Razy.679792 (file analysis)

The Razy.679792 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.679792 virus can do?

The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Razy.679792?


File Info:
crc32: 76700722
md5: 5e09ee043cf8d65598422169d29c6c17
name: 5E09EE043CF8D65598422169D29C6C17.mlw
sha1: 7bc4a7e3f6d2b9ca6b9960908006031a267f2923
sha256: d675b0ae4071c83d0b642d20a974ef20a9fa2edb84f0985979a95749f6db5951
sha512: 83b2d344f3689340d36ecd5fa9b4a74fc86d03a3a6263e3cb607d02fc0b51532a760e63ec00042e75cdfea5f2757a4f3cf16d693fc8c8cdf06189f51aeaab3c2
ssdeep: 768:8DMdshVEIMK/jBhQ6LusCxYrznbVoWzvK51z7C9RkqeNLxi:8DcscbmBhQ67CxobbzC1z7C9GN4
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: Application Frame Host
FileVersion: 10.0.19041.746 (WinBuild.160101.0800)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 10.0.19041.746
FileDescription: Application Frame Host
OriginalFilename: ApplicationFrameHost.exe
Translation: 0x0409 0x04b0

Razy.679792 also known as:

Elastic	malicious (high confidence)
ALYac	Gen:Variant.Razy.679792
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Gen:Variant.Razy.679792
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/ClipBanker.MZ
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.MSIL.Generic
MicroWorld-eScan	Gen:Variant.Razy.679792
Ad-Aware	Gen:Variant.Razy.679792
Sophos	Generic ML PUA (PUA)
BitDefenderTheta	Gen:NN.ZemsilF.34126.cm0@a8NPKJfi
FireEye	Generic.mg.5e09ee043cf8d655
Emsisoft	Gen:Variant.Razy.679792 (B)
SentinelOne	Static AI – Malicious PE
Avira	TR/Dropper.Gen
eGambit	Unsafe.AI_Score_99%
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Arcabit	Trojan.Razy.DA5F70
ZoneAlarm	HEUR:Trojan.MSIL.Generic
GData	Gen:Variant.Razy.679792
MAX	malware (ai score=87)
Ikarus	Trojan.Bladabindi
MaxSecure	Trojan.Malware.300983.susgen

How to remove Razy.679792?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Razy.679792 (file analysis)