PUP.PC Accelerator.BA

The detection of PUP.PC Accelerator.BA on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take immediate action to remove it to prevent further damage.

What Is PUP.PC Accelerator.BA?

PUP.PC Accelerator.BA is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are software applications that may not be malicious in nature but can still cause problems with your computer's performance, stability, and security. They often claim to provide useful features or functionality but may also display unwanted advertisements, collect user data, or install additional software without permission.

How PUP.PC Accelerator.BA Operates

PUPs like PUP.PC Accelerator.BA typically operate by installing themselves on a system through various means, such as bundled software downloads, infected email attachments, or exploited vulnerabilities. Once installed, they may run in the background, consuming system resources and potentially causing issues with other applications. They may also communicate with remote servers to download additional components or transmit user data. In some cases, PUPs may also attempt to trick users into purchasing unnecessary software or services.

Symptoms of Infection

The symptoms of a PUP.PC Accelerator.BA infection can vary, but common indicators include slow system performance, increased pop-up advertisements, and unexpected changes to browser settings or homepage. You may also notice unfamiliar programs or icons on your desktop or taskbar. In some cases, PUPs can also cause system crashes, freezes, or errors, making it difficult to use your computer.

• Slow system performance or freezes
• Unwanted pop-up advertisements or browser redirects
• Changes to browser settings or homepage
• Unfamiliar programs or icons on the desktop or taskbar
• System crashes or errors

How to Remove PUP.PC Accelerator.BA

1. Boot your computer in Safe Mode with Networking to prevent the PUP from loading and to allow for a clean removal process.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full system scan and detect any malicious components associated with PUP.PC Accelerator.BA.
3. Uninstall any suspicious programs or applications that may be related to the PUP, using the "Add/Remove Programs" or "Programs and Features" control panel.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any unwanted extensions or add-ons.
5. Reboot your computer and perform another full system scan to ensure that all components of the PUP have been removed.

Conclusion

Removing PUP.PC Accelerator.BA from your system is crucial to preventing further damage and ensuring the security and performance of your computer. By following the steps outlined above, you can effectively remove this potentially unwanted program and restore your system to a healthy state. Remember to always be cautious when downloading software or clicking on links, and to use reputable anti-malware tools to protect your system from future threats.

Analysis Report

General information

Family Name:	PUP.PC Accelerator.BA
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 82706057f27370d4f17bfd8dc576fcce SHA1: 2814d822fe7fb6886b7a354859c64d8302ea8a6f SHA256: B5A33D71AFB7A8FB2DB052E9C37160F769C2F5A28769BE76D0D32184FBE0051A File Size: 121.02 KB, 121022 bytes

MD5: f779d1311d14cb9fe5a664214354cbe4 SHA1: a496ce4daa9a4849325fc95f89ee3b6e06bef667 SHA256: FABD583AB302171A065FC918C8CEDA62E51EBDE295BCB804F9C1340E5AF722E7 File Size: 121.03 KB, 121025 bytes

MD5: c90af8ef582e02647286c414336ced04 SHA1: 658530ace11ffa600073b648469eefcb9475f62a SHA256: 069DAFB8BA0272F16D960022668341788BC94D159C9B4E3CC8DF30B664C97E4C File Size: 121.03 KB, 121032 bytes

MD5: 31063953fd3e7ef546a69cbc4d294b67 SHA1: 8fbe11a26670d493de7a45abce5ee8d80844d06c SHA256: 70A933247BC7D1A32C1B6DD4A1B9EA770DF6AB1B6D00E17A7E3E6C212645A45B File Size: 121.02 KB, 121016 bytes

MD5: fd60d863ca65b436397289022fdf73b4 SHA1: 667a5796bc9bae43e0c6dd9e2e85fe4d00bb07d0 SHA256: 7BB49D157350D372BD55CE3CAAD7CE58ED510111CCE16198CD85EB85CFD4A2F7 File Size: 121.01 KB, 121006 bytes

Show More

MD5: a3a7e59a8100f56e1664d03c33deb10f SHA1: 254e498b0ed280e9719afa10c41a9e3a03136993 SHA256: 592FB94FDA645F45C5BF1F5BD743513AA783FE4B02404EE65D0B2EED9CB901C0 File Size: 121.05 KB, 121054 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	ProtectorsOfRealm Code
File Description	ProtectorsOfRealm
File Version	1.0.0.1
Legal Copyright	© ProtectorsOfRealm Code 2021
Product Name	ProtectorsOfRealm
Product Version	1.0.0.1!12/4/2021@05:59:58 1.0.0.1!11/22/2021@14:10:15 1.0.0.1!10/17/2021@05:49:47 1.0.0.1!9/6/2021@08:57:09 1.0.0.1!9/4/2021@23:49:52 1.0.0.1!8/22/2021@15:56:11

File Traits

• dll
• HighEntropy
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\nse68f4.tmp\oupdater.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsf1287.tmp\oupdater.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nskba3e.tmp\oupdater.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsp4169.tmp\oupdater.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nssf99a.tmp\oupdater.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nst348f.tmp\oupdater.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\~nsua.tmp\un_a.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Rizgnsxv\AppData\Local\Temp\~nsuA.tmp\Un_A.exe	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Rizgnsxv\AppData\Local\Temp\~nsuA.tmp\Un_A.exe\??\C:\Users\Rizgnsxv\AppData\Local\Temp\~nsuA.tmp	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	*1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62*1\??\C:\P	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	*1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old122e4*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old12352*1\??\C:\P	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Process Shell Execute	CreateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Rizgnsxv\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\

"C:\Users\Pfukqopu\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\

"C:\Users\Vmamrhuz\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\

"C:\Users\Kohjavgr\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\

"C:\Users\Mjesrbtl\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\

Show More

"C:\Users\Elwbbqwt\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\