What is “Win32/Kryptik.HVSI”?

The Win32/Kryptik.HVSI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HVSI virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Rhaeto (Romance)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Kryptik.HVSI?

File Info:
name: 5D91F2BE55C4C7419256.mlw
path: /opt/CAPEv2/storage/binaries/136dad7a2c234bf9e3817601445f8c6fa2285dac85b4b0253ed270630a5b1ca7
crc32: 6528742F
md5: 5d91f2be55c4c7419256b6b853a5dcc6
sha1: 511d7157d4784549f260e660d7f1929c757f6468
sha256: 136dad7a2c234bf9e3817601445f8c6fa2285dac85b4b0253ed270630a5b1ca7
sha512: e78e27cd4444715de5ecbc37f8ec602cb6419b4a36990e2c5402d647f1a15752bcf3b81969fc11e394a94d2cfcd108d29050bcb70473fb4fd71d0c05f2af2be0
ssdeep: 98304:1N9ZGhN1DLdS6YBdMBYsHWwwS85X4V+KWUti1mAyb3xZCvd:18hf06YBd4Ys2Kstib6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E536BFA2B605F6CFD44E2778946BCE4A585D8BB842314807BC5CB8BEFDB3C831685D58
sha3_384: a933755d61e119b4f8d9bf52c5137fb08fe97125eb8da64f69e567b0a7626b54de650640d6abadaaf6efaac66f93bcd1
ep_bytes: 558bec6aff68502565006814c3640064
timestamp: 2019-02-16 08:00:02

Version Info:
FileDescription: EF Process Manager
FileVersion: 24.02
InternalName: EF Process Manager
OriginalFilename: EFPrcMan.exe
ProductName: EF Process Manager
ProductVersion: 24.02
Translation: 0x0000 0x04b0

Win32/Kryptik.HVSI also known as:

How to remove Win32/Kryptik.HVSI?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.