PUP.UniDL
The detection of PUP.UniDL on your system indicates the presence of a potentially unwanted program (PUP) that may be compromising your computer's security and performance. It is essential to understand the nature of this threat and take immediate action to remove it to prevent further damage.
Table of Contents
What Is PUP.UniDL?
PUP.UniDL is a type of malware that is classified as a potentially unwanted program. This category of threats includes software that, while not necessarily malicious in the classical sense, can still cause significant problems for users. PUPs often exhibit behaviors such as displaying unwanted advertisements, collecting user data without consent, or altering system settings for the benefit of the software's creators rather than the user. The presence of PUP.UniDL suggests that your system has been compromised by such a program.
How PUP.UniDL Operates
PUPs like PUP.UniDL typically operate by exploiting vulnerabilities in software or by being installed alongside other programs without the user's full knowledge or consent. Once installed, they can start modifying system settings, displaying unwanted content, or even downloading additional malware. Their operation is often stealthy, aiming to remain undetected by the user for as long as possible to maximize their effectiveness.
Symptoms of Infection
Symptoms of a PUP.UniDL infection can vary but commonly include an increase in unwanted advertisements (pop-ups, banners, etc.), changes in browser settings (such as a new homepage or default search engine), slowdowns in system performance, and the presence of unknown or suspicious programs in the list of installed applications. Users may also notice that their browsing data is being collected or that their system is more prone to crashes.
How to Remove PUP.UniDL
- Boot your computer in Safe Mode with Networking to prevent PUP.UniDL from loading and interfering with the removal process.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all components of the PUP.
- Manually uninstall any suspicious programs that were installed around the time the PUP was detected. Be cautious and only remove programs you are certain are not necessary for your system's operation.
- Reset your web browsers (Chrome, Firefox, Edge, etc.) to their default settings to remove any changes made by the PUP, such as altered homepages or search engines.
- Reboot your computer and perform another full scan with your anti-malware tool to ensure that all components of PUP.UniDL have been removed.
Conclusion
Removing PUP.UniDL requires careful and thorough action to ensure that all components of the potentially unwanted program are eliminated from your system. By following the steps outlined above and maintaining vigilance in the future, you can protect your computer from similar threats and keep your personal data and system performance safe. Regularly updating your operating system, browsers, and security software, as well as being cautious when installing new programs, are key practices in preventing PUP infections.
Analysis Report
General information
| Family Name: | PUP.UniDL |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
585cd3eef3480c262fdbd2e632ade8db
SHA1:
8f9a20253c4c6a48668b3a6a909f258b372a0c36
File Size:
2.10 MB, 2103684 bytes
|
|
MD5:
c0d8659c1a9402c50e602c9e42e9d168
SHA1:
68a3f4ecfbfd4eb3500b3c6e05027e1fde76226a
SHA256:
9F1B2224948E26DD6AAE0603327EA788253EC02C207B4ED521280885D855C655
File Size:
2.21 MB, 2205599 bytes
|
|
MD5:
be58b71d2f29fbd282a5a7b4cc4373c3
SHA1:
1b4c22cb7cdba8b531fd62c76c0b2893e2146630
SHA256:
8248DB5E80A0B2EDDBAEDABF781196282DC90AC459ED3981C79F438BDCFFC055
File Size:
2.14 MB, 2137547 bytes
|
|
MD5:
5af890ee0a599edd9ca3f633edc699d3
SHA1:
2c3e738c2666d3828bd6b8160eca1f9f3e4e1e12
SHA256:
0264AE3CC90EC8FAA56A5153B7801F9E5F86E2EABDCC5568F64FB68633043888
File Size:
1.96 MB, 1957006 bytes
|
|
MD5:
0b460fc44273a535ec823f1f613e5c6c
SHA1:
1caba232f66d1ea0f39867952fdd713c239ec89c
SHA256:
D9EAA4EB78CE4567DBBCC31AD9C950377DA0112CC2FA40E8BC15FBA85A714763
File Size:
1.90 MB, 1896568 bytes
|
Show More
|
MD5:
c607a4e212f02ef70ca4b287a9d9da43
SHA1:
98d886bb5752ee52f42015ff20cbecf1b3bff98b
SHA256:
A4D137E7191F761640B7E2CF1DE23B557719F7B29E20B8F73D575B9CF45CD4A5
File Size:
6.06 MB, 6064812 bytes
|
|
MD5:
b10601dbdf62923031a9adac864bca5d
SHA1:
56cabd671ef85ee642df7368714da18551eb6e10
SHA256:
CD339F8FAA868A027846A2A57CAA79B282B69556FACEF64A2715831FAEF4928A
File Size:
2.41 MB, 2414423 bytes
|
|
MD5:
061c29e194653c8e0dcf5ac7fcf50f7a
SHA1:
96777095054b6b067c74e46320bfdd9db8cc1896
SHA256:
6410199F7C4DC4022501508E77AD9ED3AEC6E2423F03122ABCA6426489344ABC
File Size:
2.01 MB, 2010538 bytes
|
|
MD5:
f0471b3ec752fbbe2f442df775bc17ca
SHA1:
8a3f56fe159c9513b63d2358510a6612519123dd
SHA256:
7EA5DCFA15991822F08AD23FA68AF47B60EA86C78986340FB99EDEED4B3E283C
File Size:
1.86 MB, 1855020 bytes
|
|
MD5:
d7fde511fc4ff4359106020426d90653
SHA1:
64bd6b1bf237a6f18fe410fee0fec24ce0c2db34
SHA256:
672A0C7EDD66D11208FD23FD48FFEA87CF888966B4EFE7C1FC0467BD92663F6A
File Size:
2.33 MB, 2329853 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments | This installation was built with Inno Setup. |
| Company Name |
|
| File Description |
|
| File Version | 1.0.0.0 |
| Legal Copyright | Copyright |
| Product Name |
|
| Product Version |
|
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 2,300 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 2,300 |
| Unknown Blocks: | 0 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Farfli.BZ
- Gamehack.QAB
- Kryptik.BBL
- Remcos.AM
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\is-40v5e.tmp\8a3f56fe159c9513b63d2358510a6612519123dd_0001855020.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-69c6v.tmp\1b4c22cb7cdba8b531fd62c76c0b2893e2146630_0002137547.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-906s3.tmp\96777095054b6b067c74e46320bfdd9db8cc1896_0002010538.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-j1cu1.tmp\8f9a20253c4c6a48668b3a6a909f258b372a0c36_0002103684.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-nq069.tmp\2c3e738c2666d3828bd6b8160eca1f9f3e4e1e12_0001957006.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-qcpo1.tmp\98d886bb5752ee52f42015ff20cbecf1b3bff98b_0006064812.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-rg6a8.tmp\1caba232f66d1ea0f39867952fdd713c239ec89c_0001896568.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-ubull.tmp\64bd6b1bf237a6f18fe410fee0fec24ce0c2db34_0002329853.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-useam.tmp\56cabd671ef85ee642df7368714da18551eb6e10_0002414423.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-vvqd5.tmp\68a3f4ecfbfd4eb3500b3c6e05027e1fde76226a_0002205599.tmp | Generic Write,Read Attributes |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Process Shell Execute |
|
| User Data Access |
|
| Process Manipulation Evasion |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\Users\Kmptfqsk\AppData\Local\Temp\is-J1CU1.tmp\8f9a20253c4c6a48668b3a6a909f258b372a0c36_0002103684.tmp" /SL5="$20238,1047040,0,c:\users\user\downloads\8f9a20253c4c6a48668b3a6a909f258b372a0c36_0002103684.exe"
|
"C:\Users\Cpsnawua\AppData\Local\Temp\is-VVQD5.tmp\68a3f4ecfbfd4eb3500b3c6e05027e1fde76226a_0002205599.tmp" /SL5="$40224,876032,0,c:\users\user\downloads\68a3f4ecfbfd4eb3500b3c6e05027e1fde76226a_0002205599"
|
"C:\Users\Kulragln\AppData\Local\Temp\is-69C6V.tmp\1b4c22cb7cdba8b531fd62c76c0b2893e2146630_0002137547.tmp" /SL5="$70044,1046016,0,c:\users\user\downloads\1b4c22cb7cdba8b531fd62c76c0b2893e2146630_0002137547"
|
"C:\Users\Chegvwzr\AppData\Local\Temp\is-NQ069.tmp\2c3e738c2666d3828bd6b8160eca1f9f3e4e1e12_0001957006.tmp" /SL5="$90366,904704,0,c:\users\user\downloads\2c3e738c2666d3828bd6b8160eca1f9f3e4e1e12_0001957006"
|
"C:\Users\Nzybypjb\AppData\Local\Temp\is-QCPO1.tmp\98d886bb5752ee52f42015ff20cbecf1b3bff98b_0006064812.tmp" /SL5="$11052A,5302744,721408,c:\users\user\downloads\98d886bb5752ee52f42015ff20cbecf1b3bff98b_0006064812"
|
Show More
"C:\Users\Bdzbdnse\AppData\Local\Temp\is-USEAM.tmp\56cabd671ef85ee642df7368714da18551eb6e10_0002414423.tmp" /SL5="$60276,1046016,0,c:\users\user\downloads\56cabd671ef85ee642df7368714da18551eb6e10_0002414423"
|
"C:\Users\Dtrjjnfl\AppData\Local\Temp\is-906S3.tmp\96777095054b6b067c74e46320bfdd9db8cc1896_0002010538.tmp" /SL5="$5033E,945664,0,c:\users\user\downloads\96777095054b6b067c74e46320bfdd9db8cc1896_0002010538"
|
"C:\Users\Ukfazixt\AppData\Local\Temp\is-40V5E.tmp\8a3f56fe159c9513b63d2358510a6612519123dd_0001855020.tmp" /SL5="$5027C,864768,0,c:\users\user\downloads\8a3f56fe159c9513b63d2358510a6612519123dd_0001855020"
|
"C:\Users\Vqijhpci\AppData\Local\Temp\is-UBULL.tmp\64bd6b1bf237a6f18fe410fee0fec24ce0c2db34_0002329853.tmp" /SL5="$30366,1339392,0,c:\users\user\downloads\64bd6b1bf237a6f18fe410fee0fec24ce0c2db34_0002329853"
|
