PUP.Maombi.Store Download Manager

The detection of PUP.Maombi.Store Download Manager on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take immediate action to remove it to prevent any potential harm.

What Is PUP.Maombi.Store Download Manager?

PUP.Maombi.Store Download Manager is a type of potentially unwanted program that is designed to manage downloads on your computer. However, its presence can lead to various issues, including unwanted software installations, pop-up ads, and compromised system security. PUPs like this one often sneak onto systems through bundled software downloads or by exploiting vulnerabilities in the system or browser.

How PUP.Maombi.Store Download Manager Operates

PUP.Maombi.Store Download Manager operates by installing itself on your system, often without your knowledge or consent. Once installed, it can start managing your downloads, potentially replacing your default download manager. This can lead to a range of issues, including the installation of additional unwanted software, redirection to malicious websites, and the collection of your personal data. The program may also display pop-up ads, slow down your system, and compromise your online security.

Symptoms of Infection

The symptoms of a PUP.Maombi.Store Download Manager infection can vary, but common signs include unwanted pop-up ads, slow system performance, and unfamiliar programs installed on your computer. You may also notice that your browser settings have been changed, or that you are being redirected to suspicious websites. Additionally, you may experience issues with your system's stability, such as crashes or freezes.

• Unwanted pop-up ads and notifications
• Slow system performance and responsiveness
• Unfamiliar programs installed on your computer
• Changed browser settings and redirection to suspicious websites
• System crashes and freezes

How to Remove PUP.Maombi.Store Download Manager

1. Boot your computer in Safe Mode with Networking to prevent the PUP from loading and to allow for a clean removal process.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all components of the PUP.
3. Uninstall any suspicious programs that were installed without your knowledge or consent, as they may be related to the PUP.
4. Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any changes made by the PUP.
5. Reboot your computer and perform another full scan to ensure that all components of the PUP have been removed.

Conclusion

Removing PUP.Maombi.Store Download Manager from your system is crucial to preventing any potential harm and restoring your computer's performance and security. By following the steps outlined above, you can effectively remove this PUP and prevent any further issues. It's also essential to practice good cybersecurity habits, such as regularly updating your software, using strong antivirus protection, and being cautious when downloading software from the internet. By taking these precautions, you can help protect your system from similar threats in the future.

SpyHunter Detects & Remove PUP.Maombi.Store Download Manager

Analysis Report

General information

Family Name:	PUP.Maombi.Store Download Manager
Signature status:	Self Signed

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 328c4e4240ee68d08339a50e7349664d SHA1: 97af4baf91db75bff82f4bd759ba61045a433444 SHA256: 049A796F385ADCF51B042A316497588232290C5BCC24299087541AE2AC0A3CB0 File Size: 3.70 MB, 3698536 bytes

MD5: 5721d758ee6e8aeb07ca37a51199e885 SHA1: c037cb70a71d2b72d0195fff3669ac4a48f383b6 SHA256: 9CE819DF3CCDBE65EE622C6CE5FCBA2EF06590A1B8AB22E65848117EAA269C25 File Size: 8.77 MB, 8774000 bytes

MD5: 4b3fa1c725865b59bf4ebdb7159413b5 SHA1: 01694ccfbd2a4ae0d94379d4b7418e3a7b34d71a SHA256: 20ABD3690D60A76BB3CD0E618BC7A71BC1F6D23AEE40140D8E299A5CC56617B7 File Size: 7.82 MB, 7820776 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have relocations information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	This installation was built with Inno Setup.
File Description	Terraria Setup Веселая ферма 3 Setup ГТА Сан Андреас Setup
Product Name	Terraria Веселая ферма 3 ГТА Сан Андреас
Product Version	0.0.0.1

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
LLC Maombi Ru	GlobalSign GCC R45 EV CodeSigning CA 2020	Self Signed

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\1aba9905-b951-a2dd-8b02-45944ae87aa9\install	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\1aba9905-b951-a2dd-8b02-45944ae87aa9\install\0	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\1aba9905-b951-a2dd-8b02-45944ae87aa9\install\0\offer0.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\1aba9905-b951-a2dd-8b02-45944ae87aa9\install\1	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\1aba9905-b951-a2dd-8b02-45944ae87aa9\install\1\1.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\1aba9905-b951-a2dd-8b02-45944ae87aa9\install\7	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\1aba9905-b951-a2dd-8b02-45944ae87aa9\install\7\7.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\1aba9905-b951-a2dd-8b02-45944ae87aa9\install\8	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\1aba9905-b951-a2dd-8b02-45944ae87aa9\install\8\8.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\1aba9905-b951-a2dd-8b02-45944ae87aa9\install\info.xml	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\is-1tf99.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-1tf99.tmp\eykv6jk92.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\jquery.min.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\klrav15fu.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\main.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\main.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\unzip.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-1tf99.tmp\webview.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-5bnje.tmp\97af4baf91db75bff82f4bd759ba61045a433444_0003698536.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c8gug.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-c8gug.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c8gug.tmp\jquery.min.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c8gug.tmp\main.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c8gug.tmp\main.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c8gug.tmp\unzip.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c8gug.tmp\wa3s73y13.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c8gug.tmp\webview.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-ihb9r.tmp\01694ccfbd2a4ae0d94379d4b7418e3a7b34d71a_0007820776.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-mo6im.tmp\8ab1bb8e-2de9-a342-718c-c63666af9c55\install	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\temp\is-mo6im.tmp\8ab1bb8e-2de9-a342-718c-c63666af9c55\install\0	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\temp\is-mo6im.tmp\8ab1bb8e-2de9-a342-718c-c63666af9c55\install\0\offer0.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-mo6im.tmp\8ab1bb8e-2de9-a342-718c-c63666af9c55\install\6	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\temp\is-mo6im.tmp\8ab1bb8e-2de9-a342-718c-c63666af9c55\install\6\6.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-mo6im.tmp\8ab1bb8e-2de9-a342-718c-c63666af9c55\install\info.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-mo6im.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-mo6im.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-mo6im.tmp\jquery.min.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-mo6im.tmp\main.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-mo6im.tmp\main.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-mo6im.tmp\ncwnwvi6l.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-mo6im.tmp\unzip.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-mo6im.tmp\webview.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-mo6im.tmp\zp6xi0eym.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-rknj7.tmp\c037cb70a71d2b72d0195fff3669ac4a48f383b6_0008774000.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\setup log 2026-02-06 #001.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\setup log 2026-02-21 #001.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\setup log 2026-03-30 #001.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	勍ჵ韋ǜ	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	뾴쀳ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	婖삣쀳ǜ	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
User Data Access	GetUserObjectInformation
Keyboard Access	GetKeyState
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant Show More ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Anti Debug	IsDebuggerPresent
Process Terminate	TerminateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Nieblzlr\AppData\Local\Temp\is-5BNJE.tmp\97af4baf91db75bff82f4bd759ba61045a433444_0003698536.tmp" /SL5="$402E4,2854007,1089536,c:\users\user\downloads\97af4baf91db75bff82f4bd759ba61045a433444_0003698536"

"C:\Users\Nieblzlr\AppData\Local\Temp\is-MO6IM.tmp\unzip.exe" -P qwerty0987 -d C:\Users\Nieblzlr\AppData\Local\Temp\is-MO6IM.tmp\8AB1BB8E-2DE9-A342-718C-C63666AF9C55 C:\Users\Nieblzlr\AppData\Local\Temp\is-MO6IM.tmp\NCWNWVI6L.zip

"C:\Users\Lthhvuyd\AppData\Local\Temp\is-RKNJ7.tmp\c037cb70a71d2b72d0195fff3669ac4a48f383b6_0008774000.tmp" /SL5="$402EC,7865631,1148416,c:\users\user\downloads\c037cb70a71d2b72d0195fff3669ac4a48f383b6_0008774000"

"C:\Users\Xxnrdsqp\AppData\Local\Temp\is-IHB9R.tmp\01694ccfbd2a4ae0d94379d4b7418e3a7b34d71a_0007820776.tmp" /SL5="$4036C,7061147,1089536,c:\users\user\downloads\01694ccfbd2a4ae0d94379d4b7418e3a7b34d71a_0007820776"

"C:\Users\Xxnrdsqp\AppData\Local\Temp\is-1TF99.tmp\unzip.exe" -P qwerty0987 -d C:\Users\Xxnrdsqp\AppData\Local\Temp\is-1TF99.tmp\1ABA9905-B951-A2DD-8B02-45944AE87AA9 C:\Users\Xxnrdsqp\AppData\Local\Temp\is-1TF99.tmp\EYKV6JK92.zip

Show More

"C:\Users\Xxnrdsqp\AppData\Local\Temp\is-1TF99.tmp\unzip.exe" -P qwerty0987 -d C:\Users\Xxnrdsqp\AppData\Local\Temp\is-1TF99.tmp\1ABA9905-B951-A2DD-8B02-45944AE87AA9 C:\Users\Xxnrdsqp\AppData\Local\Temp\is-1TF99.tmp\KLRAV15FU.zip