Win32/GenKryptik.EAXA (file analysis)

The Win32/GenKryptik.EAXA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/GenKryptik.EAXA virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Win32/GenKryptik.EAXA?


File Info:
crc32: ADE132D8
md5: 010fd95e50b9670f1e6dd3d5ce1e943e
name: nsdgfxcv.exe
sha1: 7c7873fad4e0e165cbb73500b2f92dca546dcd28
sha256: 114257e3e90db7c21fcee083ad500e98973ba203c0b1c42e630c397e93d3bfd9
sha512: 4f154878fd5a5186a45ebed47f65c615b8df4d6ab80b75ac8b787714e1bb214598a76751189276d1070e0e193e0782a2cee8ed348e1945273035c6927b9630e1
ssdeep: 3072:VTL4HqCpi06NoIgXoPlvAyhmenKn8tNrZ+/wouqJtQzUKKKrXn7U2V5fflZzC:VTLz06OfelvnhmenKY+/KsmxKKrw2V5u
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) bewails 2019
InternalName: Richeyville.exe
FileVersion: 7.8.5.7
CompanyName: blandest
ProductName: unanchors
ProductVersion: 3.0.2.7
FileDescription: beneplacit
OriginalFilename: Cnossus.exe
Translation: 0x0409 0x04b0

Win32/GenKryptik.EAXA also known as:

FireEye	Generic.mg.010fd95e50b9670f
McAfee	Artemis!010FD95E50B9
Sangfor	Malware
CrowdStrike	win/malicious_confidence_90% (W)
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZexaF.33558.lu3@aajHAsgi
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	Backdoor.Win32.NetWiredRC.jxa
Rising	Trojan.Generic@ML.80 (RDML:f11xc52nLlso88jzoZKbIw)
McAfee-GW-Edition	Artemis
Endgame	malicious (high confidence)
ZoneAlarm	Backdoor.Win32.NetWiredRC.jxa
Microsoft	Trojan:Win32/Wacatac.B!ml
VBA32	BScope.Trojan.Nanocore
Cylance	Unsafe
ESET-NOD32	a variant of Win32/GenKryptik.EAXA
SentinelOne	DFI – Suspicious PE
eGambit	Unsafe.AI_Score_97%
Fortinet	W32/GenKryptik.EASK!tr
Webroot	Pua.Adware.Convertad
Cybereason	malicious.ad4e0e
Paloalto	generic.ml
Qihoo-360	HEUR/QVM10.1.249D.Malware.Gen

How to remove Win32/GenKryptik.EAXA?

Win32/GenKryptik.EAXA removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X