Should I remove “MSIL/Filecoder.AHF”?

The MSIL/Filecoder.AHF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Filecoder.AHF virus can do?

How to determine MSIL/Filecoder.AHF?


File Info:
crc32: 7F3B67C9
md5: 2f6931a3b73d5bedbcb5517b922c0920
name: 2F6931A3B73D5BEDBCB5517B922C0920.mlw
sha1: 98657f3f851afe3de738e89acb14ef7cd486b22d
sha256: f1baec9778cc4100c537c17e4038dcb2085e7a91ec02ccd7fd099ee103b5da4e
sha512: 15f2fa018cad484c2e9432a99e9e5daedbec6ac24d662c241f13678bed2e53d3a8cfef069cb7375c2d5e09839050b180b4ed972d072e9017022b47c7d25b16d1
ssdeep: 768:JY9CCJFb7WHsnAfdnEJ58s4mS9yH3kigAYGptAEHIr+DK2YcKV1OfYcKV1:JTC/b7WqSY8uSJigAdAn+2vV1O+V1
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2021
Assembly Version: 1.0.0.0
InternalName: Legion.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: Legion
ProductVersion: 1.0.0.0
FileDescription: Legion
OriginalFilename: Legion.exe

MSIL/Filecoder.AHF also known as:

K7AntiVirus	Trojan ( 0057a1601 )
DrWeb	Trojan.Siggen13.538
Cynet	Malicious (score: 100)
ALYac	Gen:Heur.MSIL.Krypt.44
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_60% (W)
Alibaba	Trojan:MSIL/Filecoder.667ccb15
K7GW	Trojan ( 0057a1601 )
Cybereason	malicious.3b73d5
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Filecoder.AHF
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan.MSIL.DiskWriter.gen
BitDefender	Gen:Heur.MSIL.Krypt.44
MicroWorld-eScan	Gen:Heur.MSIL.Krypt.44
Ad-Aware	Gen:Heur.MSIL.Krypt.44
Sophos	Mal/Generic-S
BitDefenderTheta	Gen:NN.ZemsilF.34670.cm0@a45JjX
McAfee-GW-Edition	RDN/Generic.dx
FireEye	Generic.mg.2f6931a3b73d5bed
Emsisoft	Gen:Heur.MSIL.Krypt.44 (B)
SentinelOne	Static AI – Malicious PE
Avira	TR/Ransom.upcxn
eGambit	Unsafe.AI_Score_99%
Microsoft	Ransom:MSIL/CryptoLocker.DG!MTB
GData	Gen:Heur.MSIL.Krypt.44
AhnLab-V3	Malware/Win.Generic.C4403531
McAfee	Artemis!2F6931A3B73D
MAX	malware (ai score=89)
Malwarebytes	Malware.AI.3344917095
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R002H09D221
Rising	Trojan.Filecoder!8.68 (CLOUD)
Ikarus	Trojan.Crypt
MaxSecure	Trojan.Malware.73704538.susgen
Fortinet	W32/DiskWriter.AHF!tr.ransom
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Win32/Ransom.DiskWriter.HgIASR8A

How to remove MSIL/Filecoder.AHF?

MSIL/Filecoder.AHF removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X