Trojan.Siggen18.59734

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\windows11installationassistant.lnk

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS] 'dLl' = '00000000'
[<HKLM>\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS] 'sCr' = '00000000'
[<HKLM>\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS] 'CMd' = '00000000'
[<HKLM>\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS] 'exe' = '00000000'
[<HKLM>\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS] '<DRIVERS>\etc\hOSTS' = '00000000'

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"

Modifies file system

Creates the following files

%TEMP%\is-tcvcf.tmp\<File name>.tmp
%APPDATA%\windows11installationassistant\images\is-mafh9.tmp
%APPDATA%\windows11installationassistant\images\is-crggd.tmp
%APPDATA%\windows11installationassistant\images\is-g74s5.tmp
%APPDATA%\windows11installationassistant\images\is-2a086.tmp
%APPDATA%\windows11installationassistant\images\is-tssqm.tmp
C:\tmp\.cmd
C:\tmp\.vbs
%TEMP%\is-3u8jn.tmp\temp\.cmd
%TEMP%\aut3ed4.tmp
%APPDATA%\windows11installationassistant\images\is-3pk0g.tmp
%APPDATA%\windows11installationassistant\images\is-167ut.tmp
%TEMP%\1n3l1s6g.tmp
%WINDIR%\temp\aut4b42.tmp
%WINDIR%\temp\1n6i0v0u.tmp
%WINDIR%\temp\aut4b43.tmp
%WINDIR%\temp\aut4b54.tmp
%TEMP%\aut4dc2.tmp
%TEMP%\2w3n3r6f.tmp
%TEMP%\aut4de2.tmp
%TEMP%\aut4e12.tmp
%WINDIR%\temp\aut57c0.tmp
%TEMP%\aut3ee4.tmp
%TEMP%\aut3ef5.tmp
%APPDATA%\windows11installationassistant\images\is-0rsl2.tmp
%APPDATA%\windows11installationassistant\images\is-f2ige.tmp
%APPDATA%\windows11installationassistant\images\is-o1b7b.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-24vd7.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-vj4n9.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-o0a6p.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-8746j.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-ss70r.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-681cb.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-nvaf3.tmp
%APPDATA%\windows11installationassistant\images\is-1hqb4.tmp
%APPDATA%\windows11installationassistant\images\is-qqtuh.tmp
%APPDATA%\windows11installationassistant\images\is-nmt3p.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-9bqk2.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-ln2jb.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-ucqn1.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-j30hc.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-53lma.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-18vl8.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-2rqf4.tmp
%APPDATA%\windows11installationassistant\images\is-eqlcr.tmp
%APPDATA%\windows11installationassistant\is-jscen.tmp
%APPDATA%\windows11installationassistant\images\is-cvpqa.tmp
%APPDATA%\windows11installationassistant\images\is-a16vi.tmp
%APPDATA%\windows11installationassistant\images\is-2d4hv.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-2qmbd.tmp
%WINDIR%\temp\2n9p1r6x.tmp
%WINDIR%\temp\aut57f0.tmp
%WINDIR%\temp\aut5800.tmp
%WINDIR%\temp\aut5908.tmp
%TEMP%\aut83fe.tmp
%TEMP%\1y6c1x6n.tmp
%TEMP%\aut842d.tmp
%TEMP%\aut844e.tmp
%WINDIR%\temp\aut8b0f.tmp
%WINDIR%\temp\2x3o4e4u.tmp
%WINDIR%\temp\aut8b2f.tmp
%WINDIR%\temp\aut8bbd.tmp
%WINDIR%\temp\aut90ba.tmp
%WINDIR%\temp\2b3i2k8w.tmp
%WINDIR%\temp\aut90cb.tmp
%WINDIR%\temp\aut90cc.tmp
%APPDATA%\windows11installationassistant\.cmd
%APPDATA%\windows11installationassistant\.vbs
%WINDIR%\temp\aut9d96.tmp
%WINDIR%\temp\2i2a3e2u.tmp
%WINDIR%\temp\aut9db6.tmp
%WINDIR%\temp\aut9dc7.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowscritical.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowswarning.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowssuccess.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowshelp.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\pfp.png
%WINDIR%\temp\aut7eb2.tmp
%WINDIR%\temp\1h6u6n8b.tmp
%WINDIR%\temp\aut7e92.tmp
%WINDIR%\temp\aut7e82.tmp
%WINDIR%\temp\2n1p2r4x.tmp
%WINDIR%\temp\aut5957.tmp
%WINDIR%\temp\aut5a42.tmp
%TEMP%\aut5ef1.tmp
%TEMP%\1q5n2y8n.tmp
%TEMP%\aut5f01.tmp
%TEMP%\aut5f12.tmp
%WINDIR%\temp\aut671b.tmp
%WINDIR%\temp\2m6k8u0r.tmp
%WINDIR%\temp\aut673b.tmp
%WINDIR%\temp\aut674c.tmp
%WINDIR%\temp\aut6eb9.tmp
%WINDIR%\temp\2g9l6q8d.tmp
%WINDIR%\temp\aut6f56.tmp
%WINDIR%\temp\aut6f57.tmp
%TEMP%\aut7416.tmp
%TEMP%\2q9i4o0d.tmp
%TEMP%\aut7455.tmp
%TEMP%\aut7466.tmp
%WINDIR%\temp\aut79b1.tmp
%WINDIR%\temp\0pzk2k6k.tmp
%WINDIR%\temp\aut79f1.tmp
%WINDIR%\temp\aut7a11.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windows 11.png
%APPDATA%\windows11installationassistant\images\is-2oebm.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-mj1kr.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-1bh6u.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-8shic.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-r58l2.tmp
%APPDATA%\windows11installationassistant\is-gcbfp.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ceenj.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-dsg9u.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-f7mtq.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-jopqh.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ecp8a.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-qfj4i.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-7plj8.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-qdkts.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-1nc5v.tmp
%APPDATA%\windows11installationassistant\images\is-uqo30.tmp
%APPDATA%\windows11installationassistant\images\is-e5mh8.tmp
%APPDATA%\windows11installationassistant\images\is-g6j9k.tmp
%APPDATA%\windows11installationassistant\images\is-en1pq.tmp
%TEMP%\is-3u8jn.tmp\temp\is-63bq1.tmp
%APPDATA%\windows11installationassistant\images\is-pqd7d.tmp
%APPDATA%\windows11installationassistant\images\is-m197f.tmp
%APPDATA%\windows11installationassistant\images\is-9b5q3.tmp
%APPDATA%\windows11installationassistant\images\is-fsfid.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-br7i7.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-jcf9q.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-crubv.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-sj1h5.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-9dp5e.tmp
%TEMP%\is-vjvcs.tmp\_isetup\_shfoldr.dll
%TEMP%\is-c2e6l.tmp\<File name>.tmp
%TEMP%\is-3u8jn.tmp\_isetup\_setup64.tmp
%TEMP%\is-3u8jn.tmp\_isetup\_shfoldr.dll
%TEMP%\is-3u8jn.tmp\is-894pp.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-m64ta.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-15d9a.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-pb68i.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-v2mku.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-3li43.tmp
%TEMP%\is-vjvcs.tmp\_isetup\_setup64.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-gvj67.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-lmacv.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-t8lbb.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-r35lb.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-nrv2m.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-50ddl.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-kh9do.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-os2sg.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-voddg.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ul26o.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-friq5.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-lamvv.tmp
%APPDATA%\windows11installationassistant\images\is-olek7.tmp
%APPDATA%\windows11installationassistant\images\is-7ep6h.tmp
%APPDATA%\windows11installationassistant\images\is-cd2gc.tmp
%APPDATA%\windows11installationassistant\images\is-iov8r.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-1be74.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-enmjp.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-m7asa.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-q2bl8.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-j00p6.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-ok8h3.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-85dtu.tmp
%APPDATA%\windows11installationassistant\images\is-uka8e.tmp
%APPDATA%\windows11installationassistant\images\is-ae6g2.tmp
%APPDATA%\windows11installationassistant\images\is-4o4mi.tmp
%APPDATA%\windows11installationassistant\images\is-psoo9.tmp
%APPDATA%\windows11installationassistant\images\is-drm74.tmp
%APPDATA%\windows11installationassistant\images\is-8bfgi.tmp
%APPDATA%\windows11installationassistant\images\is-nbjru.tmp
%APPDATA%\windows11installationassistant\images\is-t6f23.tmp
%APPDATA%\windows11installationassistant\images\is-74q33.tmp
%APPDATA%\windows11installationassistant\images\is-1v8jb.tmp
%APPDATA%\windows11installationassistant\images\is-c4dsu.tmp
%APPDATA%\windows11installationassistant\images\is-c3062.tmp
%APPDATA%\windows11installationassistant\images\is-ikqi2.tmp
%APPDATA%\windows11installationassistant\images\is-mh157.tmp
%APPDATA%\windows11installationassistant\images\is-7cnpa.tmp
%APPDATA%\windows11installationassistant\images\is-sst31.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-1lrvr.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-0pnar.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-tb1gk.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-v3l94.tmp
%APPDATA%\windows11installationassistant\images\is-09u7e.tmp
%APPDATA%\windows11installationassistant\images\is-vmcli.tmp
%APPDATA%\windows11installationassistant\images\is-47v6e.tmp
%APPDATA%\windows11installationassistant\images\is-pine4.tmp
%APPDATA%\windows11installationassistant\images\is-022ko.tmp
%APPDATA%\windows11installationassistant\images\is-1msn8.tmp
%APPDATA%\windows11installationassistant\images\is-7gha0.tmp
C:\tmp\is-kmr6v.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ts3k0.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-6n82e.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-loacr.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-16qc4.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-vg80s.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-a491q.tmp
C:\tmp\is-9264m.tmp
%APPDATA%\windows11installationassistant\images\is-eunac.tmp
%APPDATA%\windows11installationassistant\images\is-ffjr4.tmp
%APPDATA%\windows11installationassistant\images\is-0bbk4.tmp
%APPDATA%\windows11installationassistant\images\is-u7oba.tmp
%APPDATA%\windows11installationassistant\images\is-ngd2f.tmp
%APPDATA%\windows11installationassistant\images\is-lc66h.tmp
%APPDATA%\windows11installationassistant\images\is-e23c5.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-uvque.tmp
%APPDATA%\windows11installationassistant\images\is-rn4dq.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\cpus.txt

Sets the 'hidden' attribute to the following files

%APPDATA%\windows11installationassistant\ar.xml
%TEMP%\is-3u8jn.tmp\temp\r.exe
C:\tmp\ico1.ico
C:\tmp\pbd.dll
%APPDATA%\windows11installationassistant\windows11instaiiation.scr
%APPDATA%\windows11installationassistant\.cmd
%APPDATA%\windows11installationassistant\.vbs

Deletes the following files

%TEMP%\is-vjvcs.tmp\_isetup\_setup64.tmp
%WINDIR%\temp\aut8b2f.tmp
%WINDIR%\temp\aut8b0f.tmp
%TEMP%\1y6c1x6n.tmp
%TEMP%\aut844e.tmp
%TEMP%\aut842d.tmp
%TEMP%\aut83fe.tmp
%TEMP%\aut7466.tmp
%WINDIR%\temp\1h6u6n8b.tmp
%WINDIR%\temp\aut7e92.tmp
%WINDIR%\temp\aut7e82.tmp
%WINDIR%\temp\0pzk2k6k.tmp
%WINDIR%\temp\aut7a11.tmp
%WINDIR%\temp\aut79f1.tmp
%WINDIR%\temp\aut79b1.tmp
%WINDIR%\temp\aut7eb2.tmp
%TEMP%\2q9i4o0d.tmp
%WINDIR%\temp\aut8bbd.tmp
%WINDIR%\temp\aut9dc7.tmp
%TEMP%\is-3u8jn.tmp\_isetup\_setup64.tmp
%TEMP%\is-3u8jn.tmp\temp\r.exe
C:\tmp\pbd.dll
C:\tmp\ico1.ico
%APPDATA%\windows11installationassistant\ar.xml
%TEMP%\is-3u8jn.tmp\windows.11.compatibility.checker.exe
%TEMP%\is-3u8jn.tmp\temp\.cmd
%WINDIR%\temp\2x3o4e4u.tmp
%WINDIR%\temp\aut9db6.tmp
%WINDIR%\temp\aut9d96.tmp
%WINDIR%\temp\2b3i2k8w.tmp
%WINDIR%\temp\aut90cc.tmp
%WINDIR%\temp\aut90cb.tmp
%WINDIR%\temp\aut90ba.tmp
%WINDIR%\temp\2i2a3e2u.tmp
%TEMP%\aut7455.tmp
%TEMP%\aut7416.tmp
%WINDIR%\temp\2g9l6q8d.tmp
%TEMP%\aut4e12.tmp
%TEMP%\aut4de2.tmp
%TEMP%\aut4dc2.tmp
%WINDIR%\temp\1n6i0v0u.tmp
%WINDIR%\temp\aut4b54.tmp
%WINDIR%\temp\aut57c0.tmp
%WINDIR%\temp\aut4b43.tmp
%TEMP%\1n3l1s6g.tmp
%TEMP%\aut3ef5.tmp
%TEMP%\aut3ee4.tmp
%TEMP%\aut3ed4.tmp
%TEMP%\is-tcvcf.tmp\<File name>.tmp
%TEMP%\is-vjvcs.tmp\_isetup\_shfoldr.dll
%WINDIR%\temp\aut4b42.tmp
%WINDIR%\temp\aut57f0.tmp
%TEMP%\2w3n3r6f.tmp
%WINDIR%\temp\aut5800.tmp
%WINDIR%\temp\aut6f57.tmp
%TEMP%\1q5n2y8n.tmp
%WINDIR%\temp\aut6f56.tmp
%WINDIR%\temp\aut6eb9.tmp
%WINDIR%\temp\2m6k8u0r.tmp
%WINDIR%\temp\aut674c.tmp
%WINDIR%\temp\aut673b.tmp
%WINDIR%\temp\aut671b.tmp
%TEMP%\aut5f12.tmp
%WINDIR%\temp\2n9p1r6x.tmp
%TEMP%\aut5f01.tmp
%TEMP%\aut5ef1.tmp
%WINDIR%\temp\2n1p2r4x.tmp
%WINDIR%\temp\aut5a42.tmp
%WINDIR%\temp\aut5957.tmp
%WINDIR%\temp\aut5908.tmp
%TEMP%\is-3u8jn.tmp\_isetup\_shfoldr.dll
%TEMP%\is-c2e6l.tmp\<File name>.tmp

Moves the following files

from %TEMP%\is-3u8jn.tmp\is-894pp.tmp to %TEMP%\is-3u8jn.tmp\windows.11.compatibility.checker.exe
from %APPDATA%\windows11installationassistant\images\is-rn4dq.tmp to %APPDATA%\windows11installationassistant\images\menuicon@350.png
from %APPDATA%\windows11installationassistant\images\is-sst31.tmp to %APPDATA%\windows11installationassistant\images\menuicon@325.png
from %APPDATA%\windows11installationassistant\images\is-7cnpa.tmp to %APPDATA%\windows11installationassistant\images\menuicon@300.png
from %APPDATA%\windows11installationassistant\images\is-mh157.tmp to %APPDATA%\windows11installationassistant\images\menuicon@275.png
from %APPDATA%\windows11installationassistant\images\is-ikqi2.tmp to %APPDATA%\windows11installationassistant\images\menuicon@250.png
from %APPDATA%\windows11installationassistant\images\is-c3062.tmp to %APPDATA%\windows11installationassistant\images\menuicon@225.png
from %APPDATA%\windows11installationassistant\images\is-c4dsu.tmp to %APPDATA%\windows11installationassistant\images\menuicon@200.png
from %APPDATA%\windows11installationassistant\images\is-1v8jb.tmp to %APPDATA%\windows11installationassistant\images\menuicon@175.png
from %APPDATA%\windows11installationassistant\images\is-74q33.tmp to %APPDATA%\windows11installationassistant\images\menuicon@150.png
from %APPDATA%\windows11installationassistant\images\is-t6f23.tmp to %APPDATA%\windows11installationassistant\images\menuicon@125.png
from %APPDATA%\windows11installationassistant\images\is-nbjru.tmp to %APPDATA%\windows11installationassistant\images\menuicon@100.png
from %APPDATA%\windows11installationassistant\images\is-8bfgi.tmp to %APPDATA%\windows11installationassistant\images\foldericon@75-.png
from %APPDATA%\windows11installationassistant\images\is-drm74.tmp to %APPDATA%\windows11installationassistant\images\foldericon@350.png
from %APPDATA%\windows11installationassistant\images\is-psoo9.tmp to %APPDATA%\windows11installationassistant\images\foldericon@325.png
from %APPDATA%\windows11installationassistant\icons\classic\is-1bh6u.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16.ico
from %APPDATA%\windows11installationassistant\images\is-4o4mi.tmp to %APPDATA%\windows11installationassistant\images\foldericon@300.png
from %APPDATA%\windows11installationassistant\images\is-uka8e.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@200.png
from %APPDATA%\windows11installationassistant\icons\classic\is-85dtu.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-ok8h3.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-j00p6.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-q2bl8.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-m7asa.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-enmjp.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-1be74.tmp to %APPDATA%\windows11installationassistant\icons\classic\prev.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-1lrvr.tmp to %APPDATA%\windows11installationassistant\icons\classic\next.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-tb1gk.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-0pnar.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-v3l94.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-uvque.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8.ico
from %APPDATA%\windows11installationassistant\images\is-e23c5.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@150.png
from %APPDATA%\windows11installationassistant\images\is-ae6g2.tmp to %APPDATA%\windows11installationassistant\images\foldericon@100.png
from %APPDATA%\windows11installationassistant\icons\classic\is-53lma.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4.ico
from %APPDATA%\windows11installationassistant\images\is-2a086.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets.png
from %APPDATA%\windows11installationassistant\icons\classic\is-9bqk2.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15.ico
from %APPDATA%\windows11installationassistant\images\is-g74s5.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet@100.png
from %APPDATA%\windows11installationassistant\images\is-crggd.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet.png
from %APPDATA%\windows11installationassistant\images\is-mafh9.tmp to %APPDATA%\windows11installationassistant\images\pagerbackr@100.png
from %APPDATA%\windows11installationassistant\images\is-167ut.tmp to %APPDATA%\windows11installationassistant\images\pagerbackc.png
from %APPDATA%\windows11installationassistant\images\is-3pk0g.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@350.png
from %APPDATA%\windows11installationassistant\images\is-0rsl2.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@325.png
from %APPDATA%\windows11installationassistant\images\is-f2ige.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@300.png
from %APPDATA%\windows11installationassistant\images\is-o1b7b.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@275.png
from %APPDATA%\windows11installationassistant\images\is-2d4hv.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@250.png
from %APPDATA%\windows11installationassistant\images\is-a16vi.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@225.png
from %APPDATA%\windows11installationassistant\images\is-cvpqa.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@200.png
from %APPDATA%\windows11installationassistant\is-jscen.tmp to %APPDATA%\windows11installationassistant\windows11instaiiation.scr
from %APPDATA%\windows11installationassistant\images\is-eqlcr.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@175.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-2rqf4.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13.ico
from %APPDATA%\windows11installationassistant\images\is-lc66h.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@125.png
from %APPDATA%\windows11installationassistant\icons\classic\is-18vl8.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-j30hc.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-ucqn1.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-2qmbd.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-ln2jb.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20a.ico
from %APPDATA%\windows11installationassistant\images\is-nmt3p.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@175.png
from %APPDATA%\windows11installationassistant\images\is-qqtuh.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@150.png
from %APPDATA%\windows11installationassistant\images\is-1hqb4.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@125.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-nvaf3.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-681cb.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-ss70r.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-8746j.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-o0a6p.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-vj4n9.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-24vd7.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-mj1kr.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16a.ico
from %APPDATA%\windows11installationassistant\images\is-2oebm.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@100.png
from %APPDATA%\windows11installationassistant\images\is-ngd2f.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@100.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-br7i7.tmp to %APPDATA%\windows11installationassistant\icons\new blue\next.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ecp8a.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-jopqh.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-f7mtq.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-dsg9u.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ceenj.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6a.ico
from %APPDATA%\windows11installationassistant\is-gcbfp.tmp to %APPDATA%\windows11installationassistant\ar.xml
from %APPDATA%\windows11installationassistant\icons\new blue\is-r58l2.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-8shic.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-qdkts.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-7plj8.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-crubv.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-sj1h5.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-9dp5e.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-friq5.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-qfj4i.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ul26o.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-os2sg.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-kh9do.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-50ddl.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-nrv2m.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-r35lb.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-t8lbb.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-lmacv.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-lamvv.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-gvj67.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-3li43.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-v2mku.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-pb68i.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-15d9a.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-m64ta.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-voddg.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15.ico
from %APPDATA%\windows11installationassistant\images\is-vmcli.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@100.png
from %APPDATA%\windows11installationassistant\images\is-0bbk4.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@325.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-jcf9q.tmp to %APPDATA%\windows11installationassistant\icons\new blue\prev.ico
from %APPDATA%\windows11installationassistant\images\is-ffjr4.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@300.png
from %APPDATA%\windows11installationassistant\images\is-eunac.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@250.png
from C:\tmp\is-9264m.tmp to C:\tmp\pbd.dll
from %APPDATA%\windows11installationassistant\icons\classic\is-a491q.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-vg80s.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-16qc4.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-loacr.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-6n82e.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d2.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ts3k0.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d1a.ico
from C:\tmp\is-kmr6v.tmp to C:\tmp\ico1.ico
from %APPDATA%\windows11installationassistant\images\is-7gha0.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@225.png
from %APPDATA%\windows11installationassistant\images\is-1msn8.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@200.png
from %APPDATA%\windows11installationassistant\images\is-022ko.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@175.png
from %APPDATA%\windows11installationassistant\images\is-pine4.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@150.png
from %APPDATA%\windows11installationassistant\images\is-u7oba.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@350.png
from %APPDATA%\windows11installationassistant\images\is-47v6e.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@125.png
from %APPDATA%\windows11installationassistant\images\is-09u7e.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@200.png
from %APPDATA%\windows11installationassistant\images\is-iov8r.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@175.png
from %APPDATA%\windows11installationassistant\images\is-cd2gc.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@150.png
from %APPDATA%\windows11installationassistant\images\is-7ep6h.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@125.png
from %APPDATA%\windows11installationassistant\images\is-olek7.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@100.png
from %APPDATA%\windows11installationassistant\images\is-fsfid.tmp to %APPDATA%\windows11installationassistant\images\createfence@200.png
from %APPDATA%\windows11installationassistant\images\is-9b5q3.tmp to %APPDATA%\windows11installationassistant\images\createfence@175.png
from %APPDATA%\windows11installationassistant\images\is-m197f.tmp to %APPDATA%\windows11installationassistant\images\createfence@150.png
from %APPDATA%\windows11installationassistant\images\is-pqd7d.tmp to %APPDATA%\windows11installationassistant\images\createfence@125.png
from %TEMP%\is-3u8jn.tmp\temp\is-63bq1.tmp to %TEMP%\is-3u8jn.tmp\temp\r.exe
from %APPDATA%\windows11installationassistant\images\is-en1pq.tmp to %APPDATA%\windows11installationassistant\images\createfence@100.png
from %APPDATA%\windows11installationassistant\images\is-g6j9k.tmp to %APPDATA%\windows11installationassistant\images\closeicon@150.png
from %APPDATA%\windows11installationassistant\images\is-e5mh8.tmp to %APPDATA%\windows11installationassistant\images\closeicon@125.png
from %APPDATA%\windows11installationassistant\images\is-uqo30.tmp to %APPDATA%\windows11installationassistant\images\closeicon@100.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-1nc5v.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9a.ico
from %APPDATA%\windows11installationassistant\images\is-tssqm.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets@100.png

Substitutes the following files

%TEMP%\is-3u8jn.tmp\temp\.cmd

Network activity

UDP

DNS ASK microsoft.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''
ClassName: 'MPWClass' WindowName: ''

Creates and executes the following

'%TEMP%\is-tcvcf.tmp\<File name>.tmp' /SL5="$B0230,18788298,203776,<Full path to file>"
'%TEMP%\is-3u8jn.tmp\temp\r.exe' /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%TEMP%\is-3u8jn.tmp\windows.11.compatibility.checker.exe'
'%TEMP%\is-3u8jn.tmp\temp\r.exe' /TI/ /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%TEMP%\is-3u8jn.tmp\temp\r.exe' /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%TEMP%\is-3u8jn.tmp\temp\r.exe' /TI/ /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'%TEMP%\is-3u8jn.tmp\temp\r.exe' /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'%TEMP%\is-3u8jn.tmp\temp\r.exe' /TI/ /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%TEMP%\is-3u8jn.tmp\temp\r.exe' /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'%TEMP%\is-3u8jn.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'%TEMP%\is-3u8jn.tmp\temp\r.exe' /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'%TEMP%\is-c2e6l.tmp\<File name>.tmp' /SL5="$C0230,18788298,203776,<Full path to file>" /verysilent /sp-
'%TEMP%\is-3u8jn.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'%APPDATA%\windows11installationassistant\windows11instaiiation.scr'
'<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F' (with hidden window)
'<Full path to file>' /verysilent /sp-' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-3U8JN.tmp\temp\.cmd""' (with hidden window)
'%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby' (with hidden window)
'<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"' (with hidden window)
'<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F' (with hidden window)
'%APPDATA%\windows11installationassistant\windows11instaiiation.scr' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby
'<SYSTEM32>\rundll32.exe' C:\tmp\pbd.dll, Uaby
'%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-3U8JN.tmp\temp\.cmd""
'<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%WINDIR%\syswow64\cmd.exe' /c cUrL -s ipINFO.io/Ip
'%WINDIR%\syswow64\cmd.exe' /c cuRL -s IPINfo.Io/city
'%WINDIR%\syswow64\cmd.exe' /c cUrl -s IPiNfo.io/country
'%WINDIR%\syswow64\attrib.exe' +s +H %APPDATA%\windows11installationassistant\.cmD
'%WINDIR%\syswow64\attrib.exe' +s +h %APPDATA%\windows11installationassistant\.vbs
'<SYSTEM32>\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml
'%WINDIR%\syswow64\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial