W64.Expiro.H5 information

The W64.Expiro.H5 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What W64.Expiro.H5 virus can do?

Authenticode signature is invalid

How to determine W64.Expiro.H5?


File Info:
name: 485054A7153AF60C29C4.mlw
path: /opt/CAPEv2/storage/binaries/d49d14572fb849a55bd61fc518a8115b81ea17f0a97e467804faeac24567657f
crc32: 025DCFC0
md5: 485054a7153af60c29c4931fc728bed2
sha1: 99a29bc595f693800b121cb057d2c5bfe946f633
sha256: d49d14572fb849a55bd61fc518a8115b81ea17f0a97e467804faeac24567657f
sha512: acfd6a92f8e080e29b7580f2d3a156120bc3fec31afcded0d157a510c94255d0bdcf73bc156acd7ead9ff8474cd8e118071426dea88bfabe2a0eb0a1ab9ca79d
ssdeep: 12288:WzQCHzCe4gXNyc1sp87g65MLheidoVHc94qCisH68//9msOwcbIdQ7L:2x7XNtsp8dSUVHvqPsF/9msVw
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T1ED55020453F81494F673DB7599B09241DB7ABD629E22AFAF1301120A1F76AE1CD39F32
sha3_384: d9071b49f2ba0bed0900f9a94f21f87e347f1091315e92d8d10a319059bb8cbb20e57784b2a8c9b4009cf3ca2d7f619c
ep_bytes: 4883ec28e8c7d713004883c428e97afe
timestamp: 2020-12-09 14:31:37

Version Info:
CompanyName: Oracle Corporation
FileDescription: Java(TM) Platform SE binary
FileVersion: 11.281.2.09
Full Version: 11.281.2.09
InternalName: Java SSV Agent Process
LegalCopyright: Copyright © 2020
OriginalFilename: ssvagent.exe
ProductName: Java(TM) Platform SE 8 U281
ProductVersion: 8.0.2810.9
Translation: 0x0000 0x04b0

W64.Expiro.H5 also known as:

MicroWorld-eScan	Win64.Expiro.Gen.7
FireEye	Generic.mg.485054a7153af60c
CAT-QuickHeal	W64.Expiro.H5
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Virus ( 00592e701 )
K7GW	Virus ( 00592e701 )
Cyren	W64/Expiro.AR.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win64/Expiro.CV
Kaspersky	Virus.Win64.Moiva.a
BitDefender	Win64.Expiro.Gen.7
Avast	Win64:Expiro-AJ [Inf]
Tencent	Virus.Win64.VirMoiva.a
Ad-Aware	Win64.Expiro.Gen.7
TACHYON	Virus/W64.Movia
Emsisoft	Win64.Expiro.Gen.7 (B)
DrWeb	Win32.Expiro.153
VIPRE	Win64.Expiro.Gen.7
SentinelOne	Static AI – Suspicious PE
GData	Win64.Expiro.Gen.7
Google	Detected
Avira	W32/Infector.Gen
Antiy-AVL	Trojan/Generic.ASVirus.317
Arcabit	Win64.Expiro.Gen.7
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R470896
Acronis	suspicious
ALYac	Win64.Expiro.Gen.7
MAX	malware (ai score=81)
Rising	Virus.Expiro!1.A140 (CLASSIC)
Ikarus	Trojan.Patched
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W64/Expiro.CP!tr
AVG	Win64:Expiro-AJ [Inf]
Panda	W64/Moyv.A

How to remove W64.Expiro.H5?

W64.Expiro.H5 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X