Malware

Win64.Expiro.Gen.7 (B) (file analysis)

Malware Removal

The Win64.Expiro.Gen.7 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win64.Expiro.Gen.7 (B) virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Binary compilation timestomping detected

How to determine Win64.Expiro.Gen.7 (B)?



File Info:

name: 9CC5BD6C9CD67C629006.mlw
path: /opt/CAPEv2/storage/binaries/d5a02e641937fe4be7e4b66b2d7580b21c2140a4c3ebaa279f2cf9d970aa3b0b
crc32: D48BB701
md5: 9cc5bd6c9cd67c629006d8f83a6dc336
sha1: 4d46f44791f640d8f73c9b8b3b8e5f2998592a85
sha256: d5a02e641937fe4be7e4b66b2d7580b21c2140a4c3ebaa279f2cf9d970aa3b0b
sha512: 753da1f79948ea66288dc92aa7f4ca3853a1217dc2d10dfad429aaffa552d7e2fb1d50c6e44e7515a243c521137db2b7d024db3b79c8751b527645873d9c2885
ssdeep: 24576:xfVpK1x1CsqjnhMgeiCl7G0nehbGZpbD:Rqz4Dmg27RnWGj
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T18975D09EA2A814E4D026933884879146E6B17C510B2196CBDF72B37DEF3FAF49D3C215
sha3_384: 76da6ed29f9d92d637654bb6a55332d3f53145788ba76699c5594eefe59bf9da30a997b9655ae5fb62b26b92d094720a
ep_bytes: 4883ec28e8330600004883c428e96efe
timestamp: 2024-09-19 09:18:39


Version Info:

CompanyName: Microsoft Corporation
FileDescription: Reusable UX Interaction Manager
FileVersion: 10.0.19041.1019 (WinBuild.160101.0800)
InternalName: Reusable UX Interaction Manager
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: RUXIMIH.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.19041.1019
Translation: 0x0409 0x04b0

Win64.Expiro.Gen.7 (B) also known as:

DrWebWin32.Expiro.153
MicroWorld-eScanWin64.Expiro.Gen.7
FireEyeGeneric.mg.9cc5bd6c9cd67c62
CAT-QuickHealW64.Expiro.H5
SangforSuspicious.Win32.Save.a
K7AntiVirusVirus ( 00592e701 )
K7GWVirus ( 00592e701 )
CyrenW64/Expiro.AR.gen!Eldorado
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win64/Expiro.CV
KasperskyVirus.Win64.Moiva.a
BitDefenderWin64.Expiro.Gen.7
AvastWin64:Expiro-AJ [Inf]
TencentVirus.Win64.VirMoiva.a
Ad-AwareWin64.Expiro.Gen.7
VIPREWin64.Expiro.Gen.7
EmsisoftWin64.Expiro.Gen.7 (B)
IkarusVirus.Win64.Expiro
GDataWin64.Expiro.Gen.7
GoogleDetected
MAXmalware (ai score=89)
Antiy-AVLTrojan/Generic.ASVirus.316
ArcabitWin64.Expiro.Gen.7
MicrosoftTrojan:Win32/Sabsik.EN.B!ml
CynetMalicious (score: 100)
AhnLab-V3Virus/Win.Expiro.X2156
ALYacWin64.Expiro.Gen.7
TACHYONVirus/W64.Movia
RisingVirus.Expiro!1.A140 (CLASSIC)
MaxSecureTrojan.Malware.121218.susgen
FortinetW64/Expiro.CU
AVGWin64:Expiro-AJ [Inf]
PandaW64/Moyv.A

How to remove Win64.Expiro.Gen.7 (B)?

Win64.Expiro.Gen.7 (B) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment