Malware

What is “Malware.AI.4185168642”?

Malware Removal

The Malware.AI.4185168642 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.4185168642 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Malware.AI.4185168642?


File Info:

name: 4AE85F226AED848AE4E9.mlw
path: /opt/CAPEv2/storage/binaries/bab686b6e9002e944669d7ef8fa4b434005d32cd9f767f7a90909385f8c8cc0c
crc32: 60372FE8
md5: 4ae85f226aed848ae4e906c4d0f6f44a
sha1: 5cdb3fd665d51e65383925757da226129b638e56
sha256: bab686b6e9002e944669d7ef8fa4b434005d32cd9f767f7a90909385f8c8cc0c
sha512: 743c37b4c9e1b78c2f30e600f54519ad38d9c2f724fa52694a8634ac7d10eed46de979fac861b4e444bd8cc3c6aa9ae86b80a32d37d9856b5372f63304a975b5
ssdeep: 49152:x1SpUNEHAtai3fP7bfbx5Wf1R6bJ11DTKDcCp0YKQ4WsD5vNk:6i3fP7jbhW0YKQqD0
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T1ABA59E17F59502E8C0A8C134CB57A9F2EB61BC468F34B9EF069592111E77BE4EB38718
sha3_384: 54ef2c5637b98d1141d3045072c5041af714b8869853eaf115196f45947fc4bdc95150b25672ba11b8482d8e41c02b39
ep_bytes: 90554889e55648ffce57415441554156
timestamp: 2021-05-08 00:06:56

Version Info:

CompanyName: Google LLC
FileDescription: Google Chrome
FileVersion: 90.0.4430.212
InternalName: elevation_service_exe
LegalCopyright: Copyright 2020 Google LLC. All rights reserved.
OriginalFilename: elevation_service.exe
ProductName: Google Chrome
ProductVersion: 90.0.4430.212
CompanyShortName: Google
ProductShortName: Chrome
LastChange: e3cd97fc771b893b7fd1879196d1215b622c2bed-refs/branch-heads/4430@#1429
Official Build: 1
Translation: 0x0409 0x04b0

Malware.AI.4185168642 also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanWin64.Expiro.Gen.3
FireEyeGeneric.mg.4ae85f226aed848a
ALYacWin64.Expiro.Gen.3
ZillyaVirus.Expiro.Win64.34
K7AntiVirusVirus ( 0040f8071 )
K7GWVirus ( 0040f8071 )
CrowdStrikewin/malicious_confidence_100% (D)
CyrenW64/Expiro.D!gen
SymantecW64.Xpiro.F
ESET-NOD32Win64/Expiro.AG
BaiduWin64.Virus.Expiro.r
TrendMicro-HouseCallPE64_EXPIRO.AR
ClamAVWin.Malware.Expiro-8069490-0
KasperskyVirus.Win64.Expiro.g
BitDefenderWin64.Expiro.Gen.3
NANO-AntivirusVirus.Win64.Expiro.dtfhve
AvastWin32:Expiro-DD
RisingVirus.Expiro!1.A140 (CLASSIC)
Ad-AwareWin64.Expiro.Gen.3
EmsisoftWin64.Expiro.Gen.3 (B)
DrWebWin64.Expiro.108
VIPREVirus.Win64.Expiro.gen.a (v)
TrendMicroPE64_EXPIRO.AR
McAfee-GW-EditionW64/Expiro.a
SentinelOneStatic AI – Malicious PE
SophosML/PE-A + W64/Expiro-S
APEXMalicious
GDataWin64.Expiro.Gen.3
AviraW64/Expiro.AF
MAXmalware (ai score=80)
Antiy-AVLVirus/Win64.Expiro.x
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
CynetMalicious (score: 100)
AhnLab-V3Win64/Expiro2.Gen
Acronissuspicious
McAfeeW64/Expiro.a
TACHYONVirus/W64.Expiro.C
MalwarebytesMalware.AI.4185168642
TencentVirus.Win64.Expiro.ad
IkarusVirus.Win32.Expiro
FortinetW64/Expiro.Q
AVGWin32:Expiro-DD
Cybereasonmalicious.26aed8
PandaW32/Expiro.gen

How to remove Malware.AI.4185168642?

Malware.AI.4185168642 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment