7309728372.scr

pal家族

卡巴斯基

Infected 1
1. 8e790db084157bfc0e675cad030f8f04.exe
Scan result        File is infected
Found threats        Trojan.Win32.Yakes.pwci
File size        84.50KB
File type        PE32/EXE
Date of scan        2016-07-03 21:55:46
Bases release date        2016-07-03 13:44:28 UTC
MD5        8e790db084157bfc0e675cad030f8f04
SHA1        52b2097c5eff3e1678219ffe8ac78f68ef06c78e
SHA256
503f6d93db916266f8443acb0f2f26970323cbd04c45dd6ac514cccd92b9062d

nick20010117

HPMA
Mitigation   HollowProcess

Platform     6.1.7600/x86 06_17*
PID          5328
Application  C:\Users\Administrator\Desktop\8e790db084157bfc0e675cad030f8f04\8e790db084157bfc0e675cad030f8f04.exe

Filename     C:\Windows\System32\msiexec.exe

Target PID   5032
Target       C:\Windows\System32\msiexec.exe
Image Base   0x004D0000
CheckReason  0

Process Trace
1  C:\Users\Administrator\Desktop\8e790db084157bfc0e675cad030f8f04\8e790db084157bfc0e675cad030f8f04.exe [5328]
2  C:\Windows\explorer.exe [1204]
3  C:\Windows\System32\userinit.exe [480]