Benign Download

Trojan-Downloader.Win32.BHO.yk

Image list icon size importExecute shell command (ShellExecuteA)

SHA-256cd1d25988ec38c359ea69eac3b795f0c06e784e5c689549cb40ad1d88090f327

Evidence

Query/set system parameters (string) 0x7f484–0x7f524

0x7f4846765000000005472616e736c6174654dge....TranslateM
0x7f4944449537973416363656c000000005472DISysAccel....Tr
0x7f4a461636b506f7075704d656e7500000000ackPopupMenu....
0x7f4b453797374656d506172616d6574657273SystemParameters
0x7f4c4496e666f4100000053686f7757696e64InfoA...ShowWind
0x7f4d46f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x82504–0x825e4

0x825046d3c7f3c843c9f3cac3cb93ccb3cd03cm<.<.<.<.<.<.<.<
0x82514ee3cfb3c0a3d1c3d213d403d4d3d583d.<.<.=.=!=@=M=X=
0x82524653d773d7c3d943db43dbc3dc03dc43de=w=|=.=.=.=.=.=
0x82534c83dcc3dd03dd43dd83ddc3d343e403e.=.=.=.=.=.=4>@>
0x825445f3e6e3eab3eb03e563f603f6a3f733f_>n>.>.>V?`?j?s?
⋯10 more rows

Execute shell command (ShellExecuteA) 0x827ec–0x8290c

⋯3 more rows
0x8281c3d345c347c348034843488348c349034=4\4|4.4.4.4.4.4
0x8282c943498349c34a034a434a834ac34b034.4.4.4.4.4.4.4.4
0x8283cb434b834bc34c0344536c4362b377f37.4.4.4.4E6.6+7.7
0x8284c9737a437b23775388838bd38d0387939.7.7.7u8.8.8.8y9
0x8285ca739c239423a473a613a9b3aa93a213b.9.9B:G:a:.:.:!;
0x8286c523b593bb53b403c6f3c1e3d603d833dR;Y;.;@<o<.=`=.=
0x8287c623e833e873e8b3e8f3e933e973e9b3eb>.>.>.>.>.>.>.>
0x8288c9f3ea33ea73eab3eaf3eb33eb73ebb3e.>.>.>.>.>.>.>.>
0x8289cbf3ec33ec73ecb3ecf3ed33ed73ed23f.>.>.>.>.>.>.>.?
⋯7 more rows