Trojan.Siggen32.15601

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdateTaskMachineQC] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdateTaskMachineQC] 'ImagePath' = '%ALLUSERSPROFILE%\Google\Chrome\updater.exe'

Создает следующие сервисы

'GoogleUpdateTaskMachineQC' %ALLUSERSPROFILE%\Google\Chrome\updater.exe

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует:

Журнал событий Windows (Windows Event Logging)

добавляет исключения антивируса:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData,$env:windir) -ExclusionExtension @('.exe','.dll') -Force

Внедряет код в

следующие системные процессы:

<SYSTEM32>\conhost.exe
%WINDIR%\explorer.exe

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''

Изменения в файловой системе

Создает следующие файлы

nul
%TEMP%\winupdate_20251225_085403_5b5d1126fff5\runtime.zip
%TEMP%\winupdate_20251225_085403_5b5d1126fff5\cmake.zip
%TEMP%\winupdate_20251225_085403_5b5d1126fff5\updater.exe
%TEMP%\__psscriptpolicytest_31ld2uf3.nl4.ps1
%TEMP%\__psscriptpolicytest_o2e5husq.yfz.psm1
%TEMP%\content\4840-2940-updater.exe-08-54-10-884.dump
%TEMP%\nqr20poh\nqr20poh.0.cs
%TEMP%\nqr20poh\nqr20poh.cmdline
%TEMP%\nqr20poh\nqr20poh.out
%TEMP%\nqr20poh\cscd9f7fa5913f4bbfac242d80e62aaa8a.tmp
%TEMP%\res9a4c.tmp
%TEMP%\nqr20poh\nqr20poh.dll
%TEMP%\content\4840-2940-updater.exe-08-54-11-883.dump
%TEMP%\content\4840-2940-updater.exe-08-54-12-262.dump
%TEMP%\content\4840-2940-updater.exe-08-54-12-331.dump
%TEMP%\content\4840-2940-updater.exe-08-54-12-532.dump
%TEMP%\content\4840-2940-updater.exe-08-54-12-579.dump
%TEMP%\__psscriptpolicytest_r2swqzch.xbi.ps1
%TEMP%\__psscriptpolicytest_cplclfzo.lge.psm1
%TEMP%\content\4840-2940-updater.exe-08-54-13-081.dump
%TEMP%\content\4840-2940-updater.exe-08-54-13-103.dump
%TEMP%\content\4840-2940-updater.exe-08-54-13-266.dump
%TEMP%\content\4840-2940-updater.exe-08-54-13-420.dump
%TEMP%\content\4840-2940-updater.exe-08-54-13-552.dump
%TEMP%\content\4840-2940-updater.exe-08-54-13-637.dump
%TEMP%\content\4840-2940-updater.exe-08-54-13-880.dump
%TEMP%\content\4840-2940-updater.exe-08-54-13-943.dump
%TEMP%\content\4840-2940-updater.exe-08-54-13-972.dump
%TEMP%\content\4840-2940-updater.exe-08-54-14-006.dump
%TEMP%\content\4840-2940-updater.exe-08-54-14-038.dump
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\updater.exe.log
%ALLUSERSPROFILE%\neptune\extracted\root1.exe
%ALLUSERSPROFILE%\neptune\extracted\root2.exe
%ALLUSERSPROFILE%\neptune\extracted\root3.exe
%TEMP%\_mei36522\vcruntime140.dll
%TEMP%\_mei36522\vcruntime140_1.dll
%TEMP%\_mei36522\_asyncio.pyd
%TEMP%\_mei36522\_bz2.pyd
%TEMP%\_mei36522\_ctypes.pyd
%TEMP%\_mei36522\_decimal.pyd
%TEMP%\_mei36522\_hashlib.pyd
%TEMP%\_mei36522\_lzma.pyd
%TEMP%\_mei36522\_multiprocessing.pyd
%TEMP%\_mei36522\_overlapped.pyd
%TEMP%\_mei36522\_queue.pyd
%TEMP%\_mei36522\_socket.pyd
%TEMP%\_mei36522\_ssl.pyd
%TEMP%\_mei36522\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei36522\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei36522\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei36522\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei36522\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei36522\base_library.zip
%TEMP%\_mei36522\certifi\cacert.pem
%TEMP%\_mei36522\charset_normalizer\md.cp311-win_amd64.pyd
%TEMP%\_mei36522\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
%TEMP%\_mei36522\libcrypto-1_1.dll
%TEMP%\_mei36522\libffi-8.dll
%TEMP%\_mei36522\libssl-1_1.dll
%TEMP%\_mei36522\pyexpat.pyd
%TEMP%\_mei36522\python311.dll
%TEMP%\_mei36522\pywin32_system32\pywintypes311.dll
%TEMP%\_mei36522\select.pyd
%TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
%TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
%TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
%TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
%TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
%TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
%TEMP%\_mei36522\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei36522\ucrtbase.dll
%TEMP%\_mei36522\unicodedata.pyd
%TEMP%\_mei36522\wheel-0.45.1.dist-info\installer
%TEMP%\_mei36522\wheel-0.45.1.dist-info\license.txt
%TEMP%\_mei36522\wheel-0.45.1.dist-info\metadata
%TEMP%\_mei36522\wheel-0.45.1.dist-info\record
%TEMP%\_mei36522\wheel-0.45.1.dist-info\wheel
%TEMP%\_mei36522\wheel-0.45.1.dist-info\entry_points.txt
%TEMP%\_mei36522\win32\win32crypt.pyd
%ALLUSERSPROFILE%\google\chrome\updater.exe
%WINDIR%\temp\__psscriptpolicytest_txlmdyrn.arp.ps1
%WINDIR%\temp\__psscriptpolicytest_shi0cwmk.22v.psm1
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-172.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-388.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-473.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-620.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-658.dump
%WINDIR%\temp\__psscriptpolicytest_tctk4hmd.wix.ps1
%WINDIR%\temp\__psscriptpolicytest_ymsks3bi.rgi.psm1
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-842.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-874.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-937.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-044.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-181.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-265.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-393.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-437.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-469.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-511.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-551.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-585.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-617.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-53-00-009.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-53-00-062.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-53-00-094.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-53-00-109.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-53-00-147.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-53-00-179.dump
%WINDIR%\temp\content\1976-4892-powershell.exe-07-53-00-248.dump
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
%WINDIR%\temp\qbafufdsigxp.sys

Удаляет файлы, которые сам же создал

%TEMP%\__psscriptpolicytest_31ld2uf3.nl4.ps1
%TEMP%\__psscriptpolicytest_o2e5husq.yfz.psm1
%TEMP%\res9a4c.tmp
%TEMP%\nqr20poh\cscd9f7fa5913f4bbfac242d80e62aaa8a.tmp
%TEMP%\nqr20poh\nqr20poh.0.cs
%TEMP%\nqr20poh\nqr20poh.dll
%TEMP%\nqr20poh\nqr20poh.cmdline
%TEMP%\nqr20poh\nqr20poh.out
%TEMP%\__psscriptpolicytest_r2swqzch.xbi.ps1
%TEMP%\__psscriptpolicytest_cplclfzo.lge.psm1
%TEMP%\winupdate_20251225_085403_5b5d1126fff5\updater.exe
%TEMP%\winupdate_20251225_085403_5b5d1126fff5\runtime.zip
%ALLUSERSPROFILE%\neptune\cmake.zip
%TEMP%\_mei36522\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei36522\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei36522\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei36522\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei36522\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei36522\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei36522\base_library.zip
%TEMP%\_mei36522\certifi\cacert.pem
%TEMP%\_mei36522\charset_normalizer\md.cp311-win_amd64.pyd
%TEMP%\_mei36522\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
%TEMP%\_mei36522\libcrypto-1_1.dll
%TEMP%\_mei36522\libffi-8.dll
%TEMP%\_mei36522\libssl-1_1.dll
%TEMP%\_mei36522\pyexpat.pyd
%TEMP%\_mei36522\python311.dll
%TEMP%\_mei36522\pywin32_system32\pywintypes311.dll
%TEMP%\_mei36522\select.pyd
%TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
%TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
%TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
%TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
%TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
%TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
%TEMP%\_mei36522\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei36522\ucrtbase.dll
%TEMP%\_mei36522\unicodedata.pyd
%TEMP%\_mei36522\vcruntime140.dll
%TEMP%\_mei36522\vcruntime140_1.dll
%TEMP%\_mei36522\wheel-0.45.1.dist-info\entry_points.txt
%TEMP%\_mei36522\wheel-0.45.1.dist-info\installer
%TEMP%\_mei36522\wheel-0.45.1.dist-info\license.txt
%TEMP%\_mei36522\wheel-0.45.1.dist-info\metadata
%TEMP%\_mei36522\wheel-0.45.1.dist-info\record
%TEMP%\_mei36522\wheel-0.45.1.dist-info\wheel
%TEMP%\_mei36522\win32\win32crypt.pyd
%TEMP%\_mei36522\_asyncio.pyd
%TEMP%\_mei36522\_bz2.pyd
%TEMP%\_mei36522\_ctypes.pyd
%TEMP%\_mei36522\_decimal.pyd
%TEMP%\_mei36522\_hashlib.pyd
%TEMP%\_mei36522\_lzma.pyd
%TEMP%\_mei36522\_multiprocessing.pyd
%TEMP%\_mei36522\_overlapped.pyd
%TEMP%\_mei36522\_queue.pyd
%TEMP%\_mei36522\_socket.pyd
%TEMP%\_mei36522\_ssl.pyd
%WINDIR%\temp\__psscriptpolicytest_txlmdyrn.arp.ps1
%WINDIR%\temp\__psscriptpolicytest_shi0cwmk.22v.psm1
%WINDIR%\temp\__psscriptpolicytest_tctk4hmd.wix.ps1
%WINDIR%\temp\__psscriptpolicytest_ymsks3bi.rgi.psm1

Перемещает следующие файлы

%TEMP%\winupdate_20251225_085403_5b5d1126fff5\cmake.zip в %ALLUSERSPROFILE%\neptune\cmake.zip
%ALLUSERSPROFILE%\neptune\extracted\root1.exe в %ALLUSERSPROFILE%\neptune\falcon.exe
%ALLUSERSPROFILE%\neptune\extracted\root2.exe в %ALLUSERSPROFILE%\neptune\summer.exe
%ALLUSERSPROFILE%\neptune\extracted\root3.exe в %ALLUSERSPROFILE%\neptune\dispute.exe

Сетевая активность

Подключается к

'po###.#atericofhal.rest':443
'lo#.###geonteambot.lol':8443
'ip##pi.com':80
'ra####manial.autos':187
'45.##3.34.36':80

TCP

Запросы HTTP GET

http://ip##pi.com/json/?fi###################################################

Другие

'lo#.###geonteambot.lol':443
'lo#.###geonteambot.lol':8443

UDP

DNS ASK po###.#atericofhal.rest
DNS ASK lo#.###geonteambot.lol
DNS ASK ip##pi.com
DNS ASK ra####manial.autos

Другое

Ищет следующие окна

ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: '18467-41' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\winupdate_20251225_085403_5b5d1126fff5\updater.exe'
'%ALLUSERSPROFILE%\neptune\falcon.exe'
'%ALLUSERSPROFILE%\neptune\summer.exe'
'%ALLUSERSPROFILE%\neptune\dispute.exe'
'%ALLUSERSPROFILE%\google\chrome\updater.exe'

Перезапускает анализируемый образец

Запускает на исполнение

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command " Add-Type -Name WinAPI -Namespace Console -MemberDefinition @\" [DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); ... (со скрытым окном)
'<SYSTEM32>\tasklist.exe' /fo csv /nh (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { $process = Start-Process -FilePath \"%TEMP%\WinUpdate_20251225_085403_5b5d1126fff5\updater.exe\" -Verb RunAs -WindowStyle Hidden -PassThru -ErrorAct... (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\nqr20poh\nqr20poh.cmdline" (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9A4C.tmp" "%TEMP%\nqr20poh\CSCD9F7FA5913F4BBFAC242D80E62AAA8A.TMP" (со скрытым окном)
'<SYSTEM32>\attrib.exe' +h %ALLUSERSPROFILE%\Neptune (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\falcon.exe\" -WindowStyle Hidden -PassThru } catch {}" (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\summer.exe\" -WindowStyle Hidden -PassThru } catch {}" (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\dispute.exe\" -WindowStyle Hidden -PassThru } catch {}" (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c "cmd /c ping 127.0.0.1 -n 3 > nul & del /f /q "%ALLUSERSPROFILE%\Neptune\dispute.exe"" (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 3
'<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
'<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' stop UsoSvc
'<SYSTEM32>\sc.exe' stop WaaSMedicSvc
'<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' stop wuauserv
'<SYSTEM32>\sc.exe' stop bits
'<SYSTEM32>\sc.exe' stop dosvc
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
'<SYSTEM32>\sc.exe' delete "GoogleUpdateTaskMachineQC"
'<SYSTEM32>\sc.exe' create "GoogleUpdateTaskMachineQC" binpath= "%ALLUSERSPROFILE%\Google\Chrome\updater.exe" start= "auto"
'<SYSTEM32>\sc.exe' stop eventlog
'<SYSTEM32>\sc.exe' start "GoogleUpdateTaskMachineQC"
'%WINDIR%\explorer.exe' SXGaBh4b6qNQIWXs Gruj7gJhahEJ2xHHXzbHcRyxK8osk1GDV+B+kwwjr2rGNRxFkxFHEyclg+i5OfUcHfjUXYdmMVgnmUGs3kPiE3/m8cZIx2qcUYsOmrOVu2ummzt4W9d0HL0dG9UjoEq3l+FAWHVHE2RDMrgL2K02cgiBoGAtS8gCiSMZA9q1PmIL8u4s...
'<Полный путь к файлу>' <Полный путь к файлу> (со скрытым окном)
'%TEMP%\winupdate_20251225_085403_5b5d1126fff5\updater.exe' (со скрытым окном)
'%ALLUSERSPROFILE%\neptune\falcon.exe' (со скрытым окном)
'%ALLUSERSPROFILE%\neptune\summer.exe' (со скрытым окном)
'%ALLUSERSPROFILE%\neptune\dispute.exe' (со скрытым окном)

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней