PUP.Torr.C

Published:

Threat Scorecard

Popularity Rank: 21,507
Threat Level: 10 % (Normal)
Infected Computers: 363
First Seen: September 3, 2021
Last Seen: October 20, 2026
OS(es) Affected: Windows

PUP.Torr.C is a Potentially Unwanted Program (PUP) that targets Windows computers. While it is not considered highly dangerous, with a low severity rating, it is still classified as unwanted software because of the intrusive and undesirable behaviors it can introduce to an infected system. Users who find this detection on their computer should understand what it does and how to remove it, even though it is not typically a severe security threat.

What PUP.Torr.C Does

Like other programs in the Potentially Unwanted Program category, PUP.Torr.C is designed to run on a victim's machine and perform actions that the user did not clearly request or fully understand when installing it. Programs of this type commonly alter browser settings, install additional toolbars, inject advertising into web pages, or redirect search queries to unfamiliar websites. The sample associated with this detection is a packed 32-bit Windows executable, a technique often used to make a program's inner workings harder to analyze and to help it slip past some security tools. It also contains code capable of checking whether a debugging tool is actively monitoring it, a trait frequently seen in software that prefers to operate without close scrutiny. In addition, it uses system functions related to network communication and to adjusting its own permission levels on the infected device, along with functionality that can access information about the user's desktop session.

How It Usually Gets Onto Computers

PUPs such as Torr.C typically spread through software bundling, where they are packaged alongside free programs, cracked software, or media downloaded from unofficial and torrent-related sources. Users often install these unwanted components unknowingly by rushing through installation wizards and accepting default or "quick install" options without reviewing every screen. Downloading free applications from unreliable file-sharing portals, torrent sites, or peer-to-peer networks is a common vector, as is clicking on misleading advertisements or pop-ups that offer free downloads.

Risks for the User

Although rated as low danger, PUP.Torr.C can still negatively affect a user's experience. Common risks tied to this category of program include a degraded browsing experience due to excessive or intrusive ads, unwanted changes to browser homepages or search engines, slower system performance, and exposure to additional, potentially more harmful software that may be installed through the same bundling methods. Programs that attempt to detect debugging tools or that quietly request elevated privileges can also indicate an interest in avoiding detection or performing more invasive actions than a typical legitimate application.

Signs of Infection

Users may notice unfamiliar toolbars or browser extensions that they did not install, a change in their default homepage or search provider, an increase in pop-up ads or redirected web searches, and a general slowdown in system or browser performance. The presence of an unrecognized executable running in the background, especially one without a digital signature or version information, can also be a warning sign.

How to Stay Protected

To avoid PUPs like Torr.C, users should download software only from official vendor websites or trusted app stores, and avoid torrent sites, cracked software, and other unofficial sources. During installation, it is important to choose the "custom" or "advanced" setup option rather than the default, so that any bundled extras can be reviewed and declined. Keeping security software up to date and performing regular system scans can help catch unwanted programs before they cause lasting issues. Reviewing installed programs and browser extensions periodically, and removing anything unfamiliar, is also a good habit for keeping a Windows system clean and running smoothly.

Analysis Report

General information

Family Name: PUP.Torr.C
Packers: UPX!
Signature status: No Signature

Known Samples

MD5: 22679b63f939795e0346e8c7814edf2a
SHA1: a270c56fc5736b0a43508156b18ecd26afe3da72
SHA256: 7C2B09516572F7B23D2038FA102CF81CEB3016DD89E0DB2C65C397A1934F8C30
File Size: 5.46 MB, 5462528 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File has been packed
  • File has TLS information
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show 3 more
  • File is Native application (NOT .NET application)
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • No Version Info
  • packed
  • x86

Block Information

Total Blocks: 10,465
Potentially Malicious Blocks: 1,153
Whitelisted Blocks: 9,312
Unknown Blocks: 0

Visual Map

... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Agent.LAA

Windows API Usage

Category API
Network Winsock2
  • WSAStartup
Other Suspicious
  • AdjustTokenPrivileges
Anti Debug
  • IsDebuggerPresent
User Data Access
  • GetUserObjectInformation