File name:

drw_tr_installer.17262564531040b1587.exe

Full analysis: https://app.any.run/tasks/79f8a728-68b5-4e19-b3ca-5b23db44ce2f
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 13, 2024, 19:43:54
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
adware
gexin
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

4CB4B49F70950E4A4530D532DA48B4DA

SHA1:

8B5D9800FCB90B7D191D91F7DB07C39AC349F573

SHA256:

8E60A1E2E06869D435215F12E4C38AC9B7104563A64360FBA4DEF63EEF53ACF9

SSDEEP:

98304:AR6cVHfybTFcN8NtqZjn7SbTx3BJRb0jDPwJOgwmQznz2ALjfZkxjLelce0k0esF:a+3MwgU5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GEXIN has been detected (SURICATA)

      • AliyunWrapExe.exe (PID: 3104)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • drw_tr_installer.17262564531040b1587.exe (PID: 7116)

    • Reads security settings of Internet Explorer

      • EDownloader.exe (PID: 3984)
      • AliyunWrapExe.exe (PID: 3104)

    • Reads Microsoft Outlook installation path

      • EDownloader.exe (PID: 3984)

    • Access to an unwanted program domain was detected

      • AliyunWrapExe.exe (PID: 3104)

    • Reads Internet Explorer settings

      • EDownloader.exe (PID: 3984)

  • INFO

    • Create files in a temporary directory

      • drw_tr_installer.17262564531040b1587.exe (PID: 7116)
      • EDownloader.exe (PID: 3984)
      • InfoForSetup.exe (PID: 1156)
      • AliyunWrapExe.exe (PID: 3104)

    • Checks supported languages

      • drw_tr_installer.17262564531040b1587.exe (PID: 7116)
      • EDownloader.exe (PID: 3984)
      • InfoForSetup.exe (PID: 6304)
      • InfoForSetup.exe (PID: 1156)
      • InfoForSetup.exe (PID: 4284)
      • AliyunWrapExe.exe (PID: 3104)
      • InfoForSetup.exe (PID: 6644)
      • InfoForSetup.exe (PID: 6636)
      • InfoForSetup.exe (PID: 5700)

    • Sends debugging messages

      • EDownloader.exe (PID: 3984)
      • AliyunWrapExe.exe (PID: 3104)

    • Reads the computer name

      • EDownloader.exe (PID: 3984)
      • InfoForSetup.exe (PID: 6304)
      • AliyunWrapExe.exe (PID: 3104)

    • Checks proxy server information

      • EDownloader.exe (PID: 3984)
      • AliyunWrapExe.exe (PID: 3104)

    • Creates files or folders in the user directory

      • AliyunWrapExe.exe (PID: 3104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:01:30 03:57:48+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 186368
UninitializedDataSize: 2048
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
10
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drw_tr_installer.17262564531040b1587.exe edownloader.exe infoforsetup.exe no specs infoforsetup.exe no specs #GEXIN aliyunwrapexe.exe infoforsetup.exe no specs infoforsetup.exe no specs infoforsetup.exe no specs infoforsetup.exe no specs drw_tr_installer.17262564531040b1587.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1156 /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"17262564531040b1587\",\"Timezone\":\"GMT-00:00\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
3104C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\AliyunWrapExe.ExeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\AliyunWrapExe.exe
InfoForSetup.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\aliyunwrapexe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\rpcrt4.dll
3984"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\EDownloader.exe" EXEDIR=C:\Users\admin\AppData\Local\Temp ||| EXENAME=drw_tr_installer.17262564531040b1587.exe ||| DOWNLOAD_VERSION=trial ||| PRODUCT_VERSION=2.0.0 ||| INSTALL_TYPE=0C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\EDownloader.exe
drw_tr_installer.17262564531040b1587.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\edownloader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4284 /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"3\",\"Errorinfo\":\"0\",\"PostURL\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=17262564531040b1587&lang=English&pcVersion=home&pid=2&tid=1&version=trial\",\"ResponseJson\":\"{\\"check\\":1,\\"msg\\":\\"\\u6210\\u529f\\",\\"data\\":{\\"pid\\":\\"2\\",\\"download\\":\\"https:\\/\\/d1.easeus.com\\/drw\\/trial\\/drw19.1.0.0_trial.exe\\",\\"download2\\":\\"https:\\/\\/d2.easeus.com\\/drw\\/trial\\/drw19.1.0.0_trial.exe\\",\\"download3\\":\\"https:\\/\\/d3.easeus.com\\/drw\\/trial\\/drw19.1.0.0_trial.exe\\",\\"version\\":\\"trial\\",\\"curNum\\":\\"19.1\\",\\"testid\\":\\"TR191_202495release-090510\\",\\"url\\":[],\\"md5\\":\\"993F4EDDAF13A2F1745A40291A68EDB8\\",\\"tj_download\\":\\"test\\",\\"referNumber\\":\\"1000000\\",\\"killSwitch\\":\\"true\\",\\"WriteLogSwitch\\":\\"false\\",\\"configid\\":\\"\\"},\\"time\\":1726256655}\",\"Result\":\"Success\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
5152"C:\Users\admin\AppData\Local\Temp\drw_tr_installer.17262564531040b1587.exe" C:\Users\admin\AppData\Local\Temp\drw_tr_installer.17262564531040b1587.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\drw_tr_installer.17262564531040b1587.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5700 /SendInfo Window "Downloading" Activity "Info_Start_Download_Program" Attribute "{\"Downloadfrom\":\"https://d1.easeus.com/drw/trial/drw19.1.0.0_trial.exe\",\"Pageid\":\"17262564531040b1587\",\"Testid\":\"TR191_202495release-090510\",\"Version\":\"trial\",\"Versionnumber\":\"19.1\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6304 /Uid "S-1-5-21-1693682860-607145093-2874071422-1001"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6636 /SendInfo Window "Home_Installer" Activity "Click_Fold_Custom"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6644 /SendInfo Window "Home_Installer" Activity "Click_Install" Attribute "{\"Country\":\"United States\",\"Install_Path\":\"C:/Program Files/EaseUS/EaseUS Data Recovery Wizard\",\"Language\":\"English\",\"Os\":\"Microsoft Windows 10\",\"Pageid\":\"17262564531040b1587\",\"Timezone\":\"GMT-00:00\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2trial\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
7116"C:\Users\admin\AppData\Local\Temp\drw_tr_installer.17262564531040b1587.exe" C:\Users\admin\AppData\Local\Temp\drw_tr_installer.17262564531040b1587.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\drw_tr_installer.17262564531040b1587.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
2 036
Read events
2 030
Write events
6
Delete events
0

Modification events

(PID) Process:(3104) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3104) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3104) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3984) EDownloader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3984) EDownloader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3984) EDownloader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
48
Suspicious files
3
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\ChineseTrad.initext
MD5:FE7AD6D1DD07AEAFEECE921ECB23F3E7
SHA256:7EF907A793D9087AA804A688BDDDECF33A76011E4D820E7332533C070277507F
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Danish.initext
MD5:EB6CB6A1EA028CAC7AE61DADC568C2F9
SHA256:4524116093969EE206FA4F04D84346349ED551B4D7B87D4206E9A12D32AF5D61
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Arabic.initext
MD5:B334764EB0A1069F6BA04C8E1F088CD0
SHA256:D9A87257F203A80489756B8B31628FFF8D10AAB229D20A637A083059233DC54C
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\French.initext
MD5:1737B0DE1DA74E1D45285479CE66E556
SHA256:201229433F78F5CB87A9357921F34CAA2820B2917FF572E82A57D31DB5774E46
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Indonesian.initext
MD5:38629FAB2999407FE8FA2DBABB097B57
SHA256:13F413DBFCBC4537D83F77E34EF0C9FA868BFA07792E990F4E94526CCEB79848
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Japanese.initext
MD5:76E3CFD74C8A8C99CCD461F17CBABD4D
SHA256:64EFC20036A6CAD10DDBDB014444C55B6DB93A481EE5FE84210DEB2377918BB8
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Korean.initext
MD5:81C343D7615A71FFA127E317C98B357E
SHA256:7E8E799B95A5E6F5AA8A18ACB78E6454E634AE52A4615F7A0B0740A51766A26F
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Norwegian.initext
MD5:74F6E38B2B7AC3893B1AB6C092B854D1
SHA256:9692FECB48E8745F26C235C8925F106E56E862CD1B7B8CA8C84B8CB751B7A748
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\skin.zipcompressed
MD5:F3A3E2CDEA5D240413A0F76C0436E79A
SHA256:6C2551A55A62943227F76F83C9D5C1EF3CA9805D85CB2C5C71BA32F3EB857C88
7116drw_tr_installer.17262564531040b1587.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\Chinese.initext
MD5:FD6CA501ED9A613A5094EB4C92C1A847
SHA256:4637C9C3FF511C3F15CB482C5A3EE42A3237D26AD002B2FCC3FF467E7A10B99F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
40
DNS requests
16
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3104
AliyunWrapExe.exe
POST
200
47.252.97.11:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
US
—
—
unknown
2120
MoUsoCoreWorker.exe
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
SE
binary
973 b
whitelisted
3104
AliyunWrapExe.exe
POST
200
47.252.97.11:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
US
—
—
unknown
3104
AliyunWrapExe.exe
POST
200
47.252.97.11:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
US
—
—
unknown
6716
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
407 b
whitelisted
6716
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
3104
AliyunWrapExe.exe
POST
200
47.252.97.11:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
US
—
—
unknown
1436
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
3984
EDownloader.exe
POST
200
65.9.95.5:80
http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/
US
binary
513 b
unknown
3104
AliyunWrapExe.exe
GET
200
8.218.236.152:80
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=2
HK
binary
1 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
6612
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
23.32.97.216:80
www.microsoft.com
AKAMAI-AS
SE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3104
AliyunWrapExe.exe
8.218.236.152:80
track.easeus.com
Alibaba US Technology Co., Ltd.
HK
suspicious
3104
AliyunWrapExe.exe
47.252.97.11:80
easeusinfo.us-east-1.log.aliyuncs.com
Alibaba US Technology Co., Ltd.
US
unknown
1436
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1436
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
www.microsoft.com
  • 23.32.97.216
  • 88.221.169.152
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
track.easeus.com
  • 8.218.236.152
unknown
easeusinfo.us-east-1.log.aliyuncs.com
  • 47.252.97.11
  • 47.252.97.8
  • 47.252.97.9
  • 47.252.97.12
  • 47.252.97.212
  • 47.252.97.15
  • 47.252.97.14
  • 47.252.97.10
  • 47.252.97.13
unknown
login.live.com
  • 40.126.32.138
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.140
  • 40.126.32.72
  • 40.126.32.68
  • 20.190.160.14
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
download.easeus.com
  • 65.9.95.5
  • 65.9.95.40
  • 65.9.95.77
  • 65.9.95.124
unknown
d1.easeus.com
  • 18.66.112.111
  • 18.66.112.6
  • 18.66.112.38
  • 18.66.112.125
unknown

Threats

PID
Process
Class
Message
3104
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
2256
svchost.exe
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
3104
AliyunWrapExe.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Gexin Installer POST Request
3104
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
—
—
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
3104
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
3104
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
Process
Message
EDownloader.exe
[2268]-19:44:03:238 ParseCmdLine param=EXEDIR=C:\Users\admin\AppData\Local\Temp ||| EXENAME=drw_tr_installer.17262564531040b1587.exe ||| DOWNLOAD_VERSION=trial ||| PRODUCT_VERSION=2.0.0 ||| INSTALL_TYPE=0
EDownloader.exe
[2268]-19:44:03:301 Install recomand return=259
EDownloader.exe
[2268]-19:44:03:707 Install recomand return=259
AliyunWrapExe.exe
PostLogResult->statusCode=
AliyunWrapExe.exe
200
AliyunWrapExe.exe
AliyunWrapExe.exe
PostLogResult->requestID=
AliyunWrapExe.exe
x-log-requestid: 66E496056013FDA1507990DA
AliyunWrapExe.exe
EDownloader.exe
[2268]-19:44:13:631 Install recomand return=259
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
drw_tr_installer.17262564531040b1587.exe