Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '%ALLUSERSPROFILE%\Microsoft Edge Update\<File name>.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\microsoft edge update\<File name>.exe
- %ALLUSERSPROFILE%\microsoft edge update\installation.log
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
- %ALLUSERSPROFILE%\microsoft edge update\startup_test_20260522_160358.txt
- %ALLUSERSPROFILE%\microsoft edge update\hook_installation.txt
- %ALLUSERSPROFILE%\microsoft edge update\system_logs.dll
- %ALLUSERSPROFILE%\microsoft edge update\clipboard_startup_20260522_160358.txt
- %ALLUSERSPROFILE%\microsoft edge update\internet_detection_startup_20260522_160359.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_startup_20260522_160359.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160400.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160401.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160402.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160403.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160404.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160405.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160406.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160407.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160408.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160409.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160410.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160411.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160412.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160413.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160414.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160415.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160416.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160417.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160418.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160419.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160420.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160421.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160422.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160423.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160424.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160425.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160426.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160427.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160428.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160429.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160430.txt
- %ALLUSERSPROFILE%\microsoft edge update\internet_check_20260522_160429.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160431.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160432.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160433.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160434.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160435.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160437.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160438.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160439.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160440.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160441.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160442.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160443.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160444.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160445.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160446.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160447.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160448.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160449.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160450.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160451.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160452.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160453.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160454.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160455.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160456.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160457.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160458.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160459.txt
- %ALLUSERSPROFILE%\microsoft edge update\timer_test_20260522_160459.txt
- %ALLUSERSPROFILE%\microsoft edge update\internet_check_20260522_160459.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160500.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160501.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160502.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160503.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160504.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160505.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160506.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160507.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160508.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160509.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160510.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160511.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160512.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160513.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160514.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160515.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160516.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160517.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160518.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160519.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160520.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160521.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160522.txt
- %ALLUSERSPROFILE%\microsoft edge update\screenshot_detection_20260522_160523.txt
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\microsoft edge update\<File name>.exe
Network activity
UDP
- DNS ASK google.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\microsoft edge update\<File name>.exe'
