Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\explorer.exe" "explorer.exe" ENABLE
Modifies file system
Creates the following files
- %TEMP%\setup.exe
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\roll.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\grid2.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\fire.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\expand.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\doors2.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\doors.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort3.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort - copy - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\burnaway.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blindsa.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blinds2a.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blinds2.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blinds.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholetr.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholetl.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholebr.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholem.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\rotatemiddle.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\rotatemiddlev - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble - copy - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\twist.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\topoint2.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\topoint.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\startmenu.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\startmenu - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\startmenu - copy - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slides2.tra
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msimain.sdb
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slides.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slidediag.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slidecolumnsupdown.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slidebothways.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\showreverse.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\safari close2.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\safari close.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\rotatemiddlev.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholebl.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_window_trasnp.tga
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_window_size_control.tga
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\default os animations.animset
- %TEMP%\miaf077.tmp\mia.lib
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\wfx4_64.dll
- %TEMP%\miaf077.tmp\data\offline\ab3fc3ce\f7243042\wfx4_64.dll
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\wfx4.dll
- %TEMP%\miaf077.tmp\data\offline\cafe7691\f7243042\wfx4.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\usp10.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\usp10.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\shfolder.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\shfolder.dll
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\sddlc.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\sdbapiu.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\sdbapi.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\riched20.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\riched20.dll
- %TEMP%\miaf077.tmp\data\offline\mwinrun.dll\mwinrunexec.dll
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\flow to and from a point.animset
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\random animations (windows, menus, start menu).animset
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\flow from right.animset
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\random window animations.animset
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_window_max_control.tga
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\rotate around the middle.animset
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_pin_on.tga
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_disable_peek.tga
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_disable_flip_3d.tga
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5_tabs.tga
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\popup.tga
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\circles2.tga
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\backimg.tga
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\spinaway.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble bottom left - copy - copy.tra
- %TEMP%\miaf077.tmp\windowfx5_setup.res
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\popup.pdn
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\sdactivate.lng
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msi.inf
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msi.cat
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\wobble - low bounce.animset
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\various slides.animset
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\805fbd8e\spin.animset
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msimain.sdb
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble bottom left - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble bottom left.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble corner - copy - copy.tra
- %TEMP%\mia1\icon.ico
- %TEMP%\mia1\finish.dfm.miaf
- %TEMP%\mia1\finish.dfm
- %TEMP%\mia1\destination.dfm
- %TEMP%\mia1\componentstree.dfm
- %TEMP%\mia.tmp
- %TEMP%\mia1\installaware.png
- %TEMP%\lang.loc
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\twist.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\topoint2.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\topoint.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\startmenu3.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\startmenu2.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\startmenu.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\spinaway.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slides.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slidecolumnsup-down.ttt
- %TEMP%\mia1\license.rtf
- %TEMP%\mia1\licensecheck.dfm
- %TEMP%\mia1\licensecheck.dfm.miaf
- %TEMP%\mia1\maintenance.dfm
- %TEMP%\mia1\mmsiexec.dll
- %TEMP%\mia1\wizard.dfm
- %TEMP%\mia1\welcome.dfm
- %TEMP%\mia1\startmenu.dfm.miaf
- %TEMP%\mia1\startmenu.dfm
- %TEMP%\mia1\startinstallation.dfm
- %TEMP%\mia1\setuptype.dfm
- %TEMP%\mia1\registrationwithserial.dfm.miaf
- %TEMP%\mia1\registration.dfm.miaf
- %TEMP%\mia1\registrationwithserial.dfm
- %TEMP%\mia1\registration.dfm
- %TEMP%\mia1\readme.dfm.miaf
- %TEMP%\mia1\readme.dfm
- %TEMP%\mia1\progressprereq.dfm
- %TEMP%\mia1\progress.dfm.miaf
- %TEMP%\mia1\progress.dfm
- %TEMP%\mia1\prereq.dfm.miaf
- %TEMP%\mia1\prereq.dfm
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\mwinrunexec.dll
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\doors.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slideboth.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\showreverse.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholebr.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholebl.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble top.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble top - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble top - copy - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble right.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble right - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble right - copy - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble rand.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble rand - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble rand - copy - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble down.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble down - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble down - copy - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble corner.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\wobble corner - copy.tra
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholem.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholetl.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blackholetr.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blinds.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\safari close.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\rotatemiddlev2.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\rotatemiddlev.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\rotatemiddle.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\roll.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\grid2.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\fire.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\expand.ttt
- %TEMP%\mia1\mwinrunexec.dll
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\doors2.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort3.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort2aa.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort2.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\distort.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\burnaway.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blindsa.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blinds2a.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\blinds2.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\safari close2.ttt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\slideboth2.ttt
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\mspatcha.dll
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_disable_peek_dark.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\line.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\leather.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\label_plus_03.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\info.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\icons.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\home_vert_separator.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\home_switch_track.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\home_switch_button_v2.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\home_horiz_separator.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\grass.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame9.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame8.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame7.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame6.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame5.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame4.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame3.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame2.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\frame2a.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\metal.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\night sky.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidefromleft.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidefrombottom.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\size2.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\sidebar.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\shrink.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\sepline.png
- %TEMP%\explorer.exe
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\reverseexpand.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\radioboxes.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\cornercollapsel.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\pattern 3.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\pattern 2.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\pattern 1.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\paper4.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\paper.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\panel_stab.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\orange peel.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\onoff.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\fadeout.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\fadein.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\expandfromsmall.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\bubbles.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\btn_plus.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\btn_minus.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\btn_close.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\bottombar.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\bnt_apply.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\bg_panel.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\applogo.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\animpreview.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\animation.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\abstract.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\1checkbox.png
- %TEMP%\miaf077.tmp\windowfx5_setup.msi
- %TEMP%\miaf077.tmp\data\windowfx5_setup.msi
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\instmsi.msi
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\instmsi.msi
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\carbon fibre.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\cart.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\button2.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\checkbox.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\expandfromright.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\checkbox2.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\expandfromleft.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\expand.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\dottedline.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\distorted glass.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\dark metal.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\cornerexpandr.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\cornerexpandl.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\random.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidefromright.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\cork.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\content_bg.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\clouds.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\clouds 2.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\closetoright.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\closetoleft.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\closebutton.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\clock.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\cornercollapser.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidefromtop.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\slider_bottom.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\slider_horizontal_bg.png
- %TEMP%\miaf077.tmp\windowfx5_setup.exe
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\wfx64.exe
- %TEMP%\miaf077.tmp\data\offline\96821531\f7243042\wfx64.exe
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\wfx32.exe
- %TEMP%\miaf077.tmp\data\offline\708e8638\f7243042\wfx32.exe
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\sdactivate.exe
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msiinst.exe
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msiinst.exe
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msiexec.exe
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msiexec.exe
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\windowfx_scripting.doc
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\readme.txt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\eula.txt
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_window_trasnp_dark.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_window_size_control_dark.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_window_max_control_dark.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_pin_on_dark.png
- %TEMP%\miaf077.tmp\data\offline\3954d236\f7243042\windowfxconfig.exe
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\windowfxconfig.exe
- %TEMP%\miaf077.tmp\data\offline\ee78a22f\f7243042\windowfxsrv.exe
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\windowfxsrv.exe
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msls31.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msisip.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msisip.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msimsg.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msimsg.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msihnd.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msihnd.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msi.dll
- %TEMP%\miaf077.tmp\data\offline\mmsi.dll\mmsiexec.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\msi.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\imagehlp.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\imagehlp.dll
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\d3dx10_41.dll
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\1ccae1b5\d3dx10_41.dll
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\f7243042\d3dcompiler_41.dll
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\1ccae1b5\d3dcompiler_41.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\cabinet.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\cabinet.dll
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\unicode\mspatcha.dll
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wb_check_m_over1.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_disable_flip_3d_dark.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx_buy_button.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\top_bar.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\toptabbuttons.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\topshadow.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\topbar.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\20ccc721\test.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\tabrow_apply.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\tabbot.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\star.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\spotlight.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\smooth pink.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\smooth blue.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\smicons.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\smallhelp.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidetotop.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidetoright.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidetoleft.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\7047210f\slidetobottom.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_back.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_bullet_01.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_bullet_02.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_logo_od_02.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5ui_tab_selected.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5ui_tab_normal.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5ui_tab_inactive.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5ui_section_selection_2.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5ui_section_selection.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5ui_panel_right_tabs.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5ui_panel_right.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wcicon.png
- %TEMP%\miaf077.tmp\data\microsoft windows installer 2.0\mwinrun.dll\ansi\msls31.dll
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wb_check_normal.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wb_check_m_over.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wait.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\87af95f\very dark metal.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_title_upgrade_wfx_02.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_title_upgrade_od.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_separator_top.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_separator_bottom.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\upgrade_logo_plus_02.png
- %TEMP%\miaf077.tmp\data\offline\fe08ebba\9586016a\wfx5_tabs.png
- %TEMP%\mia1\windowfx5_setup.msi
Deletes the following files
- %TEMP%\lang.loc
- %TEMP%\mia.tmp
Network activity
Connects to
- 'zz####eryy.ddns.net':5552
UDP
- DNS ASK zz####eryy.ddns.net
Miscellaneous
Searches for the following windows
- ClassName: 'TApplication' WindowName: 'windowfx5_setup'
Creates and executes the following
- '%TEMP%\setup.exe'
- '%TEMP%\explorer.exe'
- '%TEMP%\miaf077.tmp\windowfx5_setup.exe' /m="%TEMP%\Setup.exe" /k=""
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\explorer.exe" "explorer.exe" ENABLE' (with hidden window)
