Threat Database Potentially Unwanted Programs PUP.Youxun.A

PUP.Youxun.A

By CagedTech in Potentially Unwanted Programs
Published:
Translate To:

Threat Scorecard

Popularity Rank: 20,568
Threat Level: 10 % (Normal)
Infected Computers: 1,271
First Seen: May 24, 2012
Last Seen: October 14, 2026
OS(es) Affected: Windows

PUP.Youxun.A is a Potentially Unwanted Program (PUP) that targets Windows computers. While it is not classified as highly dangerous, its presence on a system is generally unwelcome, as it is associated with unauthorized changes to browser settings, unwanted advertising, and the installation of extra software components that users did not knowingly request. This program has been observed since 2012 and continues to be detected on systems today, indicating it remains in active circulation.

What PUP.Youxun.A Does

Like other programs in the PUP/PUA (Potentially Unwanted Application) category, PUP.Youxun.A typically installs itself on a computer alongside other software, often without the user's full awareness or explicit consent. Once active, PUPs of this type commonly engage in behaviors such as adding toolbars to web browsers, displaying intrusive advertisements, and altering the default browser homepage or search settings. PUP.Youxun.A has been associated with game-related or launcher-style software, and it may write additional files to user folders on the system as part of its installation process. It has also been observed making use of system hooking techniques, which can allow a program to monitor or intercept activity occurring elsewhere on the computer.

How It Gets Onto Computers

PUPs such as Youxun.A typically spread through software bundling, where the unwanted program is packaged together with free software, game launchers, or download managers. During installation, the bundled program may be pre-selected for installation, and users who click through the setup process quickly without reviewing each screen may inadvertently agree to install it. It can also arrive through third-party download sites, file-sharing platforms, or promotional offers tied to gaming-related content, which is typical of this type of software.

Risks for the User

Although PUP.Youxun.A carries a low danger rating, it can still create a number of nuisances and minor security concerns for affected users. These risks typically include:

  • Unwanted changes to browser homepage, new tab page, or default search engine
  • Increased display of advertisements, pop-ups, or sponsored content
  • Reduced system and browser performance due to extra background processes
  • Potential exposure to additional unwanted software bundled alongside it
  • Privacy concerns, as some PUPs collect browsing or usage data without clear disclosure

Signs of Infection

Users whose systems have been affected by PUP.Youxun.A or similar PUPs may notice unfamiliar programs or processes running that they do not recall installing. Other common signs include unexpected browser toolbars or extensions, a changed homepage or search engine, an increase in pop-up ads, and the system behaving more slowly than usual. New files or folders appearing in user-specific directories, without a known origin, may also be an indicator of PUP activity.

How to Stay Protected

To reduce the chances of installing PUP.Youxun.A or other unwanted programs, users should always download software from official or trusted sources and avoid third-party download portals when possible. During installation of any new software, it is important to choose "Custom" or "Advanced" installation options rather than "Quick" or "Express," as this allows users to see and deselect any additional bundled programs. Reading each step of an installer carefully, keeping the operating system and security software up to date, and periodically reviewing installed programs and browser extensions can also help users identify and remove unwanted software before it causes further issues.

Analysis Report

General information

Family Name: PUP.Youxun.A
Signature status: No Signature

Known Samples

MD5: 9197c0c760591d41ccbafc90b2f09759
SHA1: cbaede190936c98df663a0e6a60eeeabde49531b
SHA256: CE0B4551ECDD3CEFE20CCF43A21285360E062A0B8EEA60678D649A3747ED0867
File Size: 2.11 MB, 2109952 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have exports table
  • File doesn't have security information
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name Value
Comments 急速微端
Company Name 602游戏
File Version 5.8.7.9
Internal Name tlcqss
Legal Copyright Copyright (C) 2015-2016
Original Filename tlcqss.exe
Product Version 5.8.7.9

File Traits

  • HighEntropy
  • WriteProcessMemory
  • x86

Block Information

Total Blocks: 4,387
Potentially Malicious Blocks: 114
Whitelisted Blocks: 4,111
Unknown Blocks: 162

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 x ? x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? ? 0 ? ? ? ? ? ? ? x ? ? 0 ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 x ? 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 ? 0 0 0 0 0 ? ? 0 0 0 0 x 0 0 x x x 0 x x x 0 0 0 0 x 0 0 ? 0 x ? 0 0 0 0 0 0 0 ? 0 ? ? ? ? 0 0 ? ? ? ? ? x x 0 ? 0 0 x ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? 0 0 0 0 ? ? ? ? ? 0 0 ? 0 ? 0 0 x x x ? ? ? x ? 0 ? ? ? ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 0 0 ? ? ? ? ? ? 0 x ? ? x 0 ? x x ? x x 0 x x ? x x x x ? ? 0 0 0 x x ? x x x x x ? ? ? ? 0 x x x x x 0 x ? x ? ? 0 0 0 0 0 0 0 ? x 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 x 0 0 0 ? ? 0 x 0 ? x x x x x ? x x ? ? 0 x ? x ? ? 0 0 0 0 x 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? x 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 x ? x x x x ? x x x ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 x 0 x x x x x ? ? ? x ? 0 ? x ? 0 0 0 0 0 ? x x ? x x x x x x x x ? ? 0 ? ? ? 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 ? ? 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 1 2
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

File Attributes
c:\users\user\appdata\roaming\wangame\cqsso\cqsso.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144

Windows API Usage

Category API
Other Suspicious
  • SetWindowsHookEx