Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '"%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\windowsupdate
- %APPDATA%\microsoft\windows\start menu\programs\startup\windowsupdate.vbs
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%LOCALAPPDATA%\Microsoft\Windows\Update\WinRing0x64.sys'
Создает следующие сервисы
- 'WinRing0_1_2_0' %LOCALAPPDATA%\Microsoft\Windows\Update\WinRing0x64.sys
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса с помощью следующих ключей реестра:
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\7hojwcl57rnn' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\zvgrqymphnih' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\faqgu2yeaj4h' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\update\MicrosoftUpdateAssistant.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\update\MicrosoftUpdateWorker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\update\miner.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\update\xmrig.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\update\checker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\microsoft\windows\themes\7hojwcl57rnn\MicrosoftUpdateAssistant.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\microsoft\windows\themes\7hojwcl57rnn\MicrosoftUpdateWorker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\microsoft\windows\themes\7hojwcl57rnn\miner.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\microsoft\windows\themes\7hojwcl57rnn\xmrig.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\microsoft\windows\themes\7hojwcl57rnn\checker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\MicrosoftUpdateAssistant.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\MicrosoftUpdateWorker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\miner.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\xmrig.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\checker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\MicrosoftUpdateAssistant.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\MicrosoftUpdateWorker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\miner.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\xmrig.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\checker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\wininetcache\MicrosoftUpdateAssistant.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\wininetcache\MicrosoftUpdateWorker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\wininetcache\miner.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\wininetcache\xmrig.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\wininetcache\checker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateAssistant.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateWorker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'miner.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'xmrig.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'checker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\update\MicrosoftUpdateAssistant.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\update\MicrosoftUpdateWorker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\update\miner.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\update\xmrig.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\update\checker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%APPDATA%\microsoft\windows\themes\7hojwcl57rnn\MicrosoftUpdateAssistant.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%APPDATA%\microsoft\windows\themes\7hojwcl57rnn\MicrosoftUpdateWorker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%APPDATA%\microsoft\windows\themes\7hojwcl57rnn\miner.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%APPDATA%\microsoft\windows\themes\7hojwcl57rnn\xmrig.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%APPDATA%\microsoft\windows\themes\7hojwcl57rnn\checker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\MicrosoftUpdateAssistant.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\MicrosoftUpdateWorker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\miner.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\xmrig.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\checker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\MicrosoftUpdateAssistant.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\MicrosoftUpdateWorker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\miner.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\xmrig.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\checker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%TEMP%\wininetcache\MicrosoftUpdateAssistant.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%TEMP%\wininetcache\MicrosoftUpdateWorker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%TEMP%\wininetcache\miner.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%TEMP%\wininetcache\xmrig.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%TEMP%\wininetcache\checker.exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] '.exe' = '00000000'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei0000085c2\vcruntime140.dll
- %TEMP%\_mei0000085c2\_bz2.pyd
- %TEMP%\_mei0000085c2\_ctypes.pyd
- %TEMP%\_mei0000085c2\_decimal.pyd
- %TEMP%\_mei0000085c2\_hashlib.pyd
- %TEMP%\_mei0000085c2\_lzma.pyd
- %TEMP%\_mei0000085c2\_socket.pyd
- %TEMP%\_mei0000085c2\_ssl.pyd
- %TEMP%\_mei0000085c2\base_library.zip
- %TEMP%\_mei0000085c2\build.json
- %TEMP%\_mei0000085c2\config.json
- %TEMP%\_mei0000085c2\libcrypto-3.dll
- %TEMP%\_mei0000085c2\libffi-8.dll
- %TEMP%\_mei0000085c2\libssl-3.dll
- %TEMP%\_mei0000085c2\psutil\_psutil_windows.pyd
- %TEMP%\_mei0000085c2\python3.dll
- %TEMP%\_mei0000085c2\python312.dll
- %TEMP%\_mei0000085c2\select.pyd
- %TEMP%\_mei0000085c2\taskmgr_hook.dll
- %TEMP%\_mei0000085c2\unicodedata.pyd
- %TEMP%\_mei0000085c2\wd.bin
- %TEMP%\_mei0000085c2\xmrig.bin
- %LOCALAPPDATA%\microsoft\windows\update\microsoftupdateassistant.exe
- %TEMP%\_mei000011dc2\vcruntime140.dll
- %TEMP%\_mei000011dc2\_bz2.pyd
- %TEMP%\_mei000011dc2\_ctypes.pyd
- %TEMP%\_mei000011dc2\_decimal.pyd
- %TEMP%\_mei000011dc2\_hashlib.pyd
- %TEMP%\_mei000011dc2\_lzma.pyd
- %TEMP%\_mei000011dc2\_socket.pyd
- %TEMP%\_mei000011dc2\_ssl.pyd
- %TEMP%\_mei000011dc2\base_library.zip
- %TEMP%\_mei000011dc2\build.json
- %TEMP%\_mei000011dc2\config.json
- %TEMP%\_mei000011dc2\libcrypto-3.dll
- %TEMP%\_mei000011dc2\libffi-8.dll
- %TEMP%\_mei000011dc2\libssl-3.dll
- %TEMP%\_mei000011dc2\psutil\_psutil_windows.pyd
- %TEMP%\_mei000011dc2\python3.dll
- %TEMP%\_mei000011dc2\python312.dll
- %TEMP%\_mei000011dc2\select.pyd
- %TEMP%\_mei000011dc2\taskmgr_hook.dll
- %TEMP%\_mei000011dc2\unicodedata.pyd
- %TEMP%\_mei000011dc2\wd.bin
- %TEMP%\_mei000011dc2\xmrig.bin
- %TEMP%\_v22flfr
- %LOCALAPPDATA%\microsoft\windows\update\microsoftupdateworker.exe
- %LOCALAPPDATA%\microsoft\windows\update\.mrt_done
- %LOCALAPPDATA%\microsoft\windows\update\.sleep_done
- %LOCALAPPDATA%\microsoft\windows\update\microsoftupdatehealth.exe
- %TEMP%\_mei000011902\vcruntime140.dll
- %TEMP%\_mei000011902\_bz2.pyd
- %TEMP%\_mei000011902\_ctypes.pyd
- %TEMP%\_mei000011902\_decimal.pyd
- %TEMP%\_mei000011902\_hashlib.pyd
- %TEMP%\_mei000011902\_lzma.pyd
- %TEMP%\_mei000011902\_socket.pyd
- %TEMP%\_mei000011902\base_library.zip
- %TEMP%\_mei000011902\libcrypto-3.dll
- nul
- %TEMP%\_mei000011902\libffi-8.dll
- %TEMP%\_mei000011902\python312.dll
- %APPDATA%\microsoft\windows\themes\7hojwcl57rnn\.mrt_done
- %APPDATA%\microsoft\windows\themes\7hojwcl57rnn\.sleep_done
- %APPDATA%\microsoft\windows\themes\7hojwcl57rnn\microsoftupdateassistant.exe
- %APPDATA%\microsoft\windows\themes\7hojwcl57rnn\microsoftupdatehealth.exe
- %APPDATA%\microsoft\windows\themes\7hojwcl57rnn\microsoftupdateworker.exe
- %LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\.mrt_done
- %LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\.sleep_done
- %LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\microsoftupdateassistant.exe
- %LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\microsoftupdatehealth.exe
- %LOCALAPPDATA%\microsoft\windows\explorer\zvgrqymphnih\microsoftupdateworker.exe
- %LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\.mrt_done
- %LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\.sleep_done
- %LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\microsoftupdateassistant.exe
- %LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\microsoftupdatehealth.exe
- %LOCALAPPDATA%\microsoft\windows\wer\reportqueue\faqgu2yeaj4h\microsoftupdateworker.exe
- %LOCALAPPDATA%\microsoft\windows\update\taskmgr_hook.dll
- %TEMP%\_mei000011902\select.pyd
- %TEMP%\_mei000011902\unicodedata.pyd
- %LOCALAPPDATA%\microsoft\windows\update\runtime_full_donate.json
- %LOCALAPPDATA%\microsoft\windows\update\runtime_donate_phase.json
- %LOCALAPPDATA%\microsoft\windows\update\config.dat.tmp
- %LOCALAPPDATA%\microsoft\windows\update\config.json
Присваивает атрибут 'скрытый' для следующих файлов
- %LOCALAPPDATA%\microsoft\windows\update\microsoftupdateassistant.exe
- %LOCALAPPDATA%\microsoft\windows\update\microsoftupdateworker.exe
- %LOCALAPPDATA%\microsoft\windows\update\.mrt_done
- %LOCALAPPDATA%\microsoft\windows\update\.sleep_done
- %LOCALAPPDATA%\microsoft\windows\update\microsoftupdatehealth.exe
- %LOCALAPPDATA%\microsoft\windows\update\taskmgr_hook.dll
- %LOCALAPPDATA%\microsoft\windows\update\runtime_full_donate.json
- %LOCALAPPDATA%\microsoft\windows\update\runtime_donate_phase.json
- %LOCALAPPDATA%\microsoft\windows\update\config.dat
- %LOCALAPPDATA%\microsoft\windows\update\config.json
Удаляет файлы, которые сам же создал
- %TEMP%\_mei0000085c2\base_library.zip
- %TEMP%\_mei0000085c2\build.json
- %TEMP%\_mei0000085c2\config.json
- %TEMP%\_mei0000085c2\libcrypto-3.dll
- %TEMP%\_mei0000085c2\libffi-8.dll
- %TEMP%\_mei0000085c2\libssl-3.dll
- %TEMP%\_mei0000085c2\psutil\_psutil_windows.pyd
- %TEMP%\_mei0000085c2\python3.dll
- %TEMP%\_mei0000085c2\python312.dll
- %TEMP%\_mei0000085c2\select.pyd
- %TEMP%\_mei0000085c2\taskmgr_hook.dll
- %TEMP%\_mei0000085c2\unicodedata.pyd
- %TEMP%\_mei0000085c2\vcruntime140.dll
- %TEMP%\_mei0000085c2\wd.bin
- %TEMP%\_mei0000085c2\xmrig.bin
- %TEMP%\_mei0000085c2\_bz2.pyd
- %TEMP%\_mei0000085c2\_ctypes.pyd
- %TEMP%\_mei0000085c2\_decimal.pyd
- %TEMP%\_mei0000085c2\_hashlib.pyd
- %TEMP%\_mei0000085c2\_lzma.pyd
- %TEMP%\_mei0000085c2\_socket.pyd
- %TEMP%\_mei0000085c2\_ssl.pyd
- %TEMP%\_v22flfr
- %LOCALAPPDATA%\microsoft\windows\update\config.json
- %TEMP%\_mei000011902\base_library.zip
- %TEMP%\_mei000011902\libcrypto-3.dll
- %TEMP%\_mei000011902\libffi-8.dll
- %TEMP%\_mei000011902\python312.dll
- %TEMP%\_mei000011902\select.pyd
- %TEMP%\_mei000011902\unicodedata.pyd
- %TEMP%\_mei000011902\vcruntime140.dll
- %TEMP%\_mei000011902\_bz2.pyd
- %TEMP%\_mei000011902\_ctypes.pyd
- %TEMP%\_mei000011902\_decimal.pyd
- %TEMP%\_mei000011902\_hashlib.pyd
- %TEMP%\_mei000011902\_lzma.pyd
- %TEMP%\_mei000011902\_socket.pyd
Перемещает следующие файлы
- %LOCALAPPDATA%\microsoft\windows\update\config.dat.tmp в %LOCALAPPDATA%\microsoft\windows\update\config.dat
Сетевая активность
Подключается к
- 'po##.#ashvault.pro':443
- 'po##.#ashvault.pro':80
- 'pa###bin.com':443
TCP
Запросы HTTP GET
- http://po##.#ashvault.pro/
Другие
- 'po##.#ashvault.pro':443
- 'pa###bin.com':443
UDP
- DNS ASK po##.#ashvault.pro
- DNS ASK pa###bin.com
Другое
Создает и запускает на исполнение
- '%LOCALAPPDATA%\microsoft\windows\update\microsoftupdateassistant.exe'
- '%LOCALAPPDATA%\microsoft\windows\update\microsoftupdatehealth.exe'
- '%LOCALAPPDATA%\microsoft\windows\update\microsoftupdateworker.exe'
Перезапускает анализируемый образец
Запускает на исполнение
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\schtasks.exe' /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR \"%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\"
- '<SYSTEM32>\sc.exe' delete WindowsUpdateSvc
- '%LOCALAPPDATA%\microsoft\windows\update\microsoftupdateassistant.exe' (со скрытым окном)
- '%LOCALAPPDATA%\microsoft\windows\update\microsoftupdatehealth.exe' (со скрытым окном)
- '%LOCALAPPDATA%\microsoft\windows\update\microsoftupdateworker.exe' (со скрытым окном)
