PUP.Uran

The detection of PUP.Uran on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take appropriate steps to remove it to prevent any potential harm.

What Is PUP.Uran?

A PUP, or potentially unwanted program, is a type of software that may be installed on your computer without your full knowledge or consent. These programs can be bundled with other software or downloaded from the internet, often through deceptive or misleading means. PUP.Uran is a specific detection name given to this type of threat, indicating that it has been identified as a potentially unwanted program.

How PUP.Uran Operates

PUPs like PUP.Uran can operate in various ways, often designed to generate revenue for their creators through advertisements, data collection, or other means. They may display unwanted ads, collect personal data, or even install additional malware on your system. These programs can also slow down your computer, cause system crashes, or interfere with other software.

It's crucial to note that PUPs can be difficult to detect, as they often disguise themselves as legitimate programs or hide in the background, making them hard to identify. However, anti-virus software and other security tools can help detect and remove these threats.

Symptoms of Infection

If your system is infected with PUP.Uran, you may notice various symptoms, including unwanted ads or pop-ups, slow system performance, or unfamiliar programs installed on your computer. You may also experience system crashes, freezes, or errors, or find that your browser settings have been changed without your consent.

In some cases, you may not notice any symptoms at all, as PUPs can operate silently in the background. This is why it's essential to regularly scan your system with anti-virus software and keep your operating system and software up to date.

How to Remove PUP.Uran

1. Boot your computer in Safe Mode with Networking to prevent PUP.Uran from loading and to allow for a more effective removal process.
2. Run a full scan with a reputable anti-virus tool, such as SpyHunter, to detect and remove all instances of the PUP.
3. Uninstall any suspicious programs or software that you don't recognize or no longer need, as these may be related to the PUP.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any changes made by the PUP.
5. Reboot your computer and run another scan with your anti-virus software to ensure that the PUP has been completely removed.

Conclusion

Removing PUP.Uran from your system is crucial to prevent any potential harm and restore your computer's performance and security. By following the steps outlined above and maintaining good security practices, such as regularly scanning your system and keeping your software up to date, you can help protect your computer from PUPs and other types of malware.

Remember, prevention is key, and being cautious when downloading software or clicking on links can help prevent PUPs like PUP.Uran from infecting your system in the first place. If you're unsure about any aspect of the removal process or have concerns about your computer's security, consider consulting with a security expert or the support team for your anti-virus software.

Analysis Report

General information

Family Name:	PUP.Uran
Signature status:	Modified signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 52c4da2c2d08effd7413d91fe459e334 SHA1: 0a7d1d86a3b6dba12060a41ef3d3b0316990a125 SHA256: 4486EE3D14CFEB1CF044450A05268E632CA7B1FD43BE8E7FD54F1675C079BB68 File Size: 638.76 KB, 638760 bytes

MD5: bed35f9248881bb20134484ac11022e4 SHA1: 8c45caecd1907b51be69abed7ef8558b77458c88 SHA256: 95431231F3C4C952E2EF90128457057D455EF8765FC738C40D193283808F9FCF File Size: 638.76 KB, 638760 bytes

MD5: ae59d0b50f8f9ce4c30054b00aebbdb3 SHA1: f3a4ef22e5cb1113e9e91fc1d3ab2351448e3e1c SHA256: AF5B7C03E999BA8BCF1E6C4512C5203D87BE0A6B44C8DDDC1BCE5121E80EF846 File Size: 638.76 KB, 638760 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have exports table
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	uCoz Media LLC
File Description	uCozMedia UranUpdate Setup
File Version	1.3.27.0
Internal Name	uCozMedia UranUpdate Setup
Language Id	en
Legal Copyright	Copyright 2013 uCozMedia LLC
Original Filename	UranUpdateSetup.exe
Product Name	uCozMedia UranUpdate
Product Version	1.3.27.0

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	283
Potentially Malicious Blocks:	4
Whitelisted Blocks:	279
Unknown Blocks:	0

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 x 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 3 0 0 0 0 0 0 1 0 0 1 0 0 0 1 0 0 1 0 0 0 2 2 0 0 1 0 0 0 1 1 1 0 1 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 2 1 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 1 1 1 0 0 0 0 1 0 0 0 0 2 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 1 1 0 0 0 2 0 2 0 0 2 0 0 0 0 1 0 0 0 0 0 1 1 0 1 0 0

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\googlecrashhandler.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdate.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_am.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_ar.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_bg.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_bn.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_ca.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_cs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_da.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_de.dll	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_el.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_en-gb.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_en.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_es-419.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_es.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_et.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_fa.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_fi.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_fil.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_fr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_gu.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_hi.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_hr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_hu.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_id.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_is.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_it.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_iw.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_ja.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_kn.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_ko.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_lt.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_lv.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_ml.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_mr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_ms.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_nl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_no.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_pl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_pt-br.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_pt-pt.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_ro.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_ru.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_sk.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_sl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_sr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_sv.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_sw.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_ta.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_te.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_th.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_tr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_uk.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_ur.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_vi.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_zh-cn.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\goopdateres_zh-tw.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\npgoogleupdate3.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\psmachine.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\psuser.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\uranupdate.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\uranupdatebroker.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\uranupdatehelper.msi	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum4012.tmp\uranupdateondemand.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\googlecrashhandler.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdate.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_am.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_ar.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_bg.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_bn.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_ca.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_cs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_da.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_de.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_el.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_en-gb.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_en.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_es-419.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_es.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_et.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_fa.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_fi.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_fil.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_fr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_gu.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_hi.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_hr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_hu.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_id.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_is.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_it.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_iw.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_ja.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_kn.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_ko.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_lt.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_lv.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_ml.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_mr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_ms.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_nl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_no.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_pl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_pt-br.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_pt-pt.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_ro.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_ru.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_sk.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_sl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_sr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_sv.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_sw.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_ta.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_te.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_th.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_tr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_uk.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_ur.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_vi.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_zh-cn.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\goopdateres_zh-tw.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\npgoogleupdate3.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\psmachine.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\psuser.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\uranupdate.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\uranupdatebroker.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\uranupdatehelper.msi	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gum9d22.tmp\uranupdateondemand.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\googlecrashhandler.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdate.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_am.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_ar.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_bg.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_bn.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_ca.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_cs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_da.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_de.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_el.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_en-gb.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_en.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_es-419.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_es.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_et.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_fa.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_fi.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_fil.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_fr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_gu.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_hi.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_hr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_hu.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_id.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_is.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_it.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_iw.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_ja.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_kn.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_ko.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_lt.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_lv.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_ml.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_mr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_ms.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_nl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_no.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_pl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_pt-br.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_pt-pt.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_ro.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_ru.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_sk.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_sl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_sr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_sv.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_sw.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_ta.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_te.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_th.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_tr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_uk.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_ur.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_vi.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_zh-cn.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\goopdateres_zh-tw.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\npgoogleupdate3.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\psmachine.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\psuser.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\uranupdate.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\uranupdatebroker.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\uranupdatehelper.msi	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\guma411.tmp\uranupdateondemand.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gut4013.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\gut9d23.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\guta421.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\microsoft\systemcertificates\authroot\certificates\d69b561148f01c77c54578c10926df5b856976ad::blob	 ⥒ᖺ᮳漌쩌슉冘靷❃뛑ꎉ㖹붠喗꼲ꬢ T到ࠆثԁ܅ȃࠆثԁ܅̃ਆثЁ舁਷Ѓࠆثԁ܅Ѓࠆثԁ܅؃ࠆثԁ܅܃ࠆثԁ܅ăࠆثԁ܅ࠃS @㸰ἰआثЁꀁIJ、〒ؐ⬊ĆĄ㞂ļ́ダ؛朅ಁ́ሰူਆثЁ舁㰷āȃ쀀 0GlobalSign Roo	RegNtPreCreateKey
HKLM\software\microsoft\systemcertificates\root\certificates\be36a4562fb2ee05dbb3d32323adf445084ed656::blob	\ Ѐ 볝蚽㾜ࠛ컯퇄춈ᔻ ᰘ兘槹镹⍋ .Thawte Timestamping CA ਰࠆثԁ܅ࠃ 㚾嚤눯׮돛⏓괣䗴丈囖 晿煺硩騠ᑑ莝⃚ ꗨ뺘芄ﺎ炮ᔑ㔁뉶 ʥ	RegNtPreCreateKey
HKLM\software\microsoft\systemcertificates\authroot\certificates\d69b561148f01c77c54578c10926df5b856976ad::blob	 �<�8 {e�k�?�ӛ� ֛VH�w�Ex� &�[�iv�  r��z���<�H��S ��K�.E$�MP�c������b ˵"׷�'�j �[��.}Y�cZ|�r �c�; 0GlobalSign Root CA - R3S @0>0 +  �2 00	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
Encryption Used	BCryptOpenAlgorithmProvider
Cert Store Read	CertEnumCertificatesInStore
Anti Debug	IsDebuggerPresent OutputDebugString
User Data Access	GetUserObjectInformation

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\Users\Pendgkzg\AppData\Local\Temp\GUM4012.tmp\UranUpdate.exe /installsource taggedmi /install "appguid={7FAE01F8-9AE1-4dfb-B0E4-6C6E2CB9FF48}&appname=Uran&ap=uran&needsadmin=False&client=e5iHcF1gl76YMkFVMnXWs2EI6qyMs8ZY