Issue a security alert to all staff/users. Revise IT policy to explicitly forbid downloading or executing any OS installation media from non-Microsoft sources. Appendix A: Hash values of known malicious “highly compressed” samples (available upon request – contact SOC). Appendix B: Screenshots of typical forum scams claiming “1GB Windows 10” (attached).
| Sample | Claimed Size | Actual Extracted Size | Outcome | | :--- | :--- | :--- | :--- | | A | 610 MB | 6.2 GB (fake padding) | Contained coin miner in setup.exe | | B | 480 MB | 480 MB (no extraction) | Archive password-protected; password obtained from Telegram – yielded a data-stealer | | C | 920 MB | 1.1 GB (unbootable) | Missing install.wim ; contained only a WinPE shell + ransomware dropper |
Legitimate Windows 10 installation media cannot be compressed beyond standard ISO limits (approx. 4–5 GB for 64-bit) without removing critical system components or using proprietary, unverifiable repacking methods. Claims of reducing a 5GB ISO to 500MB–1GB are mathematically impossible without data loss or hidden payloads.
Compression utilities (7-Zip, WinRAR, ZIP) typically achieve only on binary executables and system images ( .wim / .esd files). Thus a 5GB ISO compresses to ~4GB, not 500MB.
The only legitimate size reduction method is Microsoft’s own install.esd format (used in Media Creation Tool), which still yields a final ISO of .