Trojan.DownLoader33.32273

Technical Information

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\explorer.exe" "explorer.exe" ENABLE

Modifies file system

Creates the following files

%TEMP%\setup.exe
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\roll.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\grid2.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\fire.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\expand.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\doors2.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\doors.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort3.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort - copy - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\burnaway.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blindsa.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blinds2a.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blinds2.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blinds.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholetr.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholetl.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholebr.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholem.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\rotatemiddle.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\rotatemiddlev - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble - copy - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\twist.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\topoint2.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\topoint.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\startmenu.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\startmenu - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\startmenu - copy - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slides2.tra
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msimain.sdb
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slides.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slidediag.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slidecolumnsupdown.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slidebothways.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\showreverse.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\safari close2.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\safari close.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\rotatemiddlev.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholebl.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_window_trasnp.tga
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_window_size_control.tga
%TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\default os animations.animset
%TEMP%\miaf077.tmp\mia.lib
%TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\wfx4_64.dll
%TEMP%\miaf077.tmp\data\offline\ab3fc3ce\f7243042\wfx4_64.dll
%TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\wfx4.dll
%TEMP%\miaf077.tmp\data\offline\cafe7691\f7243042\wfx4.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\usp10.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\usp10.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\shfolder.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\shfolder.dll
%TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\sddlc.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\sdbapiu.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\sdbapi.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\riched20.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\riched20.dll
%TEMP%\miaf077.tmp\data\offline\mwinrun.dll\mwinrunexec.dll
%TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\flow to and from a point.animset
%TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\random animations (windows, menus, start menu).animset
%TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\flow from right.animset
%TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\random window animations.animset
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_window_max_control.tga
%TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\rotate around the middle.animset
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_pin_on.tga
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_disable_peek.tga
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_disable_flip_3d.tga
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5_tabs.tga
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\popup.tga
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\circles2.tga
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\backimg.tga
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\spinaway.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble bottom left - copy - copy.tra
%TEMP%\miaf077.tmp\windowfx5_setup.res
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\popup.pdn
%TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\sdactivate.lng
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msi.inf
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msi.cat
%TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\wobble - low bounce.animset
%TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\various slides.animset
%TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\spin.animset
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msimain.sdb
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble bottom left - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble bottom left.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble corner - copy - copy.tra
%TEMP%\mia1\icon.ico
%TEMP%\mia1\finish.dfm.miaf
%TEMP%\mia1\finish.dfm
%TEMP%\mia1\destination.dfm
%TEMP%\mia1\componentstree.dfm
%TEMP%\mia.tmp
%TEMP%\mia1\installaware.png
%TEMP%\lang.loc
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\twist.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\topoint2.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\topoint.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\startmenu3.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\startmenu2.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\startmenu.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\spinaway.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slides.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slidecolumnsup-down.ttt
%TEMP%\mia1\license.rtf
%TEMP%\mia1\licensecheck.dfm
%TEMP%\mia1\licensecheck.dfm.miaf
%TEMP%\mia1\maintenance.dfm
%TEMP%\mia1\mmsiexec.dll
%TEMP%\mia1\wizard.dfm
%TEMP%\mia1\welcome.dfm
%TEMP%\mia1\startmenu.dfm.miaf
%TEMP%\mia1\startmenu.dfm
%TEMP%\mia1\startinstallation.dfm
%TEMP%\mia1\setuptype.dfm
%TEMP%\mia1\registrationwithserial.dfm.miaf
%TEMP%\mia1\registration.dfm.miaf
%TEMP%\mia1\registrationwithserial.dfm
%TEMP%\mia1\registration.dfm
%TEMP%\mia1\readme.dfm.miaf
%TEMP%\mia1\readme.dfm
%TEMP%\mia1\progressprereq.dfm
%TEMP%\mia1\progress.dfm.miaf
%TEMP%\mia1\progress.dfm
%TEMP%\mia1\prereq.dfm.miaf
%TEMP%\mia1\prereq.dfm
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\mwinrunexec.dll
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\doors.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slideboth.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\showreverse.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholebr.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholebl.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble top.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble top - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble top - copy - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble right.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble right - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble right - copy - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble rand.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble rand - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble rand - copy - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble down.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble down - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble down - copy - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble corner.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble corner - copy.tra
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholem.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholetl.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholetr.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blinds.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\safari close.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\rotatemiddlev2.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\rotatemiddlev.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\rotatemiddle.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\roll.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\grid2.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\fire.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\expand.ttt
%TEMP%\mia1\mwinrunexec.dll
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\doors2.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort3.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort2aa.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort2.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\burnaway.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blindsa.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blinds2a.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blinds2.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\safari close2.ttt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slideboth2.ttt
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\mspatcha.dll
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_disable_peek_dark.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\line.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\leather.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\label_plus_03.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\info.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\icons.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\home_vert_separator.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\home_switch_track.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\home_switch_button_v2.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\home_horiz_separator.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\grass.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame9.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame8.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame7.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame6.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame5.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame4.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame3.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame2.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame2a.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\metal.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\night sky.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidefromleft.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidefrombottom.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\size2.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\sidebar.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\shrink.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\sepline.png
%TEMP%\explorer.exe
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\reverseexpand.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\radioboxes.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\cornercollapsel.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\pattern 3.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\pattern 2.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\pattern 1.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\paper4.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\paper.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\panel_stab.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\orange peel.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\onoff.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\fadeout.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\fadein.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\expandfromsmall.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\bubbles.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\btn_plus.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\btn_minus.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\btn_close.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\bottombar.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\bnt_apply.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\bg_panel.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\applogo.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\animpreview.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\animation.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\abstract.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\1checkbox.png
%TEMP%\miaf077.tmp\windowfx5_setup.msi
%TEMP%\miaf077.tmp\data\windowfx5_setup.msi
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\instmsi.msi
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\instmsi.msi
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\carbon fibre.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\cart.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\button2.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\checkbox.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\expandfromright.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\checkbox2.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\expandfromleft.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\expand.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\dottedline.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\distorted glass.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\dark metal.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\cornerexpandr.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\cornerexpandl.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\random.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidefromright.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\cork.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\content_bg.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\clouds.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\clouds 2.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\closetoright.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\closetoleft.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\closebutton.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\clock.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\cornercollapser.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidefromtop.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\slider_bottom.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\slider_horizontal_bg.png
%TEMP%\miaf077.tmp\windowfx5_setup.exe
%TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\wfx64.exe
%TEMP%\miaf077.tmp\data\offline\96821531\f7243042\wfx64.exe
%TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\wfx32.exe
%TEMP%\miaf077.tmp\data\offline\708e8638\f7243042\wfx32.exe
%TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\sdactivate.exe
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msiinst.exe
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msiinst.exe
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msiexec.exe
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msiexec.exe
%TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\windowfx_scripting.doc
%TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\readme.txt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\eula.txt
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_window_trasnp_dark.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_window_size_control_dark.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_window_max_control_dark.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_pin_on_dark.png
%TEMP%\miaf077.tmp\data\offline\3954d236\f7243042\windowfxconfig.exe
%TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\windowfxconfig.exe
%TEMP%\miaf077.tmp\data\offline\ee78a22f\f7243042\windowfxsrv.exe
%TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\windowfxsrv.exe
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msls31.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msisip.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msisip.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msimsg.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msimsg.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msihnd.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msihnd.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msi.dll
%TEMP%\miaf077.tmp\data\offline\mmsi.dll\mmsiexec.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msi.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\imagehlp.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\imagehlp.dll
%TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\d3dx10_41.dll
%TEMP%\miaf077.tmp\data\offline\fe08ebba\1ccae1b5\d3dx10_41.dll
%TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\d3dcompiler_41.dll
%TEMP%\miaf077.tmp\data\offline\fe08ebba\1ccae1b5\d3dcompiler_41.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\cabinet.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\cabinet.dll
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\mspatcha.dll
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wb_check_m_over1.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_disable_flip_3d_dark.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_buy_button.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\top_bar.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\toptabbuttons.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\topshadow.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\topbar.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\test.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\tabrow_apply.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\tabbot.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\star.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\spotlight.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\smooth pink.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\smooth blue.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\smicons.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\smallhelp.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidetotop.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidetoright.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidetoleft.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidetobottom.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_back.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_bullet_01.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_bullet_02.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_logo_od_02.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5ui_tab_selected.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5ui_tab_normal.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5ui_tab_inactive.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5ui_section_selection_2.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5ui_section_selection.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5ui_panel_right_tabs.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5ui_panel_right.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wcicon.png
%TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msls31.dll
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wb_check_normal.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wb_check_m_over.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wait.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\very dark metal.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_title_upgrade_wfx_02.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_title_upgrade_od.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_separator_top.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_separator_bottom.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_logo_plus_02.png
%TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5_tabs.png
%TEMP%\mia1\windowfx5_setup.msi

Deletes the following files

%TEMP%\lang.loc
%TEMP%\mia.tmp

Network activity

Connects to

'zz####eryy.ddns.net':5552

UDP

DNS ASK zz####eryy.ddns.net

Miscellaneous

Searches for the following windows

ClassName: 'TApplication' WindowName: 'windowfx5_setup'

Creates and executes the following

'%TEMP%\setup.exe'
'%TEMP%\explorer.exe'
'%TEMP%\miaf077.tmp\windowfx5_setup.exe' /m="%TEMP%\Setup.exe" /k=""
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\explorer.exe" "explorer.exe" ENABLE' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial