SmartHawk

1.8

低危

28 个模型检测该样本为恶意！

重新分析

下载样本

329cdeac33b923e6298a73a1baa4ab3a8cfca9b6eb5a887ac1b4e84b16062e23

bb115e92474dbb685954cb97d5c9541d.exe

分析耗时

72s

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	AdWare:Win32/Generic.0d1e6a21	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Elex-P [Adw]	20201026	18.4.3895.0
Tencent	Malware.Win32.Gencirc.114bdd2b	20201026	1.0.0.1
Kingsoft		20201026	2013.8.14.323
McAfee	PUP-GJL	20201026	6.0.6.653
CrowdStrike		20190702	1.0

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2016-03-30 18:31:50

Imports

Library iSafeBase.dll:

• 0x423324 ?GetProductUtil@CAppMgr@elex@@QAEPAVCOProductUtil@@XZ

• 0x423328 ?GetInstance@?$CSingleton@VCAppMgr@elex@@@oopa@@SAPAVCAppMgr@elex@@XZ

• 0x42332c ?GetTaskMgr@CAppMgr@elex@@QAEPAVCOTaskManager@@XZ

• 0x423330 ?GetPathMgr@CAppMgr@elex@@QAEPAVCOPathManager@@XZ

Library iImportLib.dll:

• 0x4232d8 ?GetLangAreaId@func@elex@@YAKABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z

• 0x4232dc ??0Lock@thread@elex@@QAE@ABVMutex@12@_N@Z

• 0x4232e0 ??1Lock@thread@elex@@QAE@XZ

• 0x4232e4 ?trim_all@strings@elex@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z

• 0x4232e8 ?RequestURL@LibCurlClient@elex@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@K@Z

• 0x4232ec ?GetUserGuid@func@elex@@YAHPA_WKHPAH@Z

• 0x4232f0 ?ISAFE_GetMiniOSVersionDescW@os@elex@@YAHPA_WK@Z

• 0x4232f4 ?getProgramRunDir@filepath@elex@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ

• 0x4232f8 ?pathcombine@filepath@elex@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@PB_W@Z

• 0x4232fc ?s2ws@strings@elex@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@I@Z

• 0x423300 ?eBase64_Encode@CiSafeUtilities@safe@elex@@SA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@5@@Z

• 0x423304 ??1Mutex@thread@elex@@UAE@XZ

• 0x423308 ??0Mutex@thread@elex@@QAE@XZ

• 0x42330c ?ReadValue@RegKey@reg@elex@@QBEJPB_WPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z

• 0x423310 ??1RegKey@reg@elex@@QAE@XZ

• 0x423314 ??0RegKey@reg@elex@@QAE@PAUHKEY__@@PB_WK@Z

• 0x423318 ?ws2s@strings@elex@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@I@Z

• 0x42331c ?CheckResult@LibCurlClient@elex@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z

Library KERNEL32.dll:

• 0x423024 CloseHandle

• 0x423028 GlobalLock

• 0x42302c GlobalUnlock

• 0x423030 WritePrivateProfileStringW

• 0x423034 CreateMutexW

• 0x423038 GetLastError

• 0x42303c GetSystemDefaultLCID

• 0x423040 GetCurrentThreadId

• 0x423044 GetPrivateProfileStringW

• 0x423048 MultiByteToWideChar

• 0x42304c InitializeCriticalSection

• 0x423050 DeleteCriticalSection

• 0x423054 EnterCriticalSection

• 0x423058 LeaveCriticalSection

• 0x42305c InterlockedIncrement

• 0x423060 CreateThread

• 0x423064 ResumeThread

• 0x423068 InterlockedExchange

• 0x42306c GetModuleFileNameW

• 0x423070 GetCurrentProcess

• 0x423074 GetModuleHandleW

• 0x423078 GetFileSize

• 0x42307c DeviceIoControl

• 0x423080 GlobalFree

• 0x423084 GetVolumeInformationW

• 0x423088 InterlockedDecrement

• 0x42308c TlsAlloc

• 0x423090 TlsFree

• 0x423094 GetCurrentProcessId

• 0x423098 LocalFree

• 0x42309c FreeLibrary

• 0x4230a0 GetProcAddress

• 0x4230a4 LoadLibraryW

• 0x4230a8 GlobalAlloc

• 0x4230ac CreateFileW

• 0x4230b0 FormatMessageA

• 0x4230b4 GetSystemTimeAsFileTime

• 0x4230b8 QueryPerformanceCounter

• 0x4230bc HeapAlloc

• 0x4230c0 HeapReAlloc

• 0x4230c4 HeapFree

• 0x4230c8 HeapSize

• 0x4230cc GetProcessHeap

• 0x4230d0 EncodePointer

• 0x4230d4 DecodePointer

• 0x4230d8 IsDebuggerPresent

• 0x4230dc IsProcessorFeaturePresent

• 0x4230e0 HeapDestroy

Library USER32.dll:

• 0x423280 OpenClipboard

• 0x423284 EmptyClipboard

• 0x423288 CloseClipboard

• 0x42328c LoadCursorW

• 0x423290 SetCursor

• 0x423294 ScreenToClient

• 0x423298 GetCursorPos

• 0x42329c SetForegroundWindow

• 0x4232a0 BringWindowToTop

• 0x4232a4 IsIconic

• 0x4232a8 ShowWindow

• 0x4232ac SetClipboardData

• 0x4232b0 wsprintfW

• 0x4232b4 SetWindowTextW

• 0x4232b8 GetForegroundWindow

• 0x4232bc GetWindowThreadProcessId

• 0x4232c0 AttachThreadInput

• 0x4232c4 IsWindowVisible

Library COMDLG32.dll:

• 0x42301c GetOpenFileNameW

Library ADVAPI32.dll:

• 0x423000 RegOpenKeyW

• 0x423004 SetSecurityDescriptorDacl

• 0x423008 InitializeSecurityDescriptor

• 0x42300c RegCloseKey

• 0x423010 RegOpenKeyExW

• 0x423014 RegQueryValueExW

Library SHELL32.dll:

• 0x423260 ShellExecuteExW

Library OLEAUT32.dll:

• 0x423258 VariantClear

Library SHLWAPI.dll:

• 0x423268 PathCombineW

• 0x42326c PathFileExistsW

• 0x423270 PathAppendW

• 0x423274 PathFindFileNameW

• 0x423278 PathRemoveFileSpecW

Library ouilibx.dll:

• 0x423368 ?DoDataExchange@COVDialog@OUI@@UAEXPAVCODataExchange@2@@Z

• 0x42336c ?DoEventBind@COVDialog@OUI@@UAEXXZ

• 0x423370 ?GetDlgItem@COVDialog@OUI@@QAEPAVCOVWnd@2@PB_W@Z

• 0x423374 ?OCLK_RICHITEM@COVEvent@OUI@@2V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@B

• 0x423378 ?UpdatePosition@COVDialog@OUI@@UAEXXZ

• 0x42337c ?GetSelectedVView@COVViewStack@OUI@@QAEPAVCOVView@2@XZ

• 0x423380 ?OnCloseWindow@COVDialog@OUI@@MAE_NPAX@Z

• 0x423384 ?GetResID@COIDManager@OUI@@QAEKPB_W@Z

• 0x423388 ?GetIDManager@COIDManager@OUI@@SAPAV12@XZ

• 0x42338c ?PtInRect@CORect@OUI@@QBEHUtagPOINT@@@Z

• 0x423390 ?PreHandleMessage@COVDialog@OUI@@MAEJPAUHWND__@@IIJ@Z

• 0x423394 ?GetBuffer@COString@OUI@@QAEPA_WH@Z

• 0x423398 ?OnMouseLeave@COVDialog@OUI@@MAE_NXZ

• 0x42339c ?SetRectEmpty@CORect@OUI@@QAEXXZ

• 0x4233a0 ?SetText@COVRichText@OUI@@QAE_NPB_W@Z

• 0x4233a4 ?GetObjectName@COVDialog@OUI@@UAE?AVCOString@2@XZ

• 0x4233a8 ?GetMObjectName@COVDialog@OUI@@UAE?AVCOString@2@XZ

• 0x4233ac ?DoPaint@COVDialog@OUI@@UAE_NPAUIRender@2@VCOPoint@2@@Z

• 0x4233b0 ?GetPaintAlpha@COVDialog@OUI@@UAEHXZ

• 0x4233b4 ?Draw@COVDialog@OUI@@UAE_NPAUIRender@2@VCORect@2@@Z

• 0x4233b8 ?DrawTextW@COVDialog@OUI@@MAE_NPAUIRender@2@VCORect@2@K@Z

• 0x4233bc ?UpdateWndAttribs@COVDialog@OUI@@UAE_NPAVCOMapAttrib@2@@Z

• 0x4233c0 ?OnInitialUpdate@COVDialog@OUI@@UAEXXZ

• 0x4233c4 ?Hittest@COVContainer@OUI@@UAEPAVCOVWnd@2@VCOPoint@2@@Z

• 0x4233c8 ?IsSelected@COVWnd@OUI@@UBE_NXZ

• 0x4233cc ?OnAnimationStop@COVDialog@OUI@@MAEXI@Z

• 0x4233d0 ?PreTranslateMessage@COVDialog@OUI@@MAEJPAUtagMSG@@@Z

• 0x4233d4 ?OnMouseEnter@COVDialog@OUI@@MAE_NIVCOPoint@2@@Z

• 0x4233d8 ?OnTimer@COVDialog@OUI@@MAE_NI@Z

• 0x4233dc ?OnWindowSizeChanged@COVDialog@OUI@@MAEXUtagSIZE@@@Z

• 0x4233e0 ?CreateChildWnd@COVDialog@OUI@@UAEPAVCOVWnd@2@PAVCOResNode@2@@Z

• 0x4233e4 ?CreateDlg@COVDialog@OUI@@UAE_NPB_WPAVCOVWnd@2@@Z

• 0x4233e8 ?AdjustTitleBar@COVDialog@OUI@@UAE_NXZ

• 0x4233ec ?OnExitDilaog@COVDialog@OUI@@UAE_NXZ

• 0x4233f0 ?CloseDialog@COVDialog@OUI@@UAEXK@Z

• 0x4233f4 ?GetWindowStyle@COVDialog@OUI@@UAEXAAK0@Z

• 0x4233f8 ?OnMinimizeWindow@COVDialog@OUI@@MAE_NPAX@Z

• 0x4233fc ?OnMaximizeWindow@COVDialog@OUI@@MAE_NPAX@Z

• 0x423400 ?OnRestoreWindow@COVDialog@OUI@@MAE_NPAX@Z

• 0x423404 ?OnHideWindow@COVDialog@OUI@@MAE_NPAX@Z

• 0x423408 ?OnOK@COVDialog@OUI@@MAE_NPAX@Z

• 0x42340c ?OnCancel@COVDialog@OUI@@MAE_NPAX@Z

• 0x423410 ??0COVButton@OUI@@QAE@XZ

• 0x423414 ??1COVButton@OUI@@UAE@XZ

• 0x423418 ??0_UIButtonHelper@OUI@@QAE@HPB_W00PAUIUIButtonListener@1@@Z

• 0x42341c ?LoadImageFromFile@ORES_TABLE@OUI@@QAE_NPB_WPAPAUIImage@2@_N@Z

• 0x423420 ?GetResTable@ORES_TABLE@OUI@@SAPAV12@XZ

• 0x423424 ?LoadImageW@ORES_TABLE@OUI@@QAEPAUIImage@2@PB_W@Z

• 0x423428 ??0COSize@OUI@@QAE@UtagSIZE@@@Z

• 0x42342c ??BCORect@OUI@@QAEPAUtagRECT@@XZ

• 0x423430 ?RecalcLayout@COVWnd@OUI@@UAE_NXZ

• 0x423434 ??0COPoint@OUI@@QAE@XZ

• 0x423438 ??0COString@OUI@@QAE@ABV01@@Z

• 0x42343c ?GetObjectName@COVButton@OUI@@UAE?AVCOString@2@XZ

• 0x423440 ?GetMObjectName@COVButton@OUI@@UAE?AVCOString@2@XZ

• 0x423444 ?UpdateRealWndVisibility@COVWnd@OUI@@UAE_NXZ

• 0x423448 ?OnClose@COVWnd@OUI@@UAEXXZ

• 0x42344c ?IsTabWnd@COVWnd@OUI@@UAE_NXZ

• 0x423450 ?WantReturn@COVButton@OUI@@UAE_NXZ

• 0x423454 ?DoPaint@COVWnd@OUI@@UAE_NPAUIRender@2@VCOPoint@2@@Z

• 0x423458 ?Initialize@COVWnd@OUI@@UAE_NPAVCOResNode@2@@Z

• 0x42345c ?UpdateWndAttribs@COVButton@OUI@@UAE_NPAVCOMapAttrib@2@@Z

• 0x423460 ?UpdateClassStyle@COVWnd@OUI@@UAE_N_N@Z

• 0x423464 ?OnInitialUpdate@COVWnd@OUI@@UAEXXZ

• 0x423468 ?GetAutoWidth@COVButton@OUI@@UAE_NAAH@Z

• 0x42346c ?GetAutoHeight@COVButton@OUI@@UAE_NAAH@Z

• 0x423470 ?GetRefWidth@COVButton@OUI@@UAEHXZ

• 0x423474 ?ResetWindowSize@COVWnd@OUI@@UAEXXZ

• 0x423478 ?Hittest@COVWnd@OUI@@UAEPAV12@VCOPoint@2@@Z

• 0x42347c ?Activate@COVButton@OUI@@UAE_NXZ

• 0x423480 ?UpdateWndState@COVButton@OUI@@UAEXW4_VWND_STATE@2@@Z

• 0x423484 ?GetDefaultClassStyle@COVButton@OUI@@UAE?AVCOString@2@XZ

• 0x423488 ?CalcRequredSize@COVWnd@OUI@@UAE?AVCOSize@2@XZ

• 0x42348c ?PreTranslateMessage@COVWnd@OUI@@UAEJPAUtagMSG@@@Z

• 0x423490 ?PreHandleMessage@COVWnd@OUI@@UAEJPAUHWND__@@IIJ@Z

• 0x423494 ?MessageHandler@COVWnd@OUI@@UAEJIIJ@Z

• 0x423498 ?OnKeyDown@COVWnd@OUI@@UAE_NIII@Z

• 0x42349c ?OnKeyUp@COVButton@OUI@@MAE_NIII@Z

• 0x4234a0 ?OnLButtonDown@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z

• 0x4234a4 ?OnLButtonUp@COVButton@OUI@@MAE_NIVCOPoint@2@@Z

• 0x4234a8 ?OnTimer@COVWnd@OUI@@UAE_NI@Z

• 0x4234ac ?OnWindowPosChanged@COVWnd@OUI@@UAE_NPAV12@@Z

• 0x4234b0 ?OnShowWindow@COVWnd@OUI@@UAEX_N@Z

• 0x4234b4 ?SelectAll@COVContainer@OUI@@UAEXXZ

• 0x4234b8 ?DeSelectAll@COVContainer@OUI@@UAEXPAVCOVWnd@2@@Z

• 0x4234bc ?GetNavegateWnd@COVContainer@OUI@@UAEPAVCOVWnd@2@W4OVCTN_DIR@12@@Z

• 0x4234c0 ?OnChildWndsChanged@COVContainer@OUI@@MAEXXZ

• 0x4234c4 ?HittestChildWnd@COVContainer@OUI@@UAEPAVCOVWnd@2@VCOPoint@2@0@Z

• 0x4234c8 ?AddChildWnd@COVContainer@OUI@@UAEPAVCOVWnd@2@PAVCOResNode@2@@Z

• 0x4234cc ?EnsureVisible@COVContainer@OUI@@UAE_NPAVCOVWnd@2@@Z

• 0x4234d0 ?OnShowWindow@COVContainer@OUI@@MAEX_N@Z

• 0x4234d4 ?OnWindowSizeChanged@COVWnd@OUI@@UAEXUtagSIZE@@@Z

• 0x4234d8 ?OnWindowPosChanged@COVContainer@OUI@@MAE_NPAVCOVWnd@2@@Z

• 0x4234dc ?OnDestroy@COVWnd@OUI@@UAEXXZ

• 0x4234e0 ?OnDropFile@COVWnd@OUI@@UAE_NPAUHDROP__@@@Z

• 0x4234e4 ?OnWindowSize@COVWnd@OUI@@UAE_NXZ

• 0x4234e8 ?OnLButtonLongPressed@COVWnd@OUI@@UAE_NXZ

• 0x4234ec ?OnMouseActive@COVWnd@OUI@@UAEHII@Z

• 0x4234f0 ?OnContextMenu@COVWnd@OUI@@UAE_NPAV12@VCOPoint@2@@Z

• 0x4234f4 ?OnKillFocus@COVWnd@OUI@@UAE_NPAV12@@Z

• 0x4234f8 ?OnSetFocus@COVWnd@OUI@@UAE_NPAV12@@Z

• 0x4234fc ?OnTimer@COVContainer@OUI@@MAE_NI@Z

• 0x423500 ?OnSetCursor@COVWnd@OUI@@UAE_NVCOPoint@2@@Z

• 0x423504 ?OnRButtonUp@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z

• 0x423508 ?OnRButtonDown@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z

• 0x42350c ?OnRButtonDblClk@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z

• 0x423510 ?OnMouseWheel@COVWnd@OUI@@UAE_NIFVCOPoint@2@@Z

• 0x423514 ?OnMouseHWheel@COVWnd@OUI@@UAE_NIFVCOPoint@2@@Z

• 0x423518 ?OnMouseEnter@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z

• 0x42351c ?OnMouseMove@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z

• 0x423520 ?OnMouseLeave@COVWnd@OUI@@UAE_NXZ

• 0x423524 ?OnMouseHover@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z

• 0x423528 ?OnMButtonUp@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z

• 0x42352c ?OnMButtonDown@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z

• 0x423530 ?OnMButtonDblClk@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z

• 0x423534 ?OnLButtonUp@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z

• 0x423538 ?OnLButtonDown@COVContainer@OUI@@MAE_NIVCOPoint@2@@Z

• 0x42353c ?OnLButtonDblClk@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z

• 0x423540 ?OnKeyUp@COVWnd@OUI@@UAE_NIII@Z

• 0x423544 ?OnKeyDown@COVContainer@OUI@@MAE_NIII@Z

• 0x423548 ?OnVScroll@COVWnd@OUI@@UAE_NII@Z

• 0x42354c ?GetClientRect@COVWnd@OUI@@QAE_NPAUtagRECT@@@Z

• 0x423550 ?OnChar@COVWnd@OUI@@UAE_NIII@Z

• 0x423554 ?OnScroll@COVWnd@OUI@@UAEXXZ

• 0x423558 ?MessageHandler@COVContainer@OUI@@MAEJIIJ@Z

• 0x42355c ?DoEvent@COVWnd@OUI@@UAEXAAUtagTEventUI@2@@Z

• 0x423560 ?PreHandleMessage@COVContainer@OUI@@MAEJPAUHWND__@@IIJ@Z

• 0x423564 ?PreTranslateMessage@COVContainer@OUI@@MAEJPAUtagMSG@@@Z

• 0x423568 ?OnDragLeave@COVWnd@OUI@@UAEXPAUIDataObject@@@Z

• 0x42356c ?OnDropEx@COVWnd@OUI@@UAEKPAUIDataObject@@KKVCOPoint@2@@Z

• 0x423570 ?OnDrop@COVWnd@OUI@@UAEHPAUIDataObject@@KVCOPoint@2@@Z

• 0x423574 ?OnDragOver@COVWnd@OUI@@UAEKPAUIDataObject@@KVCOPoint@2@@Z

• 0x423578 ?OnDragEnter@COVWnd@OUI@@UAEKPAUIDataObject@@KVCOPoint@2@@Z

• 0x42357c ?OnEndDrag@COVWnd@OUI@@UAEXPAVCODataSource@2@KJ@Z

• 0x423580 ?OnBeginDrag@COVWnd@OUI@@UAEXPAVCODataSource@2@@Z

• 0x423584 ?CreateDataSource@COVWnd@OUI@@UAEPAVCODataSource@2@XZ

• 0x423588 ?OnDraggingBorder@COVWnd@OUI@@UAEKW4ODragDirection@12@ABVCOPoint@2@ABVCORect@2@1@Z

• 0x42358c ?GetDragImage@COVWnd@OUI@@UAEPAUHBITMAP__@@AAK@Z

• 0x423590 ?AdjustScrollBar@COVWnd@OUI@@UAE_NVCOPoint@2@VCOSize@2@@Z

• 0x423594 ?CalcRequredSize@COVContainer@OUI@@UAE?AVCOSize@2@XZ

• 0x423598 ?GetSBPageSize@COVWnd@OUI@@UAE_NHAAK@Z

• 0x42359c ?GetSBLineSize@COVWnd@OUI@@UAE_NHAAK@Z

• 0x4235a0 ?EnableScrollBar@COVWnd@OUI@@UAEXH_N@Z

• 0x4235a4 ?ShowScrollBar@COVWnd@OUI@@UAEXH_N@Z

• 0x4235a8 ?UpdatePopupWndPos@COVWnd@OUI@@UAEXAAVCOPoint@2@ABVCOSize@2@@Z

• 0x4235ac ?OnClosePopupWnd@COVWnd@OUI@@UAE_NPAVCOVPopupWnd@2@@Z

• 0x4235b0 ?OnPopupMenuItemClicked@COVWnd@OUI@@UAEXI@Z

• 0x4235b4 ?OnShowPopupWnd@COVWnd@OUI@@UAEXPAVCOVPopupWnd@2@@Z

• 0x4235b8 ?DoSelect@COVWnd@OUI@@UAEX_N@Z

• 0x4235bc ?OnSelecting@COVWnd@OUI@@UAE_NXZ

• 0x4235c0 ?IsSelected@COVView@OUI@@UBE_NXZ

• 0x4235c4 ?SetReDraw@COVWnd@OUI@@UAEX_N@Z

• 0x4235c8 ?GetBkImage@COVWnd@OUI@@UAEPAUIImage@2@XZ

• 0x4235cc ?GetFont@COVWnd@OUI@@UAEPAUIFont@2@XZ

• 0x4235d0 ?GetDefaultClassStyle@COVWnd@OUI@@UAE?AVCOString@2@XZ

• 0x4235d4 ?UpdateWndState@COVWnd@OUI@@UAEXW4_VWND_STATE@2@@Z

• 0x4235d8 ?Activate@COVWnd@OUI@@UAE_NXZ

• 0x4235dc ?GetShortKeyWnd@COVWnd@OUI@@UAEPAV12@_W@Z

• 0x4235e0 ?GetNextTab@COVWnd@OUI@@UAEPAV12@_N@Z

• 0x4235e4 ?Hittest@COVView@OUI@@UAEPAVCOVWnd@2@VCOPoint@2@@Z

• 0x4235e8 ?GetToolTip@COVWnd@OUI@@UAE?AVCOString@2@XZ

• 0x4235ec ?GetWindowTextW@COVWnd@OUI@@UAE?AVCOString@2@XZ

• 0x4235f0 ?GetInvalidRgn@COVWnd@OUI@@UAEXAAPAUHRGN__@@@Z

• 0x4235f4 ?GetWindowRect@COVWnd@OUI@@UAE_NPAUtagRECT@@@Z

• 0x4235f8 ?ResetWindowSize@COVContainer@OUI@@UAEXXZ

• 0x4235fc ?AdjustClient@COVWnd@OUI@@UAE_NXZ

• 0x423600 ?GetRefWidth@COVWnd@OUI@@UAEHXZ

• 0x423604 ?GetAutoHeight@COVContainer@OUI@@MAE_NAAH@Z

• 0x423608 ?GetAutoWidth@COVContainer@OUI@@MAE_NAAH@Z

• 0x42360c ?CalcHeight@COVWnd@OUI@@UAE_NVCOSize@2@0AAH@Z

• 0x423610 ?CalcWidth@COVWnd@OUI@@UAE_NVCOSize@2@0AAH@Z

• 0x423614 ?RecalcLayout@COVContainer@OUI@@UAE_NXZ

• 0x423618 ?CopyFrom@COVWnd@OUI@@UAEXPAV12@@Z

• 0x42361c ?IsKindOf@COVWnd@OUI@@UAE_NPB_W@Z

• 0x423620 ?UpdateClassStyle@COVContainer@OUI@@UAE_N_N@Z

• 0x423624 ?UpdateWndAttribs@COVView@OUI@@UAE_NPAVCOMapAttrib@2@@Z

• 0x423628 ?Initialize@COVContainer@OUI@@UAE_NPAVCOResNode@2@@Z

• 0x42362c ?InitializeControl@COVWnd@OUI@@UAE_NPAV12@@Z

• 0x423630 ?DrawTextW@COVWnd@OUI@@MAE_NPAUIRender@2@VCORect@2@K@Z

• 0x423634 ?DrawBkGround@COVWnd@OUI@@MAE_NPAUIRender@2@VCORect@2@K@Z

• 0x423638 ?Draw@COVWnd@OUI@@MAE_NPAUIRender@2@VCORect@2@@Z

• 0x42363c ?GetPaintAlpha@COVWnd@OUI@@UAEHXZ

• 0x423640 ?DoPaint@COVContainer@OUI@@UAE_NPAUIRender@2@VCOPoint@2@@Z

• 0x423644 ?GetClassStyle@COVWnd@OUI@@UAEKXZ

• 0x423648 ?WantReturn@COVWnd@OUI@@UAE_NXZ

• 0x42364c ?IsTabWnd@COVContainer@OUI@@UAE_NXZ

• 0x423650 ?OnClose@COVContainer@OUI@@UAEXXZ

• 0x423654 ?UpdateRealWndVisibility@COVContainer@OUI@@UAE_NXZ

• 0x423658 ?GetClassNameW@COVWnd@OUI@@UAE?AVCOString@2@XZ

• 0x42365c ?GetWindowName@COVWnd@OUI@@UAE?AVCOString@2@XZ

• 0x423660 ?CreateWnd@COVWnd@OUI@@UAE_NPAUHWND__@@KKVCORect@2@@Z

• 0x423664 ?GetMObjectName@COVView@OUI@@UAE?AVCOString@2@XZ

• 0x423668 ?GetEventSinkMap@COObject@OUI@@MBEPBUOUI_EVENTSINKMAP@2@XZ

• 0x42366c ?GetDispatchMap@COObject@OUI@@MBEPBUOUI_DISPMAP@2@XZ

• 0x423670 ?GetInterfaceMap@COObject@OUI@@MBEPBUOUI_INTERFACEMAP@2@XZ

• 0x423674 ?GetTypeLib@COObject@OUI@@UAEJKPAPAUITypeLib@@@Z

• 0x423678 ?GetTypeLibCache@COObject@OUI@@UAEPAVCOTypeLibCache@2@XZ

• 0x42367c ?GetTypeInfoCount@COObject@OUI@@UAEIXZ

• 0x423680 ?GetDispatchIID@COObject@OUI@@UAE_NPAU_GUID@@@Z

• 0x423684 ?IsInvokeAllowed@COObject@OUI@@UAE_NJ@Z

• 0x423688 ?OnFinalRelease@COObject@OUI@@UAEXXZ

• 0x42368c ?GetObjectName@COVView@OUI@@UAE?AVCOString@2@XZ

• 0x423690 ?IsWindowEnabled@COVWnd@OUI@@QBE_NXZ

• 0x423694 ?GetUIManager@COUIManager@OUI@@SAPAV12@XZ

• 0x423698 ?AddUIHandler@COUIManager@OUI@@QAEXV?$function@$$A6AXXZ@boost@@_NPAX@Z

• 0x42369c ?TrimLeft@COString@OUI@@QAEXPB_W@Z

• 0x4236a0 ?MessageBoxW@COVDialog@OUI@@QAEHPB_WI@Z

• 0x4236a4 ?GetRootWnd@COVWnd@OUI@@QAEPAV12@XZ

• 0x4236a8 ?EnableWindow@COVWnd@OUI@@UAEX_N@Z

• 0x4236ac ?SetWindowTextW@COVWnd@OUI@@UAEXPB_W@Z

• 0x4236b0 ?ShowViewByID@COVViewStack@OUI@@QAEXPB_W_N@Z

• 0x4236b4 ?Invalidate@COVWnd@OUI@@UAEXXZ

• 0x4236b8 ?IsWindowVisible@COVWnd@OUI@@QBE_N_N@Z

• 0x4236bc ?SetFocus@COVWnd@OUI@@QAEXXZ

• 0x4236c0 ?GetText@COVEdit@OUI@@QBE?AVCOString@2@XZ

• 0x4236c4 ?GetSafeHwnd@COVWnd@OUI@@QAEQAUHWND__@@XZ

• 0x4236c8 ?ShowWindow@COVWnd@OUI@@UAEX_N@Z

• 0x4236cc ?Format@COString@OUI@@QAAHPB_WZZ

• 0x4236d0 ?GetSelectedView@COVViewStack@OUI@@QAEHXZ

• 0x4236d4 ?GetControl@COVWnd@OUI@@QAEPAUIControl@2@XZ

• 0x4236d8 ?GetStringTable@OSTRING_TABLE@OUI@@SAPAV12@XZ

• 0x4236dc ?LoadStringW@OSTRING_TABLE@OUI@@QAE?AVCOString@2@PB_W@Z

• 0x4236e0 ?EnableChildWnd@COVContainer@OUI@@QAEXPB_W_N1@Z

• 0x4236e4 ?OnInitDialog@COVDialog@OUI@@UAE_NXZ

• 0x4236e8 ??0CORect@OUI@@QAE@XZ

• 0x4236ec ??1COVDialog@OUI@@UAE@XZ

• 0x4236f0 ??0COVDialog@OUI@@QAE@PB_WPAVCOVWnd@1@@Z

• 0x4236f4 ?DoModal@COVDialog@OUI@@UAEHXZ

• 0x4236f8 ?UpdateStringTableXML@OSTRING_TABLE@OUI@@QAE_NPB_W0@Z

• 0x4236fc ?GetGlobalData@OGLOBAL_DATA@OUI@@SAPAV12@XZ

• 0x423700 ?Initialize@COUIManager@OUI@@QAE_NPAUHINSTANCE__@@PA_W111_NPB_W3@Z

• 0x423704 ?Replace@COString@OUI@@QAEHPB_W0@Z

• 0x423708 ?find@?$_Tree@V?$_Tmap_traits@VCOString@OUI@@V12@U?$less@VCOString@OUI@@@std@@V?$allocator@U?$pair@$$CBVCOString@OUI@@V12@@std@@@4@$0A@@std@@@std@@QAE?AV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBVCOString@OUI@@V12@@std@@@std@@@std@@@2@ABVCOString@OUI@@@Z

• 0x42370c ?IsEmpty@COString@OUI@@QBEHXZ

• 0x423710 ?SetText@COVEdit@OUI@@QAEXPB_W@Z

• 0x423714 ?OnInitialUpdate@COVContainer@OUI@@UAEXXZ

• 0x423718 ?OKILL_FOCUS@COVEvent@OUI@@2V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@B

• 0x42371c ?OEN_CHANGED@COVEvent@OUI@@2V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@B

• 0x423720 ?OBN_CLICKED@COVEvent@OUI@@2V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@B

• 0x423724 ?GetChildWnd@COVContainer@OUI@@QAEPAVCOVWnd@2@PB_W@Z

• 0x423728 ?AddControl@CODataExchange@OUI@@QAEXPB_WPAVCOVWnd@2@@Z

• 0x42372c ??4COString@OUI@@QAEAAV01@PB_W@Z

• 0x423730 ??0COString@OUI@@QAE@XZ

• 0x423734 ?CreateChildWnd@COVContainer@OUI@@UAEPAVCOVWnd@2@PAVCOResNode@2@@Z

• 0x423738 ?FindVWnd@CODataExchange@OUI@@QAEPAVCOVWnd@2@PB_W@Z

• 0x42373c ?end@?$_Tree@V?$_Tmap_traits@VCOString@OUI@@V12@U?$less@VCOString@OUI@@@std@@V?$allocator@U?$pair@$$CBVCOString@OUI@@V12@@std@@@4@$0A@@std@@@std@@QAE?AV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBVCOString@OUI@@V12@@std@@@std@@@std@@@2@XZ

• 0x423740 ??1COString@OUI@@QAE@XZ

• 0x423744 ??0COString@OUI@@QAE@PB_W@Z

• 0x423748 ?IsEmpty@CODataExchange@OUI@@QAE_NXZ

• 0x42374c ??1CODataExchange@OUI@@QAE@XZ

• 0x423750 ??0CODataExchange@OUI@@QAE@XZ

• 0x423754 ??1COVView@OUI@@UAE@XZ

• 0x423758 ??0COVView@OUI@@QAE@XZ

• 0x42375c ??BCOString@OUI@@QBEPB_WXZ

• 0x423760 ?GetLength@COString@OUI@@QBEHXZ

• 0x423764 ?DoPaintChildWnd@COVContainer@OUI@@UAE_NPAUIRender@2@VCOPoint@2@1VCORect@2@@Z

• 0x423768 ?PostAdjustLayout@COVContainer@OUI@@UAE_NVCOPoint@2@VCOSize@2@1_N@Z

• 0x42376c ?AdjustLocation@COVContainer@OUI@@UAE_NVCOPoint@2@VCOSize@2@AAV42@@Z

• 0x423770 ?AdjustLayout@COVContainer@OUI@@UAE_NVCOSize@2@@Z

• 0x423774 ?CanMultiSel@COVContainer@OUI@@UAE_NXZ

• 0x423778 ?OnHScroll@COVWnd@OUI@@UAE_NII@Z

• 0x42377c ?OnClickedChildWnd@COVContainer@OUI@@UAE_NPAVCOVWnd@2@@Z

• 0x423780 ?OnAnimationStop@COVWnd@OUI@@UAEXI@Z

Library MSVCP110.dll:

• 0x4230e8 ?_Syserror_map@std@@YAPBDH@Z

• 0x4230ec ?_Winerror_map@std@@YAPBDH@Z

• 0x4230f0 ?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z

• 0x4230f4 ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ

• 0x4230f8 ?id@?$collate@D@std@@2V0locale@2@A

• 0x4230fc ?tolower@?$ctype@D@std@@QBEDD@Z

• 0x423100 ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z

• 0x423104 ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z

• 0x423108 _Strxfrm

• 0x42310c _Strcoll

• 0x423110 ??Bid@locale@std@@QAEIXZ

• 0x423114 ?id@?$ctype@D@std@@2V0locale@2@A

• 0x423118 ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ

• 0x42311c ??0_Lockit@std@@QAE@H@Z

• 0x423120 ??0_Locinfo@std@@QAE@PBD@Z

• 0x423124 ??1_Lockit@std@@QAE@XZ

• 0x423128 ??1_Locinfo@std@@QAE@XZ

• 0x42312c ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ

• 0x423130 ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x423134 ?_Incref@facet@locale@std@@UAEXXZ

• 0x423138 ?_Xout_of_range@std@@YAXPBD@Z

• 0x42313c ?_Xlength_error@std@@YAXPBD@Z

• 0x423140 ?_Xbad_alloc@std@@YAXXZ

• 0x423144 ??1facet@locale@std@@MAE@XZ

• 0x423148 ??_7_Facet_base@std@@6B@

• 0x42314c ??_7facet@locale@std@@6B@

• 0x423150 ??0facet@locale@std@@IAE@I@Z

Library WS2_32.dll:

• 0x4232cc WSAStartup

• 0x4232d0 WSACleanup

Library MSVCR110.dll:

• 0x423158 memchr

• 0x42315c _purecall

• 0x423160 ??_V@YAXPAX@Z

• 0x423164 exit

• 0x423168 ??8type_info@@QBE_NABV0@@Z

• 0x42316c _wcslwr_s

• 0x423170 swprintf_s

• 0x423174 wcschr

• 0x423178 ?what@exception@std@@UBEPBDXZ

• 0x42317c ??0exception@std@@QAE@ABQBD@Z

• 0x423180 _wtoi

• 0x423184 _wfopen_s

• 0x423188 fread

• 0x42318c fclose

• 0x423190 __RTDynamicCast

• 0x423194 memcpy

• 0x423198 strerror

• 0x42319c ??0exception@std@@QAE@ABQBDH@Z

• 0x4231a0 sprintf_s

• 0x4231a4 __CxxFrameHandler3

• 0x4231a8 _CxxThrowException

• 0x4231ac memset

• 0x4231b0 ??1type_info@@UAE@XZ

• 0x4231b4 _lock

• 0x4231b8 _unlock

• 0x4231bc _calloc_crt

• 0x4231c0 strchr

• 0x4231c4 ??0bad_cast@std@@QAE@PBD@Z

• 0x4231c8 ??1bad_cast@std@@UAE@XZ

• 0x4231cc ??0bad_cast@std@@QAE@ABV01@@Z

• 0x4231d0 ??0exception@std@@QAE@ABV01@@Z

• 0x4231d4 memmove

• 0x4231d8 ??2@YAPAXI@Z

• 0x4231dc wcscpy_s

• 0x4231e0 _wcsicmp

• 0x4231e4 realloc

• 0x4231e8 free

• 0x4231ec ??3@YAXPAX@Z

• 0x4231f0 ??1exception@std@@UAE@XZ

• 0x4231f4 __dllonexit

• 0x4231f8 _onexit

• 0x4231fc ?terminate@@YAXXZ

• 0x423200 _XcptFilter

• 0x423204 __crtGetShowWindowMode

• 0x423208 _amsg_exit

• 0x42320c __wgetmainargs

• 0x423210 __set_app_type

• 0x423214 _controlfp_s

• 0x423218 _invoke_watson

• 0x42321c __crtSetUnhandledExceptionFilter

• 0x423220 _except_handler4_common

• 0x423224 __crtTerminateProcess

• 0x423228 __crtUnhandledException

• 0x42322c _crt_debugger_hook

• 0x423230 _commode

• 0x423234 _fmode

• 0x423238 _wcmdln

• 0x42323c _initterm

• 0x423240 _initterm_e

• 0x423244 __setusermatherr

• 0x423248 _configthreadlocale

• 0x42324c _cexit

• 0x423250 _exit

Library isafepxy.dll:

• 0x423338 ISAFE_WriteProgramLogNoMask

• 0x42333c ISAFE_InitProgramLogEx

• 0x423340 ?ExcuteReporter@isafeBugReporter@@YAJKPB_W000P6GKK00@Z@Z

• 0x423344 ISAFE_CloseProgramLog

• 0x423348 ?instance@SCommuMod@commumod@elex@@SAPAV123@XZ

• 0x42334c ?InitialCommu@SCommuMod@commumod@elex@@SAHKPB_W@Z

• 0x423350 ?SendAction@SCommuMod@commumod@elex@@SAHPB_W0@Z

• 0x423354 ?DivertOp@SCommuMod@commumod@elex@@SAHKKKKPB_WH@Z

• 0x423358 ISAFE_WriteProgramLogString

• 0x42335c ?ClearCommu@SCommuMod@commumod@elex@@SAHXZ

• 0x423360 ISAFE_WriteProgramLog

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.

FireEye	Generic.mg.bb115e92474dbb68
Cylance	Unsafe
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	AdWare:Win32/Generic.0d1e6a21
K7GW	Riskware ( 0040eff71 )
Cyren	W32/S-37eba679!Eldorado
APEX	Malicious
Kaspersky	not-a-virus:HEUR:AdWare.Win32.ELEX.gen
SUPERAntiSpyware	PUP.YAC/Variant
Avast	Win32:Elex-P [Adw]
Tencent	Malware.Win32.Gencirc.114bdd2b
Comodo	ApplicUnwnt@#10odqxufcjfxk
DrWeb	Adware.Mutabaha.582
Invincea	Yet Another Cleaner (PUA)
McAfee-GW-Edition	PUP-GJL
Sophos	Yet Another Cleaner (PUA)
Jiangmin	AdWare.ELEX.azm
Webroot	W32.Adware.Elex
Microsoft	BrowserModifier:Win32/Xeelyak
ZoneAlarm	not-a-virus:HEUR:AdWare.Win32.ELEX.gen
GData	Win32.Application.Elex.O
McAfee	PUP-GJL
VBA32	Adware.Elex
ESET-NOD32	a variant of Win32/Adware.ELEX.TN.gen
Yandex	Trojan.GenAsa!WVfQ18lydG0
Fortinet	Riskware/Elex
AVG	Win32:Elex-P [Adw]
Panda	PUP/YAC