File name:

epm_free_installer.17358311432903b589.exe

Full analysis: https://app.any.run/tasks/24f35112-7357-4e36-919c-242a6add40ff
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: January 02, 2025, 15:19:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
adware
gexin
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

08D336FD3B3A4FE7F44EDCAD8A34414E

SHA1:

09504F07F42D2C3F357127846BCADC2934C341E2

SHA256:

8D40C6B731C5EA67005A06402513795104E39E3D9F3266FACCAAA06F62565492

SSDEEP:

98304:9xN5Qq0/EGx7RJKSdUDeJitM44SVN/i5vsyPGVzj4i6xQPNqjR6RLZX33vLGE8KS:vbe+zI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GEXIN has been detected (SURICATA)

      • AliyunWrapExe.exe (PID: 6676)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • AliyunWrapExe.exe (PID: 6676)
      • EDownloader.exe (PID: 6584)

    • Executable content was dropped or overwritten

      • epm_free_installer.17358311432903b589.exe (PID: 6548)

    • Access to an unwanted program domain was detected

      • AliyunWrapExe.exe (PID: 6676)

    • Uses WMIC.EXE to obtain computer system information

      • EDownloader.exe (PID: 6584)

  • INFO

    • Checks supported languages

      • epm_free_installer.17358311432903b589.exe (PID: 6548)
      • InfoForSetup.exe (PID: 6648)
      • InfoForSetup.exe (PID: 6608)
      • AliyunWrapExe.exe (PID: 6676)
      • EDownloader.exe (PID: 6584)
      • InfoForSetup.exe (PID: 6956)
      • InfoForSetup.exe (PID: 7028)
      • InfoForSetup.exe (PID: 2100)

    • Sends debugging messages

      • EDownloader.exe (PID: 6584)
      • AliyunWrapExe.exe (PID: 6676)

    • Create files in a temporary directory

      • EDownloader.exe (PID: 6584)
      • epm_free_installer.17358311432903b589.exe (PID: 6548)
      • InfoForSetup.exe (PID: 6648)
      • AliyunWrapExe.exe (PID: 6676)

    • Reads the computer name

      • EDownloader.exe (PID: 6584)
      • AliyunWrapExe.exe (PID: 6676)
      • InfoForSetup.exe (PID: 6608)

    • Checks proxy server information

      • AliyunWrapExe.exe (PID: 6676)
      • EDownloader.exe (PID: 6584)

    • Creates files or folders in the user directory

      • AliyunWrapExe.exe (PID: 6676)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 7048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:01:30 03:57:48+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 186368
UninitializedDataSize: 2048
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
12
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start epm_free_installer.17358311432903b589.exe edownloader.exe infoforsetup.exe no specs infoforsetup.exe no specs #GEXIN aliyunwrapexe.exe infoforsetup.exe no specs infoforsetup.exe no specs wmic.exe no specs conhost.exe no specs infoforsetup.exe no specs infoforsetup.exe no specs epm_free_installer.17358311432903b589.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2100 /SendInfo Window "Downloading" Activity "Info_Start_Download_Program" Attribute "{\"Downloadfrom\":\"https://d1.easeus.com/epm/free/epm1950_free.exe\",\"Pageid\":\"17358311432903b589\",\"Testid\":\"a70\",\"Version\":\"Free\",\"Versionnumber\":\"19.5\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.2.0\5free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
2132 /SendInfo Window "Downloading" Activity "Result_Download_Program" Attribute "{\"Average_Networkspeed\":\"0.00B\",\"Cdn\":\"https://d1.easeus.com/epm/free/epm1950_free.exe\",\"Elapsedtime\":\"121\",\"Errorinfo\":\"228\",\"Result\":\"Failed\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.2.0\5free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6404"C:\Users\admin\Desktop\epm_free_installer.17358311432903b589.exe" C:\Users\admin\Desktop\epm_free_installer.17358311432903b589.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\epm_free_installer.17358311432903b589.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6548"C:\Users\admin\Desktop\epm_free_installer.17358311432903b589.exe" C:\Users\admin\Desktop\epm_free_installer.17358311432903b589.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\epm_free_installer.17358311432903b589.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6584"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\EDownloader.exe" EXEDIR=C:\Users\admin\Desktop ||| EXENAME=epm_free_installer.17358311432903b589.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=2.2.0 ||| INSTALL_TYPE=0C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\EDownloader.exe
epm_free_installer.17358311432903b589.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.2.0\5free\edownloader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6608 /Uid "S-1-5-21-1693682860-607145093-2874071422-1001"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.2.0\5free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6648 /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"17358311432903b589\",\"Timezone\":\"GMT-00:00\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.2.0\5free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6676C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\aliyun\AliyunWrapExe.ExeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\aliyun\AliyunWrapExe.exe
InfoForSetup.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.2.0\5free\aliyun\aliyunwrapexe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\rpcrt4.dll
6956 /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"3\",\"Errorinfo\":\"0\",\"PostURL\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=17358311432903b589&lang=English&pcVersion=home&pid=5&tid=1&version=free\",\"ResponseJson\":\"{\\"check\\":1,\\"msg\\":\\"\\u6210\\u529f\\",\\"data\\":{\\"pid\\":\\"5\\",\\"download\\":\\"https:\\/\\/d1.easeus.com\\/epm\\/free\\/epm1950_free.exe\\",\\"download2\\":\\"https:\\/\\/d2.easeus.com\\/epm\\/free\\/epm1950_free.exe\\",\\"download3\\":\\"https:\\/\\/d3.easeus.com\\/epm\\/free\\/epm1950_free.exe\\",\\"version\\":\\"free\\",\\"curNum\\":\\"19.5\\",\\"testid\\":\\"a70\\",\\"url\\":[\\"https:\\/\\/d1.easeus.com\\/epm\\/free\\/epm_free_support_16.5.exe\\"],\\"md5\\":\\"5C6B81A577CB72D4890C1D303DCFF2B2\\",\\"tj_download\\":\\"test\\",\\"referNumber\\":\\"1000000\\",\\"killSwitch\\":\\"true\\",\\"WriteLogSwitch\\":\\"false\\",\\"configid\\":\\"\\"},\\"time\\":1735831192}\",\"Result\":\"Success\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.2.0\5free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
7028 /SendInfo Window "Home_Installer" Activity "Click_Install" Attribute "{\"Country\":\"United States\",\"Install_Path\":\"C:/Program Files/EaseUS/EaseUS Partition Master\",\"Language\":\"English\",\"Os\":\"Microsoft Windows 10\",\"Pageid\":\"17358311432903b589\",\"Timezone\":\"GMT-00:00\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.2.0\5free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
Total events
2 116
Read events
2 112
Write events
4
Delete events
0

Modification events

(PID) Process:(6584) EDownloader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\EaseUS\EPM_dd
Operation:writeName:xurlID
Value:
17358311432903b589
(PID) Process:(6676) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6676) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6676) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
5
Suspicious files
3
Text files
21
Unknown types
0

Dropped files

PID
Process
Filename
Type
6548epm_free_installer.17358311432903b589.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\EDownloader.exeexecutable
MD5:75C6AA0EA529A99BE1AA7A6CE1D40EB7
SHA256:2FAE081440A24194DAE7AEAB20612CFF53F6C94E6C0D09EAD3BA2CBA70A87E46
6548epm_free_installer.17358311432903b589.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\French.initext
MD5:15F2A9EA32A78D325B9E46DD973399A9
SHA256:A3E0781372CE985A66DBC516C3C4B4CCBB2524FFC7A9EB5F446DF614AFB94E34
6548epm_free_installer.17358311432903b589.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\ChineseTrad.initext
MD5:802704E820D35785E4CFBE3DD78AE935
SHA256:DADBC522D6B9C5F9CD25EF32DE2368B6AD35D7E386279B97B9D86BE31B0E7C7A
6548epm_free_installer.17358311432903b589.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\Italian.initext
MD5:667C44ABE698BE2B1FC254CB211AD0A5
SHA256:E92FFB7D792D8FE01571A40A545FAA038F746C7EE6F8F8A5AD82E8E9989EFEDC
6548epm_free_installer.17358311432903b589.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\InitConfigure.iniini
MD5:0DF699B43B77ADF78A2B817FE02A40CD
SHA256:471A797282CB28BC85F7DC870E5C38307E651844A9F45C4A70DC8BA91919B09A
6548epm_free_installer.17358311432903b589.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\Polish.initext
MD5:29C977ED855B81F3DAAE700A6754256E
SHA256:9580D1997156ED7584056C53C74FAD54EA8C380856E246CC62C6BA216425D6E6
6548epm_free_installer.17358311432903b589.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\German.initext
MD5:8D6F85CB9F0F086CE034A1537485483B
SHA256:2210C166999E5766F2D6BBC1F4817A141549D413E5185BD496AEA37031F9F3C0
6548epm_free_installer.17358311432903b589.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\Dutch.initext
MD5:A6CB84F6C5670D142C6AD5F5F4CEC586
SHA256:231B7ED6577D842CA2D44D5A3496B9E6B66255F026F82FC594E7723F4DBD861F
6548epm_free_installer.17358311432903b589.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\InitConfigure_epms.initext
MD5:398367EFD0613214E3AE77B113EA9D2B
SHA256:C44D56BFD888832B610677426C78211D2811FE3F74FBB4E3E5846DC54EA85B8D
6548epm_free_installer.17358311432903b589.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\Arabic.initext
MD5:CBA453F3F4672B54B745DA028B8BF7FA
SHA256:391B8404A5EE90BA3B2C8D4A727B2C9A48A2C9979B895DAB3FE34FF38AF971EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
28
DNS requests
13
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6676
AliyunWrapExe.exe
GET
200
8.218.236.152:80
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=19
unknown
—
—
unknown
4712
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6584
EDownloader.exe
POST
200
3.167.227.5:80
http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/
unknown
—
—
unknown
6676
AliyunWrapExe.exe
POST
200
47.252.97.14:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_epm_downloader/shards/lb
unknown
—
—
unknown
6676
AliyunWrapExe.exe
POST
200
47.252.97.14:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_epm_downloader/shards/lb
unknown
—
—
unknown
—
—
GET
—
18.66.112.6:443
https://d1.easeus.com/epm/free/epm1950_free.exe
unknown
—
—
—
6676
AliyunWrapExe.exe
POST
200
47.252.97.14:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_epm_downloader/shards/lb
unknown
—
—
unknown
6676
AliyunWrapExe.exe
POST
200
47.252.97.14:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_epm_downloader/shards/lb
unknown
—
—
unknown
—
—
GET
—
18.66.112.111:443
https://d2.easeus.com/epm/free/epm1950_free.exe
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
5208
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6676
AliyunWrapExe.exe
8.218.236.152:80
track.easeus.com
Alibaba US Technology Co., Ltd.
HK
suspicious
4712
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6584
EDownloader.exe
3.167.227.5:80
download.easeus.com
—
US
unknown
3976
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
download.easeus.com
  • 3.167.227.5
  • 3.167.227.3
  • 3.167.227.34
  • 3.167.227.63
unknown
track.easeus.com
  • 8.218.236.152
unknown
www.microsoft.com
  • 88.221.169.152
whitelisted
easeusinfo.us-east-1.log.aliyuncs.com
  • 47.252.97.14
  • 47.252.97.12
  • 47.252.97.9
  • 47.252.97.212
  • 47.252.97.11
  • 47.252.97.8
  • 47.252.97.10
  • 47.252.97.15
  • 47.252.97.13
unknown
d1.easeus.com
  • 18.66.112.6
  • 18.66.112.38
  • 18.66.112.125
  • 18.66.112.111
unknown
self.events.data.microsoft.com
  • 52.168.117.169
whitelisted
www.google.com
  • 142.250.186.68
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
6676
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
6676
AliyunWrapExe.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Gexin Installer POST Request
6676
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
6676
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
6676
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
2192
svchost.exe
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
6676
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
Process
Message
EDownloader.exe
[6588]-15:19:50:075 ParseCmdLine param=EXEDIR=C:\Users\admin\Desktop ||| EXENAME=epm_free_installer.17358311432903b589.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=2.2.0 ||| INSTALL_TYPE=0
EDownloader.exe
[6588]-15:19:50:075 CTools::loadIni configPath=C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.2.0\5free\InitConfigure.ini
EDownloader.exe
[6700]-15:19:50:700 Json parse Data Start
EDownloader.exe
[6700]-15:19:50:700 PostData Start download url=http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=17358311432903b589&lang=English&pcVersion=home&pid=5&tid=1&version=free
EDownloader.exe
[6700]-15:19:50:700 Json url: http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=17358311432903b589&lang=English&pcVersion=home&pid=5&tid=1&version=free
AliyunWrapExe.exe
PostLogResult->statusCode=
AliyunWrapExe.exe
200
AliyunWrapExe.exe
x-log-requestid: 6776AE99F7E691789D4B16DD
AliyunWrapExe.exe
PostLogResult->requestID=
AliyunWrapExe.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
epm_free_installer.17358311432903b589.exe