hxxp://tiny[.]cc/can221

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tiny.cc/can221
Sample260417-2tfd7ahs7m

Score

8^/10

defense_evasion discovery persistence privilege_escalation upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
32	3120	msedge.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4796	netsh.exe
4464	netsh.exe
4064	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	AweSun.exe

Executes dropped EXE 15 IoCs

pid	Process
3268	Aweray_Remote_2.0.0.45399_x64.exe
2436	Aweray_Remote_2.0.0.45399_x64.exe
116	AweSun.exe
1680	AweSun.exe
380	AweSun.exe
3804	AweSun.exe
2668	AweSun.exe
3232	AweSun.exe
3412	devcon.exe
1416	AweSun.exe
1028	1054330304AweSun.exe
3536	1054330304AweSun.exe
1652	1054330304AweSun.exe
1064	1054330304AweSun.exe
5624	1054330304AweSun.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AweSun = "\"C:\\Program Files\\Aweray\\AweSun\\AweSun.exe\" --cmd=autorun"	Aweray_Remote_2.0.0.45399_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AweSun = "\"C:\\Program Files\\Aweray\\AweSun\\AweSun.exe\" --cmd=autorun"	AweSun.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000244d6-471.dat	upx
behavioral1/memory/3268-503-0x00007FF662500000-0x00007FF6668EC000-memory.dmp	upx
behavioral1/memory/3268-505-0x00007FF662500000-0x00007FF6668EC000-memory.dmp	upx
behavioral1/memory/2436-512-0x00007FF662500000-0x00007FF6668EC000-memory.dmp	upx
behavioral1/memory/116-576-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp	upx
behavioral1/memory/2436-594-0x00007FF662500000-0x00007FF6668EC000-memory.dmp	upx
behavioral1/memory/1680-679-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp	upx
behavioral1/memory/380-699-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp	upx
behavioral1/memory/2436-691-0x00007FF662500000-0x00007FF6668EC000-memory.dmp	upx
behavioral1/memory/3804-700-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp	upx
behavioral1/memory/2668-702-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp	upx
behavioral1/memory/3232-722-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp	upx
behavioral1/memory/1680-719-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp	upx
behavioral1/memory/2436-726-0x00007FF662500000-0x00007FF6668EC000-memory.dmp	upx
behavioral1/memory/3232-730-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp	upx
behavioral1/memory/3232-748-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp	upx
behavioral1/memory/1680-746-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp	upx
behavioral1/memory/3232-750-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp	upx
behavioral1/memory/1416-753-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp	upx
behavioral1/memory/1028-778-0x00007FF6DB0A0000-0x00007FF6DF48C000-memory.dmp	upx
behavioral1/memory/2436-780-0x00007FF662500000-0x00007FF6668EC000-memory.dmp	upx
behavioral1/memory/3536-782-0x00007FF6DB0A0000-0x00007FF6DF48C000-memory.dmp	upx
behavioral1/memory/1652-784-0x00007FF6DB0A0000-0x00007FF6DF48C000-memory.dmp	upx
behavioral1/memory/1064-786-0x00007FF6DB0A0000-0x00007FF6DF48C000-memory.dmp	upx
behavioral1/memory/5624-788-0x00007FF6DB0A0000-0x00007FF6DF48C000-memory.dmp	upx
behavioral1/memory/2436-790-0x00007FF662500000-0x00007FF6668EC000-memory.dmp	upx
behavioral1/memory/1680-792-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp	upx
behavioral1/memory/2436-794-0x00007FF662500000-0x00007FF6668EC000-memory.dmp	upx
behavioral1/memory/2436-805-0x00007FF662500000-0x00007FF6668EC000-memory.dmp	upx
behavioral1/memory/1680-815-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\Aweray\AweSun\driver\Mirror\OrayMir.inf	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\Aweray\AweSun\driver\Mirror64\OrayMir.inf	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\Aweray\AweSun\driver\Print\oray.ppd	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\Aweray\AweSun\driver\DpmsMonitor\oraydpms.inf	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\Aweray\AweSun\CopyRights.txt	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\Aweray\AweSun\driver\Print64\oray.gpd	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\Aweray\AweSun\driver\Mirror\oraymirx86.cat	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\Aweray\AweSun\driver\Mirror64\omirhelp.dll	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\Aweray\AweSun\driver\DpmsMonitor64\oraydpmsx64.cat	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\Aweray\AweSun\RCHook.dll	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\Aweray\AweSun\AweSun.exe	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\Aweray\AweSun\driver\Mirror64\devcon.exe	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\Aweray\AweSun\athr_swoi.dll	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\Aweray\AweSun\agent\AweSun.exe	AweSun.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\Aweray\AweSun\driver\DpmsMonitor\oraydpms.sys	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\Aweray\AweSun\driver\Print\OrayPrintProcessor.dll	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\Aweray\AweSun\driver\Mirror64\oraymirx64.cat	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\Aweray\AweSun\driver\Print64\orayprint.cat	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\Aweray\AweSun\scad\64\sas.dll	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\Aweray\AweSun\driver\Print64\oray.ppd	Aweray_Remote_2.0.0.45399_x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4660_1083371725\_locales\fil\messages.json	msedge.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3120	msedge.exe

Checks SCSI registry key(s) 3 TTPs 22 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	AweSun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	AweSun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	AweSun.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	AweSun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	devcon.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AweSun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AweSun.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AweSun\SunLogin\SunloginClient\SunloginInfo\base_encry_pwd = "uxeyIiB0kGk="	AweSun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AweSun\SunLogin\SunloginClient\SunloginInfo\base_sunlogincode	AweSun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AweSun\SunLogin\SunloginClient\SunloginInfo\base_licensepsw	AweSun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AweSun\SunLogin\SunloginClient\SunloginInfo\base_fastcodepsw = "XoBGkSFHXzQ8eWWhMXj9xpi7bKGlYZMW"	AweSun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AweSun\SunLogin\SunloginClient\SunloginInfo\base_sunloginserver = "as01-asia-std.aweray.com:443"	AweSun.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209399414221091"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AweSun\SunLogin\SunloginClient\SunloginInfo	AweSun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	AweSun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AweSun	AweSun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AweSun\SunLogin	AweSun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AweSun\SunLogin\SunloginClient\SunloginInfo\base_license = "efe7-b918-d9a1-16e1"	AweSun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AweSun\SunLogin\SunloginClient\SunloginInfo\base_fastcode = "k018985991"	AweSun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AweSun\SunLogin\SunloginClient	AweSun.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{6C2385C4-A924-4C66-82E6-CED6C2242D8D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	AweSun.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2436	Aweray_Remote_2.0.0.45399_x64.exe
2436	Aweray_Remote_2.0.0.45399_x64.exe
2436	Aweray_Remote_2.0.0.45399_x64.exe
2436	Aweray_Remote_2.0.0.45399_x64.exe
2436	Aweray_Remote_2.0.0.45399_x64.exe
2436	Aweray_Remote_2.0.0.45399_x64.exe
2436	Aweray_Remote_2.0.0.45399_x64.exe
2436	Aweray_Remote_2.0.0.45399_x64.exe
3232	AweSun.exe
3232	AweSun.exe
3232	AweSun.exe
3232	AweSun.exe
1028	1054330304AweSun.exe
1028	1054330304AweSun.exe
1028	1054330304AweSun.exe
1028	1054330304AweSun.exe
3536	1054330304AweSun.exe
3536	1054330304AweSun.exe
3536	1054330304AweSun.exe
3536	1054330304AweSun.exe
1652	1054330304AweSun.exe
1652	1054330304AweSun.exe
1652	1054330304AweSun.exe
1652	1054330304AweSun.exe
1064	1054330304AweSun.exe
1064	1054330304AweSun.exe
1064	1054330304AweSun.exe
1064	1054330304AweSun.exe
5624	1054330304AweSun.exe
5624	1054330304AweSun.exe
5624	1054330304AweSun.exe
5624	1054330304AweSun.exe
5632	msedge.exe
5632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	3232	AweSun.exe
Token: SeLoadDriverPrivilege	3412	devcon.exe
Token: SeLoadDriverPrivilege	3412	devcon.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4424	4660	msedge.exe	84
PID 4660 wrote to memory of 776	4660	msedge.exe	85
PID 4660 wrote to memory of 3120	4660	msedge.exe	86
PID 4660 wrote to memory of 776	4660	msedge.exe	85
PID 4660 wrote to memory of 776	4660	msedge.exe	85
PID 4660 wrote to memory of 4772	4660	msedge.exe	87
PID 4660 wrote to memory of 4772	4660	msedge.exe	87
PID 4660 wrote to memory of 2232	4660	msedge.exe	88
PID 4660 wrote to memory of 2232	4660	msedge.exe	88
PID 4660 wrote to memory of 2232	4660	msedge.exe	88
PID 4660 wrote to memory of 4932	4660	msedge.exe	89
PID 4660 wrote to memory of 4932	4660	msedge.exe	89
PID 4660 wrote to memory of 4932	4660	msedge.exe	89
PID 4660 wrote to memory of 772	4660	msedge.exe	93
PID 4660 wrote to memory of 1292	4660	msedge.exe	94
PID 4660 wrote to memory of 772	4660	msedge.exe	93
PID 4660 wrote to memory of 1292	4660	msedge.exe	94
PID 4660 wrote to memory of 5672	4660	msedge.exe	95
PID 4660 wrote to memory of 5672	4660	msedge.exe	95
PID 4660 wrote to memory of 4712	4660	msedge.exe	96
PID 4660 wrote to memory of 4712	4660	msedge.exe	96
PID 4660 wrote to memory of 4712	4660	msedge.exe	96
PID 4660 wrote to memory of 1912	4660	msedge.exe	99
PID 4660 wrote to memory of 2292	4660	msedge.exe	102
PID 4660 wrote to memory of 1248	4660	msedge.exe	103
PID 4660 wrote to memory of 1248	4660	msedge.exe	103
PID 4660 wrote to memory of 1248	4660	msedge.exe	103
PID 4660 wrote to memory of 5320	4660	msedge.exe	112
PID 4660 wrote to memory of 4312	4660	msedge.exe	113
PID 4660 wrote to memory of 3976	4660	msedge.exe	114
PID 4660 wrote to memory of 4796	4660	msedge.exe	115
PID 4660 wrote to memory of 4796	4660	msedge.exe	115
PID 4660 wrote to memory of 5896	4660	msedge.exe	116
PID 4660 wrote to memory of 5896	4660	msedge.exe	116
PID 4660 wrote to memory of 3268	4660	msedge.exe	117
PID 3268 wrote to memory of 2436	3268	Aweray_Remote_2.0.0.45399_x64.exe	119
PID 2436 wrote to memory of 2576	2436	Aweray_Remote_2.0.0.45399_x64.exe	122
PID 2576 wrote to memory of 1772	2576	cmd.exe	124
PID 2576 wrote to memory of 4684	2576	cmd.exe	125
PID 4684 wrote to memory of 4796	4684	cmd.exe	126
PID 2576 wrote to memory of 4688	2576	cmd.exe	128
PID 4688 wrote to memory of 4464	4688	cmd.exe	129
PID 2576 wrote to memory of 1308	2576	cmd.exe	132
PID 1308 wrote to memory of 4064	1308	cmd.exe	133
PID 116 wrote to memory of 1680	116	AweSun.exe	134
PID 4660 wrote to memory of 3756	4660	msedge.exe	135
PID 4660 wrote to memory of 3756	4660	msedge.exe	135
PID 380 wrote to memory of 3804	380	AweSun.exe	138
PID 380 wrote to memory of 2668	380	AweSun.exe	139
PID 1680 wrote to memory of 3232	1680	AweSun.exe	140
PID 3232 wrote to memory of 3412	3232	AweSun.exe	141
PID 3232 wrote to memory of 1416	3232	AweSun.exe	143
PID 3232 wrote to memory of 1028	3232	AweSun.exe	144
PID 1028 wrote to memory of 3536	1028	1054330304AweSun.exe	145
PID 3536 wrote to memory of 1652	3536	1054330304AweSun.exe	147
PID 1652 wrote to memory of 1064	1652	1054330304AweSun.exe	148
PID 1064 wrote to memory of 5624	1064	1054330304AweSun.exe	149
PID 4660 wrote to memory of 5632	4660	msedge.exe	150

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tiny.cc/can221
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fffa3f1c188,0x7fffa3f1c194,0x7fffa3f1c1a0
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,3352071103954262280,9393312572775541490,262144 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,12907693074305935206,6273269178851686676,524288 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,17826003570536991683,17653075304886996367,524288 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,4811816045071940351,8745609498669345922,2097152 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10038341253718867970,9572105264080333557,2097152 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,1264623822707016211,4508490897095218644,524288 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,3592384759724116435,14799090230234341856,524288 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,4783088804742643087,495006574979130292,524288 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5560,i,12442102886916433399,14795277853749517537,2097152 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,2987310182654494940,5202273040888596385,524288 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,2987310182654494940,5202273040888596385,524288 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,14196263365388759780,17934134861568192090,524288 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3692,i,9906096470105850717,7897660399849526439,2097152 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,4734883127770910070,3851221530172915080,524288 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,16708495520372338128,5617338179589510831,524288 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,2067041214884358521,2528645067127876309,524288 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,11017978586874560466,14380022675593510526,524288 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,18008235546039209134,10275771669743852792,524288 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:5896
- C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe
  "C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe
    "C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe" --mod=install --admin=1
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c install.bat AweSun
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ver
        5⤵
        
        PID:1772
    - - C:\Windows\system32\cmd.exe
        
        cmd /c netsh advfirewall firewall delete rule name="AweSun"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4684
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="AweSun"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4796
    - - C:\Windows\system32\cmd.exe
        
        cmd /c netsh advfirewall firewall add rule name="AweSun" dir=in action=allow program="C:\Program Files\Aweray\AweSun\AweSun.exe" protocol=tcp enable=yes profile=public
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4688
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="AweSun" dir=in action=allow program="C:\Program Files\Aweray\AweSun\AweSun.exe" protocol=tcp enable=yes profile=public
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4464
    - - C:\Windows\system32\cmd.exe
        
        cmd /c netsh advfirewall firewall add rule name="AweSun" dir=in action=allow program="C:\Program Files\Aweray\AweSun\AweSun.exe" protocol=udp enable=yes profile=public
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1308
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="AweSun" dir=in action=allow program="C:\Program Files\Aweray\AweSun\AweSun.exe" protocol=udp enable=yes profile=public
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,4658835710484302091,2522370444218438116,524288 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6456,i,4177670228712465525,12853860627134273630,262144 --field-trial-handle=2240,i,17658025127120728524,1699574851164192554,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5364

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2268

C:\Program Files\Aweray\AweSun\AweSun.exe
"C:\Program Files\Aweray\AweSun\AweSun.exe" --cmd=autorun
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116
- C:\Program Files\Aweray\AweSun\AweSun.exe
  "C:\Program Files\Aweray\AweSun\AweSun.exe" --mod=install --admin=1
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Program Files\Aweray\AweSun\AweSun.exe
    "C:\Program Files\Aweray\AweSun\AweSun.exe" --mod=uninstall --cmd=silent --pid=1680
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Program Files\Aweray\AweSun\Driver\DpmsMonitor64\devcon.exe
      "C:\Program Files\Aweray\AweSun\Driver\DpmsMonitor64\devcon.exe" remove *PNP09FF
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Checks SCSI registry key(s)
      Suspicious use of AdjustPrivilegeToken
      PID:3412
  - - C:\Program Files\Aweray\AweSun\AweSun.exe
      "C:\Program Files\Aweray\AweSun\AweSun.exe" --mod=uninstall --cmd=driver_print_x
      4⤵
      Executes dropped EXE
      PID:1416
  - - C:\Users\Admin\AppData\Local\Temp\1054330304AweSun.exe
      "C:\Users\Admin\AppData\Local\Temp\1054330304AweSun.exe" --mod=uninstall --cmd=remove_silent --path="C:\Program Files\Aweray\AweSun" --retrytime=5 --pid=1680
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\1054330304AweSun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1054330304AweSun.exe" --mod=uninstall --cmd=remove_silent --admin=1 --path="C:\Program Files\Aweray\AweSun" --retrytime=4 --pid=1680
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\1054330304AweSun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1054330304AweSun.exe" --mod=uninstall --cmd=remove_silent --admin=1 --path="C:\Program Files\Aweray\AweSun" --retrytime=3 --pid=1680
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\1054330304AweSun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1054330304AweSun.exe" --mod=uninstall --cmd=remove_silent --admin=1 --path="C:\Program Files\Aweray\AweSun" --retrytime=2 --pid=1680
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\1054330304AweSun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1054330304AweSun.exe" --mod=uninstall --cmd=remove_silent --admin=1 --path="C:\Program Files\Aweray\AweSun" --retrytime=1 --pid=1680
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5624

C:\Program Files\Aweray\AweSun\AweSun.exe
"C:\Program Files\Aweray\AweSun\AweSun.exe" --mod=service
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:380
- C:\Program Files\Aweray\AweSun\AweSun.exe
  "C:\Program Files\Aweray\AweSun\AweSun.exe" --mod=watch --pid=380
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Program Files\Aweray\AweSun\AweSun.exe
  "C:\Program Files\Aweray\AweSun\AweSun.exe" --mod=update --cmd=check
  2⤵
  - Executes dropped EXE
  PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CopyRights.txt

Path C:\Program Files\Aweray\AweSun\CopyRights.txt
Size 11KB
SHA256 1e475e209ef0b5a2535e12c7434484443a1fe5609267367b5ea0a025daa7b9c3
MD5 17d74a6b4786e9bb2cca6355941a17a8
SHA1 d8b557ceaa6f6e54a8bfcfe9f35d2ee7970efe2b
SHA512 27d59e64fade8085974bd85729ce4f9b7f383b72499384e988652b14c715aa2046404d6277c26a4b32eb8d318e3afcdb5bc4a1670fca61dddfcc377b8116fc71
SSDEEP 192:XLqHbC91CSXT62udq0PbBudEmVEOz4COzkOtDQHD9+pPcMRrsf6frs5ywXQ63g3Y:XL0C9hj62u80VuqIEDC9wykaArsSfrsz
TLSH
T11142C71F3E8483731AE183963B0949C9F31B565DBB6F6191706DC28D272BB3642BD4D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devcon.exe

Path C:\Program Files\Aweray\AweSun\Driver\DpmsMonitor64\devcon.exe
Size 95KB
SHA256 b399d41fc4bb35315d1979215e8a64720eb7cb42983c03125a6b636c5c019d79
MD5 b8e0122738d513986f804c322d8f28be
SHA1 8460cb099e76411e7b1eca3b7792cf4d6fb70a71
SHA512 caa68da2ae545038551379b9470d37f4a8da1a3637f81c839ed8d388909242aa8815f2f95402eefd3754f4db88ca6466fccb5a8cdea17a855005f3c382bb82fb
SSDEEP 1536:Yssn3wuZEJOkn+h/wo6t7qXof1F4O7Wn3hZP:YsNOjwXeXofXRW3P
TLSH
T1EAA3E90263E94609F1F77B3069B512315E777C94AE38C68E029885291FE3F90DD78BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AweSun.exe

Path C:\Program Files\Aweray\AweSun\agent\AweSun.exe
Size 16.3MB
SHA256 600445b009b59642393feb3397eff4163080c2203dd511c82997b88780a042bb
MD5 4cdc1317995650d6121fa557f084d2a6
SHA1 ada852278247f6f96137c48fd3d720045b6b7c11
SHA512 c4e87fa8724f08b792562d4969daf7ee37672cff59923878f5fe651dbd8009f8b5600a3d7adb54a3b949c6d67d759235052d5b8808a0afb22d8e8b523bc3cac5
SSDEEP 196608:Esdhy/X9BnVG+IAwPpGsRyGVM8n3pPgy5yst9Wxc35rSu:lyzi9Tdbn3p4ovtxP
TLSH
T164079F0AF26601E4C6AB8074C966D617F7653C1D03F05AF76691AAE53F33AE07E3A701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

athr_swoi.dll

Path C:\Program Files\Aweray\AweSun\athr_swoi.dll
Size 89KB
SHA256 1c63735e700323120a2859b26efafce059a1d684a073b038d8631268be3d09a1
MD5 c3d690e719532211372a6bafb63b5146
SHA1 34894b2ed603ef8f84cd77e604f8a2c06a577fb0
SHA512 a13bd07f688e265fc982e1658173636b11eaa14b659525806476d5be599c44bed9958569fe54e47f7591ef21d723c668868ade7b3a9414834ac155eb3efaf058
SSDEEP 1536:qTER1QFha/BwT2ZWbWQLF7QqekkP2o+/mo7sUpHYD5dTDbJA3h1I:qu1GhwWT7Vb/mo7sUpHm5dTDQI
TLSH
T1BD93AD203A60C172D8DA99311866C3226F7AB9319FF0C4C37F19476E4F613D1BA3A35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Program Files\Aweray\AweSun\config.ini
Size 48B
SHA256 4e7cf15569ec7aba26f63add02bd85187adabb541a84b85ffe4b963fc0bf7f0d
MD5 37cb5a52bee4b8d858eccacf962864bf
SHA1 e570431065b075eb042a9cefadf84eca140f30e8
SHA512 6d133ddff30fce27dd68fa1832758c9911cf00cbadfaee7e240a5d4be827cb0c181453419c80f8fc674ec778675416731762d7c74f712600effc1c5d91fff32a
MD5 SHA1 SHA512

Submit Download

config.ini

Path C:\Program Files\Aweray\AweSun\config.ini
Size 221B
SHA256 d3730b3fd94d74660f127efddba8602159dd5b057dae56531bdef2a7175f68c9
MD5 ea0cdb5877e52837168bb4abd6b19564
SHA1 3210df1f238b55560ae9fc8cf3d0686f7aea8fab
SHA512 3f5e5e111365ac3e1bafec7b91dcc4b408fb6ae7ebc4ea083568da932aac21df7d83334f1da095ff23c2d811506a6f02670c2e5cb824ae18530dd04e4c87354c
TLSH
T15CD0970780DA8433282007D08371B644A3C406DA0C0D880209C130D9ED80A7045160A0
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Program Files\Aweray\AweSun\config.ini
Size 221B
SHA256 bed30a5395c04b2f5f4c2fcba2441c3b6c30e9a36b9f849f0ba49a6604bce050
MD5 941346ec57de575597fe51f8e4db722a
SHA1 6eb4e4dc42a495a546688e743afe8585402eb13d
SHA512 bb6d1598d333b7c62639922f99c11b212253e1199e8f2e7b7b2cc4c3ccc819eb307173a74e693bd899dd1d4d849d567dc23dafde279db0db18db71e909f04a20
TLSH
T195D0230744DFC437187107E4C371BA55A7C44EDE0D1DD90349D571DDDD80A759D161E4
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Program Files\Aweray\AweSun\config.ini
Size 455B
SHA256 ae2e1982a4401106fff24a9c90b589a83d14d21bdd9a96231872cf84577c9666
MD5 340a5e572c1cae79484bdb504c1ec32a
SHA1 7a602cd6a8e6618086be536d4c3c7c64b8580bdd
SHA512 2370077de7c921dbc47aee578f3222ae07635df8a6ad64555254df8c0c7240c663eee99338bbdee163c660b5630ff60856bc9c8e9efc1791607fd6bece19cfad
TLSH
T1A4F0DC1A86D8C4AB081107F083783D8CE58D8E9A0E69FD8529E8B2AAEDC49381D20294
MD5 SHA1 SHA512 TLSH

Submit Download

oraydpms.inf

Path C:\Program Files\Aweray\AweSun\driver\DpmsMonitor64\oraydpms.inf
Size 2KB
SHA256 63b9e482815ffd78d6afe1272cef19e74241bd0c0a96be8fcc92ed0f09092d6c
MD5 2b2d625bb68adcb735e20c4918db4e31
SHA1 a93583a75980e1c871fe187d6e07ee743f32ee4d
SHA512 9276f85a6e000fa6c7d9587fdbd31b952c7cd8ab75494039e3f3968cfb4d9195eb1c3d3c75e2e06ea9e5edbea44c1d1a56cb6734b4ea80697d56d3255e7c8bc8
TLSH
T10651556D001741B4F843E62A7FB7B551AA4A720D70DDCC22F0DC8694A7ACD187B36A9F
MD5 SHA1 SHA512 TLSH

Submit Download

oraydpms.sys

Path C:\Program Files\Aweray\AweSun\driver\DpmsMonitor64\oraydpms.sys
Size 38KB
SHA256 4d1f9b0046682fab7ccb83548539cac0471f824a3c224fa12d9a10ccf239ebe0
MD5 b81d8a3363a6ec706fb7ae3bf2725499
SHA1 b3e145f61a9ab4ba96d21d45feccb636cd3353dd
SHA512 0c33e160345c890f89fb2909ececb12180e2fb9e2372753d815f6ff01efffd3ee67c5c07c9c0628edd5b1881c73b20b5e1ae46e727dec854d262159d7a364326
SSDEEP 768:ize3bl4cTjoa30igzfHYivrRN5aI5aq3hGn:iaBoapwfNvrT3hGn
TLSH
T1D2036BA3C3615496E9E7CA35A2F58662EEB0B0449332D7DF12B5C0222F51FD56E3C398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oraydpmsx64.cat

Path C:\Program Files\Aweray\AweSun\driver\DpmsMonitor64\oraydpmsx64.cat
Size 7KB
SHA256 568a10414abc4f080d25a4cd528ec534dc1041167acb623129b122d77438cdc5
MD5 8ef4d39ee811e92c476a273a380559bf
SHA1 c1734975e8f1b50d1d51687ae3dc67f82cf3ed00
SHA512 3e18c23614015b0b3a1af009051d04afcefcac452a08eec7a488e470ee0d4091a34343b99ffeb869b542cc2747180f96d2e1e0643fe5b03756499db598e1497a
SSDEEP 192:PF2LE+22iyoOhjXHUz1TrYSI1SGQ60fsxhQ8JSdqEy:sL+4jXHUaPSGQZa3JSYj
TLSH
T1CEF1E7A6887C8583ED5F9DA067D8E94BBC78A7C30811992D11ABF7D808837E1F71881D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devcon.exe

Path C:\Program Files\Aweray\AweSun\driver\DpmsMonitor\devcon.exe
Size 83KB
SHA256 a0292a7de955bfbc7a8dffecb6d28e296d7f1e897e47bd696cdf7f4b02cef3a1
MD5 ca05a5b049f6f7f1f2629c89997e0ace
SHA1 ac79a6aa7ec3c52395365f2f02e7a1c5fb72ec2d
SHA512 c8c8608f97882f3cf118ec79f75112613108df8f4dbed8173eacf7d88484007240915faf0456ec29e13e3b9e82e8ddabc8b3e30b7403994737ff1db9c9872a5d
SSDEEP 768:VoT7t6k+JAtbOf+XzMSLNTp6tTVof182BSOe9oKSJ2SLD0BEZWk4+N5alyHa5aBQ:wt6kBOfN+Np6thof1F4O7WNx6t3hWt
TLSH
T19983C70223E89619F5F33E3069B562310E777CA1AD3CC68D028991694BF3E90DD74BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oraydpms.inf

Path C:\Program Files\Aweray\AweSun\driver\DpmsMonitor\oraydpms.inf
Size 2KB
SHA256 ec07226bd82cd2f89bae5b36bbce088c29c4a89f25e6e82af8877ee1823ae9a9
MD5 e83920982575a11efc8a5520887535ea
SHA1 877fe2b2c5e30a8bcc7b43e400350635ac4f6e32
SHA512 0fd1584a6b2ff54646a8214a96c1daca6abbd415cc186373219c5ef5a26f23f903f4a65d8e95e75cf6b54727cb8659f0bf36f93738ae6769507cd94c160483c5
TLSH
T14351666D001B41B4F803D6267FB7B5516A4A721D70DDCC22F0DC8694A79CD187B36A9F
MD5 SHA1 SHA512 TLSH

Submit Download

oraydpms.sys

Path C:\Program Files\Aweray\AweSun\driver\DpmsMonitor\oraydpms.sys
Size 30KB
SHA256 8dec5aaa259c42c40fa241fca25d5447c53139b772a1aae6ba4655d237007577
MD5 6188faf23bec90703a917ed5fed57735
SHA1 b9eac83cc44ea95c18c629998aed2d5e09116ea6
SHA512 4c6a5f357d8380cee911b265a8a17f30f75561f46ab1b233751c49c29fb0753d2a7f67f44f443310fe43051901a329778722cd0e0d69e9c7473561a930af80a1
SSDEEP 768:8SJELqkgTcmbvpGpZYlgmV1BnZN5abE5aT3h1G:8SJELPmb2wBAd3h1G
TLSH
T107E27D5426968CA2FCD68EB176FE65112D7AF5C01B72C9DB045880D8DED8FC23E2821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oraydpmsx86.cat

Path C:\Program Files\Aweray\AweSun\driver\DpmsMonitor\oraydpmsx86.cat
Size 7KB
SHA256 8a4504dbcbeb53421314a6f4e15c1994cefe0c8fc881eb5a2c9d70a3596e5817
MD5 a6f9dffa6dc0257349de76355a22d87e
SHA1 903152b833586d3aed53b47a932639298bf1fbfa
SHA512 b3233c89d024ca429adae6552256cbcbf11b0777f19221cc582a678843cfc1e8ed64f34c33ee6b95782a2ad17710edb9dbedec648f8045e94f3473725f777498
SSDEEP 192:ggrouQDPyo0hjXHUz1TrYSI1SGQ60fsxhQ8e5VRKV:ggxQyjXHUaPSGQZa3e5Vy
TLSH
T10FF1E8E2897C8147ED5F9CA167E8E987BC78E3C308019939126BF7E809837D5B70881D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OrayMir.dll

Path C:\Program Files\Aweray\AweSun\driver\Mirror64\OrayMir.dll
Size 42KB
SHA256 e6642ce46afc09f13cbfbb12a3e691b91015a4bf74bd2b6f43fccc366a6655df
MD5 33f1d65e79592f012512d791b2db71cc
SHA1 f8c4fdd3998b37e2dc74b00a745b7fa4329c7784
SHA512 c3ef7b1d683823e72e1f975dc9f6829b82296c4d57df17b176daf5d79ce0ba8bcccda9572fc7bc5422f31348cf1c9e21559ff718c1e252f22243c210922e024d
SSDEEP 768:dJvq4V1CxTRf0mcic31wXYvqfRUsX/JpsKmcRN5a35ac73h+p:W4V1Cfcj7WXYvqfRUs5w3h+p
TLSH
T184134CD183669862E0ABC730A2928E17FEB1F54457A4C3EF0164C0666F82FD56E7C778
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OrayMir.inf

Path C:\Program Files\Aweray\AweSun\driver\Mirror64\OrayMir.inf
Size 2KB
SHA256 911aebeb980746cc03083cf720ecb2f5f0d62e731cb84c207524f1dd7849abf6
MD5 7f40a58b00a40048eb31761519dece03
SHA1 b84ceb5cd8206ab32ef276d96331709b016e90e7
SHA512 037346ba9fc3916fe21f86cf5d3df39677f0cc24f250b33b3e6e7e8193f0e01342f3b95a5ebbccea9eb6888f36b78dfcc6f2987ca6d0db8593444b73f7fe3a93
TLSH
T1C351531A51870EF46B0B330DFB0F2AC2273612C890D99B05738C962557AD84EB7655ED
MD5 SHA1 SHA512 TLSH

Submit Download

OrayMir.sys

Path C:\Program Files\Aweray\AweSun\driver\Mirror64\OrayMir.sys
Size 18KB
SHA256 6fb4d9ac09882ccdbd0acf68a3066247de662b042c57d554858b59118e09caa7
MD5 df23c50cf8043006e3564eff968c609b
SHA1 fd8d79c98dbbb60545e5c13ff446f5939a3c2d82
SHA512 d00cd07e76ce9950ac58b5fd29f5a921be70186f0ea3b7c8dc91b45da4b4cb4c2638050e64a99cbf613c70623fe1b979a7cb884b967fcef214ebd53d88df9899
SSDEEP 384:udUnYPLnhGtIW5ZsHLMmfehGtIW5ZsHLcd8JN77hh5p/:yUN5aJfP5aF3hnV
TLSH
T1D7822B964BA55802FEA7CE3031E5D627BD31B690BB70C8EF5059C0515FD4FC22AB826D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devcon.exe

Path C:\Program Files\Aweray\AweSun\driver\Mirror64\devcon.exe
Size 95KB
SHA256 439a56bd07136085b9c7bce70b9ddf556356ee7c13cd50a27d07d6a3679064f1
MD5 6939c0484cbb9145271900e41805a9e7
SHA1 fe4c14965228bebd0d104cb1d4aa2cbdb748db08
SHA512 49207a7dc7110da33fb0b3c32bc2e0b175da6963957746ceeb70de9b1bfc9d6dab04f21491c31fd8e992e1701bff337cde679f5dffbcceb54b355817515fa27b
SSDEEP 1536:issn3wuZEJOkn+h/wo6t7qXof1F4O7WJ3hHI:isNOjwXeXofXRWXI
TLSH
T162A3E90263E94609F1F77B3069B512315E777C94AE38C68E029885291FE3F90DD78BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omirhelp.dll

Path C:\Program Files\Aweray\AweSun\driver\Mirror64\omirhelp.dll
Size 20KB
SHA256 a0ca49f73438c4c86039c4b14b032a81da8d05abe390fa797231221db1bcb2d6
MD5 7bac5b7d7c37041ba8736ad13a4f6f9f
SHA1 1828d32f9026691a3ef06fd0fa18767a4ac9906a
SHA512 5b8cb53fc710a5f446b15c2fc9cfa2060e6031c71bc0dc2984f67f99f5751f4fabc368faac5e7b2e100b27f62ea35d848f9ea99acf1265323490f104e5a1cbe3
SSDEEP 384:ksyBISAmnYPLnhGtIW5ZsHLM8khGtIW5ZsHLcHW8JN77hhpN:yBISAmN5aJ5aSx3hfN
TLSH
T16392199547A49C02FAA78E3061E5D226BE31B6C0AB70C5EF006DC0515F95FD22ABC26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oraymirx64.cat

Path C:\Program Files\Aweray\AweSun\driver\Mirror64\oraymirx64.cat
Size 8KB
SHA256 301603d8e4544412146e72773ed1e827897411a8dd6bb55d91db69658be66a6b
MD5 e5f70fae718ee6c8145292c5736f4e94
SHA1 09fb9b337f5c095c7c36f6bb7028274024c1f461
SHA512 d2210947b9ebdfabd1db65d96173e77c75aabce3cae016924b60e683845f695e1b5d53cf44de07733f3b55772005ca2f521fbf7d4f02d6d89b071743b201bdbe
SSDEEP 192:5suPdoNnPyshjXHUz1TroAW5LfsxhQ8ooZU:5sljXHUyAGLa3ooy
TLSH
T1F502E7B6497C8293E91B8CA057E8E85BBC38EBD34810453D216BF7AC09837D1B71981D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OrayMir.dll

Path C:\Program Files\Aweray\AweSun\driver\Mirror\OrayMir.dll
Size 33KB
SHA256 ea4e89cc813350b730130b9af23a74da60d54a047b6005a5dd040aaabd6aeefa
MD5 b7f241553b6f73e9de12352babadcc54
SHA1 c22dcab9aabd0194c1ee22afb953e9a3e7e1d634
SHA512 da33bb12dbb65319fdd46493635cd4c3e9ff9d1dd77bebbdc93ab3e4de13ec381f2c0efabfcc600983104f794afc2aafc6e6280f5e60732796fd599b21acc879
SSDEEP 768:YzoFySaXRfiEzwvu/R3hFR1dUWcqNfcN5aUd5a3l3hou:YQoRfiEeu/R3zR1syfG+3hou
TLSH
T106F25D91B7A54862DCD75A3030AA8D2AEF35B7C07767C1FF015880689F95BC22E3C769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OrayMir.inf

Path C:\Program Files\Aweray\AweSun\driver\Mirror\OrayMir.inf
Size 2KB
SHA256 e9ef680716953b247e323ad22e6a02bbbec4e7781ef85b0b9e55468a0d469ca2
MD5 c125d1a241a833df1951ab13b570f5ce
SHA1 f92553371081d2c37dca5854b44c7654707d08c9
SHA512 05e544ad7992cd7a652df1a9067da8b0fda2d733175254652f4df516514523552dbc64e6f8030084fa504c99214ac019fffd5dcaf7ff799b459e236b41b8b2c3
TLSH
T10651531A52830EF5270A730EFB4F2AC3273612C890D5DB15B38C961147AD88EB7654ED
MD5 SHA1 SHA512 TLSH

Submit Download

OrayMir.sys

Path C:\Program Files\Aweray\AweSun\driver\Mirror\OrayMir.sys
Size 16KB
SHA256 a55e312e76f531701be8b170706492a67f2eb20e50d7af3c1149dce24338ac59
MD5 48f4aa0ca2754421966f0283775ad38d
SHA1 c99b28b50091ec03cc394a0a3a36a54d37e29d3c
SHA512 3c0d54958404c716f88b4be68db2e206a9f58e2ae61125aa4283ed778a8802c39e3f9ad85efc0f25210da79395fbcc98fa2d67722a49f2e00fb4abe018956db9
SSDEEP 384:1yrdhdnYPLnhGtIW5ZsHLYJFuwhGtIW5ZsHLU08JN77hh0q:1yphdN5aT55ay3hSq
TLSH
T1F0722A858B655C02FEE7CE3030E5D667AD31BA90BE70C8AF506DC0415F94F932AA813D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devcon.exe

Path C:\Program Files\Aweray\AweSun\driver\Mirror\devcon.exe
Size 83KB
SHA256 e7fa2aae0008293c6493fe679b2aee893e3c22a0184903580df8ec2683208eb3
MD5 21482c24b658bdff86d87d8f118e1037
SHA1 63c77c600e3df61de284ea237e810244da5dc647
SHA512 3a72905721bec52f60ba481893c2bd25bccc32e474ced94f65d9ebf5d17ec2ad56b52dab25d176b9ec70dae2b2697fefde2964225e24cdc71b3941756a4a2ed2
SSDEEP 768:BoT7t6k+JAtbOf+XzMSLNTp6tTVof182BSOe9oKSJ2SLD0BEZWkJ+N5axy/5aI3R:8t6kBOfN+Np6thof1F4O7WM943hwo
TLSH
T15283C70263E89619F5F33E3069B562310E777CA1AD3CC68D0289915A4BF3E90DD74BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omirhelp.dll

Path C:\Program Files\Aweray\AweSun\driver\Mirror\omirhelp.dll
Size 18KB
SHA256 99b06ffa96d517a142173d8b2c9553abff6557813c628f9a89927f0209c0a70d
MD5 a4d024a4ab74c8c64f279b3736673ed3
SHA1 844039c2abeb0f3c5f82460e3abff6a5a526ecc8
SHA512 b64541bc8e5ca7c8d18a1ae368284081b0cb2351a7f7509fc1997352f764b895810de4ba0be2180950bdf4629259b94dbd2511191a3391e72b4023fe826ccd8e
SSDEEP 384:iedFZnYPLnhGtIW5ZsHLYZuhGtIW5ZsHLUU8JN77hh7bl:dFZN5aE5ae3hZx
TLSH
T120821A469B685803FEA7CE7031E5D626AD32F6C0BF70C5EF0059C0556F91B923EA822D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oraymirx86.cat

Path C:\Program Files\Aweray\AweSun\driver\Mirror\oraymirx86.cat
Size 8KB
SHA256 d9dcacedf971cc241e890d65c7ccec947931d1f00f57d28052db04febf6829fe
MD5 ab2c0c1b3281379461d9f9b33b7cc7bb
SHA1 16abd30513594b5137633ce8c09c187dcc8d9694
SHA512 b81a289a50c0d68eafd8d326f14c52899c09cdf9eadb4a83ad39d7c20412563cfe63a9c6c9bcdb797ee4b91b2552ce9fdb5ced6f189626123222d83086a6fa20
SSDEEP 192:YHU02G77bPyIhjeyveCtAW5LfsxhQ8gEzI:YSs7LjpvjAGLa3HI
TLSH
T17E02E7B2497C8183E96B9CE157E9F85BBC39E7D35801993E216BF3A408837D1734982D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oray.gpd

Path C:\Program Files\Aweray\AweSun\driver\Print\oray.gpd
Size 5KB
SHA256 8e3120d35fa97e78d6cd029216d647e6da1824e05814800877546225eddb32f2
MD5 099014165be15c5833535a3129bd2308
SHA1 d2fa4d5034db3acc30f2e110229d5bff59103bf9
SHA512 a2b6267c2aa24ba17ea17e26d21737a6572773cfc823464377e46dd0ed819913f5249c32659da4ac64e7a1523d81ae3b8832f098f2c7575dc06e8ea57667118e
SSDEEP 96:1C2quyAHEU08uRW7V/XWkpOC/dQ9vmfx980XxGbPsQMMEgi9A2b/o9gDl1G3nFr0:0iEJRwl+0z1BcEQNli2oFkFAZ
TLSH
T1FAB1A05D39C0A2C9767BDFF723B35D02F9A61A5B88B5D865359EBEB40FB50109200E0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.bat

Path C:\Program Files\Aweray\AweSun\install.bat
Size 2KB
SHA256 3f97122c8c4ca2dfc35f38c525ad39d05af9501dd289b6926be3fa408d902bd7
MD5 803a1345c5c572256d2cf7dc3e50b9f7
SHA1 e29fe1aef1906dfe04eccc1de49989463ce1b08b
SHA512 a6ca450362e09c5ec91078cbb460a59ce5d82cdf9f3265712952c662f251fad1c5ceb21644253fc8417c319b511ee64359b9d6147fed0e6c8325805ff2cb0394
TLSH
T1C251EE018C6C21965FA2A7F477915785F70DF60D781DEA882FE2713FE80196103EE697
MD5 SHA1 SHA512 TLSH

Submit Download

Aweray Remote.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Aweray Remote\Aweray Remote.lnk
Size 2KB
SHA256 c8945ff1d7ffd59979f719445845803bdeaa7a83207a9e85aaf51400dc0bf21f
MD5 de9785f826eaee1179c50d8e8fd452b4
SHA1 2de94eab080e98b90ab259dfcb388b71f2c1e9e2
SHA512 70e82289f24707579ed838ae5be0eed89e44a7687c91c8813357bf0ca5ef42a48df3accb47f47150e824cf707d015d4c4ce78b0d56c3a6144137556ef5895b98
TLSH
T15E419A0606D59BA6EBB3A735DB797A215737FC06EA370B9E82C10B8140A11201458F7A
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall Aweray Remote.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Aweray Remote\Uninstall Aweray Remote.lnk
Size 2KB
SHA256 fbdf4598d1d4da174010e1aacf84d65014d746988af77632b3c9de328c13430a
MD5 44e87613682ea147628e04aa2b5b5678
SHA1 1f0635f03f2af743dcad58bf3a2d46a6c55b9baf
SHA512 8896d0d48861717239c520106e54378075d187c540d7f573edfefb75aa4048ea98c75a6a61182dfe1befa19f7f9bf22616abb8b697a815da885957ab8d23e9f1
TLSH
T15741780606D59BF2EBB3A735DB79AA215737FC06EA370B9E82C10B8100A51202458F7A
MD5 SHA1 SHA512 TLSH

Submit Download

distinct

Path C:\ProgramData\OrayClient\sensors\distinct
Size 36B
SHA256 495024a40615259edbf916e52364d40d3667450d07a38662bb6ff1d72eac8351
MD5 c1a141344c11b6b43c0c21e994949c61
SHA1 c80b2ba02074605bc77435006fa16722c023361a
SHA512 c33d6412abb768f57e8cafdf992d1422ad8ec361a3851b0d7228243dcd828a5c20dc785ca4e9a689873ac20c005dece3c8db0466af25f11ec09907e5e75a0d57
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 21fc5fbcbc34dafe7f047cf26c87de50d3dcc7310190b6803d5a1d4bf122ce50
MD5 e2e32110e39fdb351c7ecb15db37cd3f
SHA1 fb5d77c81906d457242a994c9c5b147815fa803b
SHA512 88967f36c707a03be219928f47f3cd12507e7a49ffbd2087bd4bd1c36958e6737a2d371e4416e548c3b3540d2361cbdf56eb20ee54f8f6ca366549e60e4ebcda
TLSH
T1C1E02BA5CC72AC2B08FD1F1850551686EB5423872781484B7A3C93088FB1A37459AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4ae407738465c90b1a877926d987866f49aaf2a5a71c72925a523bc84c465218
MD5 0b252809d8a348fcf114adb1ef9ddc24
SHA1 462297a6a224a030843e736c0f64004dc961f157
SHA512 fb5c10428ea421d1766ddde353b0e9a279bbb03da1d7a67e7011faad2991a58a317a2ff6c398c3ce827fe222379e300a6fe3e46b13ed80a8b67a5d41511d6fd2
TLSH
T17841AEF783E8856ECA0195F0BA187E2BCF2D0910532C3D5A89E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c7eb106472e7addb45958dfb6120990e83eae686719d8906b6bea6c67e822cf3
MD5 3576fd47e7c0455d848cfb153de08f51
SHA1 76dab690e9423b1e955feb4b066a271d07ddcf62
SHA512 c16e8cdeeac510089758f2308bec05ba541efa84e20d8ad6162a830ee1cfbb3bd7ee650124e3ff911c5a98d994f743c7f66bfd15ce3b773337c61d1bf0f30873
SSDEEP 192:sxZ/2R4yMqZ/K1Ml8M96/fjsd7aVvyYqrjUdzodpLHW6+WNGYKS87m/RIgjoJ:sxZ/2716/fjslatyYiXLHbGdmljM
TLSH
T13F62E7156A38997BCCCBD619FA857F53D7F9152391900E4499FCCA0C00EAADD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7375172c247145950cbfb84d7ceab3c263c88f19fba91ddc76b49b67e8a6dd2f
MD5 ac0293bb9913c0b576e74ad8f208f406
SHA1 13fc6fc55d47ccd5bb71ef1aef548b3e4a07b65a
SHA512 a8ce8386aa36ed824cf271ea2315e15c2c16534776a57a946a86379b81ea62f30382e20ad59ec218e84f77dc5e238cb499fa2b2268bd72452321207e2594bd15
SSDEEP 192:sxZ/2R4yMqZ/K1Ml8UQM696/fjs777VvyYqrjUdzodpLHW6+WNGYKDQzm/RIg5/u:sxZ/27qMM6/fjsP7tyYiXLHbGwml3s
TLSH
T19F72E7156A38993BCCC7D61AF9957B53D7F9152391900E449AFCCA0C00EAADD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 87188055b170eb28a77ed3e99444a885212817e477d423c7173e76878b33d42a
MD5 91d7bd468f8d84abbd0c8c33f9846221
SHA1 bb24614ab9d7104d45043d632c67c46e259097b0
SHA512 eb608b83c038a1c75dec5c45d5654d371eeadc3578d72c9fcd1ffea859d12f2174f4559f563f344f1c29bf090f7fb71a561e7d9da32e723a48d68059b6b0fa29
SSDEEP 768:DcgLiAo7pLuL/aeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBMKJLlhzCpUrow:DcgLiAUE/aeWvaShqu1jasMKJLDOp/w
TLSH
T15FF20C3B6C0CCB7E4F844E9CDC2A7E8E6DE8028B9698C95447FA444C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 b479684d181e65673a67f04d95058d6dbfe80f87ec362689f1b7182828038131
MD5 30f63fc4b5c52624f1388b331a1fb6d0
SHA1 765de6977cdb4d9b5ae67c32b528fd84e56d7652
SHA512 9398b664286ab05e2a55775bf89f3bc0f03313c324307743e7c0041c73041c458af4aa103b416c407aa5d201ddb28361f76a679b4e04d3556fdfa8e7770109f9
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BzRB/Fg:krN/INhx+kcxKBzxzr/m
TLSH
T119B24A11317B42953A7E298A8594B42F76C2306330D8B93B7BB914A60F6BE20DDFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 95ef9f5e5aff1efef06f6fb38fce52a745e1f9619ef2b014db12b1bb8c586e51
MD5 8bad0da277a341146be4dfd8f1051230
SHA1 faa8d2de33ad39c9f273d8926b4ce02689ca74ce
SHA512 01dac35df8e046b9c77a91250b0fb64559971718f8d168a71bdddddd369ed3200d4520efac2864438872f3cb2c4ae0f3fec81cd019ec597b1c16e30784fc0c9e
SSDEEP 384:nLiFavqMg3sNZ8TUNTUlIm2ZTPENU6OwfjYLzREzGen+j3Ra43GrN1k+5vI+8:mFayv3wwgHnuYLWbS3RaDA
TLSH
T19DC25A35E858CABBEDEA8FC9A74A7A07EEE00267D58C4AD4DAD81D0D00D71DE1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0cba4a0f9e25778b6691aa7a64196cdfce4c9f21f1175ae27d1934c68f214f63
MD5 5c846d12d2643ac48413023b0b8667a4
SHA1 938e74883c6ed8a65dcf69ce5735c3dc881c212d
SHA512 98a2f504003fce6969932f7068e7a45448a793b2c2766f70e33ad9880516839e693fc148c18a2b390f6bb9d3f0eb4659d3df325696cb8f6fb3c25db829a2ba60
SSDEEP 384:nIiFJjccCs+Bt0S3YsNg8TUNTUlI4bZTPJWDOwfjYLzREzGe13BgSBFlzrN1k+5Z:TFJccQ49wgi0JYLWTgS9yO
TLSH
T1ADC24B32E8A4DA7BEDE78F9AB7597607AEF01163858C5AD4DAC85D0C00C71DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4cb2d1f362f6fdd7ba8736df5a560cc4b13aa887876ac0a41e73db0ac73684b0
MD5 f9e1d6ee60f668e2018e841f38ca5fab
SHA1 b4b2a0b1b53c913e726cd26dde05cf0c16147e82
SHA512 00b22e216c1ad466dcc53b689c23172449fbecb214456665a9f4c4a964366565bed5cef38b20233cdde484e9a0995dac9dfe8af46d2fecdccd7783784398ac2b
SSDEEP 384:nQiFavqMg3sN08TUNTUlIm2ZTP7hwOwfjYLzREzGe13og3Ra43GrN1k+5vI+8:rFayv3NwgHpwYLW2g3RaDA
TLSH
T1A7C23A31E858DAABEDEA8FD9B74A7603EEE04267D58C4AD4DAD81D0D00C71DE130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9f5402627b62d3604d699bfc7b394189675844d05644b78ab71e73c223536a64
MD5 99445195cfb7749702e08c27de8ac6b4
SHA1 46bf47522f892b221a49ffa8a4b9b191c6ce4879
SHA512 4935dda61dc6e1add30b4d62f5fa11446f29c371d8cdc62c5505f4485b62d24644b21e96cdfca13646091361ef26184f8c98c1a7855d12eacbc5b2d44381e5ef
SSDEEP 384:nPiFFjccCs+Bt0S3ksNg8TUNTUlI4fZTPJWDOwfjYLzREzGe13BgSBFlzrN1k+5Z:aF1ccQE9wge0JYLWTgS9yO
TLSH
T17FC23A32A8A4CABBEDE78F9AB7597607AFF0116385885AD4DAC85D0C00C71DE170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d5439f9f0a15edb41526b6b1402c123bb2fb18936842a3a6594f7708be811c17
MD5 c148e851dcee2c08827f1459e752043b
SHA1 0977d5bd644f58a4c56bbca003b700b3096e6529
SHA512 c57047dc4c709bde21eb1ce1dcd36cbeed96bc2adec714b39fa97d71539d09e8c91a1139ad36ba0fb7e06ce7baab96d3c60837dc7a6ed6e81e97e072a1f2a4c0
SSDEEP 384:nPiFJjccCs+Bt0S3YsNg8TUNTUlI4bZTPJWDOwfjYLzREzGe13BgSBFlzrN1k+5Z:aFJccQ49wgi0JYLWTgS9yO
TLSH
T157C23A32E8A4DA7BEDE78F9AB7597607AEF01163858C5AD4DAC85E0C00C71DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1a00903c54a79ccb25d0b129eb31ad38a31a463437075f493e62128115c63ab5
MD5 a3224ba38bb59bdfb85a46e31f2a2ae7
SHA1 d1b00624fba0593a34951ff91a677be8893ced46
SHA512 2db06d9e9df79e8d39c338b26e2f1b6cc042e86b3d26448708b3fa3959c1f90c24a24251da34080aa0c058db87ea6d8724b47a6f9d7dbef8aa78f5726434726d
SSDEEP 384:n1iFFjccCs+Bt0S3aAsNg8TUNTUlI4fZTPJWDOwfjYLzREzGe13xgSBFlzrN1k+j:8F1ccQZ9wge0JYLW/gS9yO
TLSH
T103D23A32E8A4CA7BEDE78F9AB7597607AEF0116385885AD4DAC85D0C00CB1DE170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eba4ad16-ca1d-40c3-8ba2-4ae9e8285803.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eba4ad16-ca1d-40c3-8ba2-4ae9e8285803.tmp
Size 25KB
SHA256 dfeb997acd2677ca158326d0d42887c82ff9cdc36466a55c09d923601298dc2d
MD5 c7e3a99ade4e3f487725461963a5b73c
SHA1 82e46111143c2beafd942a68d5d129ee94c10f42
SHA512 7435e5ef088619532a74c23d4c330c99ad680500e182b3f56303be89c41c9a1f5b2fb7cb8ceaa5a9995d5cf77bca7d6cc31cc10f364ceefadbf4a2470a62edf4
SSDEEP 384:nIiFavqM93sNg8TUNTUlI4PZTP1WDOwfjYLzREzGe13igZwirN1k+5vI+R:TFay+39wg24JYLWggZ91
TLSH
T193C21975E864CA67EDE69FDAB74A7603EFF051A385884AD4DAD81E0D00C71DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e6c3df362bc01ce5066023e72d310f6c398c1074910b5fdacce7dfb59b94de53
MD5 c92bf1570ebec2a693b317f345ad8bf6
SHA1 98bad7ee5ff7c6d25a42b467fe91d9b79c335e7a
SHA512 94bd1f35c1fb5f010b1dbc0305d967d159d92359b56fa70d0690ba3592e4b2480207e9e63c1720670243cbe120b21c7d87750b54cf1997139fe536873e20c952
TLSH
T11C410858AAFA0158B7B77E569FF6A46E487ABC772E07905D00110D4F0623A44CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download

Aweray_Remote_2.0.0.45399_x64.exe

Path C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe
Size 23.4MB
SHA256 3d14e696b705581be3fda26eed77a9f2b020fe17b0cd751b603fe1278cb19c76
MD5 c8f2d7a8ec0fdd9666aa35aa5197a02b
SHA1 4a065f650b99dd00df393769ab20f2c26de3adf4
SHA512 9e39ae4b6ec5769fda7dd1e51ee706f4b932b6756d63d82bfecd96f2190c62b081cf654a02466ed7dae97ce5c2ee8437b20167689c0efa986eb707cbe2314528
SSDEEP 393216:lnqbawGW2nApVnSjn2NZO8XHLuCby7IF2MG6L+beI7N+xuIQJyiBqAn7hR:lOhiA7c2VXLuCe7C7LCnNMreD7hR
TLSH
T162373392CF861453E04C347CF21866F187C7ECAA85E520104D8AFD66B674EF3579E4AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aweray Remote.lnk

Path C:\Users\Public\Desktop\Aweray Remote.lnk
Size 1KB
SHA256 d4974070a0f2b69a42b1b7f14cc5553aa0d3c9f9b6d4abfd9827c31a12943516
MD5 e1d37e6d999fa2eb0f4b8b7642fe5ef9
SHA1 670a4722f44ba8fe436f19a90e700be3b9f6166c
SHA512 fcd3e2e80e990945309bb939dee5a6c687511aa51e7fedfae313015c6c2731e84284c6297a7d8046270b18c98365be47611c46995db742843c7a82fe4c6446a8
TLSH
T18141A90206D69BF6EBB3A736DF7D6A115337FC06EA374AEE81C10B8140B10201419F7A
MD5 SHA1 SHA512 TLSH

Submit Download

uak.0

Path C:\Windows\Temp\uak.0
Size 1KB
SHA256 5839ef0d24cd1a6d35cc176569004f90fa28f2de6e8721f3505305c7d5efb51f
MD5 8d6ebedf43e0dcc74095cbb195e363c0
SHA1 66e42e24989acfcc2800baddf99e124a5d01f500
SHA512 1a8107a95ce538ff39dd429c361e47a47b55d90e8b239514eaedbadf8349f52841fde0a0fbd6be2b36a856419f1e762e04a7dbae2201c9ab3aadc3e51cbb7313
TLSH
T1F521C85189687C061C07D1BAF48DA7D4C59523724B91FBA3196539CB0D86D0B164C8C5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/116-576-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp

Download

memory/116-585-0x00000233C9350000-0x00000233C9380000-memory.dmp

Download

memory/380-701-0x000001CE0B4D0000-0x000001CE0B500000-memory.dmp

Download

memory/380-699-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp

Download

memory/1028-778-0x00007FF6DB0A0000-0x00007FF6DF48C000-memory.dmp

Download

memory/1028-779-0x000001F656790000-0x000001F6567C0000-memory.dmp

Download

memory/1064-787-0x00000250BE740000-0x00000250BE770000-memory.dmp

Download

memory/1064-786-0x00007FF6DB0A0000-0x00007FF6DF48C000-memory.dmp

Download

memory/1416-754-0x000001DDE4810000-0x000001DDE4840000-memory.dmp

Download

memory/1416-753-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp

Download

memory/1652-784-0x00007FF6DB0A0000-0x00007FF6DF48C000-memory.dmp

Download

memory/1652-785-0x000001CE2C4C0000-0x000001CE2C4F0000-memory.dmp

Download

memory/1680-792-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp

Download

memory/1680-815-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp

Download

memory/1680-746-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp

Download

memory/1680-719-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp

Download

memory/1680-682-0x000001BB335D0000-0x000001BB33600000-memory.dmp

Download

memory/1680-679-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp

Download

memory/1912-205-0x0000029895D50000-0x0000029895D80000-memory.dmp

Download

memory/2268-511-0x000002C0A50A0000-0x000002C0A50D0000-memory.dmp

Download

memory/2436-513-0x0000017174950000-0x0000017174980000-memory.dmp

Download

memory/2436-691-0x00007FF662500000-0x00007FF6668EC000-memory.dmp

Download

memory/2436-790-0x00007FF662500000-0x00007FF6668EC000-memory.dmp

Download

memory/2436-794-0x00007FF662500000-0x00007FF6668EC000-memory.dmp

Download

memory/2436-780-0x00007FF662500000-0x00007FF6668EC000-memory.dmp

Download

memory/2436-594-0x00007FF662500000-0x00007FF6668EC000-memory.dmp

Download

memory/2436-726-0x00007FF662500000-0x00007FF6668EC000-memory.dmp

Download

memory/2436-805-0x00007FF662500000-0x00007FF6668EC000-memory.dmp

Download

memory/2436-512-0x00007FF662500000-0x00007FF6668EC000-memory.dmp

Download

memory/2668-702-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp

Download

memory/2668-706-0x0000018DB1BE0000-0x0000018DB1C10000-memory.dmp

Download

memory/3232-723-0x0000017C3C410000-0x0000017C3C440000-memory.dmp

Download

memory/3232-722-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp

Download

memory/3232-730-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp

Download

memory/3232-750-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp

Download

memory/3232-751-0x0000017C3C410000-0x0000017C3C440000-memory.dmp

Download

memory/3232-748-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp

Download

memory/3268-503-0x00007FF662500000-0x00007FF6668EC000-memory.dmp

Download

memory/3268-506-0x0000020FDA230000-0x0000020FDA260000-memory.dmp

Download

memory/3268-505-0x00007FF662500000-0x00007FF6668EC000-memory.dmp

Download

memory/3412-734-0x00000000004C0000-0x00000000004F0000-memory.dmp

Download

memory/3536-783-0x000002522A040000-0x000002522A070000-memory.dmp

Download

memory/3536-782-0x00007FF6DB0A0000-0x00007FF6DF48C000-memory.dmp

Download

memory/3804-705-0x000002C7FB4F0000-0x000002C7FB520000-memory.dmp

Download

memory/3804-700-0x00007FF69F600000-0x00007FF6A39EC000-memory.dmp

Download

memory/4064-589-0x000001885E200000-0x000001885E230000-memory.dmp

Download

memory/4464-573-0x00000155B2B20000-0x00000155B2B50000-memory.dmp

Download

memory/4796-571-0x00000185E78E0000-0x00000185E7910000-memory.dmp

Download

memory/5624-789-0x000001D71F940000-0x000001D71F970000-memory.dmp

Download

memory/5624-788-0x00007FF6DB0A0000-0x00007FF6DF48C000-memory.dmp

Download