Trojan.Siggen18.59757

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\windows11installationassistant.lnk

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS] 'sCr' = '00000000'
[<HKLM>\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS] 'dLl' = '00000000'
[<HKLM>\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS] 'CMd' = '00000000'
[<HKLM>\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS] 'exe' = '00000000'
[<HKLM>\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS] '<DRIVERS>\etc\hOSTS' = '00000000'

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"

Modifies file system

Creates the following files

%TEMP%\is-gv42q.tmp\<File name>.tmp
%APPDATA%\windows11installationassistant\images\is-nds45.tmp
%APPDATA%\windows11installationassistant\images\is-4f7vt.tmp
%APPDATA%\windows11installationassistant\images\is-ugsvv.tmp
%APPDATA%\windows11installationassistant\images\is-vseah.tmp
%APPDATA%\windows11installationassistant\images\is-oomil.tmp
C:\tmp\.cmd
C:\tmp\.vbs
%TEMP%\is-qdge8.tmp\temp\.cmd
%TEMP%\aut24ee.tmp
%APPDATA%\windows11installationassistant\images\is-vt3ln.tmp
%APPDATA%\windows11installationassistant\images\is-j1cc8.tmp
%TEMP%\1i4y5j2d.tmp
%WINDIR%\temp\aut365b.tmp
%WINDIR%\temp\1r6k1s2l.tmp
%WINDIR%\temp\aut366c.tmp
%WINDIR%\temp\aut369c.tmp
%TEMP%\aut38ac.tmp
%TEMP%\2q5y1l2e.tmp
%TEMP%\aut38fb.tmp
%TEMP%\aut3969.tmp
%WINDIR%\temp\aut4192.tmp
%TEMP%\aut259a.tmp
%TEMP%\aut25ba.tmp
%APPDATA%\windows11installationassistant\images\is-pgoqf.tmp
%APPDATA%\windows11installationassistant\images\is-s3kgf.tmp
%APPDATA%\windows11installationassistant\images\is-60p9n.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-lesgm.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-1cjqt.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-r1hk8.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-4psi6.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-e9942.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-f6tan.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-23le7.tmp
%APPDATA%\windows11installationassistant\images\is-18lav.tmp
%APPDATA%\windows11installationassistant\images\is-6v1j2.tmp
%APPDATA%\windows11installationassistant\images\is-u26km.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-k60rm.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-bjer6.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-ldqte.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-cagnl.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-r3qku.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-dm4ai.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-4vl6v.tmp
%APPDATA%\windows11installationassistant\images\is-idk6a.tmp
%APPDATA%\windows11installationassistant\is-24bp6.tmp
%APPDATA%\windows11installationassistant\images\is-68p6r.tmp
%APPDATA%\windows11installationassistant\images\is-1jpnd.tmp
%APPDATA%\windows11installationassistant\images\is-p7n7d.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-2nair.tmp
%WINDIR%\temp\2w1r9t2f.tmp
%WINDIR%\temp\aut41a2.tmp
%WINDIR%\temp\aut41d2.tmp
%TEMP%\aut46b0.tmp
%TEMP%\aut70db.tmp
%TEMP%\1l4x6l0i.tmp
%TEMP%\aut71b7.tmp
%TEMP%\aut7273.tmp
%WINDIR%\temp\aut79f0.tmp
%WINDIR%\temp\2z3h3e2a.tmp
%WINDIR%\temp\aut7a5e.tmp
%WINDIR%\temp\aut7a7e.tmp
%APPDATA%\windows11installationassistant\.cmd
%APPDATA%\windows11installationassistant\.vbs
%WINDIR%\temp\aut845b.tmp
%WINDIR%\temp\1t1x1w2h.tmp
%WINDIR%\temp\aut8640.tmp
%WINDIR%\temp\aut867f.tmp
%WINDIR%\temp\aut9981.tmp
%WINDIR%\temp\2j6n0d8o.tmp
%WINDIR%\temp\aut9a0e.tmp
%WINDIR%\temp\aut9a2e.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowscritical.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowswarning.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowssuccess.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windowshelp.png
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\pfp.png
%WINDIR%\temp\aut69ac.tmp
%WINDIR%\temp\1g7t4d0e.tmp
%WINDIR%\temp\aut695d.tmp
%WINDIR%\temp\aut68d0.tmp
%TEMP%\2r3g7b2q.tmp
%TEMP%\aut46d0.tmp
%TEMP%\aut46e1.tmp
%WINDIR%\temp\aut472d.tmp
%WINDIR%\temp\8rqr2g8b.tmp
%WINDIR%\temp\aut4885.tmp
%WINDIR%\temp\aut48e4.tmp
%WINDIR%\temp\aut51b8.tmp
%WINDIR%\temp\1b7z6k8d.tmp
%WINDIR%\temp\aut51d8.tmp
%WINDIR%\temp\aut51e8.tmp
%WINDIR%\temp\aut54d3.tmp
%WINDIR%\temp\2t8a1g2j.tmp
%WINDIR%\temp\aut5503.tmp
%WINDIR%\temp\aut5514.tmp
%TEMP%\aut5540.tmp
%TEMP%\1t7a0g8j.tmp
%TEMP%\aut5580.tmp
%TEMP%\aut55bf.tmp
%WINDIR%\temp\aut5d8a.tmp
%WINDIR%\temp\2h6c6z4m.tmp
%WINDIR%\temp\aut5fdc.tmp
%WINDIR%\temp\aut62ca.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\windows 11.png
%APPDATA%\windows11installationassistant\images\is-c8eni.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-3paqi.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-vejt7.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-pbjn2.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-887en.tmp
%APPDATA%\windows11installationassistant\is-hrhrb.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-vfk9j.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-9cgt3.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-obprv.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-1ng8f.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-8oo2a.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-c3ubp.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ja90e.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ouks6.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-9524c.tmp
%APPDATA%\windows11installationassistant\images\is-7peis.tmp
%APPDATA%\windows11installationassistant\images\is-o1kmp.tmp
%APPDATA%\windows11installationassistant\images\is-qsmki.tmp
%APPDATA%\windows11installationassistant\images\is-igosp.tmp
%TEMP%\is-qdge8.tmp\temp\is-ng763.tmp
%APPDATA%\windows11installationassistant\images\is-1t5ls.tmp
%APPDATA%\windows11installationassistant\images\is-plpb0.tmp
%APPDATA%\windows11installationassistant\images\is-8mbk0.tmp
%APPDATA%\windows11installationassistant\images\is-frut6.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-p9idk.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-kgv34.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-hf01u.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ep9dt.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-7h5hb.tmp
%TEMP%\is-5lj6q.tmp\_isetup\_shfoldr.dll
%TEMP%\is-1a16r.tmp\<File name>.tmp
%TEMP%\is-qdge8.tmp\_isetup\_setup64.tmp
%TEMP%\is-qdge8.tmp\_isetup\_shfoldr.dll
%TEMP%\is-qdge8.tmp\is-c9iok.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-hfkqp.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-f4ncq.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-9f5b6.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-kkooc.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-9564i.tmp
%TEMP%\is-5lj6q.tmp\_isetup\_setup64.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-pfekq.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-h91ur.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-rddvt.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-91n4d.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-k6dn8.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-nuj2o.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-sfruf.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-0amkb.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-2qbps.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-7oces.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-uu9m3.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-8mt69.tmp
%APPDATA%\windows11installationassistant\images\is-o9uod.tmp
%APPDATA%\windows11installationassistant\images\is-pv32n.tmp
%APPDATA%\windows11installationassistant\images\is-2uq1i.tmp
%APPDATA%\windows11installationassistant\images\is-jurju.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-vl9c4.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-fh8r2.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-5727v.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-jfljo.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-no470.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-7lq0e.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-mcetq.tmp
%APPDATA%\windows11installationassistant\images\is-5f780.tmp
%APPDATA%\windows11installationassistant\images\is-7jnf8.tmp
%APPDATA%\windows11installationassistant\images\is-io1oo.tmp
%APPDATA%\windows11installationassistant\images\is-uvr2e.tmp
%APPDATA%\windows11installationassistant\images\is-73um3.tmp
%APPDATA%\windows11installationassistant\images\is-2li8l.tmp
%APPDATA%\windows11installationassistant\images\is-0n3mp.tmp
%APPDATA%\windows11installationassistant\images\is-h7gji.tmp
%APPDATA%\windows11installationassistant\images\is-n35io.tmp
%APPDATA%\windows11installationassistant\images\is-cksqv.tmp
%APPDATA%\windows11installationassistant\images\is-g7118.tmp
%APPDATA%\windows11installationassistant\images\is-q6div.tmp
%APPDATA%\windows11installationassistant\images\is-ila6o.tmp
%APPDATA%\windows11installationassistant\images\is-qsmht.tmp
%APPDATA%\windows11installationassistant\images\is-j2eiu.tmp
%APPDATA%\windows11installationassistant\images\is-eki6c.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-oduoj.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-7ri9s.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-oeh74.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-l6ius.tmp
%APPDATA%\windows11installationassistant\images\is-86l95.tmp
%APPDATA%\windows11installationassistant\images\is-8kmhe.tmp
%APPDATA%\windows11installationassistant\images\is-m49i6.tmp
%APPDATA%\windows11installationassistant\images\is-a0ga3.tmp
%APPDATA%\windows11installationassistant\images\is-vh06r.tmp
%APPDATA%\windows11installationassistant\images\is-d1ugu.tmp
%APPDATA%\windows11installationassistant\images\is-7h86k.tmp
C:\tmp\is-7dr3c.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-75e48.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-0vruu.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ioijl.tmp
%APPDATA%\windows11installationassistant\icons\new blue\is-ji37h.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-err83.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-24jt7.tmp
C:\tmp\is-f2q21.tmp
%APPDATA%\windows11installationassistant\images\is-8on2b.tmp
%APPDATA%\windows11installationassistant\images\is-gh7d5.tmp
%APPDATA%\windows11installationassistant\images\is-ojthg.tmp
%APPDATA%\windows11installationassistant\images\is-u0aef.tmp
%APPDATA%\windows11installationassistant\images\is-38a3i.tmp
%APPDATA%\windows11installationassistant\images\is-oec26.tmp
%APPDATA%\windows11installationassistant\images\is-m0g5i.tmp
%APPDATA%\windows11installationassistant\icons\classic\is-kgg9o.tmp
%APPDATA%\windows11installationassistant\images\is-3g5eq.tmp
%LOCALAPPDATA%\orange group\windows 11 compatibility checker\cpus.txt

Sets the 'hidden' attribute to the following files

%APPDATA%\windows11installationassistant\ar.xml
%TEMP%\is-qdge8.tmp\temp\r.exe
C:\tmp\ico1.ico
C:\tmp\pbd.dll
%APPDATA%\windows11installationassistant\windows11instaiiation.scr
%APPDATA%\windows11installationassistant\.cmd
%APPDATA%\windows11installationassistant\.vbs

Deletes the following files

%TEMP%\is-5lj6q.tmp\_isetup\_setup64.tmp
%WINDIR%\temp\aut7a5e.tmp
%WINDIR%\temp\aut79f0.tmp
%TEMP%\1l4x6l0i.tmp
%TEMP%\aut7273.tmp
%TEMP%\aut71b7.tmp
%TEMP%\aut70db.tmp
%TEMP%\aut55bf.tmp
%WINDIR%\temp\1g7t4d0e.tmp
%WINDIR%\temp\aut695d.tmp
%WINDIR%\temp\aut68d0.tmp
%WINDIR%\temp\2h6c6z4m.tmp
%WINDIR%\temp\aut62ca.tmp
%WINDIR%\temp\aut5fdc.tmp
%WINDIR%\temp\aut5d8a.tmp
%WINDIR%\temp\aut69ac.tmp
%TEMP%\1t7a0g8j.tmp
%WINDIR%\temp\aut7a7e.tmp
%WINDIR%\temp\aut9a2e.tmp
%TEMP%\is-qdge8.tmp\_isetup\_setup64.tmp
%TEMP%\is-qdge8.tmp\temp\r.exe
C:\tmp\pbd.dll
C:\tmp\ico1.ico
%APPDATA%\windows11installationassistant\ar.xml
%TEMP%\is-qdge8.tmp\windows.11.compatibility.checker.exe
%TEMP%\is-qdge8.tmp\temp\.cmd
%WINDIR%\temp\2z3h3e2a.tmp
%WINDIR%\temp\aut9a0e.tmp
%WINDIR%\temp\aut9981.tmp
%WINDIR%\temp\1t1x1w2h.tmp
%WINDIR%\temp\aut867f.tmp
%WINDIR%\temp\aut8640.tmp
%WINDIR%\temp\aut845b.tmp
%WINDIR%\temp\2j6n0d8o.tmp
%TEMP%\aut5580.tmp
%TEMP%\aut5540.tmp
%WINDIR%\temp\2t8a1g2j.tmp
%TEMP%\aut3969.tmp
%TEMP%\aut38fb.tmp
%TEMP%\aut38ac.tmp
%WINDIR%\temp\1r6k1s2l.tmp
%WINDIR%\temp\aut369c.tmp
%WINDIR%\temp\aut4192.tmp
%WINDIR%\temp\aut366c.tmp
%TEMP%\1i4y5j2d.tmp
%TEMP%\aut25ba.tmp
%TEMP%\aut259a.tmp
%TEMP%\aut24ee.tmp
%TEMP%\is-gv42q.tmp\<File name>.tmp
%TEMP%\is-5lj6q.tmp\_isetup\_shfoldr.dll
%WINDIR%\temp\aut365b.tmp
%WINDIR%\temp\aut41a2.tmp
%TEMP%\2q5y1l2e.tmp
%WINDIR%\temp\aut41d2.tmp
%WINDIR%\temp\aut5514.tmp
%WINDIR%\temp\8rqr2g8b.tmp
%WINDIR%\temp\aut5503.tmp
%WINDIR%\temp\aut54d3.tmp
%WINDIR%\temp\1b7z6k8d.tmp
%WINDIR%\temp\aut51e8.tmp
%WINDIR%\temp\aut51d8.tmp
%WINDIR%\temp\aut51b8.tmp
%WINDIR%\temp\aut48e4.tmp
%WINDIR%\temp\2w1r9t2f.tmp
%WINDIR%\temp\aut4885.tmp
%WINDIR%\temp\aut472d.tmp
%TEMP%\2r3g7b2q.tmp
%TEMP%\aut46e1.tmp
%TEMP%\aut46d0.tmp
%TEMP%\aut46b0.tmp
%TEMP%\is-qdge8.tmp\_isetup\_shfoldr.dll
%TEMP%\is-1a16r.tmp\<File name>.tmp

Moves the following files

from %TEMP%\is-qdge8.tmp\is-c9iok.tmp to %TEMP%\is-qdge8.tmp\windows.11.compatibility.checker.exe
from %APPDATA%\windows11installationassistant\images\is-3g5eq.tmp to %APPDATA%\windows11installationassistant\images\menuicon@350.png
from %APPDATA%\windows11installationassistant\images\is-eki6c.tmp to %APPDATA%\windows11installationassistant\images\menuicon@325.png
from %APPDATA%\windows11installationassistant\images\is-j2eiu.tmp to %APPDATA%\windows11installationassistant\images\menuicon@300.png
from %APPDATA%\windows11installationassistant\images\is-qsmht.tmp to %APPDATA%\windows11installationassistant\images\menuicon@275.png
from %APPDATA%\windows11installationassistant\images\is-ila6o.tmp to %APPDATA%\windows11installationassistant\images\menuicon@250.png
from %APPDATA%\windows11installationassistant\images\is-q6div.tmp to %APPDATA%\windows11installationassistant\images\menuicon@225.png
from %APPDATA%\windows11installationassistant\images\is-g7118.tmp to %APPDATA%\windows11installationassistant\images\menuicon@200.png
from %APPDATA%\windows11installationassistant\images\is-cksqv.tmp to %APPDATA%\windows11installationassistant\images\menuicon@175.png
from %APPDATA%\windows11installationassistant\images\is-n35io.tmp to %APPDATA%\windows11installationassistant\images\menuicon@150.png
from %APPDATA%\windows11installationassistant\images\is-h7gji.tmp to %APPDATA%\windows11installationassistant\images\menuicon@125.png
from %APPDATA%\windows11installationassistant\images\is-0n3mp.tmp to %APPDATA%\windows11installationassistant\images\menuicon@100.png
from %APPDATA%\windows11installationassistant\images\is-2li8l.tmp to %APPDATA%\windows11installationassistant\images\foldericon@75-.png
from %APPDATA%\windows11installationassistant\images\is-73um3.tmp to %APPDATA%\windows11installationassistant\images\foldericon@350.png
from %APPDATA%\windows11installationassistant\images\is-uvr2e.tmp to %APPDATA%\windows11installationassistant\images\foldericon@325.png
from %APPDATA%\windows11installationassistant\icons\classic\is-vejt7.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16.ico
from %APPDATA%\windows11installationassistant\images\is-io1oo.tmp to %APPDATA%\windows11installationassistant\images\foldericon@300.png
from %APPDATA%\windows11installationassistant\images\is-5f780.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@200.png
from %APPDATA%\windows11installationassistant\icons\classic\is-mcetq.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-7lq0e.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-no470.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-jfljo.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-5727v.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-fh8r2.tmp to %APPDATA%\windows11installationassistant\icons\classic\d5.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-vl9c4.tmp to %APPDATA%\windows11installationassistant\icons\classic\prev.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-oduoj.tmp to %APPDATA%\windows11installationassistant\icons\classic\next.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-oeh74.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-7ri9s.tmp to %APPDATA%\windows11installationassistant\icons\classic\d9.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-l6ius.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-kgg9o.tmp to %APPDATA%\windows11installationassistant\icons\classic\d8.ico
from %APPDATA%\windows11installationassistant\images\is-m0g5i.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@150.png
from %APPDATA%\windows11installationassistant\images\is-7jnf8.tmp to %APPDATA%\windows11installationassistant\images\foldericon@100.png
from %APPDATA%\windows11installationassistant\icons\classic\is-r3qku.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4.ico
from %APPDATA%\windows11installationassistant\images\is-vseah.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets.png
from %APPDATA%\windows11installationassistant\icons\classic\is-k60rm.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15.ico
from %APPDATA%\windows11installationassistant\images\is-ugsvv.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet@100.png
from %APPDATA%\windows11installationassistant\images\is-4f7vt.tmp to %APPDATA%\windows11installationassistant\images\pagerbullet.png
from %APPDATA%\windows11installationassistant\images\is-nds45.tmp to %APPDATA%\windows11installationassistant\images\pagerbackr@100.png
from %APPDATA%\windows11installationassistant\images\is-j1cc8.tmp to %APPDATA%\windows11installationassistant\images\pagerbackc.png
from %APPDATA%\windows11installationassistant\images\is-vt3ln.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@350.png
from %APPDATA%\windows11installationassistant\images\is-pgoqf.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@325.png
from %APPDATA%\windows11installationassistant\images\is-s3kgf.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@300.png
from %APPDATA%\windows11installationassistant\images\is-60p9n.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@275.png
from %APPDATA%\windows11installationassistant\images\is-p7n7d.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@250.png
from %APPDATA%\windows11installationassistant\images\is-1jpnd.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@225.png
from %APPDATA%\windows11installationassistant\images\is-68p6r.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@200.png
from %APPDATA%\windows11installationassistant\is-24bp6.tmp to %APPDATA%\windows11installationassistant\windows11instaiiation.scr
from %APPDATA%\windows11installationassistant\images\is-idk6a.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@175.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-4vl6v.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13.ico
from %APPDATA%\windows11installationassistant\images\is-oec26.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@125.png
from %APPDATA%\windows11installationassistant\icons\classic\is-dm4ai.tmp to %APPDATA%\windows11installationassistant\icons\classic\d4a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-cagnl.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-ldqte.tmp to %APPDATA%\windows11installationassistant\icons\classic\d3.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-2nair.tmp to %APPDATA%\windows11installationassistant\icons\classic\d2a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-bjer6.tmp to %APPDATA%\windows11installationassistant\icons\classic\d20a.ico
from %APPDATA%\windows11installationassistant\images\is-u26km.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@175.png
from %APPDATA%\windows11installationassistant\images\is-6v1j2.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@150.png
from %APPDATA%\windows11installationassistant\images\is-18lav.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@125.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-23le7.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-f6tan.tmp to %APPDATA%\windows11installationassistant\icons\classic\d19.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-e9942.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-4psi6.tmp to %APPDATA%\windows11installationassistant\icons\classic\d18.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-r1hk8.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-1cjqt.tmp to %APPDATA%\windows11installationassistant\icons\classic\d17.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-lesgm.tmp to %APPDATA%\windows11installationassistant\icons\classic\d15a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-3paqi.tmp to %APPDATA%\windows11installationassistant\icons\classic\d16a.ico
from %APPDATA%\windows11installationassistant\images\is-c8eni.tmp to %APPDATA%\windows11installationassistant\images\navigateupicon@100.png
from %APPDATA%\windows11installationassistant\images\is-38a3i.tmp to %APPDATA%\windows11installationassistant\images\fencessmall@100.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-p9idk.tmp to %APPDATA%\windows11installationassistant\icons\new blue\next.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-8oo2a.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-1ng8f.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d8.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-obprv.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-9cgt3.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d7.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-vfk9j.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6a.ico
from %APPDATA%\windows11installationassistant\is-hrhrb.tmp to %APPDATA%\windows11installationassistant\ar.xml
from %APPDATA%\windows11installationassistant\icons\new blue\is-887en.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d6.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-pbjn2.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ouks6.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d18.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ja90e.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-hf01u.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d17.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ep9dt.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-7h5hb.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d16.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-uu9m3.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d19.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-c3ubp.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-7oces.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-0amkb.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-sfruf.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d14.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-nuj2o.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d13a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-k6dn8.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-91n4d.tmp to %APPDATA%\windows11installationassistant\icons\classic\d14.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-rddvt.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-h91ur.tmp to %APPDATA%\windows11installationassistant\icons\classic\d13.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-8mt69.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-pfekq.tmp to %APPDATA%\windows11installationassistant\icons\classic\d12.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-9564i.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-kkooc.tmp to %APPDATA%\windows11installationassistant\icons\classic\d11.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-9f5b6.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-f4ncq.tmp to %APPDATA%\windows11installationassistant\icons\classic\d10.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-hfkqp.tmp to %APPDATA%\windows11installationassistant\icons\classic\d1.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-2qbps.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d15.ico
from %APPDATA%\windows11installationassistant\images\is-8kmhe.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@100.png
from %APPDATA%\windows11installationassistant\images\is-ojthg.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@325.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-kgv34.tmp to %APPDATA%\windows11installationassistant\icons\new blue\prev.ico
from %APPDATA%\windows11installationassistant\images\is-gh7d5.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@300.png
from %APPDATA%\windows11installationassistant\images\is-8on2b.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@250.png
from C:\tmp\is-f2q21.tmp to C:\tmp\pbd.dll
from %APPDATA%\windows11installationassistant\icons\classic\is-24jt7.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7a.ico
from %APPDATA%\windows11installationassistant\icons\classic\is-err83.tmp to %APPDATA%\windows11installationassistant\icons\classic\d7.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ji37h.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20a.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-ioijl.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d20.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-0vruu.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d2.ico
from %APPDATA%\windows11installationassistant\icons\new blue\is-75e48.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d1a.ico
from C:\tmp\is-7dr3c.tmp to C:\tmp\ico1.ico
from %APPDATA%\windows11installationassistant\images\is-7h86k.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@225.png
from %APPDATA%\windows11installationassistant\images\is-d1ugu.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@200.png
from %APPDATA%\windows11installationassistant\images\is-vh06r.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@175.png
from %APPDATA%\windows11installationassistant\images\is-a0ga3.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@150.png
from %APPDATA%\windows11installationassistant\images\is-u0aef.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@350.png
from %APPDATA%\windows11installationassistant\images\is-m49i6.tmp to %APPDATA%\windows11installationassistant\images\dropdownicon@125.png
from %APPDATA%\windows11installationassistant\images\is-86l95.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@200.png
from %APPDATA%\windows11installationassistant\images\is-jurju.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@175.png
from %APPDATA%\windows11installationassistant\images\is-2uq1i.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@150.png
from %APPDATA%\windows11installationassistant\images\is-pv32n.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@125.png
from %APPDATA%\windows11installationassistant\images\is-o9uod.tmp to %APPDATA%\windows11installationassistant\images\createfolderfence@100.png
from %APPDATA%\windows11installationassistant\images\is-frut6.tmp to %APPDATA%\windows11installationassistant\images\createfence@200.png
from %APPDATA%\windows11installationassistant\images\is-8mbk0.tmp to %APPDATA%\windows11installationassistant\images\createfence@175.png
from %APPDATA%\windows11installationassistant\images\is-plpb0.tmp to %APPDATA%\windows11installationassistant\images\createfence@150.png
from %APPDATA%\windows11installationassistant\images\is-1t5ls.tmp to %APPDATA%\windows11installationassistant\images\createfence@125.png
from %TEMP%\is-qdge8.tmp\temp\is-ng763.tmp to %TEMP%\is-qdge8.tmp\temp\r.exe
from %APPDATA%\windows11installationassistant\images\is-igosp.tmp to %APPDATA%\windows11installationassistant\images\createfence@100.png
from %APPDATA%\windows11installationassistant\images\is-qsmki.tmp to %APPDATA%\windows11installationassistant\images\closeicon@150.png
from %APPDATA%\windows11installationassistant\images\is-o1kmp.tmp to %APPDATA%\windows11installationassistant\images\closeicon@125.png
from %APPDATA%\windows11installationassistant\images\is-7peis.tmp to %APPDATA%\windows11installationassistant\images\closeicon@100.png
from %APPDATA%\windows11installationassistant\icons\new blue\is-9524c.tmp to %APPDATA%\windows11installationassistant\icons\new blue\d9a.ico
from %APPDATA%\windows11installationassistant\images\is-oomil.tmp to %APPDATA%\windows11installationassistant\images\pagerbullets@100.png

Substitutes the following files

%TEMP%\is-qdge8.tmp\temp\.cmd

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''
ClassName: 'MPWClass' WindowName: ''

Creates and executes the following

'%TEMP%\is-gv42q.tmp\<File name>.tmp' /SL5="$130176,18788298,203776,<Full path to file>"
'%TEMP%\is-qdge8.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'%TEMP%\is-qdge8.tmp\temp\r.exe' /TI/ /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%TEMP%\is-qdge8.tmp\temp\r.exe' /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%TEMP%\is-qdge8.tmp\temp\r.exe' /TI/ /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'%APPDATA%\windows11installationassistant\windows11instaiiation.scr'
'%TEMP%\is-qdge8.tmp\temp\r.exe' /TI/ /sW:0 reG.eXe Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%TEMP%\is-qdge8.tmp\temp\r.exe' /TI/ /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'%TEMP%\is-qdge8.tmp\temp\r.exe' /SW:0 reG.exe add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%TEMP%\is-qdge8.tmp\temp\r.exe' /sW:0 reG.exe Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'%TEMP%\is-qdge8.tmp\temp\r.exe' /sW:0 reG.exe Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'%TEMP%\is-qdge8.tmp\temp\r.exe' /Sw:0 reg.eXe add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'%TEMP%\is-1a16r.tmp\<File name>.tmp' /SL5="$C022E,18788298,203776,<Full path to file>" /verysilent /sp-
'<Full path to file>' /verysilent /sp-' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-QDGE8.tmp\temp\.cmd""' (with hidden window)
'%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F' (with hidden window)
'<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im "Windows11InstaIIation.scr"' (with hidden window)
'<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F' (with hidden window)
'%APPDATA%\windows11installationassistant\windows11instaiiation.scr' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\rundll32.exe' C:\tmp\pbd.dll, Uaby
'<SYSTEM32>\rundll32.exe' C:\tmp\pbd.dll, Uaby
'%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-QDGE8.tmp\temp\.cmd""
'<SYSTEM32>\reg.exe' Add "hKLm\SoftwAre\mIcroSofT\wINdowS deFeNder\exclusioNS\extenSIoNS" /v sCr /t reg_dWord /d 0 /F
'<SYSTEM32>\reg.exe' Add "hKlm\soFtwAre\MICrosOFt\wiNdoWS defender\eXcLuSIons\eXtensIOnS" /v dLl /t reg_dword /d 0 /f
'<SYSTEM32>\reg.exe' add "hKLm\SOfTware\MiCrosofT\wIndOws defender\eXclusiONS\eXTeNsionS" /V CMd /T reG_dWOrd /d 0 /f
'<SYSTEM32>\reg.exe' add "hklm\SoFtwAre\MIcrosoft\WindoWs deFeNder\eXclUsiONS\eXteNSIOnS" /V exe /t reG_dwOrd /d 0 /F
'%WINDIR%\syswow64\cmd.exe' /c cUrL -s ipINFO.io/Ip
'%WINDIR%\syswow64\cmd.exe' /c cuRL -s IPINfo.Io/city
'%WINDIR%\syswow64\cmd.exe' /c cUrl -s IPiNfo.io/country
'%WINDIR%\syswow64\attrib.exe' +s +H %APPDATA%\windows11installationassistant\.cmD
'<SYSTEM32>\reg.exe' Add "hKLm\sOFTWare\micrOsoFt\wINdoWS deFender\exCLusIONs\pAthS" /v "<DRIVERS>\etc\hOSTS" /T "reG_dword" /d "0" /F
'%WINDIR%\syswow64\attrib.exe' +s +h %APPDATA%\windows11installationassistant\.vbs
'<SYSTEM32>\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml
'%WINDIR%\syswow64\dxdiag.exe' /x %LOCALAPPDATA%\Orange Group\Windows 11 Compatibility Checker\dxv.xml

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial