Trojan.Siggen18.59761

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\windows11installationassistant.lnk

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS] 'sCr' = '00000000'
[<HKLM>\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS] 'dLl' = '00000000'
[<HKLM>\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS] 'CMd' = '00000000'
[<HKLM>\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS] 'exe' = '00000000'
[<HKLM>\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS] '<DRIVERS>\etc\hOSTS' = '00000000'

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"

Modifies file system

Creates the following files

%TEMP%\is-7s7n2.tmp\<File name>.tmp
%APPDATA%\windows11installationassistant\images\is-n0i1e.tmp
%APPDATA%\windows11installationassistant\images\is-6au1c.tmp
%APPDATA%\windows11installationassistant\images\is-31lic.tmp
%APPDATA%\windows11installationassistant\images\is-3qsth.tmp
%APPDATA%\windows11installationassistant\images\is-9t24j.tmp
C:\tmp\.cmd
C:\tmp\.vbs
%TEMP%\is-dtjgo.tmp\temp\.cmd
%TEMP%\aut703f.tmp
%APPDATA%\windows11installationassistant\images\is-8da9r.tmp
%APPDATA%\windows11installationassistant\images\is-me8nt.tmp
%TEMP%\1h6n4e0y.tmp
%WINDIR%\temp\aut80c3.tmp
%WINDIR%\temp\2g9e1e2g.tmp
%WINDIR%\temp\aut80e3.tmp
%WINDIR%\temp\aut8103.tmp
%TEMP%\aut8140.tmp
%TEMP%\2g1e1e6g.tmp
%TEMP%\aut8170.tmp
%TEMP%\aut8190.tmp
%WINDIR%\temp\aut92bd.tmp
%TEMP%\aut712a.tmp
%TEMP%\aut71e7.tmp
%APPDATA%\windows11installationassistant\images\is-43avf.tmp
%APPDATA%\windows11installationassistant\images\is-rac4r.tmp
%APPDATA%\windows11installationassistant\images\is-0g9mp.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-gutso.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-587i6.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-9vkfm.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-grbuc.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-5arg2.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-d0kho.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-28i8f.tmp
%APPDATA%\windows11installationassistant\images\is-9dh1a.tmp
%APPDATA%\windows11installationassistant\images\is-3861p.tmp
%APPDATA%\windows11installationassistant\images\is-m2up9.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-6cihg.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-5hgp1.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-s8o5j.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-2k3bf.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-adpf3.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-2170e.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-t8djb.tmp
%APPDATA%\windows11installationassistant\images\is-2f4v5.tmp
%APPDATA%\windows11installationassistant\is-5jhse.tmp
%APPDATA%\windows11installationassistant\images\is-11iq3.tmp
%APPDATA%\windows11installationassistant\images\is-4j16n.tmp
%APPDATA%\windows11installationassistant\images\is-031v1.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-do2b3.tmp
%WINDIR%\temp\1f9m2t4j.tmp
%WINDIR%\temp\aut92ed.tmp
%WINDIR%\temp\aut930d.tmp
%TEMP%\aut9397.tmp
%TEMP%\1x3b2v4u.tmp
%TEMP%\autbc8c.tmp
%WINDIR%\temp\autbc9c.tmp
%TEMP%\autbcac.tmp
%APPDATA%\windows11installationassistant\.cmd
%APPDATA%\windows11installationassistant\.vbs
%WINDIR%\temp\autd90f.tmp
%WINDIR%\temp\2s4d4h4k.tmp
%WINDIR%\temp\autd95e.tmp
%WINDIR%\temp\autd97f.tmp
%WINDIR%\temp\autdc2b.tmp
%WINDIR%\temp\1w4l2h4b.tmp
%WINDIR%\temp\autdc4b.tmp
%WINDIR%\temp\autdc9a.tmp
%WINDIR%\temp\autf086.tmp
%WINDIR%\temp\2n5t0k0f.tmp
%WINDIR%\temp\autf123.tmp
%WINDIR%\temp\autf152.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowscritical.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowswarning.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowssuccess.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowshelp.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\pfp.png
%TEMP%\autbc6b.tmp
%WINDIR%\temp\2j9e1d6t.tmp
%WINDIR%\temp\autbc6c.tmp
%WINDIR%\temp\autbc3d.tmp
%TEMP%\2f8m0t4j.tmp
%TEMP%\aut93c7.tmp
%TEMP%\aut93f7.tmp
%WINDIR%\temp\aut9617.tmp
%WINDIR%\temp\2x3i3i6r.tmp
%WINDIR%\temp\aut9676.tmp
%WINDIR%\temp\aut96a5.tmp
%WINDIR%\temp\aut9f79.tmp
%WINDIR%\temp\6ypt4m5z.tmp
%WINDIR%\temp\aut9f9a.tmp
%WINDIR%\temp\aut9faa.tmp
%WINDIR%\temp\auta3fc.tmp
%WINDIR%\temp\2h8o2a0o.tmp
%WINDIR%\temp\auta43b.tmp
%WINDIR%\temp\auta4b9.tmp
%TEMP%\autaa81.tmp
%TEMP%\2z2w8y0k.tmp
%TEMP%\autaaa1.tmp
%TEMP%\autab0f.tmp
%WINDIR%\temp\autb598.tmp
%WINDIR%\temp\2r9v4n0n.tmp
%WINDIR%\temp\autb5c8.tmp
%WINDIR%\temp\autb711.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windows 11.png
%APPDATA%\windows11installationassistant\images\is-gis4t.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-aqabr.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-lvlo3.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ec8li.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-onb27.tmp
%APPDATA%\windows11installationassistant\is-eta3n.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-3ecmf.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-cn6ci.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-h4ek6.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ae6om.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-aai6b.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ehguu.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-3ff1o.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-hsvlm.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-peev5.tmp
%APPDATA%\windows11installationassistant\images\is-jf8gf.tmp
%APPDATA%\windows11installationassistant\images\is-fl4lq.tmp
%APPDATA%\windows11installationassistant\images\is-c9e6m.tmp
%APPDATA%\windows11installationassistant\images\is-0vlab.tmp
%TEMP%\is-dtjgo.tmp\temp\is-upm8t.tmp
%APPDATA%\windows11installationassistant\images\is-h6lut.tmp
%APPDATA%\windows11installationassistant\images\is-c32v7.tmp
%APPDATA%\windows11installationassistant\images\is-hkkrv.tmp
%APPDATA%\windows11installationassistant\images\is-91ajv.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-qf1qe.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-f3o62.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-b93ad.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-s92q6.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ffbn6.tmp
%TEMP%\is-rb51g.tmp\_isetup\_shfoldr.dll
%TEMP%\is-mng2p.tmp\<File name>.tmp
%TEMP%\is-dtjgo.tmp\_isetup\_setup64.tmp
%TEMP%\is-dtjgo.tmp\_isetup\_shfoldr.dll
%TEMP%\is-dtjgo.tmp\is-7qu08.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-45o7u.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-rn0hj.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-v0bi5.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-96i69.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-hk912.tmp
%TEMP%\is-rb51g.tmp\_isetup\_setup64.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-n0fm8.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-m6too.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-4dd8f.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-itoi8.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-e2ebd.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-s8lie.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-r353s.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-a6k2a.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-r2cun.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-0do22.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-860t2.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-hqvcf.tmp
%APPDATA%\windows11installationassistant\images\is-gpcl7.tmp
%APPDATA%\windows11installationassistant\images\is-7u99o.tmp
%APPDATA%\windows11installationassistant\images\is-ibsnl.tmp
%APPDATA%\windows11installationassistant\images\is-n8r1d.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-0p5lg.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-svtkv.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-i3f0j.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-fkd1v.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-9kfd3.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-vpvps.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-1ch41.tmp
%APPDATA%\windows11installationassistant\images\is-keca4.tmp
%APPDATA%\windows11installationassistant\images\is-ncj8q.tmp
%APPDATA%\windows11installationassistant\images\is-rkp3f.tmp
%APPDATA%\windows11installationassistant\images\is-ksdev.tmp
%APPDATA%\windows11installationassistant\images\is-8af7r.tmp
%APPDATA%\windows11installationassistant\images\is-2vc0d.tmp
%APPDATA%\windows11installationassistant\images\is-rl78g.tmp
%APPDATA%\windows11installationassistant\images\is-4qgj6.tmp
%APPDATA%\windows11installationassistant\images\is-uncjt.tmp
%APPDATA%\windows11installationassistant\images\is-973fl.tmp
%APPDATA%\windows11installationassistant\images\is-hijjo.tmp
%APPDATA%\windows11installationassistant\images\is-9u16d.tmp
%APPDATA%\windows11installationassistant\images\is-bmtr1.tmp
%APPDATA%\windows11installationassistant\images\is-0hgma.tmp
%APPDATA%\windows11installationassistant\images\is-0993u.tmp
%APPDATA%\windows11installationassistant\images\is-8be2d.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-n2nal.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-iuai2.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-et6mu.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-1rcea.tmp
%APPDATA%\windows11installationassistant\images\is-92c7f.tmp
%APPDATA%\windows11installationassistant\images\is-3bag1.tmp
%APPDATA%\windows11installationassistant\images\is-3oje5.tmp
%APPDATA%\windows11installationassistant\images\is-fp050.tmp
%APPDATA%\windows11installationassistant\images\is-1p7oe.tmp
%APPDATA%\windows11installationassistant\images\is-6qtvs.tmp
%APPDATA%\windows11installationassistant\images\is-hk648.tmp
C:\tmp\is-bdjmf.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-4onur.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-v1nau.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-sfeim.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-bbehj.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-8ch5f.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-6sk72.tmp
C:\tmp\is-q8p66.tmp
%APPDATA%\windows11installationassistant\images\is-2f6m4.tmp
%APPDATA%\windows11installationassistant\images\is-srpb1.tmp
%APPDATA%\windows11installationassistant\images\is-06adt.tmp
%APPDATA%\windows11installationassistant\images\is-vnavh.tmp
%APPDATA%\windows11installationassistant\images\is-a5d7p.tmp
%APPDATA%\windows11installationassistant\images\is-i0u2a.tmp
%APPDATA%\windows11installationassistant\images\is-6dlta.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-br7je.tmp
%APPDATA%\windows11installationassistant\images\is-8h4tv.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\cpus.txt

Sets the 'hidden' attribute to the following files

%APPDATA%\windows11installationassistant\ar.xml
%TEMP%\is-dtjgo.tmp\temp\r.exe
C:\tmp\ico1.ico
C:\tmp\pbd.dll
%APPDATA%\windows11installationassistant\windows11instaiiation.scr
%APPDATA%\windows11installationassistant\.cmd
%APPDATA%\windows11installationassistant\.vbs

Deletes the following files

%TEMP%\is-rb51g.tmp\_isetup\_setup64.tmp
%WINDIR%\temp\autd90f.tmp
%TEMP%\is-dtjgo.tmp\temp\.cmd
%TEMP%\1x3b2v4u.tmp
%TEMP%\autbcac.tmp
%WINDIR%\temp\2j9e1d6t.tmp
%WINDIR%\temp\autbc9c.tmp
%TEMP%\autab0f.tmp
%TEMP%\autbc8c.tmp
%WINDIR%\temp\autbc6c.tmp
%WINDIR%\temp\autbc3d.tmp
%WINDIR%\temp\2r9v4n0n.tmp
%WINDIR%\temp\autb711.tmp
%WINDIR%\temp\autb5c8.tmp
%WINDIR%\temp\autb598.tmp
%TEMP%\autbc6b.tmp
%TEMP%\2z2w8y0k.tmp
%WINDIR%\temp\autd95e.tmp
%WINDIR%\temp\autf152.tmp
%TEMP%\is-dtjgo.tmp\_isetup\_setup64.tmp
%TEMP%\is-dtjgo.tmp\temp\r.exe
C:\tmp\pbd.dll
C:\tmp\ico1.ico
%APPDATA%\windows11installationassistant\ar.xml
%TEMP%\is-dtjgo.tmp\windows.11.compatibility.checker.exe
%WINDIR%\temp\2s4d4h4k.tmp
%WINDIR%\temp\autd97f.tmp
%WINDIR%\temp\autf123.tmp
%WINDIR%\temp\autf086.tmp
%WINDIR%\temp\1w4l2h4b.tmp
%WINDIR%\temp\autdc9a.tmp
%WINDIR%\temp\autdc4b.tmp
%WINDIR%\temp\autdc2b.tmp
%WINDIR%\temp\2n5t0k0f.tmp
%TEMP%\autaaa1.tmp
%TEMP%\autaa81.tmp
%WINDIR%\temp\2h8o2a0o.tmp
%TEMP%\aut8190.tmp
%TEMP%\aut8170.tmp
%TEMP%\aut8140.tmp
%WINDIR%\temp\2g9e1e2g.tmp
%WINDIR%\temp\aut8103.tmp
%WINDIR%\temp\aut92bd.tmp
%WINDIR%\temp\aut80e3.tmp
%TEMP%\1h6n4e0y.tmp
%TEMP%\aut71e7.tmp
%TEMP%\aut712a.tmp
%TEMP%\aut703f.tmp
%TEMP%\is-7s7n2.tmp\<File name>.tmp
%TEMP%\is-rb51g.tmp\_isetup\_shfoldr.dll
%WINDIR%\temp\aut80c3.tmp
%WINDIR%\temp\aut92ed.tmp
%TEMP%\2g1e1e6g.tmp
%WINDIR%\temp\aut930d.tmp
%WINDIR%\temp\auta4b9.tmp
%WINDIR%\temp\2x3i3i6r.tmp
%WINDIR%\temp\auta43b.tmp
%WINDIR%\temp\auta3fc.tmp
%WINDIR%\temp\6ypt4m5z.tmp
%WINDIR%\temp\aut9faa.tmp
%WINDIR%\temp\aut9f9a.tmp
%WINDIR%\temp\aut9f79.tmp
%WINDIR%\temp\aut96a5.tmp
%WINDIR%\temp\1f9m2t4j.tmp
%WINDIR%\temp\aut9676.tmp
%WINDIR%\temp\aut9617.tmp
%TEMP%\2f8m0t4j.tmp
%TEMP%\aut93f7.tmp
%TEMP%\aut93c7.tmp
%TEMP%\aut9397.tmp
%TEMP%\is-dtjgo.tmp\_isetup\_shfoldr.dll
%TEMP%\is-mng2p.tmp\<File name>.tmp

Moves the following files

from %TEMP%\is-dtjgo.tmp\is-7qu08.tmp to %TEMP%\is-dtjgo.tmp\windows.11.compatibility.checker.exe
from %APPDATA%\windows11installationassistant\images\is-8h4tv.tmp to %APPDATA%\windows11installationassistant\images\menuicon@350.png
from %APPDATA%\windows11installationassistant\images\is-8be2d.tmp to %APPDATA%\windows11installationassistant\images\menuicon@325.png
from %APPDATA%\windows11installationassistant\images\is-0993u.tmp to %APPDATA%\windows11installationassistant\images\menuicon@300.png
from %APPDATA%\windows11installationassistant\images\is-0hgma.tmp to %APPDATA%\windows11installationassistant\images\menuicon@275.png
from %APPDATA%\windows11installationassistant\images\is-bmtr1.tmp to %APPDATA%\windows11installationassistant\images\menuicon@250.png
from %APPDATA%\windows11installationassistant\images\is-9u16d.tmp to %APPDATA%\windows11installationassistant\images\menuicon@225.png
from %APPDATA%\windows11installationassistant\images\is-hijjo.tmp to %APPDATA%\windows11installationassistant\images\menuicon@200.png
from %APPDATA%\windows11installationassistant\images\is-973fl.tmp to %APPDATA%\windows11installationassistant\images\menuicon@175.png
from %APPDATA%\windows11installationassistant\images\is-uncjt.tmp to %APPDATA%\windows11installationassistant\images\menuicon@150.png
from %APPDATA%\windows11installationassistant\images\is-4qgj6.tmp to %APPDATA%\windows11installationassistant\images\menuicon@125.png
from %APPDATA%\windows11installationassistant\images\is-rl78g.tmp to %APPDATA%\windows11installationassistant\images\menuicon@100.png
from %APPDATA%\windows11installationassistant\images\is-2vc0d.tmp to %APPDATA%\windows11installationassistant\images\foldericon@75-.png
from %APPDATA%\windows11installationassistant\images\is-8af7r.tmp to %APPDATA%\windows11installationassistant\images\foldericon@350.png
from %APPDATA%\windows11installationassistant\images\is-ksdev.tmp to %APPDATA%\windows11installationassistant\images\foldericon@325.png
from %APPDATA%\windows11installationassistant\icons\classic\is-lvlo3.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16.ico
from %APPDATA%\windows11installationassistant\images\is-rkp3f.tmp to %APPDATA%\windows11installationassistant\images\foldericon@300.png
from %APPDATA%\windows11installationassistant\images\is-keca4.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@200.png
from %APPDATA%\windows11installationassistant\icons\classic\is-1ch41.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-vpvps.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-9kfd3.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-fkd1v.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-i3f0j.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-svtkv.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-0p5lg.tmp to %APPDATA%\windows11installationassistant\icons\classic\prev.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-n2nal.tmp to %APPDATA%\windows11installationassistant\icons\classic\next.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-et6mu.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-iuai2.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-1rcea.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-br7je.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8.ico
from %APPDATA%\windows11installationassistant\images\is-6dlta.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@150.png
from %APPDATA%\windows11installationassistant\images\is-ncj8q.tmp to %APPDATA%\windows11installationassistant\images\foldericon@100.png
from %APPDATA%\windows11installationassistant\icons\classic\is-adpf3.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4.ico
from %APPDATA%\windows11installationassistant\images\is-3qsth.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets.png
from %APPDATA%\windows11installationassistant\icons\classic\is-6cihg.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15.ico
from %APPDATA%\windows11installationassistant\images\is-31lic.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet@100.png
from %APPDATA%\windows11installationassistant\images\is-6au1c.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet.png
from %APPDATA%\windows11installationassistant\images\is-n0i1e.tmp to %APPDATA%\windows11installationassistant\images\pagerbackr@100.png
from %APPDATA%\windows11installationassistant\images\is-me8nt.tmp to %APPDATA%\windows11installationassistant\images\pagerbackc.png
from %APPDATA%\windows11installationassistant\images\is-8da9r.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@350.png
from %APPDATA%\windows11installationassistant\images\is-43avf.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@325.png
from %APPDATA%\windows11installationassistant\images\is-rac4r.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@300.png
from %APPDATA%\windows11installationassistant\images\is-0g9mp.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@275.png
from %APPDATA%\windows11installationassistant\images\is-031v1.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@250.png
from %APPDATA%\windows11installationassistant\images\is-4j16n.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@225.png
from %APPDATA%\windows11installationassistant\images\is-11iq3.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@200.png
from %APPDATA%\windows11installationassistant\is-5jhse.tmp to %APPDATA%\windows11installationassistant\windows11instaiiation.scr
from %APPDATA%\windows11installationassistant\images\is-2f4v5.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@175.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-t8djb.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13.ico
from %APPDATA%\windows11installationassistant\images\is-i0u2a.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@125.png
from %APPDATA%\windows11installationassistant\icons\classic\is-2170e.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-2k3bf.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-s8o5j.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-do2b3.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-5hgp1.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20a.ico
from %APPDATA%\windows11installationassistant\images\is-m2up9.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@175.png
from %APPDATA%\windows11installationassistant\images\is-3861p.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@150.png
from %APPDATA%\windows11installationassistant\images\is-9dh1a.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@125.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-28i8f.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-d0kho.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-5arg2.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-grbuc.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-9vkfm.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-587i6.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-gutso.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-aqabr.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16a.ico
from %APPDATA%\windows11installationassistant\images\is-gis4t.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@100.png
from %APPDATA%\windows11installationassistant\images\is-a5d7p.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@100.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-qf1qe.tmp to %APPDATA%\windows11installationassistant\icons\new blue\next.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-aai6b.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ae6om.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-h4ek6.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-cn6ci.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-3ecmf.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6a.ico
from %APPDATA%\windows11installationassistant\is-eta3n.tmp to %APPDATA%\windows11installationassistant\ar.xml
from %APPDATA%\windows11installationassistant\icons\new blue\is-onb27.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ec8li.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-hsvlm.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-3ff1o.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-b93ad.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-s92q6.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ffbn6.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-860t2.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ehguu.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-0do22.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-a6k2a.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-r353s.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-s8lie.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-e2ebd.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-itoi8.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-4dd8f.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-m6too.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-hqvcf.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-n0fm8.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-hk912.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-96i69.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-v0bi5.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-rn0hj.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-45o7u.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-r2cun.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15.ico
from %APPDATA%\windows11installationassistant\images\is-3bag1.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@100.png
from %APPDATA%\windows11installationassistant\images\is-06adt.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@325.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-f3o62.tmp to %APPDATA%\windows11installationassistant\icons\new blue\prev.ico
from %APPDATA%\windows11installationassistant\images\is-srpb1.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@300.png
from %APPDATA%\windows11installationassistant\images\is-2f6m4.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@250.png
from C:\tmp\is-q8p66.tmp to C:\tmp\pbd.dll
from %APPDATA%\windows11installationassistant\icons\classic\is-6sk72.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-8ch5f.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-bbehj.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-sfeim.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-v1nau.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d2.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-4onur.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d1a.ico
from C:\tmp\is-bdjmf.tmp to C:\tmp\ico1.ico
from %APPDATA%\windows11installationassistant\images\is-hk648.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@225.png
from %APPDATA%\windows11installationassistant\images\is-6qtvs.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@200.png
from %APPDATA%\windows11installationassistant\images\is-1p7oe.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@175.png
from %APPDATA%\windows11installationassistant\images\is-fp050.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@150.png
from %APPDATA%\windows11installationassistant\images\is-vnavh.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@350.png
from %APPDATA%\windows11installationassistant\images\is-3oje5.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@125.png
from %APPDATA%\windows11installationassistant\images\is-92c7f.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@200.png
from %APPDATA%\windows11installationassistant\images\is-n8r1d.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@175.png
from %APPDATA%\windows11installationassistant\images\is-ibsnl.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@150.png
from %APPDATA%\windows11installationassistant\images\is-7u99o.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@125.png
from %APPDATA%\windows11installationassistant\images\is-gpcl7.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@100.png
from %APPDATA%\windows11installationassistant\images\is-91ajv.tmp to %APPDATA%\windows11installationassistant\images\createfence@200.png
from %APPDATA%\windows11installationassistant\images\is-hkkrv.tmp to %APPDATA%\windows11installationassistant\images\createfence@175.png
from %APPDATA%\windows11installationassistant\images\is-c32v7.tmp to %APPDATA%\windows11installationassistant\images\createfence@150.png
from %APPDATA%\windows11installationassistant\images\is-h6lut.tmp to %APPDATA%\windows11installationassistant\images\createfence@125.png
from %TEMP%\is-dtjgo.tmp\temp\is-upm8t.tmp to %TEMP%\is-dtjgo.tmp\temp\r.exe
from %APPDATA%\windows11installationassistant\images\is-0vlab.tmp to %APPDATA%\windows11installationassistant\images\createfence@100.png
from %APPDATA%\windows11installationassistant\images\is-c9e6m.tmp to %APPDATA%\windows11installationassistant\images\closeicon@150.png
from %APPDATA%\windows11installationassistant\images\is-fl4lq.tmp to %APPDATA%\windows11installationassistant\images\closeicon@125.png
from %APPDATA%\windows11installationassistant\images\is-jf8gf.tmp to %APPDATA%\windows11installationassistant\images\closeicon@100.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-peev5.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9a.ico
from %APPDATA%\windows11installationassistant\images\is-9t24j.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets@100.png

Substitutes the following files

%TEMP%\is-dtjgo.tmp\temp\.cmd

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''
ClassName: 'MPWClass' WindowName: ''

Creates and executes the following

'%TEMP%\is-7s7n2.tmp\<File name>.tmp' /SL5="$E0156,18788298,203776,<Full path to file>"
'%TEMP%\is-dtjgo.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'%TEMP%\is-dtjgo.tmp\temp\r.exe' /TI/ /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%TEMP%\is-dtjgo.tmp\temp\r.exe' /TI/ /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%TEMP%\is-dtjgo.tmp\temp\r.exe' /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%TEMP%\is-dtjgo.tmp\temp\r.exe' /TI/ /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'%APPDATA%\windows11installationassistant\windows11instaiiation.scr'
'%TEMP%\is-dtjgo.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'%TEMP%\is-dtjgo.tmp\temp\r.exe' /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%TEMP%\is-dtjgo.tmp\temp\r.exe' /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'%TEMP%\is-dtjgo.tmp\temp\r.exe' /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'%TEMP%\is-dtjgo.tmp\temp\r.exe' /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'%TEMP%\is-mng2p.tmp\<File name>.tmp' /SL5="$F0156,18788298,203776,<Full path to file>" /verysilent /sp-
'<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F' (with hidden window)
'<Full path to file>' /verysilent /sp-' (with hidden window)
'%APPDATA%\windows11installationassistant\windows11instaiiation.scr' ' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-DTJGO.tmp\temp\.cmd""' (with hidden window)
'%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby' (with hidden window)
'<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F' (with hidden window)

Executes the following

'%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby
'<SYSTEM32>\rundll32.exe' C:\tmp\pbd.dll, Uaby
'%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-DTJGO.tmp\temp\.cmd""
'<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c cUrL -s ipINFO.io/Ip
'<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%WINDIR%\syswow64\cmd.exe' /c cuRL -s IPINfo.Io/city
'%WINDIR%\syswow64\cmd.exe' /c cUrl -s IPiNfo.io/country
'%WINDIR%\syswow64\attrib.exe' +s +H %APPDATA%\windows11installationassistant\.cmD
'%WINDIR%\syswow64\attrib.exe' +s +h %APPDATA%\windows11installationassistant\.vbs
'<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'<SYSTEM32>\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml
'%WINDIR%\syswow64\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней