PUP.Keniu

The detection of PUP.Keniu on your computer indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your system's performance and security. PUPs are not necessarily malicious in the classical sense, but they can still cause problems by consuming resources, displaying unwanted advertisements, or collecting personal data without consent.

What Is PUP.Keniu?

PUP.Keniu is a designation given to a type of potentially unwanted program that has been identified as potentially harmful to computer users. The term "PUP" is broad, encompassing a wide range of software that may be installed on a computer without the user's full understanding or consent. These programs can range from benign applications that simply nag the user for payment or upgrades, to more harmful software that can compromise the user's privacy or security.

How PUP.Keniu Operates

PUPs like PUP.Keniu often operate by installing themselves on a computer through various means, such as bundled software downloads, infected websites, or deceptive pop-up ads. Once installed, they can begin to affect the computer's operation in several ways, including altering browser settings, displaying unwanted pop-up ads, or changing the user's default search engine or homepage. In some cases, PUPs may also attempt to collect personal data, such as browsing history or search queries, which can be used for targeted advertising or other malicious purposes.

Symptoms of Infection

Computers infected with PUP.Keniu may exhibit a range of symptoms, including decreased performance, increased pop-up ads or unwanted software installations, and changes to browser settings or system configuration. Users may also notice that their computer is running slower than normal, or that certain programs or applications are not functioning properly. In some cases, the presence of a PUP may not be immediately apparent, and users may only become aware of the problem when they notice strange or unusual behavior from their computer.

• Unwanted pop-up ads or installations
• Changes to browser settings or system configuration
• Decreased computer performance
• Unexplained changes to search results or browser behavior

How to Remove PUP.Keniu

1. Boot your computer in Safe Mode with Networking to prevent the PUP from interfering with removal efforts
2. Run a full scan of your computer using a reputable anti-malware tool, such as SpyHunter, to identify and remove all traces of the PUP
3. Uninstall any suspicious programs or applications that may have been installed by the PUP
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any changes made by the PUP
5. Reboot your computer and run another scan to ensure that all remnants of the PUP have been removed

Conclusion

The removal of PUP.Keniu from your computer is an important step in maintaining the security and integrity of your system. By following the steps outlined above and using reputable anti-malware tools, you can help ensure that your computer is free from the negative effects of this potentially unwanted program. Remember to always be cautious when installing new software, and to never click on suspicious links or pop-up ads, as these can often be the source of PUP infections. With the right tools and knowledge, you can protect your computer from the threats posed by PUP.Keniu and other similar programs.

Analysis Report

General information

Family Name:	PUP.Keniu
Signature status:	Self Signed

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 1d63d99594d3e475fb67b3a8e1f04932 SHA1: a0fccdb22636802f196e373f10515aa96f4a643c SHA256: 482C2FB8B2E0BA3170A1EFBD2374A9E8C79D3982D202A8C2875524FC06630A56 File Size: 7.36 MB, 7359904 bytes

MD5: 736d0f4a6692e3ec4fcfa9bb95660792 SHA1: 8bd29aa095920c43186110b48c1d26b351a0d4da SHA256: 9C5C379DDC656EC19EA5CD0D457711B3AAF4FEEA0B9856F537D87160D4E4D708 File Size: 1.81 MB, 1805384 bytes

MD5: 93b7c48822f75450c692a1c9f9565c58 SHA1: fcbd860424585ca974c00059596cd95646dfa0e6 SHA256: 480A3E3A110857AFEEFC55E07697A8B3A40D23CF5A0B803FE7FA1344867ABC78 File Size: 715.34 KB, 715336 bytes

MD5: 538d6360657aa77a2b6c9cb4eedb54ac SHA1: 4511b99e709386c21b810860fd19073c03a87fbd SHA256: BB56E8A15B17F4650DE3F72E44DA62A94BCC0A3E8FCF0EA1AC0A2C2C65617BC4 File Size: 821.32 KB, 821320 bytes

MD5: 6af0f3d5ba0463c22d5180ec1bc56981 SHA1: ce9ec96a6e2ec38e9458a8c0a66bb40730aa35df SHA256: 93C674BF11862C196C2DAF72612BCE33B93B0F4AC51323F6A93FFD4A46839B25 File Size: 265.58 KB, 265584 bytes

Show More

MD5: a8c35aae8a30a3a31e90bfa9e384333b SHA1: 159e39f174364f450b1127011485bf80f242e1e6 SHA256: 23CE549E906B023AB7D317DC92A0B95F04F7192B53A0C55B2504E4DBD710AC0E File Size: 715.24 KB, 715240 bytes

MD5: ac42d3d8988d4f84586ad2efd5ed5f27 SHA1: a4b0090a559d0ed5f470cea90dcd4d9a97085798 SHA256: 40F8791FA56A9A3F081006C0F75E03DE6538CDC8A6649DC307EE17C7898EA28F File Size: 1.10 MB, 1098216 bytes

MD5: 857f2e5094bc4d5fa7e77a4eadbed5c6 SHA1: 6372c50f06cf81cef5cbc636f38dd70637e71164 SHA256: A7E1B9479CD3F19B64638C7D3F85283A2190419CEA04F869946223675241FD10 File Size: 493.03 KB, 493032 bytes

MD5: 385fbe397263e0521f0bcf20b4694fb9 SHA1: 6db951b3b983d91db727d21f609fe74a7ea0459c SHA256: 80C485F4DF517262FCC71C221BDCB6715357BDD24E9A928EBB7B21E0FA36636A File Size: 96.33 KB, 96328 bytes

MD5: e1d561a12867e4c2a72bf7c8d4336b7c SHA1: 3462512dc3603afbee8f11743aa677c6ec2a128d SHA256: A1C6C84A8B38D3A602AE17C7421587D1448F9759897E6772B2CAA0565DE4B9F7 File Size: 2.08 MB, 2082592 bytes

MD5: 081b7632e8f67b1a3d0dd817c9566132 SHA1: 343c85ad14d4236fc58c4a033126da0a1e33b688 SHA256: EBB2BBD665B147A104E31C39060511F2EDA9DEBAB5D010C6D6BDB4DC36709928 File Size: 3.01 MB, 3011792 bytes

MD5: 73ce108fbc01139f333479d49a5b4067 SHA1: 41d472273d506393fda663c64334dd4ce4001275 SHA256: D3F9DC3797833AD66D39B412F57694437F546DCC6F94133701FEFF487715CCCF File Size: 80.16 KB, 80160 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is 64-bit executable
• File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
• File is either console or GUI application

Show More

• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	FFmpeg Project Zhuhai Motingzhi Technology Co., Ltd. 北京科德威曼科技有限公司
File Description	about drvabrcmd expsdk64模块 FFmpeg container format library Kszzdl wmenu64 wpsvc 安装程序 服务
File Version	2026,2,25,3649 2024,04,14,1 2024,02,19,1 2023,02,06,6 2022,2,10,1138 56.40.101
Internal Name	about dmsvc drvwmabrcmd expsdk64 install Kszzdl libavformat wmenu64 wpsvc
Legal Copyright	Copyright (C) 2000-2024 FFmpeg Project Copyright(C) 2020-2024 Zhuhai Motingzhi Technology Co., Ltd. Copyright(C) 2020-2025 Zhuhai Motingzhi Technology Co., Ltd. Copyright(C) 2023-2025 北京科德威曼科技有限公司
Original Filename	about.exe avformat-56.dll dmsvc.exe drvwmabrcmd.dll expsdk64.dll install.exe Kszzdl.dll wmenu64.dll wpsvc.exe
Product Name	DLL系统修复 FFmpeg Windows优化大师 Win实用工具 Win解压缩 系统修复 驱动专家
Product Version	6,1,1,212 5,0,0,3649 5,0,0,1 4,0,1,24 2.8.22 1,0,0,6

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
珠海市莫停之科技有限公司	Certum Extended Validation Code Signing 2021 CA	Self Signed
Hong Kong master science and technology Limited	Certum Trusted Network CA 2	Root Not Trusted
珠海市莫停之科技有限公司	Certum Trusted Network CA 2	Root Not Trusted
北京科德威曼科技有限公司	DigiCert Trusted Root G4	Root Not Trusted

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	313
Potentially Malicious Blocks:	1
Whitelisted Blocks:	206
Unknown Blocks:	106

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 ? ? 0 ? 0 ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? ? 0 ? ? ? 0 0 0 0 ? 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? 0 ? ? 0 ? ? 0 0 ? ? ? ? 0 ? 0 0 0 0 0 0 0 ? 0 ? ? 0 0 0 ? 0 ? 0 0 0 0 ? ? ? ? ? ? ? 0 0 0 0 ? 0 0 ? ? 0 0 0 0 0 0 0 0 x 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? ? 0 ? 0 0 ? ? ? ? ? ? ? ? 0 ? ? 0 0 0 0 0 ? 1 1 0 0 ? 0 0 ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? ? ? ? ? ? 1 ? ? ? ? ? ? ? ? ? ? 0 0 ? 0 0 ? 0 ? ? ? ? 0 ? 0 ? 0 ? ? 0 0 ? 0 ? ? ? 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 3 1 1 1 1

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\downloads\~925f022\data\fileinfo.dat	Generic Read,Generic Execute,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 786496
c:\users\user\downloads\~925f022\toolconfig.dat	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\wow6432node\winset::userid	�kYq��ﻹ �9�*D	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Network Winsock2	WSAStartup
Network Winsock	closesocket connect gethostbyname send setsockopt socket
User Data Access	GetComputerName
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtDuplicateToken ntdll.dll!NtFreeVirtualMemory Show More ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReadFile ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
Anti Debug	NtQuerySystemInformation
Service Control	OpenSCManager OpenService StartServiceCtrlDispatcher

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\8bd29aa095920c43186110b48c1d26b351a0d4da_0001805384.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ce9ec96a6e2ec38e9458a8c0a66bb40730aa35df_0000265584.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\6db951b3b983d91db727d21f609fe74a7ea0459c_0000096328.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\343c85ad14d4236fc58c4a033126da0a1e33b688_0003011792.,LiQMAxHB