Benign Download

Trojan-GameThief.Win32.OnLineGames.ewd

Image list icon size importExecute shell command (ShellExecuteA)

SHA-256afc2f1100e437172b74fa2e242969ef07fa6ebed6c13e39d7a9e9f8c9d5d4adf

Evidence

Query/set system parameters (string) 0x700ae–0x7014e

0x700ae6765000000005472616e736c6174654dge....TranslateM
0x700be4449537973416363656c000000005472DISysAccel....Tr
0x700ce61636b506f7075704d656e7500000000ackPopupMenu....
0x700de53797374656d506172616d6574657273SystemParameters
0x700ee496e666f4100000053686f7757696e64InfoA...ShowWind
0x700fe6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x72568–0x72648

0x72568d031d431f931073216322d325f329b32.1.1.1.2.2-2_2.2
0x72578aa32c132e932f73206331d334f338b33.2.2.2.2.3.3O3.3
0x725889a33b133d933e733f6330d343a34c134.3.3.3.3.3.4:4.4
0x72598d034f1340035173526353d354c356335.4.4.5.5&5=5L5c5
0x725a8723589359835af35be35d235e135f235r5.5.5.5.5.5.5.5
⋯10 more rows

Execute shell command (ShellExecuteA) 0x72750–0x72920

⋯13 more rows
0x72820153158316a3170318c31a431c431dc31.1X1j1p1.1.1.1.1
0x728300132083228323032343238323c324032.2.2(2024282<2@2
0x72840443248324c325032643284328c329032D2H2L2P2d2.2.2.2
0x72850943298329c32a032a432a832ac32c432.2.2.2.2.2.2.2.2
0x72860e432ec32f032f432f832fc3200330433.2.2.2.2.2.2.3.3
0x7287008330c332033403348334c3350335433.3.3 3@3H3L3P3T3
0x7288058335c3360336433683378339833a033X3\3`3d3h3x3.3.3
0x72890a433a833ac33b033b433b833bc33c033.3.3.3.3.3.3.3.3
0x728a0d033f033f833fc330034043408340c34.3.3.3.3.4.4.4.4
0x728b010341434183428344834503454345834.4.4.4(4H4P4T4X4
⋯7 more rows