Technical Information
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\replace.exe
- %TEMP%\rarsfx0\windowsmanager.exe
- %TEMP%\rarsfx0\cybermania.url
- %TEMP%\rarsfx0\crack.7z
- %TEMP%\rarsfx0\blockhost.cmd
- %TEMP%\rarsfx0\keygen.7z
- %APPDATA%\yamicsoft\windows manager 2.1.6\install\windowsmanagersetup.aiui
- %APPDATA%\yamicsoft\windows manager 2.1.6\install\windowsmanagersetup.msi
- %APPDATA%\yamicsoft\windows manager 2.1.6\install\windowsmanagersetup.x64.msi
- %TEMP%\shi4f49.tmp
- %TEMP%\msi51ea.tmp
- %TEMP%\msi55d3.tmp
- %TEMP%\ai_extui_bin_1372\dialog.jpg
- %TEMP%\ai_extui_bin_1372\completi
- %TEMP%\ai_extui_bin_1372\custicon
- %TEMP%\ai_extui_bin_1372\exclamic
- %TEMP%\ai_extui_bin_1372\info
- %TEMP%\ai_extui_bin_1372\insticon
- %TEMP%\ai_extui_bin_1372\removico
- %TEMP%\ai_extui_bin_1372\repairic
- %TEMP%\ai_extui_bin_1372\up
- %TEMP%\ai_extui_bin_1372\new
- %TEMP%\ai_extui_bin_1372\banner.jpg
- %TEMP%\ai_extui_bin_1372\tabback
- %TEMP%\ai_extui_bin_1372\externaluicleaner.dll
- %TEMP%\ai_extui_bin_1372\cmdlinkarrow
- %TEMP%\ai_extui_bin_1372\dialog.scale125.jpg
- %TEMP%\ai_extui_bin_1372\aicustact.dll
- %TEMP%\ai_extui_bin_1372\shortcutflags.dll
- %TEMP%\ai_extui_bin_1372\lzmaextractor.dll
- %TEMP%\ai_extui_bin_1372\banner.scale125.jpg
- %TEMP%\ai_extui_bin_1372\banner.scale150.jpg
- %TEMP%\ai_extui_bin_1372\banner.scale200.jpg
- %TEMP%\ai_extui_bin_1372\dialog.scale150.jpg
- %TEMP%\ai_extui_bin_1372\dialog.scale200.jpg
- %APPDATA%\yamicsoft\windows manager 2.1.6\install\windowsmanagersetup1.cab
- %WINDIR%\temp\~df6ef16f0afa236197.tmp
- %WINDIR%\installer\sourcehash{1e0a3a1c-8cf5-46c9-b6bd-81009743bb58}
- %WINDIR%\temp\~df0ab69a584423c85d.tmp
- %WINDIR%\temp\~df85e3a49d6ed7d320.tmp
- %WINDIR%\temp\~df9a46df8b1e03cd3f.tmp
- %ProgramFiles%\yamicsoft\windows manager\1-clickcleaner.exe
- %ProgramFiles%\yamicsoft\windows manager\bingimages.exe
- %ProgramFiles%\yamicsoft\windows manager\checkboxcombobox.dll
- %ProgramFiles%\yamicsoft\windows manager\cmmultiplefiles.exe
- %ProgramFiles%\yamicsoft\windows manager\contextmenumanager.exe
- %ProgramFiles%\yamicsoft\windows manager\desktopcleaner.exe
- %ProgramFiles%\yamicsoft\windows manager\devcomponents.dotnetbar2.dll
- %ProgramFiles%\yamicsoft\windows manager\devcomponents.treegx.dll
- %ProgramFiles%\yamicsoft\windows manager\devicemanager.exe
- %ProgramFiles%\yamicsoft\windows manager\diskanalyzer.exe
- %ProgramFiles%\yamicsoft\windows manager\duplicatefilesfinder.exe
- %ProgramFiles%\yamicsoft\windows manager\filesecurity.exe
- %ProgramFiles%\yamicsoft\windows manager\filesplitter.exe
- %ProgramFiles%\yamicsoft\windows manager\fileundelete.exe
- %ProgramFiles%\yamicsoft\windows manager\hardwaremonitor.exe
- %ProgramFiles%\yamicsoft\windows manager\help.chm
- %ProgramFiles%\yamicsoft\windows manager\hotkeymanager.exe
- %ProgramFiles%\yamicsoft\windows manager\ipswitcher.exe
- %ProgramFiles%\yamicsoft\windows manager\jumplistquicklauncher.exe
- %ProgramFiles%\yamicsoft\windows manager\junkfilecleaner.exe
- %ProgramFiles%\yamicsoft\windows manager\language\arabic.lang
- %ProgramFiles%\yamicsoft\windows manager\language\bulgarian.lang
- %ProgramFiles%\yamicsoft\windows manager\language\chinese_simplified.lang
- %ProgramFiles%\yamicsoft\windows manager\language\chinese_traditional.lang
- %ProgramFiles%\yamicsoft\windows manager\language\croatian.lang
- %ProgramFiles%\yamicsoft\windows manager\language\czech.lang
- %ProgramFiles%\yamicsoft\windows manager\language\dutch_netherlands.lang
- %ProgramFiles%\yamicsoft\windows manager\language\english.lang
- %ProgramFiles%\yamicsoft\windows manager\language\french.lang
- %ProgramFiles%\yamicsoft\windows manager\language\german.lang
- %ProgramFiles%\yamicsoft\windows manager\language\greek.lang
- %ProgramFiles%\yamicsoft\windows manager\language\hebrew.lang
- %ProgramFiles%\yamicsoft\windows manager\language\hungarian.lang
- %ProgramFiles%\yamicsoft\windows manager\language\indonesian.lang
- %ProgramFiles%\yamicsoft\windows manager\language\italian.lang
- %ProgramFiles%\yamicsoft\windows manager\language\japanese.lang
- %ProgramFiles%\yamicsoft\windows manager\language\korean.lang
- %ProgramFiles%\yamicsoft\windows manager\language\polish.lang
- %ProgramFiles%\yamicsoft\windows manager\language\russian.lang
- %ProgramFiles%\yamicsoft\windows manager\language\serbian.lang
- %ProgramFiles%\yamicsoft\windows manager\language\slovenian.lang
- %ProgramFiles%\yamicsoft\windows manager\language\spanish.lang
- %ProgramFiles%\yamicsoft\windows manager\language\swedish.lang
- %ProgramFiles%\yamicsoft\windows manager\language\translationhelp.rtf
- %ProgramFiles%\yamicsoft\windows manager\language\turkish.lang
- %ProgramFiles%\yamicsoft\windows manager\language\vietnamese.lang
- %ProgramFiles%\yamicsoft\windows manager\launchtaskcommand.exe
- %ProgramFiles%\yamicsoft\windows manager\liveupdate.exe
- %ProgramFiles%\yamicsoft\windows manager\liveupdatecopy.exe
- %ProgramFiles%\yamicsoft\windows manager\microsoft.win32.taskscheduler.dll
- %ProgramFiles%\yamicsoft\windows manager\mytask.exe
- %ProgramFiles%\yamicsoft\windows manager\navigationpanemanager.exe
- %ProgramFiles%\yamicsoft\windows manager\networkmonitor.exe
- %ProgramFiles%\yamicsoft\windows manager\networktools.exe
- %ProgramFiles%\yamicsoft\windows manager\optimizationwizard.exe
- %ProgramFiles%\yamicsoft\windows manager\privacyprotector.exe
- %ProgramFiles%\yamicsoft\windows manager\processmanager.exe
- %ProgramFiles%\yamicsoft\windows manager\registrycleaner.exe
- %ProgramFiles%\yamicsoft\windows manager\registrydefrag.exe
- %ProgramFiles%\yamicsoft\windows manager\registrytools.exe
- %ProgramFiles%\yamicsoft\windows manager\repaircenter.exe
- %ProgramFiles%\yamicsoft\windows manager\runshortcutcreator.exe
- %ProgramFiles%\yamicsoft\windows manager\servicecontrollerex.dll
- %ProgramFiles%\yamicsoft\windows manager\servicemanager.exe
- %ProgramFiles%\yamicsoft\windows manager\settingssecurity.exe
- %ProgramFiles%\yamicsoft\windows manager\smartuninstaller.exe
- %ProgramFiles%\yamicsoft\windows manager\startmenumanager.exe
- %ProgramFiles%\yamicsoft\windows manager\startupmanager.exe
- %ProgramFiles%\yamicsoft\windows manager\supercopy.exe
- %ProgramFiles%\yamicsoft\windows manager\systeminfo.exe
- %ProgramFiles%\yamicsoft\windows manager\taskdialog.dll
- %ProgramFiles%\yamicsoft\windows manager\taskschedulermanager.exe
- %ProgramFiles%\yamicsoft\windows manager\thispcmanager.exe
- %ProgramFiles%\yamicsoft\windows manager\visualcustomizer.exe
- %ProgramFiles%\yamicsoft\windows manager\wmfolderres.dll
- %ProgramFiles%\yamicsoft\windows manager\wmimageres.dll
- %ProgramFiles%\yamicsoft\windows manager\wmpcl.dll
- %ProgramFiles%\yamicsoft\windows manager\wifimanager.exe
- %ProgramFiles%\yamicsoft\windows manager\windowsmanager.exe
- %ProgramFiles%\yamicsoft\windows manager\windowsappuninstaller.exe
- %ProgramFiles%\yamicsoft\windows manager\windowsutilities.exe
- %ProgramFiles%\yamicsoft\windows manager\securitylock.exe
- %ProgramFiles%\yamicsoft\windows manager\urlmanager.exe
- %ProgramFiles%\yamicsoft\windows manager\eventviewer.exe
- %ProgramFiles%\yamicsoft\windows manager\winapp.dll
- %ProgramFiles%\yamicsoft\windows manager\language\portuguese_brazil.lang
- %ProgramFiles%\yamicsoft\windows manager\language\portuguese_portugal.lang
- %ProgramFiles%\yamicsoft\windows manager\language\ukrainian.lang
- %ProgramFiles%\yamicsoft\windows manager\language\thailand.lang
- %ProgramFiles%\yamicsoft\windows manager\winxmenueditor.exe
- %APPDATA%\microsoft\installer\{1e0a3a1c-8cf5-46c9-b6bd-81009743bb58}\clickcleaner.exe
- %APPDATA%\microsoft\installer\{1e0a3a1c-8cf5-46c9-b6bd-81009743bb58}\liveupdate.exe
- %APPDATA%\microsoft\installer\{1e0a3a1c-8cf5-46c9-b6bd-81009743bb58}\windowsmanager.exe
- %APPDATA%\microsoft\installer\{1e0a3a1c-8cf5-46c9-b6bd-81009743bb58}\wmlogo.exe
- %APPDATA%\microsoft\installer\{1e0a3a1c-8cf5-46c9-b6bd-81009743bb58}\systemfoldermsiexec.exe
- %HOMEPATH%\desktop\windows manager.lnk
- %HOMEPATH%\desktop\1-click cleaner.lnk
- %APPDATA%\microsoft\windows\start menu\programs\yamicsoft\live update.lnk
- %APPDATA%\microsoft\windows\start menu\programs\yamicsoft\1-click cleaner.lnk
- %APPDATA%\microsoft\windows\start menu\programs\yamicsoft\windows manager.lnk
- %APPDATA%\microsoft\windows\start menu\programs\yamicsoft\uninstall windows manager.lnk
- %WINDIR%\temp\~dfa6a192e3d9cf74f5.tmp
- %WINDIR%\temp\~df4d928978916de47f.tmp
- %WINDIR%\temp\~df61b3cefe243c0ad2.tmp
- %WINDIR%\temp\~df89817fc57b0e5232.tmp
- %WINDIR%\temp\~df6f2e62a44cd10192.tmp
- %WINDIR%\temp\~dfb8fb616958dfd8fc.tmp
- %WINDIR%\temp\~df67e02083bf1cc960.tmp
- %WINDIR%\temp\~dfc68eaec2be00eebb.tmp
- %LOCALAPPDATA%\caphyon\advanced installer\{1e0a3a1c-8cf5-46c9-b6bd-81009743bb58}\windowsmanager.exe
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68c91f86-144.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68c91f8a-ee8.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ea35aed8ee9f647e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e460049e95c0299d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8a39812495ea3afe_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1d765680aecb6445_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7d255758e733ed76_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a354f424433b2e66_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fd70e10902cc462e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c8cbd2f79e11ff33_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b6c3b65f14505b63_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\db07aed739dab95d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
- %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_ftuapps1.farlad.com_0.indexeddb.leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_ftuapps1.farlad.com_0.indexeddb.leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_ftuapps1.farlad.com_0.indexeddb.leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_ftuapps1.farlad.com_0.indexeddb.leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\29ecb6edee87ca27_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bffdcef279f795b2_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2aaa22de88f41f13_0
- %TEMP%\3d8c1e2b-4fe2-43b4-ad51-64302ec90b1d.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
Moves the following files
- from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_ftuapps1.farlad.com_0.indexeddb.leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_ftuapps1.farlad.com_0.indexeddb.leveldb\current
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Network activity
Connects to
- 'ft##pps.dev':443
- 'co####.edge.skype.com':443
- 'fo###.gstatic.com':80
- 'ft####s1.farlad.com':443
- 'fo###.#oogleapis.com':443
- 'a.###.#loudflare.com':443
- 'go#####agmanager.com':443
- 'fo###.gstatic.com':443
- 'pa#####.#ooglesyndication.com':443
- 'st####.##oudflareinsights.com':443
- 'cd#.##esignal.com':443
- 'a###ytics.google.com':443
- 'go##le.ru':443
- 'st###.#.doubleclick.net':443
TCP
Other
- 'ft##pps.dev':443
- 'co####.edge.skype.com':443
- 'ft####s1.farlad.com':443
- 'fo###.#oogleapis.com':443
- 'a.###.#loudflare.com':443
- 'go#####agmanager.com':443
- 'fo###.gstatic.com':443
- 'ap#.##esignal.com':443
- 'st####.##oudflareinsights.com':443
- 'pa#####.#ooglesyndication.com':443
- 'a###ytics.google.com':443
- 'go##le.ru':443
- 'st###.#.doubleclick.net':443
UDP
- DNS ASK ft##pps.dev
- DNS ASK co####.edge.skype.com
- DNS ASK ft####s1.farlad.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK go#####agmanager.com
- DNS ASK a.###.#loudflare.com
- DNS ASK fo###.gstatic.com
- DNS ASK cd#.##esignal.com
- DNS ASK pa#####.#ooglesyndication.com
- DNS ASK st####.##oudflareinsights.com
- DNS ASK a###ytics.google.com
- DNS ASK go##le.ru
- DNS ASK ap#.##esignal.com
- DNS ASK st###.#.doubleclick.net
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Creates and executes the following
- '%TEMP%\rarsfx0\windowsmanager.exe' /qb
- '%TEMP%\rarsfx0\windowsmanager.exe' /i "%APPDATA%\Yamicsoft\Windows Manager 2.1.6\install\WindowsManagerSetup.x64.msi" /qb AI_SETUPEXEPATH=%TEMP%\RarSFX0\windowsmanager.exe SETUPEXEDIR=%TEMP%\RarSFX0\ "EXE_CMD_LINE=/exenoupdates ...
- '%TEMP%\rarsfx0\replace.exe'
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%APPDATA%\Yamicsoft\Windows Manager 2.1.6\install\WindowsManagerSetup.x64.msi" /qb AI_SETUPEXEPATH=%TEMP%\RarSFX0\windowsmanager.exe SETUPEXEDIR=%TEMP%\RarSFX0\ EXE_CMD_LINE="/exenoupdates ...
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Yamicsoft\Windows Manager" /v "Licence Key" /t REG_SZ /d "4RA93-ERD7F-B4E8B-W3122" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Yamicsoft\Windows Manager" /v "Licence User" /t REG_SZ /d "CyberMania" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Yamicsoft\Windows Manager" /v "Licence Email" /t REG_SZ /d "register@yamicsoft.com" /f
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://ftuapps.dev/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://ftuapps.dev/
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1720,16498634626594657543,15207847997688080181,131072 --lang=en-US --service-sandbox-type=none --mojo...
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Yamicsoft\Windows Manager" /v "Licence Key" /t REG_SZ /d "4RA93-ERD7F-B4E8B-W3122" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Yamicsoft\Windows Manager" /v "Licence User" /t REG_SZ /d "CyberMania" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Yamicsoft\Windows Manager" /v "Licence Email" /t REG_SZ /d "register@yamicsoft.com" /f' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://ftuapps.dev/' (with hidden window)
