ProgramData\AweSun\sensors\distinctbinary
MD5:—
SHA256:—
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\AweSun.exeexecutable
MD5:—
SHA256:—
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\driver\DpmsMonitor64\oraydpms.sysexecutable
MD5:B81D8A3363A6EC706FB7AE3BF2725499
SHA256:4D1F9B0046682FAB7CCB83548539CAC0471F824A3C224FA12D9A10CCF239EBE0
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\driver\DpmsMonitor\oraydpms.infbinary
MD5:E83920982575A11EFC8A5520887535EA
SHA256:EC07226BD82CD2F89BAE5B36BBCE088C29C4A89F25E6E82AF8877EE1823AE9A9
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\driver\DpmsMonitor\oraydpmsx86.catcat
MD5:A6F9DFFA6DC0257349DE76355A22D87E
SHA256:8A4504DBCBEB53421314A6F4E15C1994CEFE0C8FC881EB5A2C9D70A3596E5817
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\driver\Mirror\devcon.exeexecutable
MD5:21482C24B658BDFF86D87D8F118E1037
SHA256:E7FA2AAE0008293C6493FE679B2AEE893E3C22A0184903580DF8EC2683208EB3
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\driver\DpmsMonitor64\oraydpmsx64.catcat
MD5:8EF4D39EE811E92C476A273A380559BF
SHA256:568A10414ABC4F080D25A4CD528EC534DC1041167ACB623129B122D77438CDC5
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\driver\Mirror64\omirhelp.dllexecutable
MD5:7BAC5B7D7C37041BA8736AD13A4F6F9F
SHA256:A0CA49F73438C4C86039C4B14B032A81DA8D05ABE390FA797231221DB1BCB2D6
1692AweSun_1.6.0.34643.exeC:\Program Files\Aweray\AweSun\driver\Mirror\OrayMir.infbinary
MD5:C125D1A241A833DF1951AB13B570F5CE
SHA256:E9EF680716953B247E323AD22E6A02BBBEC4E7781EF85B0B9E55468A0D469CA2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
10
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1692
AweSun_1.6.0.34643.exe
34.85.64.198:443
asapi.aweray.net
—
US
suspicious
3036
AweSun.exe
34.85.64.198:443
asapi.aweray.net
—
US
suspicious
2792
AweSun.exe
35.230.49.123:443
client-api.aweray.com
—
US
suspicious
2092
AweSun.exe
142.250.185.142:80
www.google-analytics.com
Google Inc.
US
whitelisted
3036
AweSun.exe
34.94.63.51:443
asapi-us.aweray.net
—
US
unknown
2092
AweSun.exe
34.85.64.198:443
asapi.aweray.net
—
US
suspicious
—
—
192.168.100.123:137
—
—
—
malicious
1692
AweSun_1.6.0.34643.exe
142.250.185.142:80
www.google-analytics.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google-analytics.com
  • 142.250.185.142
whitelisted
sl-tk.aweray.com
  • —
unknown
asapi.aweray.net
  • 34.85.64.198
suspicious
client-api.aweray.com
  • 35.230.49.123
suspicious
asapi-us.aweray.net
  • 34.94.63.51
unknown

Threats

No threats detected
Process
Message
AweSun.exe
2021-06-28 06:27:47.567 = Debug = [monitor]PRIMARY, left=0, top=0
AweSun.exe
CLocalServer::InitConfig @ 676
AweSun.exe
2021-06-28 06:27:48.321 = Debug = [monitor]PRIMARY, left=0, top=0
AweSun.exe
2021-06-28 06:27:50.082 = Debug = [monitor]PRIMARY, left=0, top=0
AweSun.exe
2021-06-28 06:27:50.093 - Info - [http call3] new call id:1, url:https://client-api.aweray.com/softwares/AWESUN_WINDOWS/publish
AweSun.exe
2021-06-28 06:27:50.094 - Info - [http call3] id:1 create new connection : https://client-api.aweray.com:443
AweSun.exe
2021-06-28 06:27:50.094 - Info - [async dns] start resolve dns client-api.aweray.com
AweSun.exe
2021-06-28 06:27:50.180 - Info - attempt to connect server client-api.aweray.com:443(35.230.49.123:443)
AweSun.exe
2021-06-28 06:27:51.685 = Debug = ! This certificate has no flags
AweSun.exe
2021-06-28 06:27:51.685 = Debug = ! This certificate has no flags
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AweSun_1.6.0.34643.exe