| File name: | edge-cis.exe |
| Full analysis: | https://app.any.run/tasks/9449c133-e3ce-4256-8871-13926561a7b2 |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | April 19, 2025, 06:08:58 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections |
| MD5: | 05229FAF10CCA0D4BC5AB297D845B5F5 |
| SHA1: | 379A7EC986707DD230D87F7B07B6D9BD6474D001 |
| SHA256: | 8FD248D06BF0F14AE1FF27963F51B86BDA17C8E4CD9C7575826EB47CB757A173 |
| SSDEEP: | 98304:/bUWxQTRNrd9NoDY2tOXruW+565qWKgBHhd4z329rnFqnIbi8ho6EJiAwdE2IsxA:v0dFU0J9ADRlBH4HAXjnaoj |
| .exe | | | Inno Setup installer (51.8) |
|---|---|---|
| .exe | | | InstallShield setup (20.3) |
| .exe | | | Win32 EXE PECompact compressed (generic) (19.6) |
| .dll | | | Win32 Dynamic Link Library (generic) (3.1) |
| .exe | | | Win32 Executable (generic) (2.1) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:04:27 08:22:11+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 682496 |
| InitializedDataSize: | 48128 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xa7ed0 |
| OSVersion: | 6 |
| ImageVersion: | 6 |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 6.23.19.171 |
| ProductVersionNumber: | 6.23.19.171 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | |
| FileDescription: | MicrosoftEdge |
| FileVersion: | 6.23.19.171 |
| LegalCopyright: | |
| OriginalFileName: | |
| ProductName: | MicrosoftEdge |
| ProductVersion: | 5.29.83.1529 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 472 | "C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe" | C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe | services.exe | ||||||||||||
User: SYSTEM Company: Qihoo 360 Technology Co. Ltd. Integrity Level: SYSTEM Description: 360 Total Security <WscReg.exe> Exit code: 0 Version: 9, 2, 0, 1031 Modules
| |||||||||||||||
| 532 | %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 | C:\Windows\System32\csrss.exe | — | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Client Server Runtime Process Version: 10.0.19041.1 (WinBuild.160101.0800) | |||||||||||||||
| 664 | "C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=6a097089-020a-4e95-a42e-c6932e70b811 --brand-id=yandex --partner-id=pseudoportal-ru --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --gpu-process-kind=sandboxed --field-trial-handle=2404,i,1884775424906325669,2140550139139367340,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2 | C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe | browser.exe | ||||||||||||
User: admin Company: YANDEX LLC Integrity Level: LOW Description: Yandex with voice assistant Alice Exit code: 0 Version: 25.2.6.697 Modules
| |||||||||||||||
| 672 | C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1745043076 --annotation=last_update_date=1745043076 --annotation=launches_after_update=1 --annotation=machine_id=97b7721c4994e2556ff6a439510f665d --annotation=main_process_pid=5304 --annotation=metrics_client_id=a57ff17397bf4b7299464b6509eba25c --annotation=micromode=broupdater --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=25.2.6.697 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffc87fd58d0,0x7ffc87fd58dc,0x7ffc87fd58e8 | C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe | browser.exe | ||||||||||||
User: admin Company: YANDEX LLC Integrity Level: MEDIUM Description: Yandex with voice assistant Alice Exit code: 0 Version: 25.2.6.697 Modules
| |||||||||||||||
| 672 | "C:\WINDOWS\system32\bcdedit.exe" /set flightsigning on | C:\Windows\System32\bcdedit.exe | — | 360TS_Setup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Boot Configuration Data Editor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 684 | "C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=6a097089-020a-4e95-a42e-c6932e70b811 --brand-id=yandex --partner-id=pseudoportal-ru --string-annotations --process-name="Data Decoder Service" --field-trial-handle=7480,i,17135219961656772721,141421571033040994,262144 --variations-seed-version --mojo-platform-channel-handle=7704 --brver=25.2.6.697 /prefetch:8 | C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe | browser.exe | ||||||||||||
User: admin Company: YANDEX LLC Integrity Level: LOW Description: Yandex with voice assistant Alice Exit code: 0 Version: 25.2.6.697 Modules
| |||||||||||||||
| 744 | "C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=6a097089-020a-4e95-a42e-c6932e70b811 --brand-id=yandex --partner-id=pseudoportal-ru --string-annotations --process-name="Утилиты Windows" --field-trial-handle=7208,i,17135219961656772721,141421571033040994,262144 --variations-seed-version --mojo-platform-channel-handle=7124 --brver=25.2.6.697 /prefetch:8 | C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe | browser.exe | ||||||||||||
User: admin Company: YANDEX LLC Integrity Level: MEDIUM Description: Yandex with voice assistant Alice Exit code: 0 Version: 25.2.6.697 Modules
| |||||||||||||||
| 776 | "C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=6a097089-020a-4e95-a42e-c6932e70b811 --brand-id=yandex --partner-id=pseudoportal-ru --string-annotations --process-name="Распаковщик файлов" --field-trial-handle=5828,i,17135219961656772721,141421571033040994,262144 --variations-seed-version --mojo-platform-channel-handle=2512 --brver=25.2.6.697 /prefetch:8 | C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe | browser.exe | ||||||||||||
User: admin Company: YANDEX LLC Integrity Level: LOW Description: Yandex with voice assistant Alice Exit code: 0 Version: 25.2.6.697 Modules
| |||||||||||||||
| 800 | "C:\Users\admin\AppData\Local\Temp\is-QKN83.tmp\ROacfpuxceE3h.cmus\NgScHx_u_yH.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\World of Warships.lnk" 5386 | C:\Users\admin\AppData\Local\Temp\is-QKN83.tmp\ROacfpuxceE3h.cmus\NgScHx_u_yH.exe | — | edge-cis.tmp | |||||||||||
User: admin Company: Technosys Corporation Integrity Level: MEDIUM Description: Pin To Taskbar Exit code: 0 Version: 0.99.9.1 Modules
| |||||||||||||||
| 808 | "C:\Program Files (x86)\360\Total Security\safemon\QHToasts.exe" /riskprompt | C:\Program Files (x86)\360\Total Security\safemon\QHToasts.exe | — | QHSafeTray.exe | |||||||||||
User: admin Integrity Level: HIGH Description: Windows 8 Toast Notification Exit code: 0 Version: 8,6,0,1000 Modules
| |||||||||||||||
| (PID) Process: | (5492) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:000000000007028C |
| Operation: | write | Name: | VirtualDesktop |
Value: 1000000030304456BFA0DB55E4278845B426357D5B5F97B3 | |||
| (PID) Process: | (5492) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000030300 |
| Operation: | write | Name: | VirtualDesktop |
Value: 1000000030304456BFA0DB55E4278845B426357D5B5F97B3 | |||
| (PID) Process: | (5492) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:00000000000202FC |
| Operation: | write | Name: | VirtualDesktop |
Value: 1000000030304456BFA0DB55E4278845B426357D5B5F97B3 | |||
| (PID) Process: | (5956) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe |
| Operation: | write | Name: | DisableExceptionChainValidation |
Value: 0 | |||
| (PID) Process: | (5956) MicrosoftEdgeUpdate.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\proxy |
| Operation: | write | Name: | source |
Value: auto | |||
| (PID) Process: | (5956) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{CE8AD42E-BB41-4060-A366-20FA232380DE} |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (5956) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{CE8AD42E-BB41-4060-A366-20FA232380DE} |
| Operation: | write | Name: | PersistedPingString |
Value: <?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" updater="Omaha" updaterversion="1.3.151.27" shell_version="1.3.147.37" ismachine="1" sessionid="{6A815816-413F-41D5-BAC2-434397590917}" userid="{FD984739-A122-4DB0-BE5B-46E3E09D84E4}" installsource="taggedmi" requestid="{CE8AD42E-BB41-4060-A366-20FA232380DE}" dedup="cr" domainjoined="0"><hw logical_cpus="4" physmemory="4" disk_type="2" sse="1" sse2="1" sse3="1" ssse3="1" sse41="1" sse42="1" avx="1"/><os platform="win" version="10.0.19045.4046" sp="" arch="x64"/><oem product_manufacturer="DELL" product_name="DELL"/><exp etag=""r452t1+k2Tgq/HXzjvFNBRhopBWR9sbjXxqeUDH9uX0=""/><app appid="{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" version="1.3.185.17" nextversion="1.3.151.27" lang="ru" brand="" client=""><event eventtype="2" eventresult="1" errorcode="0" extracode1="0" install_time_ms="500"/></app></request> | |||
| (PID) Process: | (5956) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{CE8AD42E-BB41-4060-A366-20FA232380DE} |
| Operation: | write | Name: | PersistedPingTime |
Value: 133895165639688973 | |||
| (PID) Process: | (5492) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000020378 |
| Operation: | write | Name: | VirtualDesktop |
Value: 1000000030304456BFA0DB55E4278845B426357D5B5F97B3 | |||
| (PID) Process: | (5492) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:00000000000202FC |
| Operation: | delete key | Name: | (default) |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6004 | edge-cis.tmp | C:\Users\admin\AppData\Local\Temp\is-QKN83.tmp\_isetup\_setup64.tmp | executable | |
MD5:E4211D6D009757C078A9FAC7FF4F03D4 | SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95 | |||
| 6004 | edge-cis.tmp | C:\Users\admin\AppData\Local\Temp\is-QKN83.tmp\yvVtmf2IxedL_XC\b0HOR.aiff | binary | |
MD5:A150DA0EED596E279C6DEB1FEA8D6F2C | SHA256:2A8CEAB50BE99D2FD3A21C653A379F9C99D0E15E753B1906DE1CBFE6D46E959E | |||
| 6004 | edge-cis.tmp | C:\Users\admin\AppData\Local\Temp\is-QKN83.tmp\Cb8waZs8ilUnJ_u.vob\botva2.dll | executable | |
MD5:EF899FA243C07B7B82B3A45F6EC36771 | SHA256:DA7D0368712EE419952EB2640A65A7F24E39FB7872442ED4D2EE847EC4CFDE77 | |||
| 6004 | edge-cis.tmp | C:\Users\admin\AppData\Local\Temp\is-QKN83.tmp\FCPe6rkAhD_H3usxkdMivVC\jY6uM8yqBr6ALPAy1xJULn9.dll | executable | |
MD5:36D775C36616C72B16B419730D4B2801 | SHA256:7246F27406D90CA9DD88E609F1051D7A10DC49075AD1C942401BAC4120F7F6B5 | |||
| 5736 | edge-cis.exe | C:\Users\admin\AppData\Local\Temp\is-KK2CQ.tmp\edge-cis.tmp | executable | |
MD5:3E2E22576C1196263F8140CAC76334E8 | SHA256:57CBBAE38320D760C4AD0265F4606DAA03937E6D654D6A414BB2AEB4586748D6 | |||
| 7052 | edge-cis.exe | C:\Users\admin\AppData\Local\Temp\is-1RFL1.tmp\edge-cis.tmp | executable | |
MD5:3E2E22576C1196263F8140CAC76334E8 | SHA256:57CBBAE38320D760C4AD0265F4606DAA03937E6D654D6A414BB2AEB4586748D6 | |||
| 6004 | edge-cis.tmp | C:\Users\admin\AppData\Local\Temp\is-QKN83.tmp\oA2q.mus\Pe0m6LHa.wma.ini | binary | |
MD5:F05FA264C10F0E3F3FDFD4AE84A3064B | SHA256:BBD9B549277A01AF96F5583DC2AD67FFA0D58E001F537F95BF3040CD81829EA9 | |||
| 6004 | edge-cis.tmp | C:\Users\admin\AppData\Local\Temp\is-QKN83.tmp\yvVtmf2IxedL_XC\Cb8waZs8ilUnJ_u.vob | binary | |
MD5:0FB464321EE94C22EAB45BCCF8E1C3F3 | SHA256:779BA29CC5CEA85D9BEC7733DC4FAE1B2451F021D822EE80AC1A327768A67E2B | |||
| 5492 | explorer.exe | C:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat | binary | |
MD5:E49C56350AEDF784BFE00E444B879672 | SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E | |||
| 6004 | edge-cis.tmp | C:\Users\admin\AppData\Local\Temp\is-QKN83.tmp\b0HOR.aiff\CallbackCtrl.dll | executable | |
MD5:F07E819BA2E46A897CFABF816D7557B2 | SHA256:68F42A7823ED7EE88A5C59020AC52D4BBCADF1036611E96E470D986C8FAA172D | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.53.40.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5364 | downloader.exe | GET | 302 | 5.45.205.243:80 | http://download.yandex.ru/yandex-pack/downloader/info.rss | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.53.40.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5364 | downloader.exe | GET | 200 | 5.45.200.104:80 | http://cachev2-fra-01.cdn.yandex.net/downloader.yandex.net/yandex-pack/631081/YandexPackSetup.exe?lid=290 | unknown | — | — | whitelisted |
5408 | wermgr.exe | GET | 200 | 23.53.40.178:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5364 | downloader.exe | GET | 200 | 151.101.130.133:80 | http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D | unknown | — | — | whitelisted |
5408 | wermgr.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5364 | downloader.exe | GET | 200 | 151.101.130.133:80 | http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDG8SbJzCh95FjOiQ9g%3D%3D | unknown | — | — | whitelisted |
6044 | lite_installer.exe | GET | 200 | 213.180.204.14:80 | http://clck.yandex.ru/click/dtype=stred/pid=198/cid=73002/path=0.winapi_download/ui=%7B6a097089-020a-4e95-a42e-c6932e70b811%7D/clid1=9103221-191/dt=0/ds=0/bits=7_8_19041_3636/bver=0_0_0_0/prod_version=1_0_1_9/result=ok/* | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.53.40.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.53.40.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6004 | edge-cis.tmp | 35.228.27.190:443 | conf.datarcv.ru | GOOGLE-CLOUD-PLATFORM | FI | unknown |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 40.126.32.140:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
conf.datarcv.ru |
| unknown |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
stat.datarcv.ru |
| unknown |
config.edge.skype.com |
| whitelisted |
download.yandex.ru |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
5364 | downloader.exe | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
5364 | downloader.exe | Misc activity | ET INFO Packed Executable Download |
6044 | lite_installer.exe | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
6044 | lite_installer.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
6004 | edge-cis.tmp | Possibly Unwanted Program Detected | ADWARE [ANY.RUN] Inno Download Plugin UA |
6004 | edge-cis.tmp | Possibly Unwanted Program Detected | ADWARE [ANY.RUN] Inno Download Plugin UA |
6004 | edge-cis.tmp | Misc activity | ET INFO Packed Executable Download |
6004 | edge-cis.tmp | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
7316 | 360TS_Setup_Mini_WW_Coin_CPI202201_6.6.0.1054.exe | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
7316 | 360TS_Setup_Mini_WW_Coin_CPI202201_6.6.0.1054.exe | Misc activity | ET INFO Packed Executable Download |