| K7 Detection Name | Affected OS | Prevalence | AV Definition Version |
|---|---|---|---|
| Trojan ( 006189d81 ) | Windows | Low | 14.19.57740 |
| MD5 | e2fb2e872792e0837f2276ab1e97711b |
| SHA256 | f8e9d88b16e3bec8becf6e6ce1305efd29560b9bc19b783c2c419a9feca16215 |
| File Size | 24,847,872 bytes |
| Packer Information | N/A |
| First Seen | 20-11-2025 |
| Last Seen | 08-07-2026 |
| Aliases | Generik.FGLDOAI |
Behavior Details
1. Creates Registry:
Adds data
0F0C0A7A84682D82BAC36F9A7189AA008C195214E579BF5624A1CFCBFF7F9B16
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.ui.developer_mode
Adds data
9A46A2398415BD13740F31176029A0EE1C38B937616E56DBCCE1D7CC467B7C4B
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\media.storage_id_salt
Adds data
0
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\StabilityMetrics\user_experience_metrics.stability.exited_cleanly
Adds data
29247CA3E18CD44101B5E7CE2CF87FBAD1F17F9FD9053DE7A07F4AD8E1C3E4BB
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\homepage_is_newtabpage
Adds data
0018801712B7049E
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}\DeviceId
Adds data
8B01EC3382E7C31D18A8E33EA51C3BC890A4DAF1191729CD2D9192AA1DB19AF2
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\default_search_provider_data.template_url_data
Adds data
FBEE72E163217265E2ACF6EBF62783E78E98451A5E7100274CA1A583DE4FACB9
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\schedule_to_flush_to_disk
Adds data
9E70CCFC0323ECBF6EA0EE0FF87928ED7A11FBB951268B8AAC494A210D471ED1
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\session.startup_urls
Adds data
\x01\x00\x00\x00\x01\x00\x00\x00\xd0\x8c\x9d\xdf\x01\x15\xd1\x11\x8cz\x00\xc0O\xc2\x97\xeb\x01\x00\x00\x00\xe71\xed\x0c0\xeb}L\x9d\x86\x8a\xe6&o4\xda\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x10f\x00\x00\x00\x01\x00\x00 \x00\x00\x00\xef\x99\xdf\x10\xfa\xbc\xf3\xb1zc>\xb4(>~e\xcf\x17\x15\x99\xb36+
a\xf0\x80\xbf\xe9\xa8\x98#\x00\x00\x00\x00\x0e\x80\x00\x00\x00\x02\x00\x00 \x00\x00\x00\x05\xb1\x91j\x8d\xc4`\xf5\xb9\xf06%\x13\xf2\xceP\xce\x0f\xc6\xbdD\x18\x8c)\x82\x00\x94\x89=\xf0\xff\xa3\xc0\x0c\x00\x00\x88\xa2\x02x\x8c\xfe’UA\xaa\xa9M\xa7\L\x94\xee\x98\x7f-\x80 \x98\xf3\x9eB\x91\xba\xb6\xa52P\xc2N?4\xb75)\xb3\xaa(\x94\xff1\x99\x17\xb4\x06M\xcd\x00k\x94\xf0\xb2\x92\x1fd7\x86\x1d\xf5\xe5\xb4k\xe8\x85\xcc~2\x86u`HY\xd0\x02%k_>P\xb9cY
*\xae\x92\x85iSN\x90\xf2\xec2\xe1\xaa\xb5\xc0\x90z?O\x1c\xef\xfbFd\x90K,CB>\x1c9FKK\x0b\xf4\xca\xd1e\xeb_~\xb5y\xc5__\x96\xbd\x1a\x88\x90k\xe5\xc0Z*(\x1aX\xe6\xba\xae\xad \x88%\xb4\xa3\x874\xa3\xb7\xea\xfc b\xa8\xaf\xd2NA\xcc\xad\x04\xca\xef\xe6\x8a\xa9b\xc7pK:\xdcLh*\x05\x8f\xc2\xc2 \x15\x94\xf5\xc5./\x0f\xbb\x9c\xe6\x01^\xeb\x92\xcae\xef\xb1\xc1\x0e\xa8\xae \xd2\x18\xe6np\x8f\xdd<\x0c\x9a\x12uD\xf8]\x0e\x90\xe1l>\xbc\x94\x14\x03i\xdfs\xb9\xdd\x7f\x1ft\xd7\x9a\xb0\x06PS\xdc\xa1\x0b\x8bU\x03\xde\x81\x841\xb1\x112\xfa\x03\x0e\xaaZ\xb0\xd2\xeb\xeb\x9d\x8c\xb7\xa8\x91\x14\x895M\xdf\x9a\xca8\xc8+\xc5\x9fQ;WB\x0c\x82\xc5!\xe5\x97\xa2~d
\x02\x19′<\x15\xc57\xd3\xfedb\xa2\xd9\xf7\x84\x87
+c\x17D\xac\xd86\x03\x0f\xed\x8e\xcc\xc6\x97\x9d\xe4\xf3_9R+^\xdcU3\xab\xd3\xc3\xd1\xb2\xb1yW)\x0c\x0b-q\xa8
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}\DeviceTicket
Adds data
7D9C9DEC64F27CE8EE90C64F48A1D3646EB281C89A081C8B9DBAC8F96C63FB82
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.account_id
Adds data
1
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}\ApplicationFlags
Adds data
5B45CEEAC907040F6E1C42DE8318F6D2C28CCA62845D75D518F73F88A1C0298C
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\prefs.preference_reset_time
Adds data
BD5DC3F7891A6EE6340AC8A0A574A44E90943810CD82E32EF12A160A5BD31A5B
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\browser.show_home_button
Adds data
E843147A564743B4164AA50BEF9D81407B10FAD64D5F1487D7CFE07572B00E94
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings\mhjfbmdgcfjbbpaeojofohoefgiehjai
Adds data
1
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\StabilityMetrics\user_experience_metrics.stability.exited_cleanly
Adds data
0
under
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\usagestats
Adds data
FC8A7C9DA0ED00036C8E0DC258EB49B0532405F75E210B1124BC2BBC0A1C9D06
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings\dgiklkfkllikcanfonkcabmbdfmgleag
Adds data
C62B33C9CAFC840A76713E4425F37F6755A09B2411C00705778EBE40D98931D3
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\schedule_to_flush_to_disk
Adds data
E2F60768AC2B14B5055C7019DF152C68FC6C88FD51CC0570629300B1B79EA690
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\session.restore_on_startup
Adds data
1
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\UsageStatsInSample
Adds data
5930AF0FBA7BDC6C87E4725AE6E7D55DB40D24D408ADAA3AD00C679BAF18AE38
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\media.cdm.origin_data
Adds data
3A07412ADADB3C4C797E4CCB51D74CB746E57B915D586CBA5CA952AA5552BBC6
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\google.services.last_signed_in_username
Adds data
0A926054A736B0468335DF12ED687A65ECFF91683F3EB97E7944C3E24D0A77FC
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\homepage
Adds data
1
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\dr
Adds data
36CF68238CEA96EC7389BE6EF2EAB7E9FFCEB9E8C942CA90A643240397CF1E1A
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\safebrowsing.incidents_sent
Adds data
BC2818275F1C83B348F22CBBBD05969EFA9D9704ED4675BA0F9AD20CF99B85C3
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\pinned_tabs
Adds data
\x01\x00\x00\x00\x01\x00\x00\x00\xd0\x8c\x9d\xdf\x01\x15\xd1\x11\x8cz\x00\xc0O\xc2\x97\xeb\x01\x00\x00\x00\xe71\xed\x0c0\xeb}L\x9d\x86\x8a\xe6&o4\xda\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x10f\x00\x00\x00\x01\x00\x00 \x00\x00\x00H\xb0\xbf\xa7\xbc,jIXf\xa6\xaa\xd5\x86\xf6b\xc0\xb9\x11'\xf5K\x85\xc9
(\xd4IBB\x03O\x00\x00\x00\x00\x0e\x80\x00\x00\x00\x02\x00\x00 \x00\x00\x00W2L\x8e}U]\xfa\xb0\xb2I\xc2Vs>O?\x9d&x\xad\x05\xe9\x12\xd5\xd9\xe3R\x19H8W\x80\x00\x00\x00<\xb0$G\x9b\xeb\xf9\x13\x8a\xdcwS;\x8f\xf5\xca\x12\xe3\xc1Oy\xe1\xdf\xa6>;w\x93 \xb1\xbc\x97\x87\xbc\xdb\x16=\x83\x0c!& \xe2\x95\xef[?\x133&”\x96\x0b\x8665XI=\xaa\xdb\x81\x80s”\x99\x83+\x13
\x19<0xn><+\x8fk\xc2\xbe\x8e\xcb\x03\x11\xea\x96Q\x93\x9d\xd7\xd3?\xcd\xbb@J\xbd\xc9\xf1\x06\xba\x10\xd4jl\xa8\xb3\xd2\xc2y\xca\x0fi\xdb\xda\x06\xa6\x8c\xa9A\x13\x8f\xb4m\xfbP@\x00\x00\x00\xee\xb1!\xe0(\xf6|\xc3 x\x05r~y\x90$\xd1\xc1\x90\xc3w\x88\xe1]\xa4\x07{g\xad\xd9Ph\x85
\xff\xfer\xed\xfe'\xfcz\xadB[\x98\xd1\xc3\xba\xaf\x8b\xaf\xcdT\x1f\x01\xd2\xf7\x9cSI\xc8\xa7\xd7
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018801712B7049E
Adds data
C6CF7B54ABEA925296E722FBE1F60509B5A158ED6FB940269540D43CF914AF4F
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.last_username
Adds data
60E683B80F5691D3358A061F7F7C10A08DC996AD36CE1AE6AF20D9EA58A3838D
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\search_provider_overrides
Adds data
9E9B5F0B5C774F76E6CCE3A75FDDC1D816C9383AC011431A622A4251983D5BDC
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.install.initiallist
Adds data
5AB5C6360FE6E7F346E7C908AE763AC200F72DFD63A5904BA4E1822D670B917B
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\enterprise_signin.policy_recovery_token
Adds data
5BB4181ED41D9D06F9F2761FF212C9CF8140B1525A29766E7E7BCF70E038C9DB
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.install.initialprovidername
Removal Instructions
1. Update K7 security to the latest version.
2. Open Windows registry editor and delete the following keys:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.ui.developer_mode
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\media.storage_id_salt
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\StabilityMetrics\user_experience_metrics.stability.exited_cleanly
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\homepage_is_newtabpage
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}\DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\default_search_provider_data.template_url_data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\schedule_to_flush_to_disk
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\session.startup_urls
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}\DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.account_id
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}\ApplicationFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\prefs.preference_reset_time
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\browser.show_home_button
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings\mhjfbmdgcfjbbpaeojofohoefgiehjai
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\StabilityMetrics\user_experience_metrics.stability.exited_cleanly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\usagestats
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings\dgiklkfkllikcanfonkcabmbdfmgleag
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\schedule_to_flush_to_disk
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\session.restore_on_startup
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\UsageStatsInSample
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\media.cdm.origin_data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\google.services.last_signed_in_username
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\homepage
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\dr
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\safebrowsing.incidents_sent
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\pinned_tabs
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018801712B7049E
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.last_username
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\search_provider_overrides
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.install.initiallist
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\enterprise_signin.policy_recovery_token
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.install.initialprovidername
3. Restart the machine.