File name:

SunloginClient_11.1.1.38222.exe

Full analysis: https://app.any.run/tasks/dad383fe-5118-4814-9b83-09ff653f089a
Verdict: Malicious activity
Analysis date: May 28, 2021, 02:21:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

206CCEB18D539F76FB135F92CC7A2EF6

SHA1:

42FC4E1E2EE746BF6864F7A9796698FB300E264A

SHA256:

F35D1E7B8794A709D1A76E457ED1426DEF61BCCD65BA6C5ECC557843F3D7E6A3

SSDEEP:

393216:lPUzy4D8R/ZbkXuRfG+HqpH510Mv0E7/tGVQjLS:lcG4DuZkepw10MvtGVQjLS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • SunloginClient_11.1.1.38222.exe (PID: 3588)
      • SunloginClient.exe (PID: 2212)

    • Application was dropped or rewritten from another process

      • devcon.exe (PID: 2592)

    • Changes settings of System certificates

      • devcon.exe (PID: 2592)

    • Drops executable file immediately after starts

      • SunloginClient.exe (PID: 2212)
      • DrvInst.exe (PID: 1504)
      • DrvInst.exe (PID: 1520)

  • SUSPICIOUS

    • Application launched itself

      • SunloginClient_11.1.1.38222.exe (PID: 2440)
      • cmd.exe (PID: 824)
      • SunloginClient.exe (PID: 2212)

    • Creates a directory in Program Files

      • SunloginClient_11.1.1.38222.exe (PID: 3588)
      • SunloginClient.exe (PID: 2212)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 2512)
      • cmd.exe (PID: 2836)
      • cmd.exe (PID: 940)
      • cmd.exe (PID: 2752)
      • cmd.exe (PID: 1956)
      • cmd.exe (PID: 1900)
      • cmd.exe (PID: 2396)

    • Starts CMD.EXE for commands execution

      • SunloginClient_11.1.1.38222.exe (PID: 3588)
      • cmd.exe (PID: 824)

    • Drops a file with too old compile date

      • SunloginClient_11.1.1.38222.exe (PID: 3588)

    • Drops a file with a compile date too recent

      • SunloginClient_11.1.1.38222.exe (PID: 3588)
      • SunloginClient.exe (PID: 2212)
      • devcon.exe (PID: 2592)
      • DrvInst.exe (PID: 1520)
      • DrvInst.exe (PID: 1504)

    • Drops a file that was compiled in debug mode

      • SunloginClient_11.1.1.38222.exe (PID: 3588)
      • devcon.exe (PID: 2592)
      • DrvInst.exe (PID: 1504)
      • DrvInst.exe (PID: 1520)

    • Executable content was dropped or overwritten

      • SunloginClient_11.1.1.38222.exe (PID: 3588)
      • SunloginClient.exe (PID: 2212)
      • devcon.exe (PID: 2592)
      • DrvInst.exe (PID: 1504)
      • DrvInst.exe (PID: 1520)

    • Creates files in the program directory

      • SunloginClient_11.1.1.38222.exe (PID: 3588)
      • SunloginClient.exe (PID: 2212)
      • SunloginClient.exe (PID: 1896)

    • Starts itself from another location

      • SunloginClient_11.1.1.38222.exe (PID: 3588)

    • Creates a software uninstall entry

      • SunloginClient_11.1.1.38222.exe (PID: 3588)

    • Executed as Windows Service

      • SunloginClient.exe (PID: 2212)

    • Adds / modifies Windows certificates

      • devcon.exe (PID: 2592)

    • Executed via COM

      • DrvInst.exe (PID: 1504)
      • DrvInst.exe (PID: 1520)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 1504)
      • DrvInst.exe (PID: 1520)

    • Creates files in the Windows directory

      • DrvInst.exe (PID: 1504)
      • DrvInst.exe (PID: 1520)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 1504)
      • DrvInst.exe (PID: 1520)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (43.5)
.exe | Win32 EXE Yoda's Crypter (42.7)
.exe | Win32 Executable (generic) (7.2)
.exe | Generic Win/DOS Executable (3.2)
.exe | DOS Executable Generic (3.2)

EXIF

EXE

ProductVersion: 11.1.1.38222
ProductName: 向日葵遠程控制
OriginalFileName: SunloginClient.exe
LegalCopyright: 貝銳 版權所有
InternalName: SunloginClient
FileVersion: 11.1.1.38222
FileDescription: 向日葵遠程控制
CompanyName: 上海貝銳信息科技股份有限公司
CharacterSet: Unicode
LanguageCode: Chinese (Traditional)
FileSubtype: -
ObjectFileType: Unknown
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 11.1.1.38222
FileVersionNumber: 11.1.1.38222
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x1fbe3a0
UninitializedDataSize: 20258816
InitializedDataSize: 200704
CodeSize: 13025280
LinkerVersion: 14
PEType: PE32
TimeStamp: 2021:05:19 12:27:49+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-May-2021 10:27:49

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000168

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 19-May-2021 10:27:49
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x01352000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x01353000
0x00C6C000
0x00C6B800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.92137
.rsrc
0x01FBF000
0x00031000
0x00030600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.22495

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
HID.DLL
IMM32.dll
IPHLPAPI.DLL
KERNEL32.DLL
MSIMG32.dll
NETAPI32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
66
Monitored processes
25
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start sunloginclient_11.1.1.38222.exe sunloginclient_11.1.1.38222.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs sunloginclient.exe devcon.exe sunloginclient.exe drvinst.exe sunloginclient.exe sunloginclient.exe drvinst.exe

Process information

PID
CMD
Path
Indicators
Parent process
824cmd /c install.bat SunloginClientC:\Windows\system32\cmd.exe—SunloginClient_11.1.1.38222.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
940cmd /c netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=udp enable=yes profile=publicC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1336netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=tcp enable=yes profile=publicC:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1492netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=tcp enable=yes profile=privateC:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1504DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{63df2326-c3b9-307a-b573-2d7d407c5310}\oraymir.inf" "0" "6e6179ed3" "00000334" "WinSta0\Default" "000004D4" "208" "c:\program files\oray\sunlogin\sunloginclient\driver\mirror"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1520DrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\INF\oem4.inf" "oraymir.inf:Oray:OrayMir_Inst:1.0.1.17485:c50b00d7-ae62-4936-8bc8-20e0b9f0befb" "6e6179ed3" "00000334" "000005E8" "000005EC"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1524"C:\Program Files\Oray\SunLogin\SunloginClient\SunloginClient.exe" --mod=update --cmd=checkC:\Program Files\Oray\SunLogin\SunloginClient\SunloginClient.exe
SunloginClient.exe
User:
SYSTEM
Company:
Shanghai Best Oray Information Technology Co., Ltd.
Integrity Level:
SYSTEM
Description:
SunloginClient
Exit code:
0
Version:
11.1.1.38222
Modules
Images
c:\program files\oray\sunlogin\sunloginclient\sunloginclient.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
1736netsh advfirewall firewall delete rule name="SunloginClient"C:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1896"C:\Program Files\Oray\SunLogin\SunloginClient\SunloginClient.exe" --mod=watch --pid=2212C:\Program Files\Oray\SunLogin\SunloginClient\SunloginClient.exe
SunloginClient.exe
User:
SYSTEM
Company:
Shanghai Best Oray Information Technology Co., Ltd.
Integrity Level:
SYSTEM
Description:
SunloginClient
Exit code:
0
Version:
11.1.1.38222
Modules
Images
c:\program files\oray\sunlogin\sunloginclient\sunloginclient.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
1900cmd /c netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=udp enable=yes profile=privateC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 065
Read events
671
Write events
392
Delete events
2

Modification events

(PID) Process:(2440) SunloginClient_11.1.1.38222.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2440) SunloginClient_11.1.1.38222.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3588) SunloginClient_11.1.1.38222.exeKey:HKEY_CURRENT_USER\Software\Oray\SunLogin\SunloginClient
Operation:writeName:11.1.1.38222_IsInstalling
Value:
1
(PID) Process:(3588) SunloginClient_11.1.1.38222.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SunloginClient
Value:
"C:\Program Files\Oray\SunLogin\SunloginClient\SunloginClient.exe" --cmd=autorun
(PID) Process:(1736) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1736) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-100
Value:
DHCP Quarantine Enforcement Client
(PID) Process:(1736) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-101
Value:
Provides DHCP based enforcement for NAP
(PID) Process:(1736) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-103
Value:
1.0
(PID) Process:(1736) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-102
Value:
Microsoft Corporation
(PID) Process:(1736) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\system32\napipsec.dll,-1
Value:
IPsec Relying Party
Executable files
30
Suspicious files
19
Text files
104
Unknown types
17

Dropped files

PID
Process
Filename
Type
3588SunloginClient_11.1.1.38222.exeC:\Program Files\Oray\SunLogin\SunloginClient\SunloginClient_Test.zip —
MD5:—
SHA256:—
3588SunloginClient_11.1.1.38222.exeC:\ProgramData\OrayClient\sensors\distincttext
MD5:—
SHA256:—
3588SunloginClient_11.1.1.38222.exeC:\Program Files\Oray\SunLogin\SunloginClient\install.battext
MD5:—
SHA256:—
3588SunloginClient_11.1.1.38222.exeC:\Program Files\Oray\SunLogin\SunloginClient\SunloginClient.exeexecutable
MD5:—
SHA256:—
3588SunloginClient_11.1.1.38222.exeC:\Program Files\Oray\SunLogin\SunloginClient\driver\DpmsMonitor\oraydpmsx86.catcat
MD5:A6F9DFFA6DC0257349DE76355A22D87E
SHA256:8A4504DBCBEB53421314A6F4E15C1994CEFE0C8FC881EB5A2C9D70A3596E5817
3588SunloginClient_11.1.1.38222.exeC:\Program Files\Oray\SunLogin\SunloginClient\driver\DpmsMonitor\oraydpms.sysexecutable
MD5:DA4DE2D226359C6B3365BA71F204F0C3
SHA256:723C29AF2A2E573AC1664A65164DAD98BF6A8BF94E02BC5A52DAE1A01D277505
3588SunloginClient_11.1.1.38222.exeC:\Program Files\Oray\SunLogin\SunloginClient\CopyRights.txttext
MD5:3BA158F079A00A780929B508DA7ED724
SHA256:74A38670D91D022A1822833C4E77B40934C1F2A8EE219A0FEB78EA727CED5F91
3588SunloginClient_11.1.1.38222.exeC:\Program Files\Oray\SunLogin\SunloginClient\driver\DpmsMonitor\oraydpms.infbinary
MD5:E83920982575A11EFC8A5520887535EA
SHA256:EC07226BD82CD2F89BAE5B36BBCE088C29C4A89F25E6E82AF8877EE1823AE9A9
3588SunloginClient_11.1.1.38222.exeC:\Program Files\Oray\SunLogin\SunloginClient\driver\DpmsMonitor\devcon.exeexecutable
MD5:DEA7C7A2F6A968C4A574DF6BD22B8E97
SHA256:7FD75AECF247D44D483C6480BEAE370E9E6D5569BC1B504047279C053EAB62C9
3588SunloginClient_11.1.1.38222.exeC:\Program Files\Oray\SunLogin\SunloginClient\RCHook.dllexecutable
MD5:9E7B0955C2043524CCDDD8BE1ABBE8CC
SHA256:883F63385EFB469C42164C3B97BD6A849CEBDA76A4079F9F5E512FE59DCF7134
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2212
SunloginClient.exe
GET
200
79.133.177.228:80
http://download.oray.com/plugins/node-1.0.1.7z
RU
compressed
5.78 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3588
SunloginClient_11.1.1.38222.exe
61.142.176.18:443
client.oray.net
CHINANET Guangdong province network
CN
unknown
3588
SunloginClient_11.1.1.38222.exe
101.37.116.112:443
sl-tk.oray.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
2212
SunloginClient.exe
112.124.38.38:443
slapi.oray.net
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
2212
SunloginClient.exe
47.111.183.245:443
client-api.oray.com
—
CN
unknown
1524
SunloginClient.exe
47.111.183.245:443
client-api.oray.com
—
CN
unknown
2212
SunloginClient.exe
47.99.220.75:443
rc10-fc03.oray.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
2212
SunloginClient.exe
79.133.177.228:80
download.oray.com
SOT LINE Limited Company
RU
suspicious
2212
SunloginClient.exe
47.114.98.5:443
sl-log.oray.net
—
CN
unknown
2212
SunloginClient.exe
47.98.140.171:3000
pubsub02.oray.net
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown

DNS requests

Domain
IP
Reputation
sl-tk.oray.com
  • 101.37.116.112
  • 112.124.20.98
  • 116.62.101.24
unknown
client.oray.net
  • 61.142.176.18
unknown
slapi.oray.net
  • 112.124.38.38
  • 47.96.21.73
  • 121.40.59.15
  • 121.196.232.200
  • 121.196.235.149
  • 112.124.36.182
  • 47.110.54.142
  • 121.196.232.12
  • 121.41.74.206
  • 114.215.172.213
  • 121.196.235.44
  • 47.96.36.44
  • 47.99.218.87
  • 47.99.212.135
  • 121.40.137.32
  • 47.96.127.167
  • 120.27.156.57
unknown
client-api.oray.com
  • 47.111.183.245
  • 47.114.97.87
unknown
rc10-fc03.oray.com
  • 47.99.220.75
  • 118.178.196.138
  • 121.196.56.52
  • 121.196.56.218
  • 120.55.47.203
  • 121.196.19.0
  • 118.178.87.173
  • 114.55.250.214
  • 121.196.53.101
  • 118.178.87.158
  • 121.41.90.183
  • 47.97.245.37
  • 121.40.28.141
  • 47.99.206.67
  • 47.99.221.213
  • 47.99.189.169
  • 47.99.223.105
  • 47.99.212.198
  • 121.196.56.230
  • 118.178.127.194
  • 118.31.3.196
  • 121.196.57.95
  • 47.99.188.102
  • 121.196.54.198
  • 121.196.52.213
  • 118.178.193.89
  • 47.110.242.248
  • 118.178.85.238
unknown
download.oray.com
  • 79.133.177.228
  • 47.246.43.225
  • 47.246.43.230
  • 47.246.43.227
  • 47.246.43.223
  • 47.246.43.224
  • 47.246.43.229
  • 47.246.43.226
  • 47.246.43.228
  • 79.133.177.225
  • 79.133.177.230
  • 79.133.177.227
malicious
sl-log.oray.net
  • 47.114.98.5
unknown
pubsub02.oray.net
  • 47.98.140.171
  • 121.40.127.215
  • 47.97.111.19
  • 47.97.126.85
  • 101.37.148.156
  • 112.124.6.10
  • 118.31.13.204
  • 118.31.34.42
  • 47.97.156.111
  • 112.124.32.90
unknown

Threats

No threats detected
Process
Message
SunloginClient.exe
2021-05-28 03:21:59.242 - Info - [dpi] SetDPIAwareness isn't support.
SunloginClient.exe
2021-05-28 03:21:59.254 = Debug = [select_tracker] run ok
SunloginClient.exe
CLocalServer::InitConfig @ 608
SunloginClient.exe
SessionId:0, ConnectState:4, ClientProtocolType:0, UserName:, WinStationName:ServicesSessionId:1, ConnectState:0, ClientProtocolType:0, UserName:admin, WinStationName:Console
SunloginClient.exe
2021-05-28 03:21:59.706 - Info - [dpi] SetDPIAwareness isn't support.
SunloginClient.exe
2021-05-28 03:21:59.719 = Debug = [select_tracker] run ok
SunloginClient.exe
2021-05-28 03:21:59.999 - Info - [dpi] SetDPIAwareness isn't support.
SunloginClient.exe
2021-05-28 03:22:00.011 = Debug = [select_tracker] run ok
SunloginClient.exe
2021-05-28 03:22:00.014 - Info - [http::call3][1] new call:https://client-api.oray.com/softwares/SUNLOGIN_X_WINDOWS/publish
SunloginClient.exe
2021-05-28 03:22:00.014 - Info - [http_call3][1] create new connection : https://client-api.oray.com:443
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SunloginClient_11.1.1.38222.exe