PWSteal.Zbot.AJ

The detection of PWSteal.Zbot.AJ on your system indicates a potential threat to your personal data and computer security. This report aims to provide you with general guidance on how to understand and address this issue. It's essential to approach this situation with caution and follow the recommended steps to ensure your system's safety and integrity.

What Is PWSteal.Zbot.AJ?

PWSteal.Zbot.AJ is identified as a Trojan-type threat, which typically involves malicious software designed to gain unauthorized access to a computer system. The name suggests it might be related to password stealing, but without specific details, it's crucial to focus on general removal and protection strategies. Trojan horses are known for their ability to disguise themselves as legitimate programs, making them difficult to detect. They can be used for various malicious purposes, including data theft, spyware, and ransomware distribution.

How PWSteal.Zbot.AJ Operates

Trojan-type threats like PWSteal.Zbot.AJ often operate by exploiting vulnerabilities in software or manipulating users into installing them. Once installed, they can create backdoors for remote access, allowing attackers to control the infected system, steal sensitive information, or use the system for malicious activities. The exact operation of PWSteal.Zbot.AJ is not specified, but understanding the general behavior of Trojans can help in taking preventive measures and in the removal process.

Symptoms of Infection

Symptoms of a Trojan infection can vary widely, depending on the specific goals of the malware. Common indicators include unusual system behavior, such as slow performance, frequent crashes, or unfamiliar programs and icons. You might also notice increased network activity, pop-ups, or changes in your browser settings. However, some Trojans can operate silently, making them harder to detect without proper security software.

How to Remove PWSteal.Zbot.AJ

1. Enter Safe Mode with Networking to limit the malware's ability to interfere with the removal process. This mode allows you to use the internet to download removal tools while minimizing system activity.
2. Download and run a full scan with a reputable anti-malware tool, such as SpyHunter. Ensure the tool is updated to the latest version to increase the chances of detecting and removing the threat.
3. Uninstall suspicious programs that you don't recognize or that were installed around the time the threat was detected. Be cautious and only remove programs you are sure are not needed.
4. Reset your browsers (Chrome, Firefox, Edge, etc.) to their default settings. This can help remove any malicious extensions or settings changes made by the malware.
5. After completing the above steps, reboot your system and run another full scan with your anti-malware tool to ensure the threat has been removed. Repeat the scanning process until no threats are detected.

Conclusion

Removing PWSteal.Zbot.AJ requires careful attention to detail and adherence to best practices for malware removal. It's crucial to stay vigilant and ensure your system and personal data are protected. Regularly updating your operating system, software, and security tools can help prevent future infections. Additionally, practicing safe browsing habits, such as avoiding suspicious links and downloads, can significantly reduce the risk of encountering malware. By following these guidelines and maintaining a proactive approach to security, you can help safeguard your digital environment against threats like PWSteal.Zbot.AJ.

SpyHunter Detects & Remove PWSteal.Zbot.AJ

Analysis Report

General information

Family Name:	PUP.Keygen.M
Packers:	UPX
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 65b954667703e99b514735c9e92d2008 SHA1: 9beefc8f7e7e9aaaf0c63ec494a02e92e1f32da9 File Size: 74.75 KB, 74752 bytes

MD5: 80f3774d301620d7a66c1fac6dface95 SHA1: 596126f516391fa6891878467fdfcdb01a53635d File Size: 667.14 KB, 667140 bytes

MD5: 53ba47bfc5a346500a4f0d6f8b921798 SHA1: 70def5fac6d40a8c48e8997eae406b98db4dfd21 File Size: 163.84 KB, 163840 bytes

MD5: 190a53a8279a8028636ba9925b600933 SHA1: e4d1c6dfdc97ae2a4b0cf415a15804b7e3fe2e1a SHA256: 09CD11DDCB3F2BD2DBE4DA60E4111E60ED3A2AE7CD58E11D8EEBFA21E55B861C File Size: 331.26 KB, 331264 bytes

MD5: 350e6d0267b086df129212ec3d68fc51 SHA1: 38d49e13414e2cfce3b24df6fb50590b4ad0d768 SHA256: 9C87CC89C47FCEB1BFD59127BE9EFFB3DC1217BFFD0619D98C8AFE3C462DFA8B File Size: 34.82 KB, 34816 bytes

Show More

MD5: eb2de8182df167971afd78ed01d47437 SHA1: 83104872fef55e1f5f1081b48e99ccd3ab250439 SHA256: 8228C54F145F94D62E37A648FFABE8C2DE92F48D21A5B152653FD6153D4D877B File Size: 259.33 KB, 259330 bytes

MD5: e3d011f4646e6975a085b6db777db876 SHA1: c1ef3754ff9eee175ec825bb68d116566cca51af SHA256: 8244A2A63703695FC6BE8E0E72423D8C31483BDF809E28876015DD8709ED61C0 File Size: 724.48 KB, 724480 bytes

MD5: 9f2ed57b503b9a251e008c11314aafc5 SHA1: 16808ea30814c4b3cfb1635aa86f3f90f81ba466 SHA256: E25AC276E0A07BAADF7FBCA3B441C69649961AA88E5EEEE54A9B5157EE5525C2 File Size: 94.72 KB, 94720 bytes

MD5: 50116747a8f71db7da4022a10a29dc02 SHA1: c4386ad765d4be93c4d134596480f61e7586d011 SHA256: 2C0C165AF9F25DD1A9A3CD37D0A3E37FF2B966CC21071E270938CD44ACED25A8 File Size: 441.34 KB, 441344 bytes

MD5: 74d51ccf93aba543e0e7cf1263fcfcdb SHA1: e8c3cafeb85d4445c83fbafe8444d52aab135b5d SHA256: 4186BB2CD794844B10FA8E94E2DF2D389F17BE4B07E61791734E950F1926AD87 File Size: 199.17 KB, 199168 bytes

MD5: a467f0619f3fa6f3475df45ae16d4a70 SHA1: 5fc6d4945461be7c80c30c792658a94f718f7e9c SHA256: 09117DBBCA18065102B17F7EA37552ED8F8C024283C02FA891A22A3EFA96E284 File Size: 1.09 MB, 1088139 bytes

MD5: 5594eef3d94d657db5d073421a7fb400 SHA1: f1c29907d2878f165f5e48e52cf774be76ea4ed4 SHA256: 4E6190090E30F39DC5D828152196261A65AFB3BC4D8EE925C2C2F1570C21C322 File Size: 104.96 KB, 104960 bytes

MD5: f8779c5b0e703cf6142d53911c95d483 SHA1: f209dced5f0492e7b4ef8799638ee546efc14fc0 SHA256: 604D303DE1D21AEB5A20E47C4F8E436C881F6F890CCEB62A2C70A9588EA7B8E1 File Size: 247.81 KB, 247808 bytes

MD5: 3b27bc027637aca0f2d9ef57944086a8 SHA1: 8edcbbfe46eafe3a0306e0512f1f04c8af978257 SHA256: 29A71722399CE32C8B57D3AC01E537DF79B82340E36CC51ECC5315BAE72E2E3A File Size: 121.34 KB, 121344 bytes

MD5: cd231bf4a9e06a0a3dfcd1a1f7cd1508 SHA1: 5731a0fe7c367b91f886c31fcc3364b1057086ab SHA256: ACC5B02F585436EDE57CC4961E5219D1990EF161A930E74214E17ACEB2B5AFAA File Size: 249.50 KB, 249505 bytes

MD5: 6defdcc86d7db45bbd3aaa1f8152ef86 SHA1: 79e55eb9102b3649376ba7d5157d1c0cacc84397 SHA256: 6840C6D5B353D523D0644F65D5ADA60C7F7CF4B01C148B803301D31F4895D72F File Size: 141.31 KB, 141312 bytes

MD5: bee049a273a8587a2a67026a38f9ab48 SHA1: f5749e65ebe2ec9cb95494e0bb6b6c0132e85273 SHA256: C5CF7450EB6503E2EE8248530518B9017F6C55F4AE9AA80E9C742A59D8F5E693 File Size: 289.28 KB, 289280 bytes

MD5: ae8f6e03a3c55ef5866f0adcd04e90e3 SHA1: 9c49d87ccf6d4c6d23788edda4edc18d7528b417 SHA256: 4F1CF6C91C5B34D9DC63D02CD5859A40D112004C9877C51A8A295755B6840FE0 File Size: 237.57 KB, 237568 bytes

MD5: 09c1cfe7774ab9f26376a376950a9033 SHA1: 3bff5aefab5add81c57abd0ab52981943c55ca68 SHA256: A37ED2A9AE917B724B970B999D2955CE402498D8BFD5A5DDC8CF114950087D85 File Size: 75.26 KB, 75264 bytes

MD5: 691ae4fc368c0fc74c45bde254dd3b5c SHA1: e640a95e603681550b53d9c4040af8fae6e67fb3 SHA256: 4DA9F4768979E5970C99C20E976566CFB22D75FD767BC1562449102066C171FB File Size: 3.51 MB, 3510784 bytes

MD5: d70b865443a38812e321fe89a60dbc3f SHA1: 4fc448fa4259fd938fd70fd8ce398b9832228280 SHA256: 22AC636694201BA2B28F15DC3E77A60072E4E812338149EB3BE3E7FA07E3E3F4 File Size: 141.31 KB, 141312 bytes

MD5: 0b54265d8092a2bbd8bac746f1108b39 SHA1: 4256260a1d8ebb5d9532daedb440cf90f1a1cc85 SHA256: 0BDB92AFE6FF14DCD3B6DBD978A52B9F84BA69E4B3BE130D17B9DD7A26FB652E File Size: 106.50 KB, 106496 bytes

MD5: 7aff29a32bcd200633349f540c7e5dc4 SHA1: 3967bf3367775f375dfdcbaeeb5c5ecb7278d554 SHA256: CE6FF1C23216E2E45BD4F66EE50BBEEA9CA5CAB8B05331CC37B225371E857566 File Size: 199.68 KB, 199680 bytes

MD5: d990efdacf1b8ff5f755c70453c28e99 SHA1: 97a136d5c902d67a610946cb3e060e5b0b52437d SHA256: DC575F79953811A781C35B7D5BE9448F6F59DE9339C71A66BFF8701DA0CA7438 File Size: 155.14 KB, 155136 bytes

MD5: c1af982cfb14807f2bbbacf9bdf9f1c7 SHA1: 374a8c98b8a2c1c4280d79a0d5ae53be243fe55b SHA256: 959B69AD9AEEAD0E1E0A734222E3B3E4FD5A3B070999B95BECA8A826E87E23FE File Size: 98.30 KB, 98304 bytes

MD5: 4550afb8378fc108a4c56e4da027c221 SHA1: 0e985d5855b8802e2fabcf5a43208feb31ee62a0 SHA256: DB5E41EEFEC419AE83FDFF3016C9343A671286AD759AF48AD909F465389FB476 File Size: 201.73 KB, 201728 bytes

MD5: 85131960efa0bff69c482fb5a8f248b3 SHA1: 74fb6d974c5bee62ec4f7c6f783f505b6707c17d SHA256: B7B01F2C9FF85816D23E46F38325F9B8BBD00AF2611B57D37632F02DCAEE26F5 File Size: 69.12 KB, 69120 bytes

MD5: a087fd05f7acfc78cff6be78a640f0e3 SHA1: e14be101abaf642a63299f36f04fbab49115833d SHA256: 3BBD347B080CD393C68A696BA7735D82BE552708EE325492606908F35FF156F6 File Size: 24.06 KB, 24064 bytes

MD5: 6f2c08298dc55af31d0229602288b4ad SHA1: 0ff036598560ef21cfe267d638e27d59449749b9 SHA256: 145F442321BE85402AB3458113E7DBB02D5281DD79A4B136D665D0CC440E43AD File Size: 739.68 KB, 739684 bytes

MD5: b254576dde7fbb50aca81aad1df1cf1d SHA1: 2ddb976bc0b63239967804063859b22c03db2c23 SHA256: 914E22F03340C60DE5727E24287920E4E013AD23C0444BA1B71A0B6B7E9F6601 File Size: 160.51 KB, 160512 bytes

MD5: 51d73af9702db0af6d789f44d3a4eb63 SHA1: 70d9b93bd994725980a63d851b1e0bfecc69d234 SHA256: 859115A91529C83E833D40B0FED8B69D3C30553236CDFC681FE03BCB0AAFA9BE File Size: 185.34 KB, 185344 bytes

MD5: 3637b65c9ef8d4dd51d811596e83269c SHA1: ebfe3bc772144bf06295fd7dbed4a291a02e460f SHA256: 9196D09E63C2FEBE1326768F954684E5D60A4E7104C283C346274C2EA426D304 File Size: 100.86 KB, 100864 bytes

MD5: 50060c31bab1bfa0dfeb3f56463d052b SHA1: 65454e265a363e3a23245118b95ea18f19ddb841 SHA256: 74B1896C66BF0E1D6AE3034600BA2F4215D8691D9A976F180F4CD8ADF486A594 File Size: 87.04 KB, 87040 bytes

MD5: 517577972adb5354f37c584d5af2c37d SHA1: 8e16a968e21b971e5b60ac3e896fd698a0f7e5d6 SHA256: 7D095D114DF6B339F1AA04878FD3CB8E607790FC33DD74EC19F0DA24000E83A3 File Size: 91.14 KB, 91136 bytes

MD5: b594b1343c63fa6d1122f0dd4b8dac51 SHA1: fcf8efa1fb20fda925d15624f06b24b46c4ffd00 SHA256: FB9C447D8C856F19E46A2EFB489581B0E95DDB3D17267BF28CC6D44ACC6B4009 File Size: 103.42 KB, 103424 bytes

MD5: acb35c91f6ff882021ba0bfc31e579b0 SHA1: 789b6b02cf48718b09c139e2803ed00d8cd36632 SHA256: 2D6FB64447F22D1C7A2417AF979BC4BC5917F761EF33B3A54B86D5E88969E011 File Size: 1.98 MB, 1976544 bytes

MD5: 901ec844b552ba00ba06adca2cdc6bcd SHA1: 5f9743c8f0e0bd5533572c51f542185ed5088722 SHA256: 5993E671935D24988CB8E3E12E7B5F9869244AFB44B0FCF73BB5ADBF7123F41E File Size: 56.83 KB, 56832 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has been packed
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application

Show More

• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Show More

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Fighting For Fun The Serials 2000 Rocks Team
File Description	162 Keygens for EA Games MFC-Anwendung bactinet Serials 2000 Pro Internet Edition
File Version	3, 0, 0, 5 2, 5, 1, 162 1.00 1, 0, 0, 1
Internal Name	bactinet fff-ea162.exe serial2k TJprojMain
Legal Copyright	(c)Serials 2000 Crew Copyright (C) 2001 Copyright (c) 2003-2007 Fighting For Fun
Original Filename	bactinet.EXE fff-ea162.exe serial2k.EXE TJprojMain.exe
Product Name	Anwendung bactinet EA Games Generic Multi Keygen Project1 Serials 2000 3rd Edition [Final]
Product Version	3, 0, 0, 5 2, 5, 1, 162 1.00 1, 0, 0, 1

File Traits

• $Id: UPX
• .adata
• .aspack
• .UPX
• 2+ executable sections
• ASPack v2.11x
• ASPack v2.12
• ASPack v2_11d
• HighEntropy
• MPRESS

Show More

• MPRESS Win32
• Native MPRESS x86
• No Version Info
• ntdll
• packed
• PECompact v2.20
• upx
• UPX!
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	61
Potentially Malicious Blocks:	33
Whitelisted Blocks:	11
Unknown Blocks:	17

Visual Map

0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? x 0 x x x x x x ? ? 0 x x 0 0 0 0 x x x x x x 0 x x x x x x x x x x x x x x x x x x 0 0

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Keygen.M
• Kryptik.FUC
• Malpack.SB
• Patcher.B
• Phorpiex.CBD

Show More

• Stop.PCQR

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\__tmp_rar_sfx_access_check_9843187	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\bumpes.cmd	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rarsfx0\bumpes.cmd	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\cr-piriform.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rarsfx0\cr-piriform.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\~df035055ea305c9d8e.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\~df7951cb5c0b574e48.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\~dfc2444c5d5c45d5e6.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data

Show More

c:\users\user\appdata\local\temp\~dfde946ef6e24122b6.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\system.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\bassmod.dll	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\wow6432node\egame\cid::id	���U�(B�+�]���	RegNtPreCreateKey
HKLM\software\wow6432node\egame\msgq::83|2025-10-26 17:46:46:0	$@�`���	RegNtPreCreateKey
HKLM\software\wow6432node\egame\83::starts		RegNtPreCreateKey
HKLM\software\wow6432node\e-game\computerid::id	/�>2B�M/( ��)	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer\advanced::hidden		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::antivirusoverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::antivirusdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::firewalldisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::firewalloverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::updatesdisablenotify		RegNtPreCreateKey

Show More

HKLM\software\wow6432node\microsoft\security center::uacdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::antivirusoverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::antivirusdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::firewalldisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::firewalloverride		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list::c:\users\user\downloads\f209dced5f0492e7b4ef8799638ee546efc14fc0_0000247808	c:\users\user\downloads\f209dced5f0492e7b4ef8799638ee546efc14fc0_0000247808:*:enabled:@shell32.dll,-1	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::updatesdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::uacdisablenotify		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings::globaluseroffline		RegNtPreCreateKey
HKLM\software\microsoft\windows\currentversion\policies\system::enablelua		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list::c:\users\user\downloads\f209dced5f0492e7b4ef8799638ee546efc14fc0_0000247808	c:\users\user\downloads\f209dced5f0492e7b4ef8799638ee546efc14fc0_0000247808:*:Enabled:ipsec	RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::enablefirewall		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::donotallowexceptions		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::disablenotifications		RegNtPreCreateKey
HKCU\software\apcr\1214104697::1919251317		RegNtPreCreateKey
HKCU\software\apcr\1214104697::-456464662		RegNtPreCreateKey
HKCU\software\apcr\1214104697::1462786655		RegNtPreCreateKey
HKCU\software\apcr\1214104697::-912929324	#	RegNtPreCreateKey
HKCU\software\apcr\1214104697::1006321993	Ǐ	RegNtPreCreateKey
HKCU\software\apcr\1214104697::-1369393986	http://kluczewsko.gmina.pl/images/xs.jpghttp://4-educationtec	RegNtPreCreateKey
HKCU\software\apcr\1214104697::549857331	FHdp�`S��Nʹ��fQ��K6V��:s&�O�8�,yW�>3{x{�N%�����q�>�m3�[	RegNtPreCreateKey
HKCU\software\apcr::u1_0	ⱙ᳭	RegNtPreCreateKey
HKCU\software\apcr::u2_0	ᣫ	RegNtPreCreateKey
HKCU\software\apcr::u3_0	権ă	RegNtPreCreateKey
HKCU\software\apcr::u4_0		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\direct3d\mostrecentapplication::name	8edcbbfe46eafe3a0306e0512f1f04c8af978257_0000121344	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�l 1HO@V�N�y�9y�^�P�����m���p�$ �[�`�V ����Q]�� @ K�	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent OutputDebugString
User Data Access	GetUserName GetUserObjectInformation
Other Suspicious	SetWindowsHookEx
Network Info Queried	GetAdaptersInfo
Keyboard Access	GetAsyncKeyState GetKeyState
Network Winhttp	WinHttpOpen
Network Wininet	HttpOpenRequest HttpSendRequest InternetConnect InternetOpen InternetReadFile