Ursu.345635 malicious file

The Ursu.345635 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.345635 virus can do?

Anomalous binary characteristics

How to determine Ursu.345635?


File Info:
crc32: 29B09AC9
md5: f0d79893d6412f7504151b26289c265c
name: F0D79893D6412F7504151B26289C265C.mlw
sha1: e7a48c908456e48f693eb0fea108b064ef0a1c8d
sha256: a3c0452d8c72943ab0328d6a833af49042c4abb6a94987eada2f2aca2704bbe3
sha512: 1481eccae02b53ead410aac32ffd8102a1b01ec142ad1d0c258716ac7b924012c7dcc2b3239d749ae1b951154eb996ca615a79f2b62147dff59da452986554bd
ssdeep: 192:6bvfvBwB+VvG39bR0MK4yVH0K0K95abBTBJ:ev3GQI3990F9tZD9WBTBJ
type: MS-DOS executable, MZ for MS-DOS

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2020
Assembly Version: 1.0.0.0
InternalName: OneDrive.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: OneDrive
ProductVersion: 1.0.0.0
FileDescription: OneDrive
OriginalFilename: OneDrive.exe

Ursu.345635 also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Ursu.345635
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_90% (D)
Cybereason	malicious.3d6412
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/ClipBanker.SX
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	HEUR:Trojan-Banker.MSIL.ClipBanker.gen
BitDefender	Gen:Variant.Ursu.345635
MicroWorld-eScan	Gen:Variant.Ursu.345635
Ad-Aware	Gen:Variant.Ursu.345635
Sophos	ML/PE-A
BitDefenderTheta	Gen:NN.ZemsilF.34678.am1@a4E8Kad
FireEye	Generic.mg.f0d79893d6412f75
Emsisoft	Gen:Variant.Ursu.345635 (B)
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_97%
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Ursu.D54623
GData	Gen:Variant.Ursu.345635
MAX	malware (ai score=86)
AVG	Win32:TrojanX-gen [Trj]
Qihoo-360	HEUR/QVM03.0.AB1F.Malware.Gen

How to remove Ursu.345635?

Ursu.345635 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X