MSIL/Kryptik.YVR information

The MSIL/Kryptik.YVR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Kryptik.YVR virus can do?

The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs

How to determine MSIL/Kryptik.YVR?


File Info:
crc32: 93CFD514
md5: a0d7228a9d2fc2a0f716b7e1081ae460
name: A0D7228A9D2FC2A0F716B7E1081AE460.mlw
sha1: d20ed62b1f3c04a32d3017cb09246cd4d5d41fad
sha256: 4d39f9d0104d9bfb6f021989b520d875b77b9be03e70580edb6d9a897dcc9007
sha512: 3d198736f8c4b71dcf34e019934086a30aa8a27a29081ac0a6ebd1368993a89812f9ba490d43dfc6460a08f81ba528cf2261c01d1b6141bf10a66439f7eeb002
ssdeep: 24576:fW8I/PCncZ8iO461vHVD5sv8JST0sDd3z07:fW8IQP461vHSLT0Ad3z
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2015
Assembly Version: 2.0.1.5
InternalName: EncodingByteBuffer.exe
FileVersion: 0.3.0.6
CompanyName: x5c0fx773cx79d1x6280[QQ:2543280836]
LegalTrademarks: XiaoYan_Software
Comments: x5c0fx773cx79d1x6280xff1ax8be5x7248x672cx76eex524dx8fd8x662fx6d4bx8bd5x7248xff0cx53eax5305x542bx57fax7840x529fx80fdxff0cx540ex7eedx8fd8x4f1ax6709x66f4x65b0x3002
ProductName: x5c0fx773cx4e66x5c4b-x56fex4e66x7ba1x7406x7cfbx7edf
ProductVersion: 0.3.0.6
FileDescription: x5c0fx773cx79d1x6280xff1ax6d4bx8bd5x7248xff0cx540ex7eedx8fd8x4f1ax6709x66f4x65b0x3002
OriginalFilename: EncodingByteBuffer.exe

MSIL/Kryptik.YVR also known as:

Elastic	malicious (high confidence)
Cylance	Unsafe
Cybereason	malicious.b1f3c0
BitDefenderTheta	Gen:NN.ZemsilF.34658.4m0@a0UtmRk
Cyren	W32/MSIL_Kryptik.AIQ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
Sophos	ML/PE-A
Ikarus	Win32.Outbreak
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Cynet	Malicious (score: 100)
ESET-NOD32	a variant of MSIL/Kryptik.YVR
SentinelOne	Static AI – Malicious PE
AVG	FileRepMetagen [Malware]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (D)

How to remove MSIL/Kryptik.YVR?

MSIL/Kryptik.YVR removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X