FunMoods Toolbar

The detection of FunMoods Toolbar on your system indicates a potential threat to your computer's security and stability. This detection suggests that your system may be compromised by a malicious application that could be causing unwanted changes to your browser settings, search results, and overall system performance. It is essential to take immediate action to remove this threat and prevent any further damage.

What Is FunMoods Toolbar?

FunMoods Toolbar is a type of malicious software that can infect your computer and cause a range of problems. It is often classified as a Trojan-type threat, which means it can disguise itself as a legitimate program or application, but actually contains malicious code designed to harm your system. The primary goal of FunMoods Toolbar is to modify your browser settings, track your browsing habits, and display unwanted advertisements, which can lead to further malware infections and compromised system security.

How FunMoods Toolbar Operates

FunMoods Toolbar typically operates by infiltrating your system through exploited vulnerabilities, drive-by downloads, or social engineering tactics. Once installed, it can alter your browser settings, such as changing your default search engine, homepage, or new tab page. It may also install additional malware, adware, or potentially unwanted programs (PUPs) on your system, which can further compromise your security and stability. FunMoods Toolbar can also collect your personal data, such as browsing history, search queries, and login credentials, which can be used for malicious purposes.

Symptoms of Infection

If your system is infected with FunMoods Toolbar, you may notice a range of symptoms, including unwanted changes to your browser settings, slow system performance, and an increase in pop-up advertisements. You may also experience redirects to suspicious websites, unexpected crashes, or freezes. Additionally, you may notice that your search results are being hijacked, and you are being redirected to unfamiliar websites. These symptoms can be frustrating and may indicate a more severe malware infection.

How to Remove FunMoods Toolbar

1. Boot your computer in Safe Mode with Networking to prevent the malware from loading and to allow for a more effective removal process.
2. Run a full scan with a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of FunMoods Toolbar and related malware.
3. Uninstall any suspicious programs or applications that may be related to the FunMoods Toolbar infection.
4. Reset your browser settings to their default values, including Google Chrome, Mozilla Firefox, and Microsoft Edge, to remove any malicious extensions or add-ons.
5. Reboot your computer and run another full scan with your anti-malware tool to ensure that all remnants of the malware have been removed.

Conclusion

Removing FunMoods Toolbar from your system requires a thorough and careful approach to ensure that all instances of the malware are eliminated. By following the steps outlined above, you can effectively remove this threat and prevent any further damage to your system. It is essential to remain vigilant and take proactive steps to protect your system from future malware infections, including keeping your operating system and software up-to-date, using reputable anti-malware tools, and avoiding suspicious downloads and links.

Analysis Report

General information

Family Name:	FunMoods Toolbar
Signature status:	Self Signed

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 013bb9e47f387d987335d5b22ca0035a SHA1: f1653f0771a0956e734cb6fb95ab0cf877822be4 SHA256: 7FF082B572AC6D0F15F0D9C648236EB5F2414674742A27DFE6EAF53C86532AFA File Size: 669.40 KB, 669400 bytes

MD5: c05a9773b2a3bc3def655612f7ecc198 SHA1: 56a35c96e81aa3c92bb638b01b72f995d7f6d44f SHA256: 6EC110D61C238FFE939DBC190164B1D1DF9D3B9C4EE7EA9645C4B995045B170F File Size: 3.14 MB, 3142977 bytes

MD5: 187b84bda07f6fd272a40f17cbc801ce SHA1: d15ec7884c1598880e56d4476696134433021505 SHA256: 2047D13AB2B4A76B048A9786E0ED79EA233509BEB4D07CA10BEC89A60B79A75E File Size: 1.27 MB, 1265208 bytes

MD5: 2f5b88d20e277f839f44522bb9967811 SHA1: 1fb4a205430b552637c8e1467c69e4b9e59a2e96 SHA256: 4D3689F89C6489456DD45A2802CC69259578FEF80F2342FF91481329CD2C6A87 File Size: 1.19 MB, 1194720 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has been packed
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)

Show More

• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	This installation was built with Inno Setup.
Company Name	facemoods.com InstallCore © PC MEGA RÁPIDO LTDA
File Description	InstallCore© Installer PC MEGA RAPIDO PRO 2.1 Setup
File Version	1.4.17.5 1.4.8.1 1, 0, 0, 9
Internal Name	Installer Powered by installcore.com - SDK v2.1
Legal Copyright	Copyright © InstallCore
Product Name	facemoods InstallCore© Installer PC MEGA RAPIDO PRO 2.1
Product Version	1, 0, 0, 9

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Volonet Ltd	UTN-USERFirst-Object	Self Signed
Volonet Ltd	Volonet Ltd	Self Signed

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\1vtp0f0a0c0e0m0o0o0d0stp1v	Generic Read,Write Data,Write Attributes,Write extended,Append data
\device\namedpipe\1vtp0f0a0c0e0m0o0o0d0stp1v_test	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\0020b913.log	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\0032c9ae.log	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\css\ie6_main.css	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\css\ie6_main.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\css\ie6_main.css	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\browse.css	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\browse.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\browse.css	Synchronize,Write Attributes

Show More

c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\button.css	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\button.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\button.css	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\checkbox.css	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\checkbox.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\checkbox.css	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\images\button-bg.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\images\button-bg.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\images\button-bg.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\images\progress-bg.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\images\progress-bg.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\images\progress-bg.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\progress-bar.css	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\progress-bar.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\css\sdk-ui\progress-bar.css	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\css\style.css	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\css\style.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\css\style.css	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\defaultoffer\ad_code.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\defaultoffer\ad_code.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\defaultoffer\ad_html.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\defaultoffer\ad_html.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\bb-logo.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\bb-logo.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\bb-logo.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\box-facemoods.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\box-facemoods.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\box-facemoods.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\box.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\box.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\box.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\butt-grn.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\butt-grn.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\butt-grn.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\butt-gry.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\butt-gry.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\butt-gry.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\buttons.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\buttons.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\buttons.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\en.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\en.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\en.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\es.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\es.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\es.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\fr.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\fr.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\fr.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\it.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\it.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\it.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\logo.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\logo.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\logo.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\never-miss.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\never-miss.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\never-miss.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\package\babylon_logo.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\package\babylon_logo.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\package\babylon_logo.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\package\installer-pic.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\package\installer-pic.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\package\installer-pic.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\package\pkg_screenshot.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\package\pkg_screenshot.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\package\pkg_screenshot.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\progress-bg.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\progress-bg.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\progress-bg.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\wdt.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\wdt.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\wdt.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\images\x.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\images\x.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\images\x.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\license\license_en.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\license\license_en.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\license\license_en.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\license\license_es.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\license\license_es.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\license\license_es.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\license\license_fr.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\license\license_fr.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\license\license_fr.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\license\license_it.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\license\license_it.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\license\license_it.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\locale\en.locale	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\locale\en.locale	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\locale\en.locale	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\locale\es.locale	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\locale\es.locale	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\locale\es.locale	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\locale\fr.locale	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\locale\fr.locale	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\locale\fr.locale	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\locale\it.locale	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\locale\it.locale	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\locale\it.locale	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\ask\offer_code.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\offers\ask\offer_code.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\ask\offer_code.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\ask\offer_html.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\offers\ask\offer_html.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\ask\offer_html.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\bb\offer_code.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\offers\bb\offer_code.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\bb\offer_code.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\bb\offer_html.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\offers\bb\offer_html.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\bb\offer_html.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\dp\offer_code.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\offers\dp\offer_code.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\dp\offer_code.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\dp\offer_html.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\offers\dp\offer_html.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\dp\offer_html.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\fm\offer_code.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\offers\fm\offer_code.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\fm\offer_code.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\fm\offer_html.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\offers\fm\offer_html.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\fm\offer_html.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\sn\offer_code.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\offers\sn\offer_code.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\sn\offer_code.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\sn\offer_html.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\offers\sn\offer_html.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\sn\offer_html.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\wdt\offer_code.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\offers\wdt\offer_code.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\wdt\offer_code.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\wdt\offer_html.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\offers\wdt\offer_html.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\offers\wdt\offer_html.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ish2144531\sdk\exceptlist.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ish2144531\sdk\exceptlist.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ish2144531\sdk\exceptlist.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsp6d45.tmp\modern-header.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsp6d45.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsp6d45.tmp\userinfo.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsq227e.tmp\modern-header.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsq227e.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsq227e.tmp\userinfo.dll	Generic Write,Read Attributes

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
User Data Access	GetUserObjectInformation
Network Info Queried	GetAdaptersInfo
Network Wininet	InternetOpen
Keyboard Access	GetKeyState