| URL: | https://gofile.io/d/oCpKeH |
| Full analysis: | https://app.any.run/tasks/fdfea30c-458f-40cf-8812-516a3b699176 |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | July 08, 2025, 19:11:00 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| MD5: | EEFEB339808EE82B6F14CFE8EE8295EF |
| SHA1: | 30337FCF74C145D4CADC9D0ECBCBAA7332C0A587 |
| SHA256: | 87AF714936A2543A83049EDCA85E61F5910CA2D2C3B5615E7A302399D2FA95BA |
| SSDEEP: | 3:N8rxL13Vn:2ZJV |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 128 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3844 --field-trial-handle=1368,i,5794656408797037170,5356790748642057879,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 128 | "C:\Users\admin\AppData\Local\gyp.exe" -a "C:\Users\admin\Desktop\heur\HEUR-Trojan.Win32.Generic-7444f4603765a665753fefbaecb73ed5faabe2023f7de34fab7e8ec224b64c42..exe" | C:\Users\admin\AppData\Local\gyp.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Gemplus Cryptographic Service Provider Exit code: 0 Version: 5.1.2522.0 (main.010719-1909) Modules
| |||||||||||||||
| 284 | "C:\Users\admin\AppData\Roaming\InstallDir\system.exe" | C:\Users\admin\AppData\Roaming\InstallDir\system.exe | — | system.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 292 | taskeng.exe {665B2EB3-4094-4F5C-9CFD-B00E6B5BA3D1} | C:\Windows\System32\taskeng.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Engine Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 344 | "C:\Users\admin\Desktop\heur\HEUR-Trojan.Win32.Generic-9096cd34c8f099659c52b6dfc49b62e25a797fb4ebcc9f9956bb41b2a626f585..exe" | C:\Users\admin\Desktop\heur\HEUR-Trojan.Win32.Generic-9096cd34c8f099659c52b6dfc49b62e25a797fb4ebcc9f9956bb41b2a626f585..exe | — | explorer.exe | |||||||||||
User: admin Company: asasasas Integrity Level: MEDIUM Description: asasasa Exit code: 0 Version: 3.05.0009 Modules
| |||||||||||||||
| 344 | "C:\config.Bin\9A0D2F91826.exe" | C:\config.Bin\9A0D2F91826.exe | explorer.exe | ||||||||||||
User: admin Company: AVM GmbH Integrity Level: MEDIUM Description: Loon Gang Adler Exit code: 0 Version: 9.9 Modules
| |||||||||||||||
| 392 | "C:\Users\admin\AppData\Local\gyp.exe" -a "C:\Users\admin\Desktop\heur\HEUR-Trojan.Win32.Generic-8702c07d36d27e91f94b20a2147cda31f1d918fb9dc43dfc84f9a28d241170fc..exe" | C:\Users\admin\AppData\Local\gyp.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Gemplus Cryptographic Service Provider Exit code: 0 Version: 5.1.2522.0 (main.010719-1909) Modules
| |||||||||||||||
| 524 | "C:\Users\admin\Desktop\heur\HEUR-Trojan.Win32.Generic-9082eaeb6b865e352e1eef8f4cbb7c290a47ef2781b57a0b0b82d0db7b8dc21c..exe" | C:\Users\admin\Desktop\heur\HEUR-Trojan.Win32.Generic-9082eaeb6b865e352e1eef8f4cbb7c290a47ef2781b57a0b0b82d0db7b8dc21c..exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 548 | "C:\Users\admin\AppData\Local\gyp.exe" -a "C:\Users\admin\Desktop\heur\HEUR-Trojan.Win32.Generic-7790ce2450044c34945164bfac2eb52541f3bb419d37713dcf0817c37ba8cbe4..exe" | C:\Users\admin\AppData\Local\gyp.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Gemplus Cryptographic Service Provider Exit code: 0 Version: 5.1.2522.0 (main.010719-1909) Modules
| |||||||||||||||
| 556 | svchost.exe | C:\Windows\System32\svchost.exe | HEUR-Trojan.Win32.Generic-9063ab88dba834f74760b613da46b858441e18b02c1ebc80744f7454e26272b2..exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Host Process for Windows Services Exit code: 3221225477 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| (PID) Process: | (2932) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (2932) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 0 | |||
| (PID) Process: | (2932) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault |
| Operation: | write | Name: | S-1-5-21-1302019708-1500728564-335382590-1000 |
Value: A0014E0106982F00 | |||
| (PID) Process: | (2932) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\FirstNotDefault |
| Operation: | delete value | Name: | S-1-5-21-1302019708-1500728564-335382590-1000 |
Value: | |||
| (PID) Process: | (2932) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge |
| Operation: | write | Name: | UsageStatsInSample |
Value: 1 | |||
| (PID) Process: | (2932) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | usagestats |
Value: 1 | |||
| (PID) Process: | (2932) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | urlstats |
Value: 1 | |||
| (PID) Process: | (2932) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\IEToEdge |
| Operation: | delete value | Name: | DisabledPendingAutoUpdateConsent |
Value: | |||
| (PID) Process: | (1080) svchost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet |
| Operation: | write | Name: | {4040CF00-1B3E-486A-B407-FA14C56B6FC0} |
Value: D4DA6D5AB446 | |||
| (PID) Process: | (2932) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2932 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF18144e.TMP | — | |
MD5:— | SHA256:— | |||
| 2932 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2932 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF18146d.TMP | — | |
MD5:— | SHA256:— | |||
| 2932 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2932 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1814bb.TMP | — | |
MD5:— | SHA256:— | |||
| 2932 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2932 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat | binary | |
MD5:C71FF4D3A6085C165C6A9C908C072A09 | SHA256:3CA7B7E98B5CA1C1DC458415463D00ACD9DF8302F481B103C93177FD2642B37B | |||
| 3068 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pma | binary | |
MD5:C612E96CBFAC63232FC2062E15600FB1 | SHA256:DB3C05D5EC0B6719A73E7F0BE84BCE9342772DA70567E7CE08CF6573480B38FF | |||
| 2932 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Last Version | text | |
MD5:61FE7896F9494DCDF53480A325F4FB85 | SHA256:ACFD3CD36E0DFCF1DCB67C7F31F2A5B9BA0815528A0C604D4330DFAA9E683E51 | |||
| 2932 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Variations | binary | |
MD5:961E3604F228B0D10541EBF921500C86 | SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3656 | msedge.exe | GET | 301 | 49.12.202.237:80 | http://7-zip.org/ | unknown | — | — | unknown |
1036 | HEUR-Trojan.Win32.Generic-8361b0d803cadbec4c2244e9298f30a9ebe611e86df3f1fb6898726c2beefd12..exe | GET | — | 142.250.186.132:80 | http://www.google.com/ | unknown | — | — | whitelisted |
1036 | HEUR-Trojan.Win32.Generic-8361b0d803cadbec4c2244e9298f30a9ebe611e86df3f1fb6898726c2beefd12..exe | GET | 301 | 35.158.87.123:80 | http://psfk.com/img/icons/twitter.png?v19=29&tq=gHZutDyMv5rJejXia9nrmsl6giWz%2BJZbVyA%3D | unknown | — | — | malicious |
1452 | explorer.exe | POST | 403 | 172.67.167.202:80 | http://weddingbee.com/gate.php | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2932 | msedge.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3656 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3656 | msedge.exe | 150.171.27.11:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3656 | msedge.exe | 45.112.123.126:443 | gofile.io | AMAZON-02 | SG | whitelisted |
3656 | msedge.exe | 51.159.98.203:443 | s.gofile.io | Online S.a.s. | FR | whitelisted |
3656 | msedge.exe | 51.75.242.210:443 | api.gofile.io | OVH SAS | FR | whitelisted |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
gofile.io |
| whitelisted |
s.gofile.io |
| whitelisted |
api.gofile.io |
| whitelisted |
www.bing.com |
| whitelisted |
arc.msn.com |
| whitelisted |
store6.gofile.io |
| whitelisted |
ntp.msn.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
3656 | msedge.exe | Potentially Bad Traffic | ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io) |
3656 | msedge.exe | Potentially Bad Traffic | ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io) |
3656 | msedge.exe | Misc activity | ET FILE_SHARING File Sharing Related Domain in TLS SNI (gofile .io) |
3656 | msedge.exe | Misc activity | ET FILE_SHARING File Sharing Related Domain in TLS SNI (gofile .io) |
3656 | msedge.exe | Potentially Bad Traffic | ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io) |
3656 | msedge.exe | Potentially Bad Traffic | ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io) |
3656 | msedge.exe | Potentially Bad Traffic | ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io) |
3656 | msedge.exe | Potentially Bad Traffic | ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io) |
3656 | msedge.exe | Misc activity | ET FILE_SHARING File Sharing Related Domain in TLS SNI (gofile .io) |
3656 | msedge.exe | Misc activity | ET FILE_SHARING File Sharing Related Domain in TLS SNI (gofile .io) |
Process | Message |
|---|---|
HEUR-Trojan.Win32.Generic-9356e380f6da9efb80d2a8f6417aef094c9e46abe3f30065d1f2e48d3814e4f2..exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2010 Oreans Technologies ---
------------------------------------------------
|
HEUR-Trojan.Win32.Generic-9162c1643afeaf61ed44aebae58797a26d5b94e85d84311e719736fa03153c34..exe | 4203164 |
HEUR-Trojan.Win32.Generic-9085f8a76c559da7f3626b70e2de94b5142cd2c8630c9fbd654f73106b1f96c5..exe | 60000 60080
|
HEUR-Trojan.Win32.Generic-8916d140c0132a93cf5e5272fb314799bb3e80214d2073fdad03155a56679e9b..exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2009 Oreans Technologies ---
------------------------------------------------
|
HEUR-Trojan.Win32.Generic-8964d564cda4ecd1351bca67548802fe818c6da7475f0fbf702e0bf543f363b8..exe | %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s |
HEUR-Trojan.Win32.Generic-8964d564cda4ecd1351bca67548802fe818c6da7475f0fbf702e0bf543f363b8..exe | %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s |
HEUR-Trojan.Win32.Generic-8916d140c0132a93cf5e5272fb314799bb3e80214d2073fdad03155a56679e9b..exe | 5000 |
HEUR-Trojan.Win32.Generic-08764e0f3e20057c324a3b9f8a27ce1042288a90a933df2330925169624bc201..exe | In the fifth, your ass goes down. Say it. |
HEUR-Trojan.Win32.Generic-8796c958e875048e58fa857bbf8d5d07e7b38635e2bdc073dfd83fcbe4438703..exe | 60000 60080
|
9A0D2F91826.exe | 5858C9BA |