Trojan.Siggen18.59760

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\windows11installationassistant.lnk
<SYSTEM32>\tasks\ar

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS] 'dLl' = '00000000'
[<HKLM>\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS] 'sCr' = '00000000'
[<HKLM>\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS] 'CMd' = '00000000'
[<HKLM>\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS] 'exe' = '00000000'
[<HKLM>\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS] '<DRIVERS>\etc\hOSTS' = '00000000'

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"

Modifies file system

Creates the following files

%TEMP%\is-7ofkg.tmp\<File name>.tmp
%APPDATA%\windows11installationassistant\images\is-4apdq.tmp
%APPDATA%\windows11installationassistant\images\is-lt842.tmp
%APPDATA%\windows11installationassistant\images\is-7lpni.tmp
%APPDATA%\windows11installationassistant\images\is-ia2e7.tmp
%APPDATA%\windows11installationassistant\images\is-qc99o.tmp
C:\tmp\.cmd
C:\tmp\.vbs
%TEMP%\is-nk2td.tmp\temp\.cmd
%TEMP%\aut818e.tmp
%APPDATA%\windows11installationassistant\images\is-r2bjf.tmp
%APPDATA%\windows11installationassistant\images\is-3qqaq.tmp
%TEMP%\8rdt9s8n.tmp
%WINDIR%\temp\aut8eb7.tmp
%WINDIR%\temp\2u4t9u6b.tmp
%WINDIR%\temp\aut8ef7.tmp
%WINDIR%\temp\aut8f07.tmp
%TEMP%\aut901e.tmp
%TEMP%\1u7t6u4b.tmp
%TEMP%\aut902f.tmp
%TEMP%\aut906e.tmp
%WINDIR%\temp\aut9904.tmp
%TEMP%\aut819e.tmp
%TEMP%\aut820c.tmp
%APPDATA%\windows11installationassistant\images\is-caea8.tmp
%APPDATA%\windows11installationassistant\images\is-6kd3l.tmp
%APPDATA%\windows11installationassistant\images\is-8qg1d.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-gqhmo.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-1eafv.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-utqf9.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-fjmi3.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-bp7vb.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-skvtu.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-64446.tmp
%APPDATA%\windows11installationassistant\images\is-cqv5l.tmp
%APPDATA%\windows11installationassistant\images\is-ffco9.tmp
%APPDATA%\windows11installationassistant\images\is-7jodi.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-dt5ho.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-r11ha.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-8e0e9.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-q4duj.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-adclc.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-73m1k.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-t4s24.tmp
%APPDATA%\windows11installationassistant\images\is-qelko.tmp
%APPDATA%\windows11installationassistant\is-8b735.tmp
%APPDATA%\windows11installationassistant\images\is-dcu1h.tmp
%APPDATA%\windows11installationassistant\images\is-uin8h.tmp
%APPDATA%\windows11installationassistant\images\is-lotnp.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-tq129.tmp
%WINDIR%\temp\1d2c6e4p.tmp
%WINDIR%\temp\aut9914.tmp
%WINDIR%\temp\aut9934.tmp
%WINDIR%\temp\aut99fd.tmp
%WINDIR%\temp\autc4a5.tmp
%WINDIR%\temp\1u9i1b6z.tmp
%WINDIR%\temp\autc4b6.tmp
%WINDIR%\temp\autc4c7.tmp
%APPDATA%\windows11installationassistant\.cmd
%APPDATA%\windows11installationassistant\.vbs
%WINDIR%\temp\autd789.tmp
%WINDIR%\temp\1f6x8w4t.tmp
%WINDIR%\temp\autd7aa.tmp
%WINDIR%\temp\autd7ba.tmp
%WINDIR%\temp\autd7e7.tmp
%WINDIR%\temp\3f0x2w4t.tmp
%WINDIR%\temp\autd807.tmp
%WINDIR%\temp\autd856.tmp
%WINDIR%\temp\aute649.tmp
%WINDIR%\temp\2x4n8h0g.tmp
%WINDIR%\temp\aute6f5.tmp
%WINDIR%\temp\aute7b1.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowscritical.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowswarning.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowssuccess.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowshelp.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\pfp.png
%TEMP%\autc40b.tmp
%TEMP%\autc3eb.tmp
%WINDIR%\temp\autc3fc.tmp
%WINDIR%\temp\autc3dc.tmp
%WINDIR%\temp\2d5c4e4p.tmp
%WINDIR%\temp\aut9a1d.tmp
%WINDIR%\temp\aut9a3e.tmp
%TEMP%\auta488.tmp
%TEMP%\2a8r5v6c.tmp
%TEMP%\auta4a8.tmp
%TEMP%\auta4c8.tmp
%WINDIR%\temp\auta572.tmp
%WINDIR%\temp\1a4r1v2c.tmp
%WINDIR%\temp\auta5a2.tmp
%WINDIR%\temp\auta870.tmp
%WINDIR%\temp\autb5c7.tmp
%WINDIR%\temp\2p0t5x2g.tmp
%WINDIR%\temp\autb5d7.tmp
%WINDIR%\temp\autb5e8.tmp
%TEMP%\autb624.tmp
%TEMP%\2p4t4x4g.tmp
%TEMP%\autb635.tmp
%TEMP%\autb665.tmp
%WINDIR%\temp\autc3bb.tmp
%WINDIR%\temp\2u0i6b8z.tmp
%TEMP%\autc3bb.tmp
%TEMP%\1u2i6b0z.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windows 11.png
%APPDATA%\windows11installationassistant\images\is-d6s7q.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-err7s.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-dls5o.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-f5c8n.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-l7idr.tmp
%APPDATA%\windows11installationassistant\is-lfhoj.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-61p4l.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-aerg8.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-p12mg.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-84niu.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-l6sje.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-grch4.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-iqdsm.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ehtu5.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-4lmdq.tmp
%APPDATA%\windows11installationassistant\images\is-dnv82.tmp
%APPDATA%\windows11installationassistant\images\is-pr53h.tmp
%APPDATA%\windows11installationassistant\images\is-3ri21.tmp
%APPDATA%\windows11installationassistant\images\is-id94p.tmp
%TEMP%\is-nk2td.tmp\temp\is-e6k5r.tmp
%APPDATA%\windows11installationassistant\images\is-n49bb.tmp
%APPDATA%\windows11installationassistant\images\is-rrh87.tmp
%APPDATA%\windows11installationassistant\images\is-v7mur.tmp
%APPDATA%\windows11installationassistant\images\is-jaif6.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ucj6g.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-oh3g7.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-7cj82.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-6vphp.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-o31u5.tmp
%TEMP%\is-kt453.tmp\_isetup\_shfoldr.dll
%TEMP%\is-1goel.tmp\<File name>.tmp
%TEMP%\is-nk2td.tmp\_isetup\_setup64.tmp
%TEMP%\is-nk2td.tmp\_isetup\_shfoldr.dll
%TEMP%\is-nk2td.tmp\is-dqnj8.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-9tf9n.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-53v8b.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-2mm8n.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-4uler.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-c6m2k.tmp
%TEMP%\is-kt453.tmp\_isetup\_setup64.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-acofp.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-7nrei.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-naq07.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-8v9un.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-l0lmj.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-3l4a5.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-t3op8.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-qc06u.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-9qiml.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-lhptd.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-fdrog.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-gj94s.tmp
%APPDATA%\windows11installationassistant\images\is-ptut3.tmp
%APPDATA%\windows11installationassistant\images\is-8sjft.tmp
%APPDATA%\windows11installationassistant\images\is-gvig6.tmp
%APPDATA%\windows11installationassistant\images\is-a9dsr.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-ai9sp.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-cgup1.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-0h8ji.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-qb8qe.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-tht82.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-atc4h.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-5aac1.tmp
%APPDATA%\windows11installationassistant\images\is-0ecft.tmp
%APPDATA%\windows11installationassistant\images\is-8plqe.tmp
%APPDATA%\windows11installationassistant\images\is-0463d.tmp
%APPDATA%\windows11installationassistant\images\is-if7lg.tmp
%APPDATA%\windows11installationassistant\images\is-c48a5.tmp
%APPDATA%\windows11installationassistant\images\is-p4fkl.tmp
%APPDATA%\windows11installationassistant\images\is-l4gpe.tmp
%APPDATA%\windows11installationassistant\images\is-ond2l.tmp
%APPDATA%\windows11installationassistant\images\is-scj6t.tmp
%APPDATA%\windows11installationassistant\images\is-q6lbe.tmp
%APPDATA%\windows11installationassistant\images\is-fgpec.tmp
%APPDATA%\windows11installationassistant\images\is-4ukq8.tmp
%APPDATA%\windows11installationassistant\images\is-uh87u.tmp
%APPDATA%\windows11installationassistant\images\is-7b67i.tmp
%APPDATA%\windows11installationassistant\images\is-c0kdu.tmp
%APPDATA%\windows11installationassistant\images\is-2usn2.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-25sfv.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-4a515.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-c4dd8.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-oh8bp.tmp
%APPDATA%\windows11installationassistant\images\is-sl0kf.tmp
%APPDATA%\windows11installationassistant\images\is-1in3p.tmp
%APPDATA%\windows11installationassistant\images\is-drbeh.tmp
%APPDATA%\windows11installationassistant\images\is-jhcrj.tmp
%APPDATA%\windows11installationassistant\images\is-0l6h7.tmp
%APPDATA%\windows11installationassistant\images\is-0gc2j.tmp
%APPDATA%\windows11installationassistant\images\is-le9jl.tmp
C:\tmp\is-akec6.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-rh3n4.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-4e9v4.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-nuqt9.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-88g3b.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-734du.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-ug603.tmp
C:\tmp\is-iu1d6.tmp
%APPDATA%\windows11installationassistant\images\is-vsk9r.tmp
%APPDATA%\windows11installationassistant\images\is-rnc1c.tmp
%APPDATA%\windows11installationassistant\images\is-jm909.tmp
%APPDATA%\windows11installationassistant\images\is-f0193.tmp
%APPDATA%\windows11installationassistant\images\is-2j7sd.tmp
%APPDATA%\windows11installationassistant\images\is-4ej16.tmp
%APPDATA%\windows11installationassistant\images\is-vc5ed.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-25eqp.tmp
%APPDATA%\windows11installationassistant\images\is-i6kiv.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\cpus.txt

Sets the 'hidden' attribute to the following files

%APPDATA%\windows11installationassistant\ar.xml
%TEMP%\is-nk2td.tmp\temp\r.exe
C:\tmp\ico1.ico
C:\tmp\pbd.dll
%APPDATA%\windows11installationassistant\windows11instaiiation.scr
%APPDATA%\windows11installationassistant\.cmd
%APPDATA%\windows11installationassistant\.vbs

Deletes the following files

%TEMP%\is-kt453.tmp\_isetup\_setup64.tmp
%WINDIR%\temp\autd789.tmp
%TEMP%\is-nk2td.tmp\temp\.cmd
%WINDIR%\temp\1u9i1b6z.tmp
%WINDIR%\temp\autc4c7.tmp
%WINDIR%\temp\autc4b6.tmp
%WINDIR%\temp\autc4a5.tmp
%TEMP%\autb665.tmp
%TEMP%\1u2i6b0z.tmp
%WINDIR%\temp\2u0i6b8z.tmp
%WINDIR%\temp\autc3fc.tmp
%TEMP%\autc3eb.tmp
%WINDIR%\temp\autc3dc.tmp
%TEMP%\autc3bb.tmp
%WINDIR%\temp\autc3bb.tmp
%TEMP%\autc40b.tmp
%TEMP%\2p4t4x4g.tmp
%WINDIR%\temp\autd7aa.tmp
%WINDIR%\temp\aute7b1.tmp
%TEMP%\is-nk2td.tmp\_isetup\_setup64.tmp
%TEMP%\is-nk2td.tmp\temp\r.exe
C:\tmp\pbd.dll
C:\tmp\ico1.ico
%APPDATA%\windows11installationassistant\ar.xml
%TEMP%\is-nk2td.tmp\windows.11.compatibility.checker.exe
%WINDIR%\temp\1f6x8w4t.tmp
%WINDIR%\temp\autd7ba.tmp
%WINDIR%\temp\aute6f5.tmp
%WINDIR%\temp\aute649.tmp
%WINDIR%\temp\3f0x2w4t.tmp
%WINDIR%\temp\autd856.tmp
%WINDIR%\temp\autd807.tmp
%WINDIR%\temp\autd7e7.tmp
%WINDIR%\temp\2x4n8h0g.tmp
%TEMP%\autb635.tmp
%TEMP%\autb624.tmp
%WINDIR%\temp\2p0t5x2g.tmp
%TEMP%\aut906e.tmp
%TEMP%\aut902f.tmp
%TEMP%\aut901e.tmp
%WINDIR%\temp\2u4t9u6b.tmp
%WINDIR%\temp\aut8f07.tmp
%WINDIR%\temp\aut9904.tmp
%WINDIR%\temp\aut8ef7.tmp
%TEMP%\8rdt9s8n.tmp
%TEMP%\aut820c.tmp
%TEMP%\aut819e.tmp
%TEMP%\aut818e.tmp
%TEMP%\is-7ofkg.tmp\<File name>.tmp
%TEMP%\is-kt453.tmp\_isetup\_shfoldr.dll
%WINDIR%\temp\aut8eb7.tmp
%WINDIR%\temp\aut9914.tmp
%TEMP%\1u7t6u4b.tmp
%WINDIR%\temp\aut9934.tmp
%WINDIR%\temp\autb5e8.tmp
%TEMP%\2a8r5v6c.tmp
%WINDIR%\temp\autb5d7.tmp
%WINDIR%\temp\autb5c7.tmp
%WINDIR%\temp\1a4r1v2c.tmp
%WINDIR%\temp\auta870.tmp
%WINDIR%\temp\auta5a2.tmp
%WINDIR%\temp\auta572.tmp
%TEMP%\auta4c8.tmp
%WINDIR%\temp\1d2c6e4p.tmp
%TEMP%\auta4a8.tmp
%TEMP%\auta488.tmp
%WINDIR%\temp\2d5c4e4p.tmp
%WINDIR%\temp\aut9a3e.tmp
%WINDIR%\temp\aut9a1d.tmp
%WINDIR%\temp\aut99fd.tmp
%TEMP%\is-nk2td.tmp\_isetup\_shfoldr.dll
%TEMP%\is-1goel.tmp\<File name>.tmp

Moves the following files

from %TEMP%\is-nk2td.tmp\is-dqnj8.tmp to %TEMP%\is-nk2td.tmp\windows.11.compatibility.checker.exe
from %APPDATA%\windows11installationassistant\images\is-i6kiv.tmp to %APPDATA%\windows11installationassistant\images\menuicon@350.png
from %APPDATA%\windows11installationassistant\images\is-2usn2.tmp to %APPDATA%\windows11installationassistant\images\menuicon@325.png
from %APPDATA%\windows11installationassistant\images\is-c0kdu.tmp to %APPDATA%\windows11installationassistant\images\menuicon@300.png
from %APPDATA%\windows11installationassistant\images\is-7b67i.tmp to %APPDATA%\windows11installationassistant\images\menuicon@275.png
from %APPDATA%\windows11installationassistant\images\is-uh87u.tmp to %APPDATA%\windows11installationassistant\images\menuicon@250.png
from %APPDATA%\windows11installationassistant\images\is-4ukq8.tmp to %APPDATA%\windows11installationassistant\images\menuicon@225.png
from %APPDATA%\windows11installationassistant\images\is-fgpec.tmp to %APPDATA%\windows11installationassistant\images\menuicon@200.png
from %APPDATA%\windows11installationassistant\images\is-q6lbe.tmp to %APPDATA%\windows11installationassistant\images\menuicon@175.png
from %APPDATA%\windows11installationassistant\images\is-scj6t.tmp to %APPDATA%\windows11installationassistant\images\menuicon@150.png
from %APPDATA%\windows11installationassistant\images\is-ond2l.tmp to %APPDATA%\windows11installationassistant\images\menuicon@125.png
from %APPDATA%\windows11installationassistant\images\is-l4gpe.tmp to %APPDATA%\windows11installationassistant\images\menuicon@100.png
from %APPDATA%\windows11installationassistant\images\is-p4fkl.tmp to %APPDATA%\windows11installationassistant\images\foldericon@75-.png
from %APPDATA%\windows11installationassistant\images\is-c48a5.tmp to %APPDATA%\windows11installationassistant\images\foldericon@350.png
from %APPDATA%\windows11installationassistant\images\is-if7lg.tmp to %APPDATA%\windows11installationassistant\images\foldericon@325.png
from %APPDATA%\windows11installationassistant\icons\classic\is-dls5o.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16.ico
from %APPDATA%\windows11installationassistant\images\is-0463d.tmp to %APPDATA%\windows11installationassistant\images\foldericon@300.png
from %APPDATA%\windows11installationassistant\images\is-0ecft.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@200.png
from %APPDATA%\windows11installationassistant\icons\classic\is-5aac1.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-atc4h.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-tht82.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-qb8qe.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-0h8ji.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-cgup1.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-ai9sp.tmp to %APPDATA%\windows11installationassistant\icons\classic\prev.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-25sfv.tmp to %APPDATA%\windows11installationassistant\icons\classic\next.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-c4dd8.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-4a515.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-oh8bp.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-25eqp.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8.ico
from %APPDATA%\windows11installationassistant\images\is-vc5ed.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@150.png
from %APPDATA%\windows11installationassistant\images\is-8plqe.tmp to %APPDATA%\windows11installationassistant\images\foldericon@100.png
from %APPDATA%\windows11installationassistant\icons\classic\is-adclc.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4.ico
from %APPDATA%\windows11installationassistant\images\is-ia2e7.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets.png
from %APPDATA%\windows11installationassistant\icons\classic\is-dt5ho.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15.ico
from %APPDATA%\windows11installationassistant\images\is-7lpni.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet@100.png
from %APPDATA%\windows11installationassistant\images\is-lt842.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet.png
from %APPDATA%\windows11installationassistant\images\is-4apdq.tmp to %APPDATA%\windows11installationassistant\images\pagerbackr@100.png
from %APPDATA%\windows11installationassistant\images\is-3qqaq.tmp to %APPDATA%\windows11installationassistant\images\pagerbackc.png
from %APPDATA%\windows11installationassistant\images\is-r2bjf.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@350.png
from %APPDATA%\windows11installationassistant\images\is-caea8.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@325.png
from %APPDATA%\windows11installationassistant\images\is-6kd3l.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@300.png
from %APPDATA%\windows11installationassistant\images\is-8qg1d.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@275.png
from %APPDATA%\windows11installationassistant\images\is-lotnp.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@250.png
from %APPDATA%\windows11installationassistant\images\is-uin8h.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@225.png
from %APPDATA%\windows11installationassistant\images\is-dcu1h.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@200.png
from %APPDATA%\windows11installationassistant\is-8b735.tmp to %APPDATA%\windows11installationassistant\windows11instaiiation.scr
from %APPDATA%\windows11installationassistant\images\is-qelko.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@175.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-t4s24.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13.ico
from %APPDATA%\windows11installationassistant\images\is-4ej16.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@125.png
from %APPDATA%\windows11installationassistant\icons\classic\is-73m1k.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-q4duj.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-8e0e9.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-tq129.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-r11ha.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20a.ico
from %APPDATA%\windows11installationassistant\images\is-7jodi.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@175.png
from %APPDATA%\windows11installationassistant\images\is-ffco9.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@150.png
from %APPDATA%\windows11installationassistant\images\is-cqv5l.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@125.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-64446.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-skvtu.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-bp7vb.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-fjmi3.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-utqf9.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-1eafv.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-gqhmo.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-err7s.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16a.ico
from %APPDATA%\windows11installationassistant\images\is-d6s7q.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@100.png
from %APPDATA%\windows11installationassistant\images\is-2j7sd.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@100.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-ucj6g.tmp to %APPDATA%\windows11installationassistant\icons\new blue\next.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-l6sje.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-84niu.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-p12mg.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-aerg8.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-61p4l.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6a.ico
from %APPDATA%\windows11installationassistant\is-lfhoj.tmp to %APPDATA%\windows11installationassistant\ar.xml
from %APPDATA%\windows11installationassistant\icons\new blue\is-l7idr.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-f5c8n.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ehtu5.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-iqdsm.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-7cj82.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-6vphp.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-o31u5.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-fdrog.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-grch4.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-lhptd.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-qc06u.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-t3op8.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-3l4a5.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-l0lmj.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-8v9un.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-naq07.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-7nrei.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-gj94s.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-acofp.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-c6m2k.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-4uler.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-2mm8n.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-53v8b.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-9tf9n.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-9qiml.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15.ico
from %APPDATA%\windows11installationassistant\images\is-1in3p.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@100.png
from %APPDATA%\windows11installationassistant\images\is-jm909.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@325.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-oh3g7.tmp to %APPDATA%\windows11installationassistant\icons\new blue\prev.ico
from %APPDATA%\windows11installationassistant\images\is-rnc1c.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@300.png
from %APPDATA%\windows11installationassistant\images\is-vsk9r.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@250.png
from C:\tmp\is-iu1d6.tmp to C:\tmp\pbd.dll
from %APPDATA%\windows11installationassistant\icons\classic\is-ug603.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-734du.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-88g3b.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-nuqt9.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-4e9v4.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d2.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-rh3n4.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d1a.ico
from C:\tmp\is-akec6.tmp to C:\tmp\ico1.ico
from %APPDATA%\windows11installationassistant\images\is-le9jl.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@225.png
from %APPDATA%\windows11installationassistant\images\is-0gc2j.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@200.png
from %APPDATA%\windows11installationassistant\images\is-0l6h7.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@175.png
from %APPDATA%\windows11installationassistant\images\is-jhcrj.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@150.png
from %APPDATA%\windows11installationassistant\images\is-f0193.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@350.png
from %APPDATA%\windows11installationassistant\images\is-drbeh.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@125.png
from %APPDATA%\windows11installationassistant\images\is-sl0kf.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@200.png
from %APPDATA%\windows11installationassistant\images\is-a9dsr.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@175.png
from %APPDATA%\windows11installationassistant\images\is-gvig6.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@150.png
from %APPDATA%\windows11installationassistant\images\is-8sjft.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@125.png
from %APPDATA%\windows11installationassistant\images\is-ptut3.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@100.png
from %APPDATA%\windows11installationassistant\images\is-jaif6.tmp to %APPDATA%\windows11installationassistant\images\createfence@200.png
from %APPDATA%\windows11installationassistant\images\is-v7mur.tmp to %APPDATA%\windows11installationassistant\images\createfence@175.png
from %APPDATA%\windows11installationassistant\images\is-rrh87.tmp to %APPDATA%\windows11installationassistant\images\createfence@150.png
from %APPDATA%\windows11installationassistant\images\is-n49bb.tmp to %APPDATA%\windows11installationassistant\images\createfence@125.png
from %TEMP%\is-nk2td.tmp\temp\is-e6k5r.tmp to %TEMP%\is-nk2td.tmp\temp\r.exe
from %APPDATA%\windows11installationassistant\images\is-id94p.tmp to %APPDATA%\windows11installationassistant\images\createfence@100.png
from %APPDATA%\windows11installationassistant\images\is-3ri21.tmp to %APPDATA%\windows11installationassistant\images\closeicon@150.png
from %APPDATA%\windows11installationassistant\images\is-pr53h.tmp to %APPDATA%\windows11installationassistant\images\closeicon@125.png
from %APPDATA%\windows11installationassistant\images\is-dnv82.tmp to %APPDATA%\windows11installationassistant\images\closeicon@100.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-4lmdq.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9a.ico
from %APPDATA%\windows11installationassistant\images\is-qc99o.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets@100.png

Substitutes the following files

%TEMP%\is-nk2td.tmp\temp\.cmd

Network activity

Connects to

'microsoft.com':80

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

UDP

DNS ASK microsoft.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''
ClassName: 'MPWClass' WindowName: ''

Creates and executes the following

'%TEMP%\is-7ofkg.tmp\<File name>.tmp' /SL5="$B0234,18788298,203776,<Full path to file>"
'%APPDATA%\windows11installationassistant\windows11instaiiation.scr'
'%TEMP%\is-nk2td.tmp\temp\r.exe' /TI/ /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%TEMP%\is-nk2td.tmp\temp\r.exe' /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%TEMP%\is-nk2td.tmp\temp\r.exe' /TI/ /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'%TEMP%\is-nk2td.tmp\temp\r.exe' /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%TEMP%\is-nk2td.tmp\temp\r.exe' /TI/ /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%TEMP%\is-nk2td.tmp\temp\r.exe' /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'%TEMP%\is-nk2td.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'%TEMP%\is-nk2td.tmp\temp\r.exe' /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'%TEMP%\is-nk2td.tmp\temp\r.exe' /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'%TEMP%\is-nk2td.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'%TEMP%\is-1goel.tmp\<File name>.tmp' /SL5="$C021C,18788298,203776,<Full path to file>" /verysilent /sp-
'<Full path to file>' /verysilent /sp-' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-NK2TD.tmp\temp\.cmd""' (with hidden window)
'%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"' (with hidden window)
'<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F' (with hidden window)
'%APPDATA%\windows11installationassistant\windows11instaiiation.scr' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby
'<SYSTEM32>\rundll32.exe' C:\tmp\pbd.dll, Uaby
'%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-NK2TD.tmp\temp\.cmd""
'<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%WINDIR%\syswow64\cmd.exe' /c cUrL -s ipINFO.io/Ip
'%WINDIR%\syswow64\cmd.exe' /c cuRL -s IPINfo.Io/city
'%WINDIR%\syswow64\cmd.exe' /c cUrl -s IPiNfo.io/country
'<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%WINDIR%\syswow64\attrib.exe' +s +H %APPDATA%\windows11installationassistant\.cmD
'%WINDIR%\syswow64\attrib.exe' +s +h %APPDATA%\windows11installationassistant\.vbs
'<SYSTEM32>\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml
'%WINDIR%\syswow64\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней