File name:

drw_tr_installer.17262564531040b1587.exe

Full analysis: https://app.any.run/tasks/79f8a728-68b5-4e19-b3ca-5b23db44ce2f
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 13, 2024, 19:43:54
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
adware
gexin
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

4CB4B49F70950E4A4530D532DA48B4DA

SHA1:

8B5D9800FCB90B7D191D91F7DB07C39AC349F573

SHA256:

8E60A1E2E06869D435215F12E4C38AC9B7104563A64360FBA4DEF63EEF53ACF9

SSDEEP:

98304:AR6cVHfybTFcN8NtqZjn7SbTx3BJRb0jDPwJOgwmQznz2ALjfZkxjLelce0k0esF:a+3MwgU5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GEXIN has been detected (SURICATA)

      • AliyunWrapExe.exe (PID: 3104)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • drw_tr_installer.17262564531040b1587.exe (PID: 7116)

    • Reads security settings of Internet Explorer

      • AliyunWrapExe.exe (PID: 3104)
      • EDownloader.exe (PID: 3984)

    • Access to an unwanted program domain was detected

      • AliyunWrapExe.exe (PID: 3104)

    • Reads Internet Explorer settings

      • EDownloader.exe (PID: 3984)

    • Reads Microsoft Outlook installation path

      • EDownloader.exe (PID: 3984)

  • INFO

    • Create files in a temporary directory

      • EDownloader.exe (PID: 3984)
      • drw_tr_installer.17262564531040b1587.exe (PID: 7116)
      • AliyunWrapExe.exe (PID: 3104)
      • InfoForSetup.exe (PID: 1156)

    • Checks supported languages

      • drw_tr_installer.17262564531040b1587.exe (PID: 7116)
      • EDownloader.exe (PID: 3984)
      • InfoForSetup.exe (PID: 1156)
      • InfoForSetup.exe (PID: 4284)
      • InfoForSetup.exe (PID: 6636)
      • InfoForSetup.exe (PID: 5700)
      • InfoForSetup.exe (PID: 6644)
      • InfoForSetup.exe (PID: 6304)
      • AliyunWrapExe.exe (PID: 3104)

    • Reads the computer name

      • EDownloader.exe (PID: 3984)
      • AliyunWrapExe.exe (PID: 3104)
      • InfoForSetup.exe (PID: 6304)

    • Checks proxy server information

      • AliyunWrapExe.exe (PID: 3104)
      • EDownloader.exe (PID: 3984)

    • Creates files or folders in the user directory

      • AliyunWrapExe.exe (PID: 3104)

    • Sends debugging messages

      • AliyunWrapExe.exe (PID: 3104)
      • EDownloader.exe (PID: 3984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:01:30 03:57:48+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 186368
UninitializedDataSize: 2048
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
10
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drw_tr_installer.17262564531040b1587.exe edownloader.exe infoforsetup.exe no specs infoforsetup.exe no specs #GEXIN aliyunwrapexe.exe infoforsetup.exe no specs infoforsetup.exe no specs infoforsetup.exe no specs infoforsetup.exe no specs drw_tr_installer.17262564531040b1587.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1156 /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"17262564531040b1587\",\"Timezone\":\"GMT-00:00\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
3104C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\AliyunWrapExe.ExeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\AliyunWrapExe.exe
InfoForSetup.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\aliyunwrapexe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\rpcrt4.dll
3984"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\EDownloader.exe" EXEDIR=C:\Users\admin\AppData\Local\Temp ||| EXENAME=drw_tr_installer.17262564531040b1587.exe ||| DOWNLOAD_VERSION=trial ||| PRODUCT_VERSION=2.0.0 ||| INSTALL_TYPE=0C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\EDownloader.exe
drw_tr_installer.17262564531040b1587.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\edownloader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4284 /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"3\",\"Errorinfo\":\"0\",\"PostURL\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=17262564531040b1587&lang=English&pcVersion=home&pid=2&tid=1&version=trial\",\"ResponseJson\":\"{\\"check\\":1,\\"msg\\":\\"\\u6210\\u529f\\",\\"data\\":{\\"pid\\":\\"2\\",\\"download\\":\\"https:\\/\\/d1.easeus.com\\/drw\\/trial\\/drw19.1.0.0_trial.exe\\",\\"download2\\":\\"https:\\/\\/d2.easeus.com\\/drw\\/trial\\/drw19.1.0.0_trial.exe\\",\\"download3\\":\\"https:\\/\\/d3.easeus.com\\/drw\\/trial\\/drw19.1.0.0_trial.exe\\",\\"version\\":\\"trial\\",\\"curNum\\":\\"19.1\\",\\"testid\\":\\"TR191_202495release-090510\\",\\"url\\":[],\\"md5\\":\\"993F4EDDAF13A2F1745A40291A68EDB8\\",\\"tj_download\\":\\"test\\",\\"referNumber\\":\\"1000000\\",\\"killSwitch\\":\\"true\\",\\"WriteLogSwitch\\":\\"false\\",\\"configid\\":\\"\\"},\\"time\\":1726256655}\",\"Result\":\"Success\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
5152"C:\Users\admin\AppData\Local\Temp\drw_tr_installer.17262564531040b1587.exe" C:\Users\admin\AppData\Local\Temp\drw_tr_installer.17262564531040b1587.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\drw_tr_installer.17262564531040b1587.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5700 /SendInfo Window "Downloading" Activity "Info_Start_Download_Program" Attribute "{\"Downloadfrom\":\"https://d1.easeus.com/drw/trial/drw19.1.0.0_trial.exe\",\"Pageid\":\"17262564531040b1587\",\"Testid\":\"TR191_202495release-090510\",\"Version\":\"trial\",\"Versionnumber\":\"19.1\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6304 /Uid "S-1-5-21-1693682860-607145093-2874071422-1001"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6636 /SendInfo Window "Home_Installer" Activity "Click_Fold_Custom"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6644 /SendInfo Window "Home_Installer" Activity "Click_Install" Attribute "{\"Country\":\"United States\",\"Install_Path\":\"C:/Program Files/EaseUS/EaseUS Data Recovery Wizard\",\"Language\":\"English\",\"Os\":\"Microsoft Windows 10\",\"Pageid\":\"17262564531040b1587\",\"Timezone\":\"GMT-00:00\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
7116"C:\Users\admin\AppData\Local\Temp\drw_tr_installer.17262564531040b1587.exe" C:\Users\admin\AppData\Local\Temp\drw_tr_installer.17262564531040b1587.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\drw_tr_installer.17262564531040b1587.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
2 036
Read events
2 030
Write events
6
Delete events
0

Modification events

(PID) Process:(3104) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3104) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3104) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3984) EDownloader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3984) EDownloader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3984) EDownloader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
48
Suspicious files
3
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\skin.zipcompressed
MD5:7EB6D83983A64C85C6BC6B1CB39BE9C9
SHA256:14BE9FB17C1DA65FEAB053C5594D8EF48195DE66EE6EE40759A62795A485AC57
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Dutch.initext
MD5:E4E098A3E165FC5ECB4CB806B7E6E9D8
SHA256:3FE882930B7C5299290AE6C0C20AE065BD915984B381436B1C3D1D1CBFC67127
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\EDownloader.exeexecutable
MD5:1A7DF9803F164146E5A3632EA2F05D1F
SHA256:A868D63B166C0DB08D1F18585B6B0607C4928A03FAD264F9C976EE3CB82B3A29
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Danish.initext
MD5:EB6CB6A1EA028CAC7AE61DADC568C2F9
SHA256:4524116093969EE206FA4F04D84346349ED551B4D7B87D4206E9A12D32AF5D61
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\ChineseTrad.initext
MD5:FE7AD6D1DD07AEAFEECE921ECB23F3E7
SHA256:7EF907A793D9087AA804A688BDDDECF33A76011E4D820E7332533C070277507F
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Chinese.initext
MD5:FD6CA501ED9A613A5094EB4C92C1A847
SHA256:4637C9C3FF511C3F15CB482C5A3EE42A3237D26AD002B2FCC3FF467E7A10B99F
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Arabic.initext
MD5:B334764EB0A1069F6BA04C8E1F088CD0
SHA256:D9A87257F203A80489756B8B31628FFF8D10AAB229D20A637A083059233DC54C
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Indonesian.initext
MD5:38629FAB2999407FE8FA2DBABB097B57
SHA256:13F413DBFCBC4537D83F77E34EF0C9FA868BFA07792E990F4E94526CCEB79848
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\German.initext
MD5:DECAA2CBBACCAE2A64C588243FBD6435
SHA256:4FFD51F20C76EE5D6CBAF16EA2AB9D0A0B0491E710C42D548724D5B5AAF3D55F
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\InitConfigure.initext
MD5:59585EE1CCA2648AD7A242CE5D531E00
SHA256:79D7D5F6552BDDED7A3A89AD5458A63DBE49AC0F6AD59FAE523648AFF5141D93
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
40
DNS requests
16
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3104
AliyunWrapExe.exe
POST
200
47.252.97.11:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
unknown
—
—
unknown
3104
AliyunWrapExe.exe
GET
200
8.218.236.152:80
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=2
unknown
—
—
unknown
1436
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3104
AliyunWrapExe.exe
POST
200
47.252.97.11:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
unknown
—
—
unknown
3104
AliyunWrapExe.exe
POST
200
47.252.97.11:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
unknown
—
—
unknown
3104
AliyunWrapExe.exe
POST
200
47.252.97.11:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
unknown
—
—
unknown
3104
AliyunWrapExe.exe
POST
200
47.252.97.11:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
unknown
—
—
unknown
6716
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6716
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
6612
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
23.32.97.216:80
www.microsoft.com
AKAMAI-AS
SE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3104
AliyunWrapExe.exe
8.218.236.152:80
track.easeus.com
Alibaba US Technology Co., Ltd.
HK
suspicious
3104
AliyunWrapExe.exe
47.252.97.11:80
easeusinfo.us-east-1.log.aliyuncs.com
Alibaba US Technology Co., Ltd.
US
unknown
1436
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1436
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
www.microsoft.com
  • 23.32.97.216
  • 88.221.169.152
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
track.easeus.com
  • 8.218.236.152
unknown
easeusinfo.us-east-1.log.aliyuncs.com
  • 47.252.97.11
  • 47.252.97.8
  • 47.252.97.9
  • 47.252.97.12
  • 47.252.97.212
  • 47.252.97.15
  • 47.252.97.14
  • 47.252.97.10
  • 47.252.97.13
unknown
login.live.com
  • 40.126.32.138
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.140
  • 40.126.32.72
  • 40.126.32.68
  • 20.190.160.14
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
download.easeus.com
  • 65.9.95.5
  • 65.9.95.40
  • 65.9.95.77
  • 65.9.95.124
unknown
d1.easeus.com
  • 18.66.112.111
  • 18.66.112.6
  • 18.66.112.38
  • 18.66.112.125
unknown

Threats

PID
Process
Class
Message
3104
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
2256
svchost.exe
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
3104
AliyunWrapExe.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Gexin Installer POST Request
3104
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
—
—
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
3104
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
3104
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
Process
Message
EDownloader.exe
[2268]-19:44:03:238 ParseCmdLine param=EXEDIR=C:\Users\admin\AppData\Local\Temp ||| EXENAME=drw_tr_installer.17262564531040b1587.exe ||| DOWNLOAD_VERSION=trial ||| PRODUCT_VERSION=2.0.0 ||| INSTALL_TYPE=0
EDownloader.exe
[2268]-19:44:03:301 Install recomand return=259
EDownloader.exe
[2268]-19:44:03:707 Install recomand return=259
AliyunWrapExe.exe
PostLogResult->statusCode=
AliyunWrapExe.exe
200
AliyunWrapExe.exe
AliyunWrapExe.exe
PostLogResult->requestID=
AliyunWrapExe.exe
x-log-requestid: 66E496056013FDA1507990DA
AliyunWrapExe.exe
EDownloader.exe
[2268]-19:44:13:631 Install recomand return=259
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
drw_tr_installer.17262564531040b1587.exe