MD5: bbaa166030f437fd4f202c8d60c730b7
SHA1: 7ae6fc5bc6a26912d9d49117341c76db0e931192
SHA256: b756dce0576a570d0e5fdfd28e46cf2b533c11ee23b9e4a16bf4ecaf4e494fab
SSDeep: 6144:QQ/XrBxnFWdTkbtxZLIhD7rpVw2gxbE9A86ck/zGrcAgEIY0ujITABtM2agxC0wD:Q4rBxnLxZWrpVw2 A9nuiQAgPumAwF
Size: 413741 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-06-24 22:24:48
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:580
mofcomp.exe:2552
WindowsXP-KB968930-x86-ENG.exe:1964
ngen.exe:3920
ngen.exe:3496
ngen.exe:3928
ngen.exe:3944
ngen.exe:3556
ngen.exe:3456
ngen.exe:3472
ngen.exe:3516
ngen.exe:3572
ngen.exe:3580
ngen.exe:3488
ngen.exe:3912
ngen.exe:3588
ngen.exe:3480
ngen.exe:3936
ngen.exe:3464
ngen.exe:3404
ngen.exe:3508
ngen.exe:3428
ngen.exe:3540
ngen.exe:3564
ngen.exe:3548
ngen.exe:3888
update.exe:1944
PSCustomSetupUtil.exe:2928
PSCustomSetupUtil.exe:3612
PSCustomSetupUtil.exe:3716
PSCustomSetupUtil.exe:2612
PSCustomSetupUtil.exe:3636
PSCustomSetupUtil.exe:2652
PSCustomSetupUtil.exe:2840
PSCustomSetupUtil.exe:3064
PSCustomSetupUtil.exe:3596
PSCustomSetupUtil.exe:2880
PSCustomSetupUtil.exe:3692
PSCustomSetupUtil.exe:3024
PSCustomSetupUtil.exe:3088
PSCustomSetupUtil.exe:2816
PSCustomSetupUtil.exe:3768
PSCustomSetupUtil.exe:3668
PSCustomSetupUtil.exe:3740
PSCustomSetupUtil.exe:3136
PSCustomSetupUtil.exe:3172
PSCustomSetupUtil.exe:2976
PSCustomSetupUtil.exe:2952
PSCustomSetupUtil.exe:3808
PSCustomSetupUtil.exe:3112
PSCustomSetupUtil.exe:2752
PSCustomSetupUtil.exe:2676
PSCustomSetupUtil.exe:2792
PSSetupNativeUtils.exe:4052
mscorsvw.exe:3580
mscorsvw.exe:600
mscorsvw.exe:3940
mscorsvw.exe:2436
mscorsvw.exe:2808
mscorsvw.exe:3412
mscorsvw.exe:2524
mscorsvw.exe:2204
mscorsvw.exe:3512
mscorsvw.exe:2328
mscorsvw.exe:1072
mscorsvw.exe:2268
mscorsvw.exe:1508
mscorsvw.exe:2604
mscorsvw.exe:2708
mscorsvw.exe:3264
mscorsvw.exe:164
mscorsvw.exe:3700
mscorsvw.exe:3204
mscorsvw.exe:960
mscorsvw.exe:3788
mscorsvw.exe:4076
mscorsvw.exe:1064
mscorsvw.exe:2168
mscorsvw.exe:2376
wsmanhttpconfig.exe:2532
wsmanhttpconfig.exe:2484

The Trojan injects its code into the following process(es):

svchost.exe:636
svchost.exe:1324

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process mofcomp.exe:2552 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\wbem\Logs\mofcomp.log (1814 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpCF.tmp (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmpCF.tmp (0 bytes)

The process WindowsXP-KB968930-x86-ENG.exe:1964 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\1825901857bd78668d\about_type_operators.help.txt (5 bytes)
C:\1825901857bd78668d\winrm.vbs (2727 bytes)
C:\1825901857bd78668d\update (4 bytes)
C:\1825901857bd78668d\eventforwarding.adm (2 bytes)
C:\1825901857bd78668d\about_windows_powershell_ise.help.txt (6 bytes)
C:\1825901857bd78668d\about_ref.help.txt (1 bytes)
C:\1825901857bd78668d\pwrshplugin.dll (802 bytes)
C:\1825901857bd78668d\microsoft.powershell.security.resources.dll (9 bytes)
C:\1825901857bd78668d\wsmplpxy.dll (603 bytes)
C:\1825901857bd78668d\powershell_ise.exe (2526 bytes)
C:\1825901857bd78668d\about_join.help.txt (2 bytes)
C:\1825901857bd78668d\winrs.exe (1154 bytes)
C:\1825901857bd78668d\about_hash_tables.help.txt (6 bytes)
C:\1825901857bd78668d\about_data_sections.help.txt (5 bytes)
C:\1825901857bd78668d\wsmauto.dll (1842 bytes)
C:\1825901857bd78668d\about_remote_output.help.txt (887 bytes)
C:\1825901857bd78668d\about_signing.help.txt (12 bytes)
C:\1825901857bd78668d\about_functions.help.txt (586 bytes)
C:\1825901857bd78668d\compiledcomposition.microsoft.powershell.gpowershell.dll (1737 bytes)
C:\1825901857bd78668d\about_functions_advanced.help.txt (3 bytes)
C:\1825901857bd78668d\microsoft.powershell.graphicalhost.dll (4408 bytes)
C:\1825901857bd78668d\spmsg.dll (495 bytes)
C:\1825901857bd78668d\certificate.format.ps1xml (155 bytes)
C:\1825901857bd78668d\about_providers.help.txt (59 bytes)
C:\1825901857bd78668d\about_wmi_cmdlets.help.txt (8 bytes)
C:\1825901857bd78668d\update\update.inf (2457 bytes)
C:\1825901857bd78668d\wevtfwd.dll (3351 bytes)
C:\1825901857bd78668d\powershell.exe.mui (10 bytes)
C:\1825901857bd78668d\pwrshmsg.dll (4 bytes)
C:\1825901857bd78668d\about_break.help.txt (792 bytes)
C:\1825901857bd78668d\wsmprovhost.exe (657 bytes)
C:\1825901857bd78668d\microsoft.backgroundintelligenttransfer.management.resources.dll (7 bytes)
C:\1825901857bd78668d\about_while.help.txt (2 bytes)
C:\1825901857bd78668d\about_methods.help.txt (6 bytes)
C:\1825901857bd78668d\about_session_configurations.help.txt (276 bytes)
C:\1825901857bd78668d\update\eula.txt (586 bytes)
C:\1825901857bd78668d\about_reserved_words.help.txt (1 bytes)
C:\1825901857bd78668d\about_comparison_operators.help.txt (11 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.management.dll-help.xml (28236 bytes)
C:\1825901857bd78668d\about_switch.help.txt (489 bytes)
C:\1825901857bd78668d\wsmsvc.dll (15909 bytes)
C:\1825901857bd78668d\about_eventlogs.help.txt (5 bytes)
C:\1825901857bd78668d\microsoft.wsman.runtime.dll (33 bytes)
C:\1825901857bd78668d\pwrshsip.dll (24 bytes)
C:\$Directory (800 bytes)
C:\1825901857bd78668d\about_try_catch_finally.help.txt (7 bytes)
C:\1825901857bd78668d\about_job_details.help.txt (824 bytes)
C:\1825901857bd78668d\microsoft.powershell.gpowershell.dll (9738 bytes)
C:\1825901857bd78668d\winrshost.exe (22 bytes)
C:\1825901857bd78668d\about_profiles.help.txt (457 bytes)
C:\1825901857bd78668d\about_for.help.txt (146 bytes)
C:\1825901857bd78668d\about_history.help.txt (3 bytes)
C:\1825901857bd78668d\winrsmgr.dll (2 bytes)
C:\1825901857bd78668d\wtrinstaller.ico (4803 bytes)
C:\1825901857bd78668d\powershelltrace.format.ps1xml (344 bytes)
C:\1825901857bd78668d\about_arrays.help.txt (8 bytes)
C:\1825901857bd78668d\about_execution_policies.help.txt (13 bytes)
C:\1825901857bd78668d\microsoft.powershell.consolehost.resources.dll (778 bytes)
C:\1825901857bd78668d\about_quoting_rules.help.txt (659 bytes)
C:\1825901857bd78668d\system.management.automation.dll (38414 bytes)
C:\1825901857bd78668d\about_scopes.help.txt (76 bytes)
C:\1825901857bd78668d\about_remote_jobs.help.txt (13 bytes)
C:\1825901857bd78668d\about_format.ps1xml.help.txt (17 bytes)
C:\1825901857bd78668d\about_operators.help.txt (770 bytes)
C:\1825901857bd78668d\about_comment_based_help.help.txt (595 bytes)
C:\1825901857bd78668d\powershell_ise.resources.dll (4 bytes)
C:\1825901857bd78668d\wsmanhttpconfig.exe (3009 bytes)
C:\1825901857bd78668d\microsoft.backgroundintelligenttransfer.management.interop.dll (1532 bytes)
C:\1825901857bd78668d\about_jobs.help.txt (12 bytes)
C:\1825901857bd78668d\filesystem.format.ps1xml (133 bytes)
C:\1825901857bd78668d\about_types.ps1xml.help.txt (481 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.management.dll (3386 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.management.resources.dll (508 bytes)
C:\1825901857bd78668d\about_bits_cmdlets.help.txt (7 bytes)
C:\1825901857bd78668d\microsoft.backgroundintelligenttransfer.management.dll (1537 bytes)
C:\1825901857bd78668d\system.management.automation.dll-help.xml (16567 bytes)
C:\1825901857bd78668d\system.management.automation.resources.dll (3153 bytes)
C:\1825901857bd78668d\windowsremotemanagement.adm (574 bytes)
C:\1825901857bd78668d\about_special_characters.help.txt (3 bytes)
C:\1825901857bd78668d\dotnettypes.format.ps1xml (266 bytes)
C:\1825901857bd78668d\update\spcustom.dll (23 bytes)
C:\1825901857bd78668d\wsmtxt.xsl (2 bytes)
C:\1825901857bd78668d\about_script_internationalization.help.txt (9 bytes)
C:\1825901857bd78668d\update\updspapi.dll (5940 bytes)
C:\1825901857bd78668d\about_parsing.help.txt (2 bytes)
C:\1825901857bd78668d\winrssrv.dll (12 bytes)
C:\1825901857bd78668d\about_functions_advanced_methods.help.txt (9 bytes)
C:\1825901857bd78668d\about_logical_operators.help.txt (2 bytes)
C:\1825901857bd78668d\winrmprov.mof (789 bytes)
C:\1825901857bd78668d\about_return.help.txt (3 bytes)
C:\1825901857bd78668d\about_remote_requirements.help.txt (6 bytes)
C:\1825901857bd78668d\about_trap.help.txt (10 bytes)
C:\1825901857bd78668d\about_line_editing.help.txt (1 bytes)
C:\1825901857bd78668d\about_throw.help.txt (5 bytes)
C:\1825901857bd78668d\wsmauto.mof (4 bytes)
C:\1825901857bd78668d\about_arithmetic_operators.help.txt (168 bytes)
C:\1825901857bd78668d\about_redirection.help.txt (2 bytes)
C:\1825901857bd78668d\microsoft.powershell.gpowershell.resources.dll (408 bytes)
C:\1825901857bd78668d\about_remote_faq.help.txt (775 bytes)
C:\1825901857bd78668d\spuninst.exe (3787 bytes)
C:\1825901857bd78668d\microsoft.powershell.editor.resources.dll (562 bytes)
C:\1825901857bd78668d\bitstransfer.format.ps1xml (16 bytes)
C:\1825901857bd78668d\about_pipelines.help.txt (411 bytes)
C:\1825901857bd78668d\pspluginwkr.dll (1756 bytes)
C:\1825901857bd78668d\about_functions_advanced_parameters.help.txt (962 bytes)
C:\1825901857bd78668d\powershell.exe (7339 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.diagnostics.resources.dll (470 bytes)
C:\1825901857bd78668d\about_remote.help.txt (7 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.diagnostics.dll-help.xml (2301 bytes)
C:\1825901857bd78668d\about_prompts.help.txt (7 bytes)
C:\1825901857bd78668d\about_pssnapins.help.txt (6 bytes)
C:\1825901857bd78668d\importallmodules.psd1 (438 bytes)
C:\1825901857bd78668d\about_wildcards.help.txt (3 bytes)
C:\1825901857bd78668d\microsoft.backgroundintelligenttransfer.management.dll-help.xml (2472 bytes)
C:\1825901857bd78668d\about_debuggers.help.txt (21 bytes)
C:\1825901857bd78668d\microsoft.powershell.consolehost.dll (3118 bytes)
C:\1825901857bd78668d\winrm.cmd (35 bytes)
C:\1825901857bd78668d\wsmpty.xsl (1 bytes)
C:\1825901857bd78668d\about_pssession_details.help.txt (9 bytes)
C:\1825901857bd78668d\wsmwmipl.dll (2816 bytes)
C:\1825901857bd78668d\microsoft.wsman.management.dll (5010 bytes)
C:\1825901857bd78668d\update\update.exe (10748 bytes)
C:\1825901857bd78668d\about_if.help.txt (3 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.utility.dll (9684 bytes)
C:\1825901857bd78668d\about_continue.help.txt (1 bytes)
C:\1825901857bd78668d\about_regular_expressions.help.txt (5 bytes)
C:\1825901857bd78668d\winrmprov.dll (591 bytes)
C:\1825901857bd78668d\about_functions_cmdletbindingattribute.help.txt (3 bytes)
C:\1825901857bd78668d\diagnostics.format.ps1xml (590 bytes)
C:\1825901857bd78668d\about_automatic_variables.help.txt (14 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.utility.dll-help.xml (20810 bytes)
C:\1825901857bd78668d\about_language_keywords.help.txt (11 bytes)
C:\1825901857bd78668d\microsoft.powershell.consolehost.dll-help.xml (900 bytes)
C:\1825901857bd78668d\pscustomsetuputil.exe (316 bytes)
C:\1825901857bd78668d\about_path_syntax.help.txt (5 bytes)
C:\1825901857bd78668d\microsoft.powershell.security.dll (1145 bytes)
C:\1825901857bd78668d\about_command_syntax.help.txt (5 bytes)
C:\1825901857bd78668d\about_commonparameters.help.txt (12 bytes)
C:\1825901857bd78668d\about_assignment_operators.help.txt (379 bytes)
C:\1825901857bd78668d\about_remote_troubleshooting.help.txt (146 bytes)
C:\1825901857bd78668d\powershellcore.format.ps1xml (1492 bytes)
C:\1825901857bd78668d\about_escape_characters.help.txt (2 bytes)
C:\1825901857bd78668d\about_objects.help.txt (2 bytes)
C:\1825901857bd78668d\about_transactions.help.txt (1011 bytes)
C:\1825901857bd78668d\about_pssessions.help.txt (9 bytes)
C:\1825901857bd78668d\about_preference_variables.help.txt (37 bytes)
C:\1825901857bd78668d\update\kb968930xp.cat (512 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.diagnostics.dll (998 bytes)
C:\1825901857bd78668d\registry.format.ps1xml (20 bytes)
C:\1825901857bd78668d\microsoft.powershell.graphicalhost.resources.dll (16 bytes)
C:\1825901857bd78668d\microsoft.wsman.management.dll-help.xml (8740 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.utility.resources.dll (508 bytes)
C:\1825901857bd78668d\about_locations.help.txt (794 bytes)
C:\1825901857bd78668d\$shtdwn$.req (788 bytes)
C:\1825901857bd78668d\about_core_commands.help.txt (221 bytes)
C:\1825901857bd78668d\about_windows_powershell_2.0.help.txt (453 bytes)
C:\1825901857bd78668d\about_command_precedence.help.txt (8 bytes)
C:\1825901857bd78668d\profile.ps1 (772 bytes)
C:\1825901857bd78668d\microsoft.wsman.management.resources.dll (13 bytes)
C:\1825901857bd78668d\about_parameters.help.txt (9 bytes)
C:\1825901857bd78668d\about_do.help.txt (2 bytes)
C:\1825901857bd78668d\about_scripts.help.txt (12 bytes)
C:\1825901857bd78668d\update\update.ver (14 bytes)
C:\1825901857bd78668d\windowsremoteshell.adm (12 bytes)
C:\1825901857bd78668d\default.help.txt (2 bytes)
C:\1825901857bd78668d\pssetupnativeutils.exe (9 bytes)
C:\1825901857bd78668d\help.format.ps1xml (3947 bytes)
C:\1825901857bd78668d\about_environment_variables.help.txt (417 bytes)
C:\1825901857bd78668d\bitstransfer.psd1 (950 bytes)
C:\1825901857bd78668d\about_split.help.txt (10 bytes)
C:\1825901857bd78668d\windowspowershellhelp.chm (26041 bytes)
C:\1825901857bd78668d\getevent.types.ps1xml (15 bytes)
C:\1825901857bd78668d\types.ps1xml (2510 bytes)
C:\1825901857bd78668d\microsoft.powershell.security.dll-help.xml (1797 bytes)
C:\1825901857bd78668d\about_properties.help.txt (7 bytes)
C:\1825901857bd78668d\winrm.ini (1956 bytes)
C:\1825901857bd78668d\about_ws-management_cmdlets.help.txt (405 bytes)
C:\1825901857bd78668d\spupdsvc.exe (287 bytes)
C:\1825901857bd78668d\about_foreach.help.txt (10 bytes)
C:\1825901857bd78668d\about_requires.help.txt (2 bytes)
C:\1825901857bd78668d\wsman.format.ps1xml (837 bytes)
C:\1825901857bd78668d\about_aliases.help.txt (6 bytes)
C:\1825901857bd78668d\wsmres.dll (6164 bytes)
C:\1825901857bd78668d\about_modules.help.txt (13 bytes)
C:\1825901857bd78668d\about_script_blocks.help.txt (3 bytes)
C:\1825901857bd78668d\microsoft.powershell.editor.dll (14450 bytes)
C:\1825901857bd78668d\about_variables.help.txt (6 bytes)
C:\1825901857bd78668d\winrscmd.dll (2907 bytes)

The Trojan deletes the following file(s):

C:\1825901857bd78668d\about_type_operators.help.txt (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.utility.dll (0 bytes)
C:\1825901857bd78668d\winrm.vbs (0 bytes)
C:\1825901857bd78668d\about_core_commands.help.txt (0 bytes)
C:\1825901857bd78668d\eventforwarding.adm (0 bytes)
C:\1825901857bd78668d\about_windows_powershell_ise.help.txt (0 bytes)
C:\1825901857bd78668d\update (0 bytes)
C:\1825901857bd78668d\about_session_configurations.help.txt (0 bytes)
C:\1825901857bd78668d\pwrshplugin.dll (0 bytes)
C:\1825901857bd78668d\about_methods.help.txt (0 bytes)
C:\1825901857bd78668d\wsmplpxy.dll (0 bytes)
C:\1825901857bd78668d\powershell_ise.exe (0 bytes)
C:\1825901857bd78668d\about_join.help.txt (0 bytes)
C:\1825901857bd78668d\winrs.exe (0 bytes)
C:\1825901857bd78668d\about_hash_tables.help.txt (0 bytes)
C:\1825901857bd78668d\about_remote_requirements.help.txt (0 bytes)
C:\1825901857bd78668d\about_throw.help.txt (0 bytes)
C:\1825901857bd78668d\about_remote_output.help.txt (0 bytes)
C:\1825901857bd78668d\about_signing.help.txt (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.security.resources.dll (0 bytes)
C:\1825901857bd78668d\about_functions.help.txt (0 bytes)
C:\1825901857bd78668d\about_remote.help.txt (0 bytes)
C:\1825901857bd78668d\about_functions_advanced.help.txt (0 bytes)
C:\_533875_ (0 bytes)
C:\1825901857bd78668d\pscustomsetuputil.exe (0 bytes)
C:\1825901857bd78668d\spmsg.dll (0 bytes)
C:\1825901857bd78668d\certificate.format.ps1xml (0 bytes)
C:\1825901857bd78668d\about_wmi_cmdlets.help.txt (0 bytes)
C:\1825901857bd78668d\update\update.inf (0 bytes)
C:\1825901857bd78668d\about_ws-management_cmdlets.help.txt (0 bytes)
C:\1825901857bd78668d\powershell.exe.mui (0 bytes)
C:\1825901857bd78668d\pwrshmsg.dll (0 bytes)
C:\1825901857bd78668d\about_break.help.txt (0 bytes)
C:\1825901857bd78668d\wsmprovhost.exe (0 bytes)
C:\1825901857bd78668d\microsoft.backgroundintelligenttransfer.management.resources.dll (0 bytes)
C:\1825901857bd78668d\about_while.help.txt (0 bytes)
C:\1825901857bd78668d\about_ref.help.txt (0 bytes)
C:\1825901857bd78668d\update\eula.txt (0 bytes)
C:\1825901857bd78668d\wevtfwd.dll (0 bytes)
C:\1825901857bd78668d\about_types.ps1xml.help.txt (0 bytes)
C:\1825901857bd78668d\winrmprov.dll (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.management.dll-help.xml (0 bytes)
C:\1825901857bd78668d\about_switch.help.txt (0 bytes)
C:\1825901857bd78668d\wsmsvc.dll (0 bytes)
C:\1825901857bd78668d\about_quoting_rules.help.txt (0 bytes)
C:\1825901857bd78668d\microsoft.wsman.runtime.dll (0 bytes)
C:\1825901857bd78668d\pwrshsip.dll (0 bytes)
C:\1825901857bd78668d\about_try_catch_finally.help.txt (0 bytes)
C:\1825901857bd78668d\about_job_details.help.txt (0 bytes)
C:\1825901857bd78668d\about_parsing.help.txt (0 bytes)
C:\1825901857bd78668d\winrshost.exe (0 bytes)
C:\1825901857bd78668d\about_profiles.help.txt (0 bytes)
C:\1825901857bd78668d\about_for.help.txt (0 bytes)
C:\1825901857bd78668d\wsmpty.xsl (0 bytes)
C:\1825901857bd78668d\winrsmgr.dll (0 bytes)
C:\1825901857bd78668d\wtrinstaller.ico (0 bytes)
C:\1825901857bd78668d\powershelltrace.format.ps1xml (0 bytes)
C:\1825901857bd78668d\about_arrays.help.txt (0 bytes)
C:\1825901857bd78668d\about_locations.help.txt (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.consolehost.resources.dll (0 bytes)
C:\1825901857bd78668d\about_eventlogs.help.txt (0 bytes)
C:\1825901857bd78668d\system.management.automation.dll (0 bytes)
C:\1825901857bd78668d\about_scopes.help.txt (0 bytes)
C:\1825901857bd78668d\about_remote_jobs.help.txt (0 bytes)
C:\1825901857bd78668d\about_format.ps1xml.help.txt (0 bytes)
C:\1825901857bd78668d\about_operators.help.txt (0 bytes)
C:\1825901857bd78668d\about_comment_based_help.help.txt (0 bytes)
C:\1825901857bd78668d\about_reserved_words.help.txt (0 bytes)
C:\1825901857bd78668d\wsmanhttpconfig.exe (0 bytes)
C:\1825901857bd78668d\microsoft.backgroundintelligenttransfer.management.interop.dll (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.editor.resources.dll (0 bytes)
C:\1825901857bd78668d\about_jobs.help.txt (0 bytes)
C:\1825901857bd78668d\filesystem.format.ps1xml (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.management.dll (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.management.resources.dll (0 bytes)
C:\1825901857bd78668d\about_bits_cmdlets.help.txt (0 bytes)
C:\1825901857bd78668d\microsoft.backgroundintelligenttransfer.management.dll (0 bytes)
C:\1825901857bd78668d\system.management.automation.dll-help.xml (0 bytes)
C:\1825901857bd78668d\about_return.help.txt (0 bytes)
C:\1825901857bd78668d\windowsremotemanagement.adm (0 bytes)
C:\1825901857bd78668d\about_special_characters.help.txt (0 bytes)
C:\1825901857bd78668d\about_wildcards.help.txt (0 bytes)
C:\1825901857bd78668d\about_environment_variables.help.txt (0 bytes)
C:\1825901857bd78668d\wsmtxt.xsl (0 bytes)
C:\1825901857bd78668d\about_script_internationalization.help.txt (0 bytes)
C:\1825901857bd78668d\about_providers.help.txt (0 bytes)
C:\1825901857bd78668d\winrssrv.dll (0 bytes)
C:\1825901857bd78668d\about_functions_advanced_methods.help.txt (0 bytes)
C:\1825901857bd78668d\winrmprov.mof (0 bytes)
C:\1825901857bd78668d\system.management.automation.resources.dll (0 bytes)
C:\1825901857bd78668d\about_data_sections.help.txt (0 bytes)
C:\1825901857bd78668d\about_trap.help.txt (0 bytes)
C:\1825901857bd78668d\about_line_editing.help.txt (0 bytes)
C:\1825901857bd78668d\wsmauto.dll (0 bytes)
C:\1825901857bd78668d\wsmauto.mof (0 bytes)
C:\1825901857bd78668d\about_arithmetic_operators.help.txt (0 bytes)
C:\1825901857bd78668d\about_redirection.help.txt (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.gpowershell.resources.dll (0 bytes)
C:\1825901857bd78668d\about_remote_faq.help.txt (0 bytes)
C:\1825901857bd78668d\spuninst.exe (0 bytes)
C:\1825901857bd78668d (0 bytes)
C:\1825901857bd78668d\about_pssnapins.help.txt (0 bytes)
C:\1825901857bd78668d\bitstransfer.format.ps1xml (0 bytes)
C:\1825901857bd78668d\about_pipelines.help.txt (0 bytes)
C:\1825901857bd78668d\pspluginwkr.dll (0 bytes)
C:\1825901857bd78668d\dotnettypes.format.ps1xml (0 bytes)
C:\1825901857bd78668d\about_functions_advanced_parameters.help.txt (0 bytes)
C:\1825901857bd78668d\powershell.exe (0 bytes)
C:\1825901857bd78668d\about_scripts.help.txt (0 bytes)
C:\1825901857bd78668d\compiledcomposition.microsoft.powershell.gpowershell.dll (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.diagnostics.dll-help.xml (0 bytes)
C:\1825901857bd78668d\about_prompts.help.txt (0 bytes)
C:\1825901857bd78668d\microsoft.wsman.management.dll-help.xml (0 bytes)
C:\1825901857bd78668d\importallmodules.psd1 (0 bytes)
C:\1825901857bd78668d\update\updspapi.dll (0 bytes)
C:\1825901857bd78668d\about_debuggers.help.txt (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.consolehost.dll (0 bytes)
C:\1825901857bd78668d\winrm.cmd (0 bytes)
C:\1825901857bd78668d\about_history.help.txt (0 bytes)
C:\1825901857bd78668d\about_pssession_details.help.txt (0 bytes)
C:\1825901857bd78668d\wsmwmipl.dll (0 bytes)
C:\1825901857bd78668d\microsoft.wsman.management.dll (0 bytes)
C:\1825901857bd78668d\about_if.help.txt (0 bytes)
C:\1825901857bd78668d\about_logical_operators.help.txt (0 bytes)
C:\1825901857bd78668d\about_continue.help.txt (0 bytes)
C:\1825901857bd78668d\about_regular_expressions.help.txt (0 bytes)
C:\1825901857bd78668d\about_comparison_operators.help.txt (0 bytes)
C:\1825901857bd78668d\about_functions_cmdletbindingattribute.help.txt (0 bytes)
C:\1825901857bd78668d\diagnostics.format.ps1xml (0 bytes)
C:\1825901857bd78668d\about_automatic_variables.help.txt (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.utility.dll-help.xml (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.gpowershell.dll (0 bytes)
C:\1825901857bd78668d\about_language_keywords.help.txt (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.consolehost.dll-help.xml (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.graphicalhost.dll (0 bytes)
C:\1825901857bd78668d\about_path_syntax.help.txt (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.security.dll (0 bytes)
C:\1825901857bd78668d\about_command_syntax.help.txt (0 bytes)
C:\1825901857bd78668d\about_commonparameters.help.txt (0 bytes)
C:\1825901857bd78668d\about_assignment_operators.help.txt (0 bytes)
C:\1825901857bd78668d\about_remote_troubleshooting.help.txt (0 bytes)
C:\1825901857bd78668d\powershellcore.format.ps1xml (0 bytes)
C:\1825901857bd78668d\about_escape_characters.help.txt (0 bytes)
C:\1825901857bd78668d\about_objects.help.txt (0 bytes)
C:\1825901857bd78668d\about_transactions.help.txt (0 bytes)
C:\1825901857bd78668d\about_pssessions.help.txt (0 bytes)
C:\1825901857bd78668d\about_preference_variables.help.txt (0 bytes)
C:\1825901857bd78668d\update\kb968930xp.cat (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.diagnostics.dll (0 bytes)
C:\1825901857bd78668d\powershell_ise.resources.dll (0 bytes)
C:\1825901857bd78668d\registry.format.ps1xml (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.graphicalhost.resources.dll (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.utility.resources.dll (0 bytes)
C:\1825901857bd78668d\about_execution_policies.help.txt (0 bytes)
C:\1825901857bd78668d\update\update.exe (0 bytes)
C:\1825901857bd78668d\about_windows_powershell_2.0.help.txt (0 bytes)
C:\1825901857bd78668d\about_command_precedence.help.txt (0 bytes)
C:\1825901857bd78668d\profile.ps1 (0 bytes)
C:\1825901857bd78668d\microsoft.wsman.management.resources.dll (0 bytes)
C:\1825901857bd78668d\about_parameters.help.txt (0 bytes)
C:\1825901857bd78668d\about_do.help.txt (0 bytes)
C:\1825901857bd78668d\update\update.ver (0 bytes)
C:\1825901857bd78668d\windowsremoteshell.adm (0 bytes)
C:\1825901857bd78668d\default.help.txt (0 bytes)
C:\1825901857bd78668d\pssetupnativeutils.exe (0 bytes)
C:\1825901857bd78668d\help.format.ps1xml (0 bytes)
C:\1825901857bd78668d\update\spcustom.dll (0 bytes)
C:\1825901857bd78668d\bitstransfer.psd1 (0 bytes)
C:\1825901857bd78668d\about_split.help.txt (0 bytes)
C:\1825901857bd78668d\windowspowershellhelp.chm (0 bytes)
C:\1825901857bd78668d\getevent.types.ps1xml (0 bytes)
C:\1825901857bd78668d\types.ps1xml (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.security.dll-help.xml (0 bytes)
C:\1825901857bd78668d\about_properties.help.txt (0 bytes)
C:\1825901857bd78668d\winrm.ini (0 bytes)
C:\1825901857bd78668d\microsoft.backgroundintelligenttransfer.management.dll-help.xml (0 bytes)
C:\1825901857bd78668d\spupdsvc.exe (0 bytes)
C:\1825901857bd78668d\about_foreach.help.txt (0 bytes)
C:\1825901857bd78668d\about_requires.help.txt (0 bytes)
C:\1825901857bd78668d\wsman.format.ps1xml (0 bytes)
C:\1825901857bd78668d\about_aliases.help.txt (0 bytes)
C:\1825901857bd78668d\wsmres.dll (0 bytes)
C:\1825901857bd78668d\about_modules.help.txt (0 bytes)
C:\1825901857bd78668d\about_script_blocks.help.txt (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.commands.diagnostics.resources.dll (0 bytes)
C:\1825901857bd78668d\microsoft.powershell.editor.dll (0 bytes)
C:\1825901857bd78668d\about_variables.help.txt (0 bytes)
C:\1825901857bd78668d\winrscmd.dll (0 bytes)

The process ngen.exe:3920 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (784 bytes)

The process ngen.exe:3496 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (772 bytes)

The process ngen.exe:3928 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (1106 bytes)

The process ngen.exe:3944 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (746 bytes)

The process ngen.exe:3556 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (468 bytes)

The process ngen.exe:3456 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (1220 bytes)

The process ngen.exe:3472 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (866 bytes)

The process ngen.exe:3516 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (1450 bytes)

The process ngen.exe:3572 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (1140 bytes)

The process ngen.exe:3580 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (474 bytes)

The process ngen.exe:3488 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (494 bytes)

The process ngen.exe:3912 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (486 bytes)

The process ngen.exe:3588 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (826 bytes)

The process ngen.exe:3480 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (1186 bytes)

The process ngen.exe:3936 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (1428 bytes)

The process ngen.exe:3464 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (554 bytes)

The process ngen.exe:3404 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (596 bytes)

The process ngen.exe:3508 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (1104 bytes)

The process ngen.exe:3428 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (896 bytes)

The process ngen.exe:3540 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (770 bytes)

The process ngen.exe:3564 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v2.0.50727\ngen.log (800 bytes)

The process ngen.exe:3548 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):