Malware

What is “Win64/Expiro.DP”?

Malware Removal

The Win64/Expiro.DP is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win64/Expiro.DP virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Binary compilation timestomping detected

How to determine Win64/Expiro.DP?



File Info:

name: CEAD4DBC20651C47706D.mlw
path: /opt/CAPEv2/storage/binaries/4e37faa099388e34b2fa207ae5dacb0cc74c52fa01c79b9db2276d737dcce316
crc32: C82D3A85
md5: cead4dbc20651c47706d15547a8a6179
sha1: eba6e4b198037db6931e3522793c8b10ab361f70
sha256: 4e37faa099388e34b2fa207ae5dacb0cc74c52fa01c79b9db2276d737dcce316
sha512: 6faa561b07964005fe6304cfe500543bb33fd2bdd7bbe8b1317c9ded3cca93a48cb91f8cc81f2bb07244cc567fab69621e4a15c4278fffcaa7a8944ec541d373
ssdeep: 24576:TfPaezgNmgM5NJWsAbK/11MNYYdO5QH6fFfr35P4inBikO4p4V2QGHMzZhjQ3Je:TfPfgkQu/1uNYYdO5QH6fFf75PtVOOQ5
type: PE32+ executable (console) x86-64, for MS Windows
tlsh: T19665AE1EA3DC0896D4BB81348A518A16EB727C2E1B22D6CF2160C33D2F67ED55E75F06
sha3_384: ad5ce6f08b99a151b2987d411697db609cafe8d71bc3ba13adfc7bc6be94f993812bfd6829bc0b7e08e9f812905b0eeb
ep_bytes: 4883ec28e8d70300004883c428e95efe
timestamp: 2047-11-07 06:47:09


Version Info:

CompanyName: Microsoft Corporation
FileDescription: Windows Media Player Network Sharing Service
FileVersion: 12.0.22000.795 (WinBuild.160101.0800)
InternalName: Windows Media Player Network Sharing Service
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WMPNetwk.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 12.0.22000.795
Translation: 0x0409 0x04b0

Win64/Expiro.DP also known as:

DrWebWin32.Expiro.153
MicroWorld-eScanWin64.Expiro.Gen.7
ALYacWin64.Expiro.Gen.7
VIPREWin64.Expiro.Gen.7
SangforVirus.Win32.Save.a
K7AntiVirusVirus ( 00592e701 )
K7GWVirus ( 00592e701 )
Cybereasonmalicious.198037
CyrenW64/Expiro.AR.gen!Eldorado
SymantecW64.Xpiro.J!dam
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win64/Expiro.DP
KasperskyVirus.Win64.Moiva.a
BitDefenderWin64.Expiro.Gen.7
NANO-AntivirusVirus.Win64.Virut-Gen.bwpxnc
AvastWin64:Expiro-AJ [Inf]
TencentVirus.Win64.VirMoiva.a
Ad-AwareWin64.Expiro.Gen.7
TACHYONVirus/W64.Movia
EmsisoftWin64.Expiro.Gen.7 (B)
F-SecureMalware.W32/Infector.Gen
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.cead4dbc20651c47
SophosMal/Generic-S
SentinelOneStatic AI – Malicious PE
GDataWin64.Expiro.Gen.7
GoogleDetected
AviraW32/Infector.Gen
Antiy-AVLVirus/Win32.Expiro.x
ArcabitWin64.Expiro.Gen.7
ZoneAlarmVirus.Win64.Moiva.a
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
CynetMalicious (score: 100)
AhnLab-V3Virus/Win.Expiro.X2155
Acronissuspicious
MAXmalware (ai score=85)
IkarusVirus.Win64.Expiro
MaxSecureTrojan.Malware.121218.susgen
FortinetW64/Expiro.CU
AVGWin64:Expiro-AJ [Inf]
PandaW64/Moyv.A
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Win64/Expiro.DP?

Win64/Expiro.DP removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment