Win32/Kryptik.HEDZ removal instruction

The Win32/Kryptik.HEDZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HEDZ virus can do?

Executable code extraction
Creates RWX memory
Drops a binary and executes it
Performs some HTTP requests
Unconventionial language used in binary resources: Latvian
The binary likely contains encrypted or compressed data.
Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
Installs itself for autorun at Windows startup
Creates a copy of itself
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/Kryptik.HEDZ?


File Info:
crc32: A0A6F026
md5: 7e61b3ce6388b6c022bc08b1f157add1
name: tmp9fhog9_5
sha1: eb158894a12c66f64cdec72c40bd9acb2bb7c176
sha256: 6fb4a4a85483d95777b46f352778315d09f617a449a03d90cd9246d2827e6ac6
sha512: 65134f20ebd49bd7cddb85354432ba8538aa55212b1d40991036d7c4e8ff596bff6f4fbedbd13c1003e785a1367f442282b49324782d717419a808fa81ac75a0
ssdeep: 12288:dZ8fMO9ET3DnPtmnOyEZFG1ZnF4SeHqRD/TE1:gfMOkZjfFGnksD41
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
InternalName: osf3xswgesv.ixi
FileVersionOld: 1.2.0.1
ProductVersion: 1.0.4.1
Copyrighd: Copyrighd (C) 2020, odfgbiv
Translation: 0x0842 0x04c4

Win32/Kryptik.HEDZ also known as:

Bkav	HW32.Packed.
MicroWorld-eScan	Trojan.GenericKD.34038894
FireEye	Generic.mg.7e61b3ce6388b6c0
McAfee	Packed-GBO!7E61B3CE6388
Cylance	Unsafe
Sangfor	Malware
BitDefender	Trojan.GenericKD.34038894
K7GW	Hacktool ( 700007861 )
CrowdStrike	win/malicious_confidence_100% (D)
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
GData	Trojan.GenericKD.34038894
Kaspersky	Trojan-Dropper.Win32.Scrop.acvp
Rising	Malware.Heuristic!ET#95% (RDMK:cmRtazpctQZHKO+/VhiTZaDCvHi+)
Endgame	malicious (high confidence)
Emsisoft	Trojan.GenericKD.34038894 (B)
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Gupboot.hc
Sophos	Mal/GandCrab-G
SentinelOne	DFI – Malicious PE
Arcabit	Trojan.Generic.D207646E
ZoneAlarm	Trojan-Dropper.Win32.Scrop.acvp
Microsoft	Trojan:Win32/Wacatac.D!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Danabot.C4131083
Acronis	suspicious
VBA32	BScope.Trojan.AET.281105
MAX	malware (ai score=83)
Ad-Aware	Trojan.GenericKD.34038894
Malwarebytes	Trojan.MalPack.GS
ESET-NOD32	a variant of Win32/Kryptik.HEDZ
Fortinet	W32/Kryptik.HEDU!tr
BitDefenderTheta	Gen:NN.ZexaF.34128.JC0@aCQa8Znc
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.4a12c6
Qihoo-360	HEUR/QVM10.1.FCB8.Malware.Gen

How to remove Win32/Kryptik.HEDZ?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Kryptik.HEDZ removal instruction