PUA

PUA.Extendedse.Gen removal

Malware Removal

The PUA.Extendedse.Gen is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What PUA.Extendedse.Gen virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Presents an Authenticode digital signature
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Attempts to modify proxy settings
  • Harvests cookies for information gathering
  • Anomalous binary characteristics

How to determine PUA.Extendedse.Gen?


File Info:

name: EE0C82BC0B3CC62CE591.mlw
path: /opt/CAPEv2/storage/binaries/7aa727e792b8866a81e9047e2af2112ee0cedc958f136f38ebc6f237ceb31638
crc32: 40966A2C
md5: ee0c82bc0b3cc62ce591fb4db5adb56b
sha1: 09c17dd3eb146d563505e54f508972126a1a3463
sha256: 7aa727e792b8866a81e9047e2af2112ee0cedc958f136f38ebc6f237ceb31638
sha512: 4d0359011aa0eaac79ee27dd466414ee5f0b970a618fe357f1a818dbfba4baa51ddc29dea9c8cf1ae4239e068ecff4206c63288b6da81b83aa276eda92a5d284
ssdeep: 12288:ovp8lJOpS7Tn7fB6KIVcEj3j6nuDI4mBJCrstVowdODu7g/D4poTN1v0VnH9L9:ovwOpiOdanu84xg1OeBGBJ0VnH9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T126E423C39DE29875D3E1893B6DB287A24E737E811EB2511674BCFA8ACF377940809345
sha3_384: b379f09330c64027f10b6492cc3bafe6607044cf4ef9a4e50337d11e40720afbbd78f081559ab170a49f1b37df803d14
ep_bytes: 558bec83c4c453565733c08945f08945
timestamp: 1992-06-19 22:22:17

Version Info:

Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription:
FileVersion:
LegalCopyright:
ProductName:
ProductVersion:
Translation: 0x0000 0x04b0

PUA.Extendedse.Gen also known as:

BkavW32.AIDetect.malware1
MicroWorld-eScanAdware.GenericKD.4486019
FireEyeGeneric.mg.ee0c82bc0b3cc62c
CAT-QuickHealPUA.Extendedse.Gen
ALYacAdware.GenericKD.4486019
MalwarebytesPUP.Optional.InstallCore
ZillyaTrojan.PackedCRTD.Win32.422
CrowdStrikewin/grayware_confidence_100% (W)
K7GWTrojan ( 004966411 )
K7AntiVirusTrojan ( 004966411 )
BaiduWin32.Adware.InstallCore.a
VirITPUP.Win32.ExtendSetup.A
CyrenW32/A-40818173!Eldorado
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32Win32/InstallCore.Gen.A potentially unwanted
APEXMalicious
CynetMalicious (score: 100)
Kasperskynot-a-virus:HEUR:AdWare.Win32.DealPly.gen
BitDefenderAdware.GenericKD.4486019
NANO-AntivirusRiskware.Win32.InstallCore.dcnbmc
SUPERAntiSpywarePUP.InstallCore/Variant
Ad-AwareAdware.GenericKD.4486019
EmsisoftApplication.InstallCore (A)
ComodoMalware@#nhwhtjigf69o
DrWebTrojan.Packed2.39798
VIPREAdware.GenericKD.4486019
McAfee-GW-EditionArtemis
Trapminemalicious.high.ml.score
SophosInstall Core Click run software (PUA)
SentinelOneStatic AI – Malicious PE
GDataWin32.Application.InstallCore.LX
AviraPUA/InstallCore.Gen7
MAXmalware (ai score=68)
Antiy-AVLTrojan/Generic.ASMalwS.330C
ArcabitAdware.Generic.D447383
MicrosoftPUADlManager:Win32/InstallCore
GoogleDetected
Acronissuspicious
McAfeeArtemis!EE0C82BC0B3C
VBA32Downware.InstallCore
CylanceUnsafe
TrendMicro-HouseCallTROJ_GEN.R067H0CH922
RisingTrojan.Generic@AI.100 (RDMK:1g1VOj82WyN3GW29Dr+PgA)
YandexPUA.InstallCore!ccEnnuDKr6Q
IkarusTrojan-Spy.Zbot
MaxSecureAdware.not_a_virus_WIN32_AdWare_DealPly_gen_l_182898
Cybereasonmalicious.c0b3cc

How to remove PUA.Extendedse.Gen?

PUA.Extendedse.Gen removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment