<< Back to Top Threats
K7 Detection Name Affected OS Prevalence AV Definition Version
Suspicious Program ( ID709803 ) Windows Low 12.87.48335
MD5

49076479b6baedb225097897277cff0f
SHA256

daf91f547532777888388631df1c4bc91d5048755db01af7a290c8ce3db17ae2
File Size

587,144 bytes
Packer Information

N/A
First Seen

21-05-2023
Last Seen

08-07-2026
Aliases

Win32/Kryptik.HTOI

Behavior Details

1. Creates Registry:
Adds data
C:\Users\\AppData\Local\Temp\49076479b6baedb22509.dat.exe
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\49076479b6baedb22509.dat.exe

Removal Instructions

1. Update K7 security to the latest version.
2. Open Windows registry editor and delete the following keys:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\49076479b6baedb22509.dat.exe
3. Restart the machine.