GridinSoft Threat Intelligence

Susp detection reports

Suspicious files with signals that require additional review before trust.

Detection category

Susp threat reports

Suspicious files with signals that require additional review before trust. ThreatInfo groups these records so analysts and users can review related filenames, hashes, and GridinSoft detection names from one place.

This category page groups related ThreatInfo records so users can compare file names, hashes, publishers, and GridinSoft detection names in one place.

Indexed reports 233

Latest shown 60

Detected 59

Observed detection families

Common Susp verdicts

These are the most frequent GridinSoft detection names in the latest reports shown below. Repeated families help users recognize whether a file belongs to a broader campaign or bundled software cluster.

SUSP.XORed_MSDOS 32 reports

General Threat 4 reports

SuspCPUMiner 4 reports

Trojan.Heur! 4 reports

SUSP.Encoded_EXE 2 reports

SUSP.XORed_Mozilla 2 reports

SUSP_Base64_Encoded_Hex_Encoded_Code.bot!yf 2 reports

Adware.Downloader 1 reports

Analyst focus

What to check first

Use this page as a starting point: open the exact file report, compare the MD5 hash, and run a local scan before deciding whether the file is safe.

A known filename appearing with an unexpected hash or location.
Publisher, product, or certificate data that does not match the file origin.
Repeated detections from the same family across recent reports.

Frequent metadata

Publishers and products

Publishers Oleg N. Scherbakov 4 Sergei Strelec 4 TimON 3 Valve Corporation 3 Company 'gora-sah' 2 EA Digital Illusions CE AB 2

Products 7-Zip SFX 8 Button TC #3.2.5 3 Battlefield 4™ 2 NOSSO(R) 2 Steam Client Service Library 2 WCF RIA Services 2

GridinSoft Anti-Malware

Scan for Susp detections

If a file from this category appears on your computer, verify the exact report and run a full system scan. GridinSoft Anti-Malware is used to detect and remove threats listed in ThreatInfo reports.

Download scanner

01 Match the hash

Use the MD5 value from the report. A filename alone is not enough because unrelated files can share the same name.

02 Review origin

Check the publisher, product name, certificate, and file path for mismatches or unfamiliar install locations.

03 Scan and remove

If the file is unexpected, scan the device and remove related startup entries, bundled components, and leftover files.

Recent reports

Latest Susp file records

nosso_air.exe 1abd134f4a6b288effdaa84e72ea1da7 SUSP.XORed_MSDOS Adobe AIR Installer.exe cf45786aa4bc968fe69d4de45e5bbcc2 SUSP.XORed_MSDOS uh.dll dee522e807bdfd9b79db03ff6e90116a SUSP.XORed_Mozilla uh.dll 4b655699bc7faee25ec18a810491d3c5 SUSP.XORed_Mozilla eUptqYbL.exe f05bb1be9a70c14c833e50aef9daff80 SUSP.XORed_MSDOS paq8o.exe 4345c08592f9f31b4bfec9da32dacbbb SUSP.XORed_MSDOS file2[1].exe de1d218b720234db46044c3ad4e41643 SUSP.Double_Encoded Power4GearHybrid.exe c7afd52d0fe79e842b4fa8bb5fa5b856 SUSP.XORed_MSDOS WirelessConsole.exe 4dd24b46294d3a75d374fb770a11fba8 SUSP.XORed_MSDOS List of the HWIDs.exe c3f488701356cb8c0f3673615699480c SUSP.XORed_MSDOS vorbisHooked.dll da807a1bcf63d28d39e4905ae59b8b7e SUSP.XORed_MSDOS AIMP3.exe 9920503097b1801fefa3afae655d3769 SUSP.XORed_MSDOS DriverSweeper 3.2.exe 6769621ac638e3cbf010459037a491e1 SUSP.XORed_MSDOS ATK Generic.exe ff45a45cfc3851ea00fbcd2286ad6331 SUSP.XORed_MSDOS 7-Zip.exe 7e0121055064d159a1ba20ed89495783 SUSP.XORed_MSDOS sdkencryptedappticket.dll 51db3d70af0cbf06389c84f31011823b SUSP.XORed_MSDOS ccav_installer.exe bdc178f5c6cd569a8f6ee60b72d9ed87 SUSP.XORed_MSDOS TrdngAnlzr2249.exe 170c7f0a34cf011b4ed6e2bd94dee728 SUSP.Encoded_EXE TrdngAnlzr98262[1].exe 10e41c37d5031a2694fc5150d5ef1808 SUSP.Encoded_EXE SteamService.dll c6cdb4b4fad96aa7ae076119fa1f9b57 SUSP.XORed_MSDOS crashhandler.dll c60918485b40e77888edd5490d086055 SUSP.XORed_MSDOS SentinelKeyW.dll b5713ba60e3a0f4e5c56f47e21be4e1a SUSP.XORed_MSDOS SteamService.dll cb27625b3a8ff0c171f645761cad7d47 SUSP.XORed_MSDOS DiskDefragPro.exe ddca05416a23c4bed1694724306c13c4 SUSP.XORed_MSDOS hdclone507.exe 184b9011d51c7b75a7ebb768056b29c5 SUSP.XORed_MSDOS IsoBuster_All.exe 324382676bfdf9b5a0d0e14d369f17e2 SUSP.XORed_MSDOS DoubleDriver_All.exe facf5706d9ac9a64ed5ce133b4b9fe9f SUSP.XORed_MSDOS PBM_X64.exe 7a5b9cac34037c0692b66baf5ca57c90 SUSP.XORed_MSDOS WinUtilities.exe b336bc8d295ff82d9d916778ce3ac624 SUSP.XORed_MSDOS Auslogics.exe 2c76061baf916db934ba962957f85161 SUSP.XORed_MSDOS RAMExpert.exe a25c3e8ec548102ea7783a4b4f171b17 SUSP.XORed_MSDOS 7z SFX Builder.exe f2646c6f67756a119b2176fcd625c647 SUSP.XORed_MSDOS TotalComander.exe 49af6e869eec3d4d5213f8e33d0314d0 SUSP.XORed_MSDOS 7zSFX_Constructor.exe b439b3789c7926d59a7f4eee2906bb48 SUSP.XORed_MSDOS 7zSFX.exe 3a6b556cb34e330ca36d3229722a0c13 SUSP.XORed_MSDOS OOUserManager_x64_Eng.exe 8d5b884783a720eaadee1ccae2b6ad11 SUSP.XORed_MSDOS WinDirStat.exe 1800e423bb409d03772ba5268b7b3a6b SUSP.XORed_MSDOS solo_pks.pyd 48f01f2ff31efd17e7c528fdc5ce8714 SUSP_Base64_Encoded_Hex_Encoded_Code.bot!yf mps2.exe bf5642d5e7ad4ace5983cbb1a5397cd8 SUSP_Base64_Encoded_Hex_Encoded_Code.bot!yf ffmpeg.exe 39d11c773b46d3084ef4aac1f9863146 Under review iw3sp.exe 03964744f047ba2fc71f23faa898da82 SuspCPUMiner 013173.EXE f8f99e9f8ddc31ce42078693b632147c General Threat bf4.exe ded83cb9bb9334f1442a0099096632c9 Ransom.Occamy tomy.exe 01e1b37ce90d4d7cfda53bb868bac1bb Trojan.Gen gSpark.exe c66a9e8da5d457c616588afa7f51fe34 General Threat Watch_Dogs_3dm.exe b67207651afe16783cefe77e2dadf5eb PUP.Presenoker pZLib.exe 4ec5a227ba436999669b7954ae038771 General Threat svchost.exe 92cc8268e782ec7f35eb127b99e8e095 SuspCPUMiner winedevice.exe aecb7818d3bca12ed4018f9d9e1e9d99 SuspCPUMiner EnemyFront.exe c0da3cc35fa8cda41355e0a5c426925a Trojan.Heur! left4dead.exe 57fe398df9dcbeef74d3fa8b764014e7 Ransom.Wacatac fm.exe 8586a2b0e7657961ace25cf867726e31 Trojan.Heur! CoJGunslinger.exe 694c58ded30165d6ddff7dfce2098a4a Trojan.Heur! Blur.exe e8efc0a9ed92eaaf7b3c82dcd1b1b72f General Threat ZAM.exe a074e51ce0c1538134a6c08265c63697 Adware.Downloader bf4.exe bf93139eede039de6d2110fa0f290300 Trojan.Heur! gsam.exe 2a368cf672b278c7c0facf4827485d4f Worm.Gamarue Tumblebugs.exe 1f1e0176facbf6f3a4b60c1c81eca43b Trojan.Packed GeometryDash.exe 46ec62179269cb42610e1765e42bee56 SuspCPUMiner xmr-stak-cpu.exe 1c1de53f365de8f9eddae3afeb14445d Risk.CoinMiner

Questions

Susp FAQ

How should I use this category page?

Use it to find recent reports in the same detection family, then open the exact file report and compare the hash, publisher, path, and detection name.

Why can the same filename have different verdicts?

Attackers and bundlers often reuse common filenames, so the MD5 hash and metadata are more reliable than the name alone.

What should I do if a listed file exists on my device?

Do not rely on the filename only. Verify the hash, review the file location, and run a full system scan before keeping or removing it.