Benign Download

Trojan.Win32.KillAV.vv

CreateRemoteThread API referenceCreateRemoteThread API string

SHA-256d7a76ecc60f2cba5489f498d3759e0d548c5611fa07cff0d985c415827f060fb

Evidence

CreateRemoteThread API string 0x510a4–0x51174

⋯3 more rows
0x510d400004372656174655468726561640000..CreateThread..
0x510e443726561746552656d6f746554687265CreateRemoteThre
0x510f46164000043726561746546696c654d61ad..CreateFileMa
0x511047070696e674100004372656174654669ppingA..CreateFi
⋯7 more rows

Query/set system parameters (string) 0x51b9e–0x51c3e

0x51b9e654d65737361676500005472616e736ceMessage..Transl
0x51bae6174654d4449537973416363656c0000ateMDISysAccel..
0x51bbe547261636b506f7075704d656e750000TrackPopupMenu..
0x51bce53797374656d506172616d6574657273SystemParameters
0x51bde496e666f4100000053686f7757696e64InfoA...ShowWind
0x51bee6f77000053686f775363726f6c6c4261ow..ShowScrollBa
⋯5 more rows

CreateRemoteThread API reference 0x53318–0x533e8

⋯3 more rows
0x53348643968396c398039a039a839ac39b039d9h9l9.9.9.9.9.9
0x53358b439b839bc39c039c439c839d839f839.9.9.9.9.9.9.9.9
0x53368003a043a083a0c3a103a143a183a1c3a.:.:.:.:.:.:.:.:
0x53378203a383a453a4d3a5c3a693a713a8c3a :8:E:M:\:i:q:.:
⋯7 more rows

Query/set system parameters (symbol) 0x5345c–0x5360c

0x5345c1d3437344134a7348335233757383e39.474A4.4.5#7W8>9
0x5346c7439c539f239563aa03adb3aea3a593bt9.9.9V:.:.:.:Y;
0x5347ca73bf53b683c6f3cac3cb03cb43cb83c.;.;h<o<.<.<.<.<
0x5348cbc3cc03cc43cc83ccc3cd03cd43cd83c.<.<.<.<.<.<.<.<
0x5349cdc3ce03ce43ce83cd13deb3d493e703e.<.<.<.<.=.=I>p>
⋯23 more rows

Image list icon size import 0x5362c–0x537dc

⋯14 more rows
0x5370cb33df23d363e473e6a3e843ea83eac3e.=.=6>G>j>.>.>.>
0x5371cb03eb43eb83ebc3ec03ec43ec83ecc3e.>.>.>.>.>.>.>.>
0x5372cd03ed43ed83edc3ee03ee43ee83eec3e.>.>.>.>.>.>.>.>
0x5373cf03ef43ef83efc3e003f043f083f0c3f.>.>.>.>.?.?.?.?
0x5374c103f143f183f1c3f203f243f283f2c3f.?.?.?.? ?$?(?,?
⋯9 more rows