Should I remove “Win32/Kryptik.HQVI”?

The Win32/Kryptik.HQVI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Kryptik.HQVI virus can do?

Sample contains Overlay data
Authenticode signature is invalid

How to determine Win32/Kryptik.HQVI?


File Info:
name: DB6BCEADE61B9CB586DF.mlw
path: /opt/CAPEv2/storage/binaries/45a01f830ab131ef908ca80975bb850613de0568c0f071ea18ad56b8fde9cb46
crc32: BA96CE90
md5: db6bceade61b9cb586dfc83706227c7f
sha1: da6e790633fce284cddf2599ee23e3cc5d26d9d5
sha256: 45a01f830ab131ef908ca80975bb850613de0568c0f071ea18ad56b8fde9cb46
sha512: 92959b96b980ae2860359f594fd5b02f9da2bb2bd57c19b1d57a5d0898a6363f7a923b3a83df55ef0e07222bf6bd3dda31b3c56e84365f3d3f8811ce9bcd0898
ssdeep: 6144:DL0vVlTyuoM6T2nSPp3JXXD2NQ3BtbCeCI/Pn46W7LdThP3Nh:U95Vt6T2nSXXDr3BtbCeCavZE5VP3Nh
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A9A4AED936F4C7789CA5DA63F44488EF0E84D60B005F78F4ACA1812AD6477B7429ACB7
sha3_384: ab90a768f737f632d5a3f57cc23134663bf424bb2524ac1eab13268e855b8be7dc0285a1506495a5827af6ab81c5fe92
ep_bytes: 0fbe0d70e066000fb64424040fafc8c7
timestamp: 2022-09-19 23:15:30

Version Info:
0: [No Data]

Win32/Kryptik.HQVI also known as:

FireEye	Generic.mg.db6bceade61b9cb5
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/Kryptik.HQVI
Cynet	Malicious (score: 100)
SentinelOne	Static AI – Suspicious PE
Trapmine	suspicious.low.ml.score
Sophos	Generic ML PUA (PUA)
Microsoft	Trojan:Win32/Wacatac.B!ml
APEX	Malicious
Rising	Trojan.Generic@AI.93 (RDML:mYFg7NhfHlNZp2uj+ep8wg)
CrowdStrike	win/malicious_confidence_60% (D)

How to remove Win32/Kryptik.HQVI?

Win32/Kryptik.HQVI removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X