File name:

drw_tr_installer.17262564531040b1587.exe

Full analysis: https://app.any.run/tasks/79f8a728-68b5-4e19-b3ca-5b23db44ce2f
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 13, 2024, 19:43:54
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
adware
gexin
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

4CB4B49F70950E4A4530D532DA48B4DA

SHA1:

8B5D9800FCB90B7D191D91F7DB07C39AC349F573

SHA256:

8E60A1E2E06869D435215F12E4C38AC9B7104563A64360FBA4DEF63EEF53ACF9

SSDEEP:

98304:AR6cVHfybTFcN8NtqZjn7SbTx3BJRb0jDPwJOgwmQznz2ALjfZkxjLelce0k0esF:a+3MwgU5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GEXIN has been detected (SURICATA)

      • AliyunWrapExe.exe (PID: 3104)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • EDownloader.exe (PID: 3984)
      • AliyunWrapExe.exe (PID: 3104)

    • Executable content was dropped or overwritten

      • drw_tr_installer.17262564531040b1587.exe (PID: 7116)

    • Reads Internet Explorer settings

      • EDownloader.exe (PID: 3984)

    • Reads Microsoft Outlook installation path

      • EDownloader.exe (PID: 3984)

    • Access to an unwanted program domain was detected

      • AliyunWrapExe.exe (PID: 3104)

  • INFO

    • Checks supported languages

      • drw_tr_installer.17262564531040b1587.exe (PID: 7116)
      • EDownloader.exe (PID: 3984)
      • InfoForSetup.exe (PID: 6304)
      • InfoForSetup.exe (PID: 1156)
      • AliyunWrapExe.exe (PID: 3104)
      • InfoForSetup.exe (PID: 6644)
      • InfoForSetup.exe (PID: 6636)
      • InfoForSetup.exe (PID: 4284)
      • InfoForSetup.exe (PID: 5700)

    • Create files in a temporary directory

      • drw_tr_installer.17262564531040b1587.exe (PID: 7116)
      • EDownloader.exe (PID: 3984)
      • InfoForSetup.exe (PID: 1156)
      • AliyunWrapExe.exe (PID: 3104)

    • Reads the computer name

      • EDownloader.exe (PID: 3984)
      • InfoForSetup.exe (PID: 6304)
      • AliyunWrapExe.exe (PID: 3104)

    • Sends debugging messages

      • EDownloader.exe (PID: 3984)
      • AliyunWrapExe.exe (PID: 3104)

    • Checks proxy server information

      • AliyunWrapExe.exe (PID: 3104)
      • EDownloader.exe (PID: 3984)

    • Creates files or folders in the user directory

      • AliyunWrapExe.exe (PID: 3104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:01:30 03:57:48+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 186368
UninitializedDataSize: 2048
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
10
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drw_tr_installer.17262564531040b1587.exe edownloader.exe infoforsetup.exe no specs infoforsetup.exe no specs #GEXIN aliyunwrapexe.exe infoforsetup.exe no specs infoforsetup.exe no specs infoforsetup.exe no specs infoforsetup.exe no specs drw_tr_installer.17262564531040b1587.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1156 /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"17262564531040b1587\",\"Timezone\":\"GMT-00:00\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
3104C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\AliyunWrapExe.ExeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\AliyunWrapExe.exe
InfoForSetup.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\aliyunwrapexe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\rpcrt4.dll
3984"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\EDownloader.exe" EXEDIR=C:\Users\admin\AppData\Local\Temp ||| EXENAME=drw_tr_installer.17262564531040b1587.exe ||| DOWNLOAD_VERSION=trial ||| PRODUCT_VERSION=2.0.0 ||| INSTALL_TYPE=0C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\EDownloader.exe
drw_tr_installer.17262564531040b1587.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\edownloader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4284 /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"3\",\"Errorinfo\":\"0\",\"PostURL\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=17262564531040b1587&lang=English&pcVersion=home&pid=2&tid=1&version=trial\",\"ResponseJson\":\"{\\"check\\":1,\\"msg\\":\\"\\u6210\\u529f\\",\\"data\\":{\\"pid\\":\\"2\\",\\"download\\":\\"https:\\/\\/d1.easeus.com\\/drw\\/trial\\/drw19.1.0.0_trial.exe\\",\\"download2\\":\\"https:\\/\\/d2.easeus.com\\/drw\\/trial\\/drw19.1.0.0_trial.exe\\",\\"download3\\":\\"https:\\/\\/d3.easeus.com\\/drw\\/trial\\/drw19.1.0.0_trial.exe\\",\\"version\\":\\"trial\\",\\"curNum\\":\\"19.1\\",\\"testid\\":\\"TR191_202495release-090510\\",\\"url\\":[],\\"md5\\":\\"993F4EDDAF13A2F1745A40291A68EDB8\\",\\"tj_download\\":\\"test\\",\\"referNumber\\":\\"1000000\\",\\"killSwitch\\":\\"true\\",\\"WriteLogSwitch\\":\\"false\\",\\"configid\\":\\"\\"},\\"time\\":1726256655}\",\"Result\":\"Success\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
5152"C:\Users\admin\AppData\Local\Temp\drw_tr_installer.17262564531040b1587.exe" C:\Users\admin\AppData\Local\Temp\drw_tr_installer.17262564531040b1587.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\drw_tr_installer.17262564531040b1587.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5700 /SendInfo Window "Downloading" Activity "Info_Start_Download_Program" Attribute "{\"Downloadfrom\":\"https://d1.easeus.com/drw/trial/drw19.1.0.0_trial.exe\",\"Pageid\":\"17262564531040b1587\",\"Testid\":\"TR191_202495release-090510\",\"Version\":\"trial\",\"Versionnumber\":\"19.1\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6304 /Uid "S-1-5-21-1693682860-607145093-2874071422-1001"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6636 /SendInfo Window "Home_Installer" Activity "Click_Fold_Custom"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6644 /SendInfo Window "Home_Installer" Activity "Click_Install" Attribute "{\"Country\":\"United States\",\"Install_Path\":\"C:/Program Files/EaseUS/EaseUS Data Recovery Wizard\",\"Language\":\"English\",\"Os\":\"Microsoft Windows 10\",\"Pageid\":\"17262564531040b1587\",\"Timezone\":\"GMT-00:00\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
7116"C:\Users\admin\AppData\Local\Temp\drw_tr_installer.17262564531040b1587.exe" C:\Users\admin\AppData\Local\Temp\drw_tr_installer.17262564531040b1587.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\drw_tr_installer.17262564531040b1587.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
2 036
Read events
2 030
Write events
6
Delete events
0

Modification events

(PID) Process:(3104) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3104) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3104) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3984) EDownloader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3984) EDownloader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3984) EDownloader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
48
Suspicious files
3
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Arabic.initext
MD5:B334764EB0A1069F6BA04C8E1F088CD0
SHA256:D9A87257F203A80489756B8B31628FFF8D10AAB229D20A637A083059233DC54C
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\EDownloader.exeexecutable
MD5:1A7DF9803F164146E5A3632EA2F05D1F
SHA256:A868D63B166C0DB08D1F18585B6B0607C4928A03FAD264F9C976EE3CB82B3A29
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Dutch.initext
MD5:E4E098A3E165FC5ECB4CB806B7E6E9D8
SHA256:3FE882930B7C5299290AE6C0C20AE065BD915984B381436B1C3D1D1CBFC67127
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Japanese.initext
MD5:76E3CFD74C8A8C99CCD461F17CBABD4D
SHA256:64EFC20036A6CAD10DDBDB014444C55B6DB93A481EE5FE84210DEB2377918BB8
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Polish.initext
MD5:DEF85351F7FDA76B962D6DE5F86F5FE5
SHA256:E833E96EA0E4568FDDF90386AFDFF3F9BED6EA643FAF9EE6BC0938BE71344294
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Italian.initext
MD5:AF930A64DA61B99CB120C8A3222456EB
SHA256:1287CD9E6626EC2081379694A309578C1D83BCA25B2C621D1A5D4608CD7AF9BF
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Malay.initext
MD5:534A5DFA634D7B7DF7A581D4E1D08F78
SHA256:984E71C01CB1C2DFB260AE1C0F764F6BDF91E4F523F5DC4161B3D19456993CBB
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Korean.initext
MD5:81C343D7615A71FFA127E317C98B357E
SHA256:7E8E799B95A5E6F5AA8A18ACB78E6454E634AE52A4615F7A0B0740A51766A26F
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\LanguageTransfor.initext
MD5:FFE692A67871185785EC705B1CC12C81
SHA256:373BEC6E7976324FF879C2988BAB772C69336D7BCB9A32386A6021568350A824
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Mungarian.initext
MD5:35331ED66C059568C54865EF7D41087C
SHA256:F55A35E6D3CCC944D4C264E34244A127BCE54079621CAB25D9E8E53CC1F9AC07
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
40
DNS requests
16
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3104
AliyunWrapExe.exe
POST
200
47.252.97.11:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
unknown
—
—
unknown
3104
AliyunWrapExe.exe
GET
200
8.218.236.152:80
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=2
unknown
—
—
unknown
3104
AliyunWrapExe.exe
POST
200
47.252.97.11:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
unknown
—
—
unknown
1436
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3104
AliyunWrapExe.exe
POST
200
47.252.97.11:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
unknown
—
—
unknown
3984
EDownloader.exe
POST
200
65.9.95.5:80
http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/
unknown
—
—
unknown
3104
AliyunWrapExe.exe
POST
200
47.252.97.11:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
unknown
—
—
unknown
3104
AliyunWrapExe.exe
POST
200
47.252.97.11:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
unknown
—
—
unknown
6716
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
6612
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
23.32.97.216:80
www.microsoft.com
AKAMAI-AS
SE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3104
AliyunWrapExe.exe
8.218.236.152:80
track.easeus.com
Alibaba US Technology Co., Ltd.
HK
suspicious
3104
AliyunWrapExe.exe
47.252.97.11:80
easeusinfo.us-east-1.log.aliyuncs.com
Alibaba US Technology Co., Ltd.
US
unknown
1436
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1436
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
www.microsoft.com
  • 23.32.97.216
  • 88.221.169.152
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
track.easeus.com
  • 8.218.236.152
unknown
easeusinfo.us-east-1.log.aliyuncs.com
  • 47.252.97.11
  • 47.252.97.8
  • 47.252.97.9
  • 47.252.97.12
  • 47.252.97.212
  • 47.252.97.15
  • 47.252.97.14
  • 47.252.97.10
  • 47.252.97.13
unknown
login.live.com
  • 40.126.32.138
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.140
  • 40.126.32.72
  • 40.126.32.68
  • 20.190.160.14
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
download.easeus.com
  • 65.9.95.5
  • 65.9.95.40
  • 65.9.95.77
  • 65.9.95.124
unknown
d1.easeus.com
  • 18.66.112.111
  • 18.66.112.6
  • 18.66.112.38
  • 18.66.112.125
unknown

Threats

PID
Process
Class
Message
3104
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
2256
svchost.exe
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
3104
AliyunWrapExe.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Gexin Installer POST Request
3104
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
—
—
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
3104
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
3104
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
Process
Message
EDownloader.exe
[2268]-19:44:03:238 ParseCmdLine param=EXEDIR=C:\Users\admin\AppData\Local\Temp ||| EXENAME=drw_tr_installer.17262564531040b1587.exe ||| DOWNLOAD_VERSION=trial ||| PRODUCT_VERSION=2.0.0 ||| INSTALL_TYPE=0
EDownloader.exe
[2268]-19:44:03:301 Install recomand return=259
EDownloader.exe
[2268]-19:44:03:707 Install recomand return=259
AliyunWrapExe.exe
PostLogResult->statusCode=
AliyunWrapExe.exe
200
AliyunWrapExe.exe
AliyunWrapExe.exe
PostLogResult->requestID=
AliyunWrapExe.exe
x-log-requestid: 66E496056013FDA1507990DA
AliyunWrapExe.exe
EDownloader.exe
[2268]-19:44:13:631 Install recomand return=259
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
drw_tr_installer.17262564531040b1587.exe