Trojan.Siggen18.59763

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\windows11installationassistant.lnk

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS] 'dLl' = '00000000'
[<HKLM>\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS] 'sCr' = '00000000'
[<HKLM>\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS] 'CMd' = '00000000'
[<HKLM>\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS] 'exe' = '00000000'
[<HKLM>\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS] '<DRIVERS>\etc\hOSTS' = '00000000'

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"

Modifies file system

Creates the following files

%TEMP%\is-9h93p.tmp\<File name>.tmp
%APPDATA%\windows11installationassistant\images\is-uoise.tmp
%APPDATA%\windows11installationassistant\images\is-vmfi2.tmp
%APPDATA%\windows11installationassistant\images\is-hu7mh.tmp
%APPDATA%\windows11installationassistant\images\is-m0k61.tmp
%APPDATA%\windows11installationassistant\images\is-nntht.tmp
C:\tmp\.cmd
C:\tmp\.vbs
%TEMP%\is-1free.tmp\temp\.cmd
%TEMP%\autc32f.tmp
%APPDATA%\windows11installationassistant\images\is-icrb1.tmp
%APPDATA%\windows11installationassistant\images\is-cendi.tmp
%TEMP%\1d2c2p8m.tmp
%WINDIR%\temp\autccb0.tmp
%WINDIR%\temp\2r6q0j0c.tmp
%WINDIR%\temp\autccd1.tmp
%WINDIR%\temp\autcce1.tmp
%TEMP%\autcf40.tmp
%TEMP%\2r6q0j8c.tmp
%TEMP%\autcf7f.tmp
%TEMP%\autcfde.tmp
%TEMP%\autd95d.tmp
%TEMP%\autc33f.tmp
%TEMP%\autc350.tmp
%APPDATA%\windows11installationassistant\images\is-9s96p.tmp
%APPDATA%\windows11installationassistant\images\is-47fhv.tmp
%APPDATA%\windows11installationassistant\images\is-cvh78.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-60a5j.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-49p37.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-n98sj.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-u4pll.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-86um6.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-9nl94.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-f11p4.tmp
%APPDATA%\windows11installationassistant\images\is-umhv9.tmp
%APPDATA%\windows11installationassistant\images\is-313db.tmp
%APPDATA%\windows11installationassistant\images\is-a84vu.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-ih4gh.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-0r8q3.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-qlqjr.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-hvbjc.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-kg6q9.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-armb3.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-4vh6d.tmp
%APPDATA%\windows11installationassistant\images\is-3m1j6.tmp
%APPDATA%\windows11installationassistant\is-s3e8d.tmp
%APPDATA%\windows11installationassistant\images\is-kjqsp.tmp
%APPDATA%\windows11installationassistant\images\is-2r4lp.tmp
%APPDATA%\windows11installationassistant\images\is-u5ij5.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-rfff6.tmp
%TEMP%\2p5n2i4a.tmp
%TEMP%\autd97d.tmp
%WINDIR%\temp\autd98c.tmp
%WINDIR%\temp\0fap2n0i.tmp
%WINDIR%\temp\aut212.tmp
%WINDIR%\temp\2f1z9b2v.tmp
%WINDIR%\temp\aut223.tmp
%WINDIR%\temp\aut233.tmp
%APPDATA%\windows11installationassistant\.cmd
%APPDATA%\windows11installationassistant\.vbs
%WINDIR%\temp\aut1544.tmp
%WINDIR%\temp\1m1c7v6o.tmp
%WINDIR%\temp\aut1555.tmp
%WINDIR%\temp\aut15f2.tmp
%WINDIR%\temp\aut1563.tmp
%WINDIR%\temp\2m7c5v6o.tmp
%WINDIR%\temp\aut1620.tmp
%WINDIR%\temp\aut168e.tmp
%WINDIR%\temp\aut24af.tmp
%WINDIR%\temp\1z7w0n8k.tmp
%WINDIR%\temp\aut24cf.tmp
%WINDIR%\temp\aut255d.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowscritical.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowswarning.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowssuccess.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowshelp.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\pfp.png
%TEMP%\autff95.tmp
%TEMP%\2h7r7o6u.tmp
%TEMP%\autff46.tmp
%TEMP%\autfe7a.tmp
%WINDIR%\temp\autd99d.tmp
%WINDIR%\temp\autd99e.tmp
%TEMP%\autd9bd.tmp
%WINDIR%\temp\autdcd7.tmp
%WINDIR%\temp\6pbo2h3d.tmp
%WINDIR%\temp\autdd06.tmp
%WINDIR%\temp\autdd36.tmp
%WINDIR%\temp\autdeca.tmp
%WINDIR%\temp\2o8h7d2b.tmp
%WINDIR%\temp\autdf09.tmp
%WINDIR%\temp\autdf49.tmp
%WINDIR%\temp\autec13.tmp
%WINDIR%\temp\0pzf9m8c.tmp
%TEMP%\autecdd.tmp
%TEMP%\2f4m0c4z.tmp
%WINDIR%\temp\autf0f4.tmp
%WINDIR%\temp\autf133.tmp
%TEMP%\autf180.tmp
%TEMP%\autf191.tmp
%WINDIR%\temp\autfd9f.tmp
%WINDIR%\temp\2h9r9o6u.tmp
%WINDIR%\temp\autfdcf.tmp
%WINDIR%\temp\autfdef.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windows 11.png
%APPDATA%\windows11installationassistant\images\is-po8tp.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-gc46f.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-6v86r.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-1628d.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-3kel5.tmp
%APPDATA%\windows11installationassistant\is-a86a7.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-i34tp.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-hlfit.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-264so.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-manf6.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-014hk.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-3sut0.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-5c73v.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-435jg.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-4a7i7.tmp
%APPDATA%\windows11installationassistant\images\is-ji9ve.tmp
%APPDATA%\windows11installationassistant\images\is-iufhb.tmp
%APPDATA%\windows11installationassistant\images\is-b3e47.tmp
%APPDATA%\windows11installationassistant\images\is-s5t0q.tmp
%TEMP%\is-1free.tmp\temp\is-38t6u.tmp
%APPDATA%\windows11installationassistant\images\is-08ips.tmp
%APPDATA%\windows11installationassistant\images\is-tmdtp.tmp
%APPDATA%\windows11installationassistant\images\is-nm9bl.tmp
%APPDATA%\windows11installationassistant\images\is-dstk9.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-crj9j.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-pio0m.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ngb3n.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-l09on.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-9vf4v.tmp
%TEMP%\is-ltb3s.tmp\_isetup\_shfoldr.dll
%TEMP%\is-qio4q.tmp\<File name>.tmp
%TEMP%\is-1free.tmp\_isetup\_setup64.tmp
%TEMP%\is-1free.tmp\_isetup\_shfoldr.dll
%TEMP%\is-1free.tmp\is-srbha.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-rmhcv.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-qs1pf.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-8lr37.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-e16ca.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-je6iu.tmp
%TEMP%\is-ltb3s.tmp\_isetup\_setup64.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-olmie.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-1uc2m.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-laeht.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-45no6.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-fatqq.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-qvso7.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-d81si.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-g6o8e.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-sbvj3.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-6o1kl.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-c26pl.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-n1p73.tmp
%APPDATA%\windows11installationassistant\images\is-4e2fh.tmp
%APPDATA%\windows11installationassistant\images\is-ec092.tmp
%APPDATA%\windows11installationassistant\images\is-93ov2.tmp
%APPDATA%\windows11installationassistant\images\is-q3es6.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-n14in.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-usbvr.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-h9hij.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-ato6l.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-3smq8.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-tgb8g.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-p32cu.tmp
%APPDATA%\windows11installationassistant\images\is-eoile.tmp
%APPDATA%\windows11installationassistant\images\is-8lqr4.tmp
%APPDATA%\windows11installationassistant\images\is-k3tvq.tmp
%APPDATA%\windows11installationassistant\images\is-55p0g.tmp
%APPDATA%\windows11installationassistant\images\is-q90i7.tmp
%APPDATA%\windows11installationassistant\images\is-lhgi2.tmp
%APPDATA%\windows11installationassistant\images\is-s4rlh.tmp
%APPDATA%\windows11installationassistant\images\is-nu2s1.tmp
%APPDATA%\windows11installationassistant\images\is-1jt6p.tmp
%APPDATA%\windows11installationassistant\images\is-g9ofr.tmp
%APPDATA%\windows11installationassistant\images\is-ftutb.tmp
%APPDATA%\windows11installationassistant\images\is-vdt27.tmp
%APPDATA%\windows11installationassistant\images\is-mti0r.tmp
%APPDATA%\windows11installationassistant\images\is-6ppp6.tmp
%APPDATA%\windows11installationassistant\images\is-ck3f3.tmp
%APPDATA%\windows11installationassistant\images\is-sta9t.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-4gm05.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-ijdq2.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-neimm.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-pburp.tmp
%APPDATA%\windows11installationassistant\images\is-558q2.tmp
%APPDATA%\windows11installationassistant\images\is-7jgcq.tmp
%APPDATA%\windows11installationassistant\images\is-2prsm.tmp
%APPDATA%\windows11installationassistant\images\is-hfp7d.tmp
%APPDATA%\windows11installationassistant\images\is-ff758.tmp
%APPDATA%\windows11installationassistant\images\is-jlt3n.tmp
%APPDATA%\windows11installationassistant\images\is-to4ab.tmp
C:\tmp\is-4tfin.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-jak0r.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-4kesk.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-nbkhp.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ffles.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-ofp0i.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-qkdq7.tmp
C:\tmp\is-79d0n.tmp
%APPDATA%\windows11installationassistant\images\is-hl50j.tmp
%APPDATA%\windows11installationassistant\images\is-c5gs5.tmp
%APPDATA%\windows11installationassistant\images\is-67nj8.tmp
%APPDATA%\windows11installationassistant\images\is-0pq8u.tmp
%APPDATA%\windows11installationassistant\images\is-61l0l.tmp
%APPDATA%\windows11installationassistant\images\is-ev5fd.tmp
%APPDATA%\windows11installationassistant\images\is-c2lig.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-r5305.tmp
%APPDATA%\windows11installationassistant\images\is-5t4i6.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\cpus.txt

Sets the 'hidden' attribute to the following files

%APPDATA%\windows11installationassistant\ar.xml
%TEMP%\is-1free.tmp\temp\r.exe
C:\tmp\ico1.ico
C:\tmp\pbd.dll
%APPDATA%\windows11installationassistant\windows11instaiiation.scr
%APPDATA%\windows11installationassistant\.cmd
%APPDATA%\windows11installationassistant\.vbs

Deletes the following files

%TEMP%\is-ltb3s.tmp\_isetup\_setup64.tmp
%WINDIR%\temp\aut1544.tmp
%TEMP%\is-1free.tmp\temp\.cmd
%WINDIR%\temp\2f1z9b2v.tmp
%WINDIR%\temp\aut233.tmp
%WINDIR%\temp\aut223.tmp
%WINDIR%\temp\aut212.tmp
%TEMP%\autf191.tmp
%TEMP%\2h7r7o6u.tmp
%TEMP%\autff46.tmp
%TEMP%\autfe7a.tmp
%WINDIR%\temp\2h9r9o6u.tmp
%WINDIR%\temp\autfdef.tmp
%WINDIR%\temp\autfdcf.tmp
%WINDIR%\temp\autfd9f.tmp
%TEMP%\autff95.tmp
%TEMP%\2f4m0c4z.tmp
%WINDIR%\temp\aut1555.tmp
%WINDIR%\temp\aut255d.tmp
%TEMP%\is-1free.tmp\_isetup\_setup64.tmp
%TEMP%\is-1free.tmp\temp\r.exe
C:\tmp\pbd.dll
C:\tmp\ico1.ico
%APPDATA%\windows11installationassistant\ar.xml
%TEMP%\is-1free.tmp\windows.11.compatibility.checker.exe
%WINDIR%\temp\1m1c7v6o.tmp
%WINDIR%\temp\aut15f2.tmp
%WINDIR%\temp\aut24cf.tmp
%WINDIR%\temp\aut24af.tmp
%WINDIR%\temp\2m7c5v6o.tmp
%WINDIR%\temp\aut168e.tmp
%WINDIR%\temp\aut1620.tmp
%WINDIR%\temp\aut1563.tmp
%WINDIR%\temp\1z7w0n8k.tmp
%TEMP%\autf180.tmp
%WINDIR%\temp\0pzf9m8c.tmp
%WINDIR%\temp\autf133.tmp
%TEMP%\autcfde.tmp
%TEMP%\autcf7f.tmp
%TEMP%\autcf40.tmp
%WINDIR%\temp\2r6q0j0c.tmp
%WINDIR%\temp\autcce1.tmp
%TEMP%\autd95d.tmp
%WINDIR%\temp\autccd1.tmp
%TEMP%\1d2c2p8m.tmp
%TEMP%\autc350.tmp
%TEMP%\autc33f.tmp
%TEMP%\autc32f.tmp
%TEMP%\is-9h93p.tmp\<File name>.tmp
%TEMP%\is-ltb3s.tmp\_isetup\_shfoldr.dll
%WINDIR%\temp\autccb0.tmp
%TEMP%\autd97d.tmp
%TEMP%\2r6q0j8c.tmp
%WINDIR%\temp\autd98c.tmp
%WINDIR%\temp\autf0f4.tmp
%WINDIR%\temp\6pbo2h3d.tmp
%TEMP%\autecdd.tmp
%WINDIR%\temp\autec13.tmp
%WINDIR%\temp\2o8h7d2b.tmp
%WINDIR%\temp\autdf49.tmp
%WINDIR%\temp\autdf09.tmp
%WINDIR%\temp\autdeca.tmp
%WINDIR%\temp\autdd36.tmp
%WINDIR%\temp\autd99d.tmp
%WINDIR%\temp\autdd06.tmp
%WINDIR%\temp\autdcd7.tmp
%TEMP%\2p5n2i4a.tmp
%TEMP%\autd9bd.tmp
%WINDIR%\temp\0fap2n0i.tmp
%WINDIR%\temp\autd99e.tmp
%TEMP%\is-1free.tmp\_isetup\_shfoldr.dll
%TEMP%\is-qio4q.tmp\<File name>.tmp

Moves the following files

from %TEMP%\is-1free.tmp\is-srbha.tmp to %TEMP%\is-1free.tmp\windows.11.compatibility.checker.exe
from %APPDATA%\windows11installationassistant\images\is-5t4i6.tmp to %APPDATA%\windows11installationassistant\images\menuicon@350.png
from %APPDATA%\windows11installationassistant\images\is-sta9t.tmp to %APPDATA%\windows11installationassistant\images\menuicon@325.png
from %APPDATA%\windows11installationassistant\images\is-ck3f3.tmp to %APPDATA%\windows11installationassistant\images\menuicon@300.png
from %APPDATA%\windows11installationassistant\images\is-6ppp6.tmp to %APPDATA%\windows11installationassistant\images\menuicon@275.png
from %APPDATA%\windows11installationassistant\images\is-mti0r.tmp to %APPDATA%\windows11installationassistant\images\menuicon@250.png
from %APPDATA%\windows11installationassistant\images\is-vdt27.tmp to %APPDATA%\windows11installationassistant\images\menuicon@225.png
from %APPDATA%\windows11installationassistant\images\is-ftutb.tmp to %APPDATA%\windows11installationassistant\images\menuicon@200.png
from %APPDATA%\windows11installationassistant\images\is-g9ofr.tmp to %APPDATA%\windows11installationassistant\images\menuicon@175.png
from %APPDATA%\windows11installationassistant\images\is-1jt6p.tmp to %APPDATA%\windows11installationassistant\images\menuicon@150.png
from %APPDATA%\windows11installationassistant\images\is-nu2s1.tmp to %APPDATA%\windows11installationassistant\images\menuicon@125.png
from %APPDATA%\windows11installationassistant\images\is-s4rlh.tmp to %APPDATA%\windows11installationassistant\images\menuicon@100.png
from %APPDATA%\windows11installationassistant\images\is-lhgi2.tmp to %APPDATA%\windows11installationassistant\images\foldericon@75-.png
from %APPDATA%\windows11installationassistant\images\is-q90i7.tmp to %APPDATA%\windows11installationassistant\images\foldericon@350.png
from %APPDATA%\windows11installationassistant\images\is-55p0g.tmp to %APPDATA%\windows11installationassistant\images\foldericon@325.png
from %APPDATA%\windows11installationassistant\icons\classic\is-6v86r.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16.ico
from %APPDATA%\windows11installationassistant\images\is-k3tvq.tmp to %APPDATA%\windows11installationassistant\images\foldericon@300.png
from %APPDATA%\windows11installationassistant\images\is-eoile.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@200.png
from %APPDATA%\windows11installationassistant\icons\classic\is-p32cu.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-tgb8g.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-3smq8.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-ato6l.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-h9hij.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-usbvr.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-n14in.tmp to %APPDATA%\windows11installationassistant\icons\classic\prev.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-4gm05.tmp to %APPDATA%\windows11installationassistant\icons\classic\next.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-neimm.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-ijdq2.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-pburp.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-r5305.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8.ico
from %APPDATA%\windows11installationassistant\images\is-c2lig.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@150.png
from %APPDATA%\windows11installationassistant\images\is-8lqr4.tmp to %APPDATA%\windows11installationassistant\images\foldericon@100.png
from %APPDATA%\windows11installationassistant\icons\classic\is-kg6q9.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4.ico
from %APPDATA%\windows11installationassistant\images\is-m0k61.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets.png
from %APPDATA%\windows11installationassistant\icons\classic\is-ih4gh.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15.ico
from %APPDATA%\windows11installationassistant\images\is-hu7mh.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet@100.png
from %APPDATA%\windows11installationassistant\images\is-vmfi2.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet.png
from %APPDATA%\windows11installationassistant\images\is-uoise.tmp to %APPDATA%\windows11installationassistant\images\pagerbackr@100.png
from %APPDATA%\windows11installationassistant\images\is-cendi.tmp to %APPDATA%\windows11installationassistant\images\pagerbackc.png
from %APPDATA%\windows11installationassistant\images\is-icrb1.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@350.png
from %APPDATA%\windows11installationassistant\images\is-9s96p.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@325.png
from %APPDATA%\windows11installationassistant\images\is-47fhv.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@300.png
from %APPDATA%\windows11installationassistant\images\is-cvh78.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@275.png
from %APPDATA%\windows11installationassistant\images\is-u5ij5.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@250.png
from %APPDATA%\windows11installationassistant\images\is-2r4lp.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@225.png
from %APPDATA%\windows11installationassistant\images\is-kjqsp.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@200.png
from %APPDATA%\windows11installationassistant\is-s3e8d.tmp to %APPDATA%\windows11installationassistant\windows11instaiiation.scr
from %APPDATA%\windows11installationassistant\images\is-3m1j6.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@175.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-4vh6d.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13.ico
from %APPDATA%\windows11installationassistant\images\is-ev5fd.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@125.png
from %APPDATA%\windows11installationassistant\icons\classic\is-armb3.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-hvbjc.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-qlqjr.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-rfff6.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-0r8q3.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20a.ico
from %APPDATA%\windows11installationassistant\images\is-a84vu.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@175.png
from %APPDATA%\windows11installationassistant\images\is-313db.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@150.png
from %APPDATA%\windows11installationassistant\images\is-umhv9.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@125.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-f11p4.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-9nl94.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-86um6.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-u4pll.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-n98sj.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-49p37.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-60a5j.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-gc46f.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16a.ico
from %APPDATA%\windows11installationassistant\images\is-po8tp.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@100.png
from %APPDATA%\windows11installationassistant\images\is-61l0l.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@100.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-crj9j.tmp to %APPDATA%\windows11installationassistant\icons\new blue\next.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-014hk.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-manf6.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-264so.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-hlfit.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-i34tp.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6a.ico
from %APPDATA%\windows11installationassistant\is-a86a7.tmp to %APPDATA%\windows11installationassistant\ar.xml
from %APPDATA%\windows11installationassistant\icons\new blue\is-3kel5.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-1628d.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-435jg.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-5c73v.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ngb3n.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-l09on.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-9vf4v.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-c26pl.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-3sut0.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-6o1kl.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-g6o8e.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-d81si.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-qvso7.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-fatqq.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-45no6.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-laeht.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-1uc2m.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-n1p73.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-olmie.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-je6iu.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-e16ca.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-8lr37.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-qs1pf.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-rmhcv.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-sbvj3.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15.ico
from %APPDATA%\windows11installationassistant\images\is-7jgcq.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@100.png
from %APPDATA%\windows11installationassistant\images\is-67nj8.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@325.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-pio0m.tmp to %APPDATA%\windows11installationassistant\icons\new blue\prev.ico
from %APPDATA%\windows11installationassistant\images\is-c5gs5.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@300.png
from %APPDATA%\windows11installationassistant\images\is-hl50j.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@250.png
from C:\tmp\is-79d0n.tmp to C:\tmp\pbd.dll
from %APPDATA%\windows11installationassistant\icons\classic\is-qkdq7.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-ofp0i.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ffles.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-nbkhp.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-4kesk.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d2.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-jak0r.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d1a.ico
from C:\tmp\is-4tfin.tmp to C:\tmp\ico1.ico
from %APPDATA%\windows11installationassistant\images\is-to4ab.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@225.png
from %APPDATA%\windows11installationassistant\images\is-jlt3n.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@200.png
from %APPDATA%\windows11installationassistant\images\is-ff758.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@175.png
from %APPDATA%\windows11installationassistant\images\is-hfp7d.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@150.png
from %APPDATA%\windows11installationassistant\images\is-0pq8u.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@350.png
from %APPDATA%\windows11installationassistant\images\is-2prsm.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@125.png
from %APPDATA%\windows11installationassistant\images\is-558q2.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@200.png
from %APPDATA%\windows11installationassistant\images\is-q3es6.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@175.png
from %APPDATA%\windows11installationassistant\images\is-93ov2.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@150.png
from %APPDATA%\windows11installationassistant\images\is-ec092.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@125.png
from %APPDATA%\windows11installationassistant\images\is-4e2fh.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@100.png
from %APPDATA%\windows11installationassistant\images\is-dstk9.tmp to %APPDATA%\windows11installationassistant\images\createfence@200.png
from %APPDATA%\windows11installationassistant\images\is-nm9bl.tmp to %APPDATA%\windows11installationassistant\images\createfence@175.png
from %APPDATA%\windows11installationassistant\images\is-tmdtp.tmp to %APPDATA%\windows11installationassistant\images\createfence@150.png
from %APPDATA%\windows11installationassistant\images\is-08ips.tmp to %APPDATA%\windows11installationassistant\images\createfence@125.png
from %TEMP%\is-1free.tmp\temp\is-38t6u.tmp to %TEMP%\is-1free.tmp\temp\r.exe
from %APPDATA%\windows11installationassistant\images\is-s5t0q.tmp to %APPDATA%\windows11installationassistant\images\createfence@100.png
from %APPDATA%\windows11installationassistant\images\is-b3e47.tmp to %APPDATA%\windows11installationassistant\images\closeicon@150.png
from %APPDATA%\windows11installationassistant\images\is-iufhb.tmp to %APPDATA%\windows11installationassistant\images\closeicon@125.png
from %APPDATA%\windows11installationassistant\images\is-ji9ve.tmp to %APPDATA%\windows11installationassistant\images\closeicon@100.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-4a7i7.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9a.ico
from %APPDATA%\windows11installationassistant\images\is-nntht.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets@100.png

Substitutes the following files

%TEMP%\is-1free.tmp\temp\.cmd

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''
ClassName: 'MPWClass' WindowName: ''

Creates and executes the following

'%TEMP%\is-9h93p.tmp\<File name>.tmp' /SL5="$B0238,18788298,203776,<Full path to file>"
'%APPDATA%\windows11installationassistant\windows11instaiiation.scr'
'%TEMP%\is-1free.tmp\windows.11.compatibility.checker.exe'
'%TEMP%\is-1free.tmp\temp\r.exe' /TI/ /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%TEMP%\is-1free.tmp\temp\r.exe' /TI/ /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'%TEMP%\is-1free.tmp\temp\r.exe' /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%TEMP%\is-1free.tmp\temp\r.exe' /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'%TEMP%\is-1free.tmp\temp\r.exe' /TI/ /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%TEMP%\is-1free.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'%TEMP%\is-1free.tmp\temp\r.exe' /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%TEMP%\is-1free.tmp\temp\r.exe' /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'%TEMP%\is-qio4q.tmp\<File name>.tmp' /SL5="$C0238,18788298,203776,<Full path to file>" /verysilent /sp-
'%TEMP%\is-1free.tmp\temp\r.exe' /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'%TEMP%\is-1free.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F' (with hidden window)
'<Full path to file>' /verysilent /sp-' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-1FREE.tmp\temp\.cmd""' (with hidden window)
'%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby' (with hidden window)
'<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"' (with hidden window)
'<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F' (with hidden window)
'%APPDATA%\windows11installationassistant\windows11instaiiation.scr' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby
'<SYSTEM32>\rundll32.exe' C:\tmp\pbd.dll, Uaby
'%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-1FREE.tmp\temp\.cmd""
'<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c cUrL -s ipINFO.io/Ip
'%WINDIR%\syswow64\cmd.exe' /c cuRL -s IPINfo.Io/city
'<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%WINDIR%\syswow64\cmd.exe' /c cUrl -s IPiNfo.io/country
'<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%WINDIR%\syswow64\attrib.exe' +s +H %APPDATA%\windows11installationassistant\.cmD
'%WINDIR%\syswow64\attrib.exe' +s +h %APPDATA%\windows11installationassistant\.vbs
'<SYSTEM32>\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml
'%WINDIR%\syswow64\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней