3e0e5b7d301c559dde78b5458df4a41579e191c67145f3db26f47d34068cf466

360Tencent

http://blog.talosintelligence.co ... ins-from-india.html

https://p.fuwafuwa.moe/hxwjhk.zip

aerbeisi

rising
682d5d60d6fc0e1d5810e9cd9d8b1c6b6fa154d5a790da944177074d28846d66 ...     Malware.Generic.d!tfe-MeXam6t03fE <cloud>
b7101462507a8cf5bf91b62b641ef1ac3d268115d6dfca54a1625efb07fccf0d ...     Hack.Win32.SpyWare.aa-QJTPq1DfYfJ <cloud>
4bce73a29ee1b9840cd82d8c08e107179cd74dc1aed488f6d16772ce12092c69 ...     Malware.Heuristic!ET#94%-biW72bkDD2C <cloud>
bcf8dbbc78883b2d84511819123cf39b1c2ffe3cd9763d08fe1544c89084cadf ...     Malware.Heuristic!ET#89%-en4rOs5WdCB <cloud>
e5d2c3a7ddd219ab361af4a709999a492387e3aaf8380187a7699895fc383e40 ...     Malware.Strealer!8.1EF-RAKI5moMmcV <cloud>

黑衣~魂

F-S K ALL

Trojan.GenericKD.4753584
C:\Users\常用.user-PC.000\Desktop\6\4bce73a29ee1b9840cd82d8c08e107179cd74dc1aed488f6d16772ce12092c69: 已清除
Trojan.Generic.20472792
C:\Users\常用.user-PC.000\Desktop\6\682d5d60d6fc0e1d5810e9cd9d8b1c6b6fa154d5a790da944177074d28846d66: 已清除
Trojan.GenericKD.5040519
C:\Users\常用.user-PC.000\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be\word\document.xml: 已跳過
Trojan.GenericKD.4911982
C:\Users\常用.user-PC.000\Desktop\6\bcf8dbbc78883b2d84511819123cf39b1c2ffe3cd9763d08fe1544c89084cadf: 已清除
Trojan.AgentWDCR.JWM
C:\Users\常用.user-PC.000\Desktop\6\b7101462507a8cf5bf91b62b641ef1ac3d268115d6dfca54a1625efb07fccf0d: 已清除
Gen:Variant.Kazy.764369
C:\Users\常用.user-PC.000\Desktop\6\e5d2c3a7ddd219ab361af4a709999a492387e3aaf8380187a7699895fc383e40: 已清除
Exploit.CVE-2012-1856.Gen
Trojan.GenericKD.5040519
C:\Users\常用.user-PC.000\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be:

Eset小粉絲

Avira kill all
[mw_shl_code=css,true]Start of the scan: 2017-05-27 23:23:54
05/27/2017,23-23-55        [INFO]        C:\Users\Ivan\Downloads\6\b7101462507a8cf5bf91b62b641ef1ac3d268115d6dfca54a1625efb07fccf0d
05/27/2017,23-23-55        [INFO]        [DETECTION] file contains 'DR/Autoit.ofeip'
05/27/2017,23-23-55        [INFO]        repair.rdf loaded (version: 1.0.27.96)
05/27/2017,23-23-55        [INFO]        C:\Users\Ivan\Downloads\6\bcf8dbbc78883b2d84511819123cf39b1c2ffe3cd9763d08fe1544c89084cadf
05/27/2017,23-23-55        [INFO]        [DETECTION] file contains 'DR/Autoit.woltu'
05/27/2017,23-23-55        [INFO]        C:\Users\Ivan\Downloads\6\e5d2c3a7ddd219ab361af4a709999a492387e3aaf8380187a7699895fc383e40
05/27/2017,23-23-55        [INFO]        [DETECTION] file contains 'TR/Spy.Gen'
05/27/2017,23-23-56        [INFO]        C:\Users\Ivan\Downloads\6\4bce73a29ee1b9840cd82d8c08e107179cd74dc1aed488f6d16772ce12092c69
05/27/2017,23-23-56        [INFO]        [DETECTION] file contains 'DR/Autoit.tnvhd'
05/27/2017,23-23-56        [INFO]        C:\Users\Ivan\Downloads\6\682d5d60d6fc0e1d5810e9cd9d8b1c6b6fa154d5a790da944177074d28846d66
05/27/2017,23-23-56        [INFO]        [DETECTION] file contains 'TR/Dropper.Gen'
ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be'
contained the pattern of 'EXP/CVE-2013-3906' [exploit][/mw_shl_code]

Yunahoshi

emsi KA
扫描开始：        2017/5/28 0:30:05
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/document.xml          Trojan.GenericKD.5040519 (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX1.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX10.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX11.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX12.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX13.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX14.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX15.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX16.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX17.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX18.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX19.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX2.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX20.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX21.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX22.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX23.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX24.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX25.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX26.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX27.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX28.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX29.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX3.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX30.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX31.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX32.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX33.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX34.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX35.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX36.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX37.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX38.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX39.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX4.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX40.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX5.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX6.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX7.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX8.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX9.xml          Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/media/image1.jpeg          Exploit.CVE-2013-3906.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\4bce73a29ee1b9840cd82d8c08e107179cd74dc1aed488f6d16772ce12092c69          Trojan.GenericKD.4753584 (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\682d5d60d6fc0e1d5810e9cd9d8b1c6b6fa154d5a790da944177074d28846d66          Trojan.Generic.20472792 (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\b7101462507a8cf5bf91b62b641ef1ac3d268115d6dfca54a1625efb07fccf0d          Trojan.AgentWDCR.JWM (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\bcf8dbbc78883b2d84511819123cf39b1c2ffe3cd9763d08fe1544c89084cadf          Trojan.GenericKD.4911982 (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\e5d2c3a7ddd219ab361af4a709999a492387e3aaf8380187a7699895fc383e40          Gen:Variant.Kazy.764369 (B) [krnl.xmd]

扫描        6
发现        47

扫描结束：        2017/5/28 0:30:36
扫描时间：        0:00:31

欧阳宣

cylance 5x

dongwenqi

卡巴修复一个，其他全部删除

saleniy35

ESET Kill 5x

275751198

360miss  2个  都入了风险库，万恶的风险库

zst470396853

如图