Before the official release for members of the Windows Insider project, the Windows 11 system image had already been sneaked off the Internet. The sneaked mirror link has also become an attack weapon in the eyes of hackers. According to Kaspersky’s report, the Internet is full of ISO images containing malware. A typical example reported by Kaspersky is the 86307_Windows 11 build 21996.1 x64 + activator.exe file with a capacity of 1.75GB. Although it is very normal and credible from the perspective of capacity and text description, the file is actually composed of a DLL file, which contains a lot of useless information. Opening this executable file will launch the installer, which looks like a normal Windows installation wizard. However, its main