File name:

TB_Free_Installer_20241210.8756.exe

Full analysis: https://app.any.run/tasks/eb7fc117-5f88-4adf-80ca-fcdbac0b7578
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: December 10, 2024, 09:59:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
adware
gexin
installer
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

D4A438EB7B3151A86CD005A8415558DB

SHA1:

53F589D07C2F2CE54A5C1F1396B08664992BC1EF

SHA256:

A8A135762A6243E3F114DD0E0CAA6F2A4F2E3CD62E0B9C5ED0E6B5124A370A1E

SSDEEP:

98304:qvVVyi2aHHTi50jZRXP3KRgxSVQhsXD5Ki1hxV1q94+PszIwIdf7yj/gDG2dZLf9:8GWuBN7O

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GEXIN has been detected (SURICATA)

      • AliyunWrapExe.exe (PID: 7044)

    • Actions looks like stealing of personal data

      • TB_free_easeus.tmp (PID: 6240)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • TB_Free_Installer_20241210.8756.exe (PID: 6936)
      • TB_free_easeus.exe (PID: 6012)
      • TB_free_easeus.tmp (PID: 6240)

    • Reads security settings of Internet Explorer

      • AliyunWrapExe.exe (PID: 7044)
      • EDownloader.exe (PID: 6972)

    • Reads Microsoft Outlook installation path

      • EDownloader.exe (PID: 6972)

    • Reads Internet Explorer settings

      • EDownloader.exe (PID: 6972)

    • Access to an unwanted program domain was detected

      • AliyunWrapExe.exe (PID: 7044)

    • Reads the Windows owner or organization settings

      • TB_free_easeus.tmp (PID: 6240)

    • Process checks presence of unattended files

      • TB_free_easeus.tmp (PID: 6240)

    • Creates files in the driver directory

      • TB_free_easeus.tmp (PID: 6240)

    • Process drops legitimate windows executable

      • TB_free_easeus.tmp (PID: 6240)

    • Drops 7-zip archiver for unpacking

      • TB_free_easeus.tmp (PID: 6240)

    • The process drops C-runtime libraries

      • TB_free_easeus.tmp (PID: 6240)

    • Drops a system driver (possible attempt to evade defenses)

      • TB_free_easeus.tmp (PID: 6240)

  • INFO

    • Checks supported languages

      • TB_Free_Installer_20241210.8756.exe (PID: 6936)
      • EDownloader.exe (PID: 6972)
      • InfoForSetup.exe (PID: 6996)
      • InfoForSetup.exe (PID: 7024)
      • AliyunWrapExe.exe (PID: 7044)
      • InfoForSetup.exe (PID: 7112)
      • InfoForSetup.exe (PID: 7140)
      • InfoForSetup.exe (PID: 7148)
      • InfoForSetup.exe (PID: 3524)
      • InfoForSetup.exe (PID: 4840)
      • TB_free_easeus.exe (PID: 6012)
      • TB_free_easeus.tmp (PID: 6240)

    • Create files in a temporary directory

      • EDownloader.exe (PID: 6972)
      • TB_Free_Installer_20241210.8756.exe (PID: 6936)
      • AliyunWrapExe.exe (PID: 7044)
      • InfoForSetup.exe (PID: 7024)
      • TB_free_easeus.exe (PID: 6012)
      • TB_free_easeus.tmp (PID: 6240)

    • Reads the computer name

      • EDownloader.exe (PID: 6972)
      • AliyunWrapExe.exe (PID: 7044)
      • TB_free_easeus.tmp (PID: 6240)

    • Creates files or folders in the user directory

      • AliyunWrapExe.exe (PID: 7044)

    • Checks proxy server information

      • AliyunWrapExe.exe (PID: 7044)
      • EDownloader.exe (PID: 6972)

    • Reads the machine GUID from the registry

      • EDownloader.exe (PID: 6972)

    • Creates files in the program directory

      • TB_free_easeus.tmp (PID: 6240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:01:30 03:57:48+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 186368
UninitializedDataSize: 2048
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
14
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start tb_free_installer_20241210.8756.exe edownloader.exe infoforsetup.exe no specs infoforsetup.exe no specs #GEXIN aliyunwrapexe.exe infoforsetup.exe no specs infoforsetup.exe no specs infoforsetup.exe no specs infoforsetup.exe no specs infoforsetup.exe no specs tb_free_easeus.exe tb_free_easeus.tmp infoforsetup.exe no specs tb_free_installer_20241210.8756.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3524 /SendInfo Window "Installing" Activity "Info_Start_Install_Program"C:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\1.0.0\3free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
4840 /SendInfo Window "Downloading" Activity "Result_Download_Program" Attribute "{\"Average_Networkspeed\":\"4.30MB\",\"Cdn\":\"https://d1.easeus.com/tb/free/TodoBackup17.0.0_free.exe\",\"Elapsedtime\":\"40\",\"Errorinfo\":\"0\",\"Result\":\"Success\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\1.0.0\3free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6012 /verysilent /DIR="C:\Program Files (x86)\EaseUS\Todo Backup" /IMAGEPATH="C:\My Backups" /LANG=English agreeImprove=true GUID=S-1-5-21-1693682860-607145093-2874071422-1001 xurlID=1-8756 C:\Users\admin\Desktop\TB_free_easeus.exe
EDownloader.exe
User:
admin
Company:
EaseUS
Integrity Level:
HIGH
Description:
EaseUS Todo Backup Free Setup
Version:
17.0
Modules
Images
c:\users\admin\desktop\tb_free_easeus.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6240"C:\Users\admin\AppData\Local\Temp\is-PFHAS.tmp\TB_free_easeus.tmp" /SL5="$602B2,179580823,539648,C:\Users\admin\Desktop\TB_free_easeus.exe" /verysilent /DIR="C:\Program Files (x86)\EaseUS\Todo Backup" /IMAGEPATH="C:\My Backups" /LANG=English agreeImprove=true GUID=S-1-5-21-1693682860-607145093-2874071422-1001 xurlID=1-8756 C:\Users\admin\AppData\Local\Temp\is-PFHAS.tmp\TB_free_easeus.tmp
TB_free_easeus.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-pfhas.tmp\tb_free_easeus.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6772 /SendInfo Window "Installing" Activity "Click_Min"C:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\1.0.0\3free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6776"C:\Users\admin\Desktop\TB_Free_Installer_20241210.8756.exe" C:\Users\admin\Desktop\TB_Free_Installer_20241210.8756.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\tb_free_installer_20241210.8756.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6936"C:\Users\admin\Desktop\TB_Free_Installer_20241210.8756.exe" C:\Users\admin\Desktop\TB_Free_Installer_20241210.8756.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\tb_free_installer_20241210.8756.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6972"C:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exe" EXEDIR=C:\Users\admin\Desktop ||| EXENAME=TB_Free_Installer_20241210.8756.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=1.0.0 ||| INSTALL_TYPE=0C:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exe
TB_Free_Installer_20241210.8756.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\1.0.0\3free\edownloader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6996 /Uid "S-1-5-21-1693682860-607145093-2874071422-1001"C:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\1.0.0\3free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
7024 /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Timezone\":\"GMT-00:00\"}"C:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe—EDownloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\downloader_easeus\1.0.0\3free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
Total events
2 510
Read events
2 501
Write events
7
Delete events
2

Modification events

(PID) Process:(7044) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7044) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7044) AliyunWrapExe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6972) EDownloader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6972) EDownloader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6972) EDownloader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6240) TB_free_easeus.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\EaseUS Todo Backup
Operation:delete valueName:Password
Value:
(PID) Process:(6240) TB_free_easeus.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\EaseUS Todo Backup
Operation:writeName:install_tmp
Value:
1
(PID) Process:(6240) TB_free_easeus.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:delete valueName:TodoBackupUninst
Value:
Executable files
2 000
Suspicious files
123
Text files
611
Unknown types
38

Dropped files

PID
Process
Filename
Type
6936TB_Free_Installer_20241210.8756.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\Chinese.initext
MD5:2C1109202C5BD64CFBD15440DBFB9E15
SHA256:503DED4C87EC70CF80920CD35985A34A7F7DF4280E8ACD2915BB105140057AA4
6936TB_Free_Installer_20241210.8756.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\skin.zipcompressed
MD5:1DB6EBFD0C6E1BECB02E64432422F4BA
SHA256:F3FE788C8113E043DF0F6295DC300E772461F3EFFF5DE1A823840347EC2F744A
6936TB_Free_Installer_20241210.8756.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeexecutable
MD5:9111AC122E8E5172E7679AE07AA4CBD9
SHA256:EF7C55F560B6C76D2EDBEFB1DEC03E32529FF0F84CB3678A994F242C27197CF5
6936TB_Free_Installer_20241210.8756.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\German.initext
MD5:11847D6DED619EF00FE65D073DCA2395
SHA256:432729DF19211765091F56578437A3564667572430B36DFF2BF48B28F15A0C06
6936TB_Free_Installer_20241210.8756.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\InitConfigure.iniini
MD5:A85F9ACC64DF19C2295A51EABE505AC5
SHA256:211A2504C0CFE8E28BC32DE9FC6065150E1D94B24573A96B43684CB0A1A6D258
6936TB_Free_Installer_20241210.8756.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\French.initext
MD5:5CF7184F2D6C19608D287EAE33B1D678
SHA256:7AB67D4EB16F742235309A0A55EAFAC60B39A79D842C84A285A1D62061A9D7EB
6936TB_Free_Installer_20241210.8756.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\ChineseTrad.initext
MD5:83ED2F53BC9654D852DB7A304DCE10AB
SHA256:CC4D59587283D2F1190D00B56D1C5E100A4DAC71D540141C61975EAD907E8FD2
6936TB_Free_Installer_20241210.8756.exeC:\Users\admin\AppData\Local\Temp\downloader_easeus\1.0.0\3free\english.initext
MD5:DDAF4E9F7E89D3AD8AC541CC7C82888E
SHA256:A82964B0605B60EED9997EA9F3D7BC23C5AD9FF95F083D51F4EBBDB137B88C94
6972EDownloader.exeC:\Users\admin\Desktop\TB_free_easeus.exe.temp —
MD5:—
SHA256:—
6972EDownloader.exeC:\Users\admin\Desktop\TB_free_easeus.exe —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
49
DNS requests
27
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6972
EDownloader.exe
POST
200
18.172.112.107:80
http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/
unknown
—
—
unknown
—
—
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7044
AliyunWrapExe.exe
GET
200
8.218.236.152:80
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=0
unknown
—
—
unknown
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7044
AliyunWrapExe.exe
POST
200
47.252.97.12:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_tbp_downloader/shards/lb
unknown
—
—
unknown
7044
AliyunWrapExe.exe
POST
200
47.252.97.12:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_tbp_downloader/shards/lb
unknown
—
—
unknown
7044
AliyunWrapExe.exe
POST
200
47.252.97.12:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_tbp_downloader/shards/lb
unknown
—
—
unknown
7044
AliyunWrapExe.exe
POST
200
47.252.97.12:80
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_tbp_downloader/shards/lb
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.164.9:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.23.209.136:443
www.bing.com
Akamai International B.V.
GB
whitelisted
1176
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
www.bing.com
  • 2.23.209.136
  • 2.23.209.149
  • 2.23.209.144
  • 2.23.209.147
  • 2.23.209.137
  • 2.23.209.142
  • 2.23.209.143
  • 2.23.209.140
  • 2.23.209.141
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.140
  • 40.126.32.76
  • 20.190.160.17
  • 40.126.32.133
  • 40.126.32.68
  • 20.190.160.22
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
download.easeus.com
  • 18.172.112.107
  • 18.172.112.32
  • 18.172.112.123
  • 18.172.112.26
unknown
track.easeus.com
  • 8.218.236.152
unknown

Threats

PID
Process
Class
Message
2192
svchost.exe
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
7044
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
7044
AliyunWrapExe.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Gexin Installer POST Request
7044
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
7044
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
7044
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
2192
svchost.exe
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
7044
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
7044
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
7044
AliyunWrapExe.exe
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TB_Free_Installer_20241210.8756.exe