3641fe7e6c4fdab70b6e7f40ad261dc4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3641fe7e6c4fdab70b6e7f40ad261dc4_JaffaCakes118
Size

1.2MB
MD5

3641fe7e6c4fdab70b6e7f40ad261dc4
SHA1

bb33d9ef237531fc4a868cf4e3dc5ca57e5bc9af
SHA256

99f5064e5c6c0bbe349b65a0546c31a96bc6ba44281c63b8a2375c5b8ecd338b
SHA512

0b0403857e781ab213e41853ffba6a886d7bad487a3ba4aa8703aa6ba22d5a8108e05e18e83ef170bddc7c34902af3b45ee0d5749a525d2f4499a4388ec282a7
SSDEEP

24576:AuaNgVxTkrIWBI5r6ESfKMacrli5xE9WVnHjuCJZ6qfGzHHVFH0:AuaaVxsIWBALMac4MWVnDPksgH110

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
3641fe7e6c4fdab70b6e7f40ad261dc4_JaffaCakes118
unpack003/content/timevsmoney/clearhist.exe
unpack003/content/timevsmoney/uninstall.exe
unpack001/tbu02243/clearhist.exe
unpack001/tbu02243/siteActiv_plugin.dll
unpack001/tbu02243/tbhelper.dll
unpack001/tbu02243/timevsmoney.dll
unpack001/tbu02243/uninstall.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

3641fe7e6c4fdab70b6e7f40ad261dc4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a23455b2d570c1e80b11b92360e41c00

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMP/$_3_
.zip
chrome/timevsmoney.jar
.zip
content/timevsmoney/1.png
.png
content/timevsmoney/10.png
.png
content/timevsmoney/100.png
.png
content/timevsmoney/101.png
.png
content/timevsmoney/102.png
.png
content/timevsmoney/103.png
.png
content/timevsmoney/104.png
.png
content/timevsmoney/105.png
.png
content/timevsmoney/106.png
.png
content/timevsmoney/107.png
.png
content/timevsmoney/108.png
.png
content/timevsmoney/109.png
.png
content/timevsmoney/11.png
.png
content/timevsmoney/110.png
.png
content/timevsmoney/111.png
.png
content/timevsmoney/112.png
.png
content/timevsmoney/113.png
.png
content/timevsmoney/114.png
.png
content/timevsmoney/115.png
.png
content/timevsmoney/116.png
.png
content/timevsmoney/117.png
.png
content/timevsmoney/118.png
.png
content/timevsmoney/119.png
.png
content/timevsmoney/12.png
.png
content/timevsmoney/120.png
.png
content/timevsmoney/121.png
.png
content/timevsmoney/122.png
.png
content/timevsmoney/123.png
.png
content/timevsmoney/124.png
.png
content/timevsmoney/125.png
.png
content/timevsmoney/126.png
.png
content/timevsmoney/127.png
.png
content/timevsmoney/128.png
.png
content/timevsmoney/129.png
.png
content/timevsmoney/13.png
.png
content/timevsmoney/130.png
.png
content/timevsmoney/131.png
.png
content/timevsmoney/132.png
.png
content/timevsmoney/133.png
.png
content/timevsmoney/134.png
.png
content/timevsmoney/135.png
.png
content/timevsmoney/136.png
.png
content/timevsmoney/137.png
.png
content/timevsmoney/138.png
.png
content/timevsmoney/139.png
.png
content/timevsmoney/14.png
.png
content/timevsmoney/140.png
.png
content/timevsmoney/141.png
.png
content/timevsmoney/142.png
.png
content/timevsmoney/143.png
.png
content/timevsmoney/144.png
.png
content/timevsmoney/145.png
.png
content/timevsmoney/146.png
.png
content/timevsmoney/147.png
.png
content/timevsmoney/148.png
.png
content/timevsmoney/149.png
.png
content/timevsmoney/15.png
.png
content/timevsmoney/150.png
.png
content/timevsmoney/151.png
.png
content/timevsmoney/152.png
.png
content/timevsmoney/153.png
.png
content/timevsmoney/154.png
.png
content/timevsmoney/155.png
.png
content/timevsmoney/156.png
.png
content/timevsmoney/157.png
.png
content/timevsmoney/158.png
.png
content/timevsmoney/159.png
.png
content/timevsmoney/16.png
.png
content/timevsmoney/160.png
.png
content/timevsmoney/161.png
.png
content/timevsmoney/162.png
.png
content/timevsmoney/163.png
.png
content/timevsmoney/164.png
.png
content/timevsmoney/165.png
.png
content/timevsmoney/166.png
.png
content/timevsmoney/167.png
.png
content/timevsmoney/168.png
.png
content/timevsmoney/169.png
.png
content/timevsmoney/17.png
.png
content/timevsmoney/170.png
.png
content/timevsmoney/171.png
.png
content/timevsmoney/172.png
.png
content/timevsmoney/173.png
.png
content/timevsmoney/174.png
.png
content/timevsmoney/175.png
.png
content/timevsmoney/176.png
.png
content/timevsmoney/177.png
.png
content/timevsmoney/178.png
.png
content/timevsmoney/179.png
.png
content/timevsmoney/18.png
.png
content/timevsmoney/180.png
.png
content/timevsmoney/181.png
.png
content/timevsmoney/182.png
.png
content/timevsmoney/183.png
.png
content/timevsmoney/184.png
.png
content/timevsmoney/185.png
.png
content/timevsmoney/186.png
.png
content/timevsmoney/187.png
.png
content/timevsmoney/188.png
.png
content/timevsmoney/189.png
.png
content/timevsmoney/19.png
.png
content/timevsmoney/190.png
.png
content/timevsmoney/191.png
.png
content/timevsmoney/192.png
.png
content/timevsmoney/193.png
.png
content/timevsmoney/194.png
.png
content/timevsmoney/195.png
.png
content/timevsmoney/196.png
.png
content/timevsmoney/197.png
.png
content/timevsmoney/198.png
.png
content/timevsmoney/199.png
.png
content/timevsmoney/2.png
.png
content/timevsmoney/20.png
.png
content/timevsmoney/200.png
.png
content/timevsmoney/201.png
.png
content/timevsmoney/202.png
.png
content/timevsmoney/203.png
.png
content/timevsmoney/204.png
.png
content/timevsmoney/205.png
.png
content/timevsmoney/206.png
.png
content/timevsmoney/207.png
.png
content/timevsmoney/208.png
.png
content/timevsmoney/209.png
.png
content/timevsmoney/21.png
.png
content/timevsmoney/210.png
.png
content/timevsmoney/211.png
.png
content/timevsmoney/212.png
.png
content/timevsmoney/213.png
.png
content/timevsmoney/214.png
.png
content/timevsmoney/215.png
.png
content/timevsmoney/216.png
.png
content/timevsmoney/217.png
.png
content/timevsmoney/218.png
.png
content/timevsmoney/219.png
.png
content/timevsmoney/22.png
.png
content/timevsmoney/220.png
.png
content/timevsmoney/221.png
.png
content/timevsmoney/222.png
.png
content/timevsmoney/223.png
.png
content/timevsmoney/224.png
.png
content/timevsmoney/225.png
.png
content/timevsmoney/226.png
.png
content/timevsmoney/227.png
.png
content/timevsmoney/228.png
.png
content/timevsmoney/229.png
.png
content/timevsmoney/23.png
.png
content/timevsmoney/230.png
.png
content/timevsmoney/231.png
.png
content/timevsmoney/232.png
.png
content/timevsmoney/233.png
.png
content/timevsmoney/234.png
.png
content/timevsmoney/235.png
.png
content/timevsmoney/236.png
.png
content/timevsmoney/237.png
.png
content/timevsmoney/238.png
.png
content/timevsmoney/239.png
.png
content/timevsmoney/24.png
.png
content/timevsmoney/25.png
.png
content/timevsmoney/26.png
.png
content/timevsmoney/27.png
.png
content/timevsmoney/28.png
.png
content/timevsmoney/29.png
.png
content/timevsmoney/3.png
.png
content/timevsmoney/30.png
.png
content/timevsmoney/31.png
.png
content/timevsmoney/32.png
.png
content/timevsmoney/33.png
.png
content/timevsmoney/34.png
.png
content/timevsmoney/35.png
.png
content/timevsmoney/36.png
.png
content/timevsmoney/37.png
.png
content/timevsmoney/38.png
.png
content/timevsmoney/39.png
.png
content/timevsmoney/4.png
.png
content/timevsmoney/40.png
.png
content/timevsmoney/41.png
.png
content/timevsmoney/42.png
.png
content/timevsmoney/43.png
.png
content/timevsmoney/44.png
.png
content/timevsmoney/45.png
.png
content/timevsmoney/46.png
.png
content/timevsmoney/47.png
.png
content/timevsmoney/48.png
.png
content/timevsmoney/49.png
.png
content/timevsmoney/5.png
.png
content/timevsmoney/50.png
.png
content/timevsmoney/51.png
.png
content/timevsmoney/52.png
.png
content/timevsmoney/53.png
.png
content/timevsmoney/54.png
.png
content/timevsmoney/55.png
.png
content/timevsmoney/56.png
.png
content/timevsmoney/57.png
.png
content/timevsmoney/58.png
.png
content/timevsmoney/59.png
.png
content/timevsmoney/6.png
.png
content/timevsmoney/60.png
.png
content/timevsmoney/61.png
.png
content/timevsmoney/62.png
.png
content/timevsmoney/63.png
.png
content/timevsmoney/64.png
.png
content/timevsmoney/65.png
.png
content/timevsmoney/66.png
.png
content/timevsmoney/67.png
.png
content/timevsmoney/68.png
.png
content/timevsmoney/69.png
.png
content/timevsmoney/7.png
.png
content/timevsmoney/70.png
.png
content/timevsmoney/71.png
.png
content/timevsmoney/72.png
.png
content/timevsmoney/73.png
.png
content/timevsmoney/74.png
.png
content/timevsmoney/75.png
.png
content/timevsmoney/76.png
.png
content/timevsmoney/77.png
.png
content/timevsmoney/78.png
.png
content/timevsmoney/79.png
.png
content/timevsmoney/8.png
.png
content/timevsmoney/80.png
.png
content/timevsmoney/81.png
.png
content/timevsmoney/82.png
.png
content/timevsmoney/83.png
.png
content/timevsmoney/84.png
.png
content/timevsmoney/85.png
.png
content/timevsmoney/86.png
.png
content/timevsmoney/87.png
.png
content/timevsmoney/88.png
.png
content/timevsmoney/89.png
.png
content/timevsmoney/9.png
.png
content/timevsmoney/90.png
.png
content/timevsmoney/91.png
.png
content/timevsmoney/92.png
.png
content/timevsmoney/93.png
.png
content/timevsmoney/94.png
.png
content/timevsmoney/95.png
.png
content/timevsmoney/96.png
.png
content/timevsmoney/97.png
.png
content/timevsmoney/98.png
.png
content/timevsmoney/99.png
.png
content/timevsmoney/basis.xml
.xml
content/timevsmoney/bubble.js
.js
content/timevsmoney/bubble.xul
.xml
content/timevsmoney/clearhist.exe
.exe windows:4 windows x86 arch:x86

22140fc584ccdb7f79e8a8b825fbd4a3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\vsp\Toolbar4\release_bin\ClearHist.pdb

Imports

kernel32

CreateToolhelp32Snapshot
Process32First
OpenProcess
TerminateProcess
Process32Next
HeapSize
InitializeCriticalSection
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
GetLastError
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
RtlUnwind
LoadLibraryA

user32

MessageBoxA

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA

shell32

ShellExecuteA

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
content/timevsmoney/contents.rdf
.xml
content/timevsmoney/icons.png
.png
content/timevsmoney/info.txt
content/timevsmoney/jscontainer.htm
.html
content/timevsmoney/md5.js
.js
content/timevsmoney/mozilla.xul
.xml
content/timevsmoney/siteActivation_URLs.txt
content/timevsmoney/tb.css
content/timevsmoney/tb.js
.js
content/timevsmoney/tb.xsl
.xml
content/timevsmoney/tb.xul
.xml
content/timevsmoney/timevsmoney.crc
content/timevsmoney/timevsmoney.inf
content/timevsmoney/uninstall.exe
.exe windows:4 windows x86 arch:x86

7008eddda5114e98f3ecd92d21fbec89

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\vsp\toolbar\toolbar45\release_bin\uninstall.pdb

Imports

kernel32

CreateMutexW
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
CloseHandle
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
Sleep
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

ole32

CoInitialize
CoUninitialize

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
content/timevsmoney/version.txt
install.rdf
.xml
tbu02243/basis.xml
.xml
tbu02243/clearhist.exe
.exe windows:4 windows x86 arch:x86

22140fc584ccdb7f79e8a8b825fbd4a3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\vsp\Toolbar4\release_bin\ClearHist.pdb

Imports

kernel32

CreateToolhelp32Snapshot
Process32First
OpenProcess
TerminateProcess
Process32Next
HeapSize
InitializeCriticalSection
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
GetLastError
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
RtlUnwind
LoadLibraryA

user32

MessageBoxA

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA

shell32

ShellExecuteA

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tbu02243/icons.bmp
tbu02243/info.txt
tbu02243/siteActiv_plugin.dll
.dll windows:4 windows x86 arch:x86

bc0ad0f98c6492f83bf0443c47f71e6d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
lstrcmpiW
GetModuleHandleW
GetModuleFileNameW
InterlockedIncrement
GetLastError
lstrlenW
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
RaiseException
LeaveCriticalSection
LoadLibraryExW
EnterCriticalSection
CreateFileA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
CreateFileW
FlushFileBuffers
LocalFree
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetProcessHeap
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
Sleep
HeapSize
CloseHandle
ReadFile
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetOEMCP
LoadLibraryA
SetStdHandle
GetConsoleCP
GetConsoleMode

user32

UnregisterClassA
CharNextW
LoadStringW

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance

oleaut32

SysAllocString
LoadTypeLi
LoadRegTypeLi
DispCallFunc
SysStringLen
VariantClear
VariantInit
VarUI4FromStr
SysFreeString

shlwapi

PathRemoveFileSpecW

Exports

Exports

PlugInvoke

Sections

.text
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tbu02243/siteActivation_URLs.txt
tbu02243/tbhelper.dll
.dll regsvr32 windows:4 windows x86 arch:x86

25987822d4f9b3e2157ded4e72643e9c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\vsp\toolbar\toolbar4\Release_bin\tbhelperU.pdb

Imports

wininet

InternetQueryOptionW
InternetCloseHandle
HttpSendRequestW
HttpQueryInfoW
FtpOpenFileW
InternetReadFile
FtpGetFileSize
InternetQueryDataAvailable
InternetSetOptionW
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpAddRequestHeadersW

rpcrt4

UuidFromStringA

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
lstrlenA
lstrlenW
DisableThreadLibraryCalls
InitializeCriticalSection
GetModuleHandleW
GetModuleFileNameW
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
SizeofResource
LoadResource
FindResourceW
SetEndOfFile
lstrcmpiW
RaiseException
CloseHandle
WaitForSingleObject
OpenThread
GlobalUnlock
GlobalLock
CreateThread
WriteFile
CreateFileW
DeleteFileW
GetCurrentThreadId
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
GetTimeZoneInformation
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
VirtualAlloc
ExitProcess
Sleep
LoadLibraryExW
LoadLibraryA
GetLocaleInfoW
FreeEnvironmentStringsA
SetConsoleCtrlHandler
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FatalAppExitA
VirtualFree
HeapCreate
IsValidCodePage
GetOEMCP
GetCPInfo
SetFilePointer
GetStartupInfoA
GetFileType
SetHandleCount
ReadFile
GetModuleFileNameA
GetStdHandle
GetCurrentThread
SetLastError
HeapFree
GetProcessHeap
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree

user32

LoadStringW
PostThreadMessageW
UnregisterClassA
SendMessageW
CloseClipboard
GetClipboardData
OpenClipboard
PeekMessageW
CharLowerBuffW
CharNextW

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW

ole32

CLSIDFromProgID
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoUninitialize
CoInitialize
CoGetInterfaceAndReleaseStream

oleaut32

VariantCopy
VarBstrCmp
UnRegisterTypeLi
RegisterTypeLi
CreateErrorInfo
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
VariantInit
SysFreeString
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysAllocString
GetErrorInfo
VariantChangeType
SetErrorInfo
SysStringLen

Exports

Exports

CreateHelperObject
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IsUnicode

Sections

.text
Size: 264KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tbu02243/timevsmoney.crc
tbu02243/timevsmoney.dll
.dll regsvr32 windows:4 windows x86 arch:x86

888bc2d4ebad10d9234d6e49fea3a47d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\vsp\toolbar\toolbar4\Release_bin\tbcore3U.pdb

Imports

wininet

FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
FindCloseUrlCache
FindFirstUrlCacheEntryW

shlwapi

PathFileExistsW
PathRemoveFileSpecW

winmm

PlaySoundW

dbghelp

SymGetModuleBase
SymGetSymFromAddr
StackWalk
SymFunctionTableAccess
SymGetLineFromAddr
SymSetOptions
SymGetOptions
SymCleanup
SymLoadModule
SymInitialize

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetVersionExW
GetCurrentThread
HeapFree
HeapAlloc
GetProcessHeap
CreateDirectoryW
GetTempPathW
SetCurrentDirectoryW
GlobalUnlock
GlobalLock
GlobalAlloc
DebugBreak
OutputDebugStringW
lstrlenA
lstrcmpW
MulDiv
IsBadCodePtr
SetUnhandledExceptionFilter
IsBadWritePtr
GetCurrentProcessId
lstrcpynW
FormatMessageW
IsBadReadPtr
ReadProcessMemory
CreateFileW
CloseHandle
OpenProcess
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
SetEvent
CreateEventW
ResumeThread
ResetEvent
WinExec
VerLanguageNameW
DeleteFileW
RemoveDirectoryW
WriteFile
CreateFileA
GetTempPathA
CopyFileW
MoveFileW
GetLongPathNameW
FreeLibrary
GetFullPathNameW
FindFirstFileW
FindNextFileW
FindClose
GlobalFree
FindResourceW
lstrcpyW
lstrcatW
DisableThreadLibraryCalls
MoveFileExW
SizeofResource
LoadResource
LoadLibraryExW
lstrlenW
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
CreateMutexW
OpenMutexW
FindResourceExW
GetUserDefaultLangID
Sleep
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
UnmapViewOfFile
TerminateThread
Process32NextW
TerminateProcess
Process32FirstW
CreateToolhelp32Snapshot
LocalFree
LocalAlloc
LockResource
GlobalSize
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
UnhandledExceptionFilter
ExitProcess
GetCommandLineA
GetSystemTimeAsFileTime
CreateThread
ExitThread
HeapReAlloc
RtlUnwind
GetThreadLocale
GetLocaleInfoA
GetACP
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
GetVersionExA
InterlockedExchange
InterlockedIncrement
GetCurrentProcess
FlushInstructionCache
RaiseException
GetCurrentThreadId
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
LoadLibraryW
OutputDebugStringA
GetLastError
SetLastError
InterlockedDecrement
GetTickCount
SetConsoleCtrlHandler
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
FlushFileBuffers
FatalAppExitA
HeapDestroy
HeapCreate
HeapSize
GetCPInfo
GetOEMCP
GetDateFormatA
IsValidCodePage
LCMapStringA
LCMapStringW
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
CompareStringA
CompareStringW
SetEnvironmentVariableA
TlsFree
IsDebuggerPresent
ReadFile
SetEndOfFile
GetConsoleCP
lstrcmpiW
GetConsoleMode

user32

LoadImageW
DrawFocusRect
GetIconInfo
GetWindowThreadProcessId
PtInRect
WindowFromDC
OffsetRect
GetMenuItemInfoW
CharUpperW
LoadMenuIndirectW
LoadMenuW
GetSubMenu
InsertMenuW
InsertMenuItemW
SetMenuItemBitmaps
EnableMenuItem
DrawEdge
GetWindowDC
DrawFrameControl
LoadBitmapW
GetCursorPos
EndMenu
DrawTextW
CopyRect
KillTimer
UpdateWindow
GetKeyState
GetSysColorBrush
SetWindowsHookExW
TrackPopupMenu
UnhookWindowsHookEx
UnregisterClassW
GetSystemMetrics
DialogBoxIndirectParamW
CharLowerW
wsprintfA
IsWindowVisible
CallNextHookEx
SetCursor
DestroyCursor
EnableWindow
MessageBeep
EnumChildWindows
SetDlgItemTextW
IsDlgButtonChecked
GetMenu
AdjustWindowRectEx
GetDlgCtrlID
GetCapture
SystemParametersInfoW
IsWindowEnabled
CheckDlgButton
EndDialog
SetActiveWindow
GetWindowRect
InflateRect
DispatchMessageW
CharUpperBuffW
DialogBoxParamW
GetActiveWindow
wsprintfW
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
ScreenToClient
CreateAcceleratorTableW
GetDC
ReleaseDC
GetDesktopWindow
GetClassNameW
SetWindowPos
RedrawWindow
GetClientRect
BeginPaint
FillRect
EndPaint
IsChild
SetFocus
GetSysColor
DestroyAcceleratorTable
CallWindowProcW
CharNextW
GetWindowTextLengthW
GetWindowTextW
DefWindowProcW
RegisterWindowMessageW
SetTimer
LoadCursorFromFileW
CharLowerBuffW
PostMessageW
GetWindowLongW
GetWindow
OpenClipboard
EmptyClipboard
CloseClipboard
MessageBoxW
GetDlgItem
GetMessagePos
MapWindowPoints
SetWindowLongW
RegisterClassExW
LoadCursorW
GetClassInfoExW
LoadStringW
GetParent
ShowWindow
MoveWindow
SetWindowTextW
CreateWindowExW
SendMessageW
GetFocus
IsWindow
DestroyWindow
DestroyMenu
CreatePopupMenu
AppendMenuW
WindowFromPoint
ClientToScreen
SetWindowRgn
TranslateMessage
GetAsyncKeyState
UnregisterClassA
SetLastErrorEx

gdi32

GetTextExtentPoint32W
SelectObject
ExtTextOutW
GetDIBits
RealizePalette
SetDIBitsToDevice
SetStretchBltMode
ExtSelectClipRgn
StretchBlt
CreateBitmap
RectVisible
StretchDIBits
CreateFontIndirectW
CreateDIBitmap
CreateRectRgn
CreateBrushIndirect
FrameRgn
CreateRectRgnIndirect
SetBkColor
SelectClipRgn
GetClipBox
RestoreDC
SaveDC
SetTextColor
SetBkMode
GetTextMetricsW
GetTextExtentPointW
CreatePen
CreatePatternBrush
Rectangle
GetStockObject
GetObjectW
GetDeviceCaps
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
DeleteDC
DeleteObject
CreateFontW
CreateDIBSection

shell32

DragQueryFileW
SHEmptyRecycleBinW
SHAddToRecentDocs
ShellExecuteW
ShellExecuteA

ole32

ReleaseStgMedium
RegisterDragDrop
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
CoUninitialize
CoInitialize
CoCreateInstance
OleUninitialize
CreateStreamOnHGlobal
OleInitialize
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
CoTaskMemRealloc
CoCreateGuid
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream

oleaut32

SysAllocString
SysFreeString
SysStringLen
VarBstrCmp
SysAllocStringByteLen
VariantInit
SysStringByteLen
VariantChangeType
VariantClear
SysAllocStringLen
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
DispCallFunc
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
SafeArrayPutElement
SafeArrayCreate
VariantCopy
VarBstrCat
GetErrorInfo
SetErrorInfo
CreateErrorInfo

Exports

Exports

??0CxExifInfo@CxImageJPG@@QAE@PAUtag_ExifInfo@1@@Z
??0CxFile@@QAE@ABV0@@Z
??0CxFile@@QAE@XZ
??0CxIOFile@@QAE@ABV0@@Z
??0CxIOFile@@QAE@PAU_iobuf@@@Z
??0CxImage@@QAE@ABV0@_N11@Z
??0CxImage@@QAE@K@Z
??0CxImage@@QAE@KKKK@Z
??0CxImage@@QAE@PAEKK@Z
??0CxImage@@QAE@PAU_iobuf@@K@Z
??0CxImage@@QAE@PAVCxFile@@K@Z
??0CxImage@@QAE@PB_WK@Z
??0CxImageGIF@@QAE@ABV0@@Z
??0CxImageGIF@@QAE@XZ
??0CxImageJPG@@QAE@ABV0@@Z
??0CxImageJPG@@QAE@XZ
??0CxMemFile@@QAE@ABV0@@Z
??0CxMemFile@@QAE@PAEK@Z
??1CxExifInfo@CxImageJPG@@QAE@XZ
??1CxFile@@UAE@XZ
??1CxIOFile@@UAE@XZ
??1CxImage@@UAE@XZ
??1CxImageGIF@@UAE@XZ
??1CxImageJPG@@UAE@XZ
??1CxMemFile@@UAE@XZ
??4CxExifInfo@CxImageJPG@@QAEAAV01@ABV01@@Z
??4CxFile@@QAEAAV0@ABV0@@Z
??4CxIOFile@@QAEAAV0@ABV0@@Z
??4CxImage@@QAEAAV0@ABV0@@Z
??4CxImageGIF@@QAEAAV0@ABV0@@Z
??4CxImageJPG@@QAEAAV0@ABV0@@Z
??4CxMemFile@@QAEAAV0@ABV0@@Z
??4CxPoint2@@QAEAAV0@ABV0@@Z
??4CxRect2@@QAEAAV0@ABV0@@Z
??_7CxFile@@6B@
??_7CxIOFile@@6B@
??_7CxImage@@6B@
??_7CxImageGIF@@6B@
??_7CxImageJPG@@6B@
??_7CxMemFile@@6B@
??_FCxExifInfo@CxImageJPG@@QAEXXZ
??_FCxIOFile@@QAEXXZ
??_FCxImage@@QAEXXZ
??_FCxMemFile@@QAEXXZ
??_OCxImage@@QAEXAAV0@@Z
?Alloc@CxMemFile@@IAEXK@Z
?AlphaClear@CxImage@@QAEXXZ
?AlphaCopy@CxImage@@QAE_NAAV1@@Z
?AlphaCreate@CxImage@@QAEXXZ
?AlphaDelete@CxImage@@QAEXXZ
?AlphaFlip@CxImage@@QAE_NXZ
?AlphaGet@CxImage@@QAEEJJ@Z
?AlphaGetMax@CxImage@@QBEEXZ
?AlphaGetPointer@CxImage@@QAEPAEJJ@Z
?AlphaInvert@CxImage@@QAEXXZ
?AlphaIsValid@CxImage@@QAE_NXZ
?AlphaMirror@CxImage@@QAE_NXZ
?AlphaPaletteClear@CxImage@@QAEXXZ
?AlphaPaletteEnable@CxImage@@QAEX_N@Z
?AlphaPaletteIsEnabled@CxImage@@QAE_NXZ
?AlphaPaletteIsValid@CxImage@@QAE_NXZ
?AlphaPaletteSplit@CxImage@@QAE_NPAV1@@Z
?AlphaSet@CxImage@@QAEXE@Z
?AlphaSet@CxImage@@QAEXJJE@Z
?AlphaSet@CxImage@@QAE_NAAV1@@Z
?AlphaSetMax@CxImage@@QAEXE@Z
?AlphaSplit@CxImage@@QAE_NPAV1@@Z
?AlphaStrip@CxImage@@QAEXXZ
?Bitfield2RGB@CxImage@@IAEXPAEGGGE@Z
?BlendPalette@CxImage@@QAEXKJ@Z
?BlendPixelColor@CxImage@@QAEXJJUtagRGBQUAD@@M_N@Z
?BlindAlphaGet@CxImage@@IAEEJJ@Z
?BlindGetPixelColor@CxImage@@IAE?AUtagRGBQUAD@@JJ@Z
?BlindGetPixelIndex@CxImage@@IAEEJJ@Z
?BlindGetPixelPointer@CxImage@@IAEPAXJJ@Z
?Clear@CxImage@@QAEXE@Z
?Close@CxIOFile@@UAE_NXZ
?Close@CxMemFile@@UAE_NXZ
?CompareColors@CxImage@@KAHPBX0@Z
?ConvertAnyFormat@CxExifInfo@CxImageJPG@@IAENPAXH@Z
?Copy@CxImage@@QAEXABV1@_N11@Z
?CopyInfo@CxImage@@IAEXABV1@@Z
?CopyToHandle@CxImage@@QAEPAXXZ
?Create@CxImage@@QAEPAXKKKK@Z
?CreateFromArray@CxImage@@QAE_NPAEKKKK_N@Z
?CreateFromHANDLE@CxImage@@QAE_NPAX@Z
?CreateFromHBITMAP@CxImage@@QAE_NPAUHBITMAP__@@PAUHPALETTE__@@@Z
?CreateFromHICON@CxImage@@QAE_NPAUHICON__@@@Z
?CreateFromMatrix@CxImage@@QAE_NPAPAEKKKK_N@Z
?Decode@CxImage@@QAE_NPAEKK@Z
?Decode@CxImage@@QAE_NPAU_iobuf@@K@Z
?Decode@CxImage@@QAE_NPAVCxFile@@K@Z
?Decode@CxImageGIF@@QAE_NPAU_iobuf@@@Z
?Decode@CxImageGIF@@QAE_NPAVCxFile@@@Z
?Decode@CxImageJPG@@QAE_NPAU_iobuf@@@Z
?Decode@CxImageJPG@@QAE_NPAVCxFile@@@Z
?DecodeExif@CxExifInfo@CxImageJPG@@QAE_NPAVCxFile@@H@Z
?DecodeExif@CxImageJPG@@QAE_NPAU_iobuf@@@Z
?DecodeExif@CxImageJPG@@QAE_NPAVCxFile@@@Z
?DecodeExtension@CxImageGIF@@IAE_NPAVCxFile@@@Z
?Destroy@CxImage@@QAE_NXZ
?DiscardAllButExif@CxExifInfo@CxImageJPG@@QAEXXZ
?Draw2@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@@Z
?Draw2@CxImage@@QAEJPAUHDC__@@JJJJ@Z
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z
?DrawLine@CxImage@@QAEXHHHHK@Z
?DrawLine@CxImage@@QAEXHHHHUtagRGBQUAD@@_N@Z
?DrawString@CxImage@@QAEJPAUHDC__@@JJPB_WUtagRGBQUAD@@1JJEE_N@Z
?DrawStringEx@CxImage@@QAEJPAUHDC__@@JJPAUtagCxTextInfo@1@_N@Z
?Enable@CxImage@@QAEX_N@Z
?EncodeExif@CxExifInfo@CxImageJPG@@QAE_NPAVCxFile@@@Z
?Eof@CxIOFile@@UAE_NXZ
?Eof@CxMemFile@@UAE_NXZ
?Error@CxIOFile@@UAEJXZ
?Error@CxMemFile@@UAEJXZ
?FindSection@CxExifInfo@CxImageJPG@@IAEPAXH@Z
?Flip@CxImage@@QAE_NXZ
?Flush@CxIOFile@@UAE_NXZ
?Flush@CxMemFile@@UAE_NXZ
?Free@CxMemFile@@IAEXXZ
?FreeMemory@CxImage@@QAEXPAX@Z
?Get16m@CxExifInfo@CxImageJPG@@IAEHPAX@Z
?Get16u@CxExifInfo@CxImageJPG@@IAEHPAX@Z
?Get32s@CxExifInfo@CxImageJPG@@IAEJPAX@Z
?Get32u@CxExifInfo@CxImageJPG@@IAEKPAX@Z
?GetBits@CxImage@@QAEPAEK@Z
?GetBpp@CxImage@@QBEGXZ
?GetBuffer@CxMemFile@@QAEPAE_N@Z
?GetC@CxIOFile@@UAEJXZ
?GetC@CxMemFile@@UAEJXZ
?GetClrImportant@CxImage@@QBEKXZ
?GetCodecOption@CxImage@@QAEKK@Z
?GetColorType@CxImage@@QAEEXZ
?GetComment@CxImageGIF@@QAEXPAD@Z
?GetDIB@CxImage@@QBEPAXXZ
?GetDisposalMethod@CxImageGIF@@QAEJXZ
?GetEffWidth@CxImage@@QBEKXZ
?GetEscape@CxImage@@QBEJXZ
?GetFlags@CxImage@@QBEKXZ
?GetFrame@CxImage@@QBEJXZ
?GetFrameDelay@CxImage@@QBEKXZ
?GetHeight@CxImage@@QBEKXZ
?GetJpegQuality@CxImage@@QBEEXZ
?GetJpegScale@CxImage@@QBEEXZ
?GetLastError@CxImage@@QAEPBDXZ
?GetLoops@CxImageGIF@@QAEJXZ
?GetNearestIndex@CxImage@@QAEEUtagRGBQUAD@@@Z
?GetNumColors@CxImage@@QBEKXZ
?GetNumFrames@CxImage@@QBEJXZ
?GetOffset@CxImage@@QAEXPAJ0@Z
?GetPalette@CxImage@@QBEPAUtagRGBQUAD@@XZ
?GetPaletteColor@CxImage@@QAE?AUtagRGBQUAD@@E@Z
?GetPaletteColor@CxImage@@QAE_NEPAE00@Z
?GetPaletteSize@CxImage@@QAEKXZ
?GetPixelColor@CxImage@@QAE?AUtagRGBQUAD@@JJ_N@Z
?GetPixelGray@CxImage@@QAEEJJ@Z
?GetPixelIndex@CxImage@@QAEEJJ@Z
?GetProgress@CxImage@@QBEJXZ
?GetSize@CxImage@@QAEJXZ
?GetTransColor@CxImage@@QAE?AUtagRGBQUAD@@XZ
?GetTransIndex@CxImage@@QBEJXZ
?GetType@CxImage@@QBEKXZ
?GetVersion@CxImage@@QAEPB_WXZ
?GetVersionNumber@CxImage@@QAE?BMXZ
?GetWidth@CxImage@@QBEKXZ
?GetXDPI@CxImage@@QBEJXZ
?GetYDPI@CxImage@@QBEJXZ
?Ghost@CxImage@@IAEXPAV1@@Z
?GifMix@CxImageGIF@@IAEXAAVCxImage@@AAUtag_image@1@@Z
?GifNextPixel@CxImageGIF@@IAEHXZ
?GrayScale@CxImage@@QAE_NXZ
?InitTextInfo@CxImage@@QAEXPAUtagCxTextInfo@1@@Z
?IsEnabled@CxImage@@QBE_NXZ
?IsGrayScale@CxImage@@QAE_NXZ
?IsIndexed@CxImage@@QBE_NXZ
?IsInside@CxImage@@QAE_NJJ@Z
?IsSamePalette@CxImage@@QAE_NAAV1@_N@Z
?IsTransparent@CxImage@@QAE_NJJ@Z
?IsTransparent@CxImage@@QBE_NXZ
?IsValid@CxImage@@QBE_NXZ
?Load@CxImage@@QAE_NPB_WK@Z
?LoadResource@CxImage@@QAE_NPAUHRSRC__@@KPAUHINSTANCE__@@@Z
?MakeBitmap@CxImage@@QAEPAUHBITMAP__@@PAUHDC__@@@Z
?Mirror@CxImage@@QAE_NXZ
?Negative@CxImage@@QAE_NXZ
?Open@CxIOFile@@QAE_NPB_W0@Z
?Open@CxMemFile@@QAE_NXZ
?ProcessExifDir@CxExifInfo@CxImageJPG@@IAE_NPAE0IQAUtag_ExifInfo@2@QAPAE@Z
?PutC@CxFile@@UAE_NE@Z
?PutC@CxIOFile@@UAE_NE@Z
?PutC@CxMemFile@@UAE_NE@Z
?Putword@CxImageGIF@@IAEXHPAVCxFile@@@Z
?RGBQUADtoRGB@CxImage@@SAKUtagRGBQUAD@@@Z
?RGBtoBGR@CxImage@@IAEXPAEH@Z
?RGBtoRGBQUAD@CxImage@@SA?AUtagRGBQUAD@@K@Z
?Read@CxIOFile@@UAEIPAXII@Z
?Read@CxMemFile@@UAEIPAXII@Z
?RotateLeft@CxImage@@QAE_NPAV1@@Z
?RotateRight@CxImage@@QAE_NPAV1@@Z
?Seek@CxIOFile@@UAE_NJH@Z
?Seek@CxMemFile@@UAE_NJH@Z
?SetClrImportant@CxImage@@QAEXK@Z
?SetCodecOption@CxImage@@QAE_NKK@Z
?SetComment@CxImageGIF@@QAEXPBD@Z
?SetDisposalMethod@CxImageGIF@@QAEXH@Z
?SetEscape@CxImage@@QAEXJ@Z
?SetFlags@CxImage@@QAEXK_N@Z
?SetFrame@CxImage@@QAEXJ@Z
?SetFrameDelay@CxImage@@QAEXK@Z
?SetGrayPalette@CxImage@@QAEXXZ
?SetJpegQuality@CxImage@@QAEXE@Z
?SetJpegScale@CxImage@@QAEXE@Z
?SetLoops@CxImageGIF@@QAEXH@Z
?SetOffset@CxImage@@QAEXJJ@Z
?SetPalette@CxImage@@QAEXKPAE00@Z
?SetPalette@CxImage@@QAEXPAUrgb_color@1@K@Z
?SetPalette@CxImage@@QAEXPAUtagRGBQUAD@@K@Z
?SetPaletteColor@CxImage@@QAEXEEEEE@Z
?SetPaletteColor@CxImage@@QAEXEK@Z
?SetPaletteColor@CxImage@@QAEXEUtagRGBQUAD@@@Z
?SetPixelColor@CxImage@@QAEXJJK@Z
?SetPixelColor@CxImage@@QAEXJJUtagRGBQUAD@@_N@Z
?SetPixelIndex@CxImage@@QAEXJJE@Z
?SetProgress@CxImage@@QAEXJ@Z
?SetStdPalette@CxImage@@QAEXXZ
?SetTransColor@CxImage@@QAEXUtagRGBQUAD@@@Z
?SetTransIndex@CxImage@@QAEXJ@Z
?SetXDPI@CxImage@@QAEXJ@Z
?SetYDPI@CxImage@@QAEXJ@Z
?Size@CxIOFile@@UAEJXZ
?Size@CxMemFile@@UAEJXZ
?Startup@CxImage@@IAEXK@Z
?Stretch@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@K@Z
?Stretch@CxImage@@QAEJPAUHDC__@@JJJJK@Z
?SwapIndex@CxImage@@QAEXEE@Z
?Tell@CxIOFile@@UAEJXZ
?Tell@CxMemFile@@UAEJXZ
?Tile@CxImage@@QAEJPAUHDC__@@PAUtagRECT@@@Z
?Transfer@CxImage@@QAE_NAAV1@@Z
?Write@CxIOFile@@UAEIPBXII@Z
?Write@CxMemFile@@UAEIPBXII@Z
?char_out@CxImageGIF@@IAEXH@Z
?cl_hash@CxImageGIF@@IAEXJ@Z
?compressLZW@CxImageGIF@@IAEXHPAVCxFile@@@Z
?compressNONE@CxImageGIF@@IAEXHPAVCxFile@@@Z
?compressRLE@CxImageGIF@@IAEXHPAVCxFile@@@Z
?decoder@CxImageGIF@@IAEFPAVCxFile@@PAVCImageIterator@@FAAH@Z
?flush_char@CxImageGIF@@IAEXXZ
?get_byte@CxImageGIF@@IAEHPAVCxFile@@@Z
?get_next_code@CxImageGIF@@IAEFPAVCxFile@@@Z
?get_num_frames@CxImageGIF@@IAEHPAVCxFile@@PAUtag_TabCol@1@PAUtag_dscgif@1@@Z
?init_exp@CxImageGIF@@IAEFF@Z
?out_line@CxImageGIF@@IAEHPAVCImageIterator@@PAEH@Z
?output@CxImageGIF@@IAEXF@Z
?process_COM@CxExifInfo@CxImageJPG@@IAEXPBEH@Z
?process_EXIF@CxExifInfo@CxImageJPG@@IAE_NPAEI@Z
?process_SOFn@CxExifInfo@CxImageJPG@@IAEXPBEH@Z
?rle_block_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z
?rle_block_out@CxImageGIF@@IAEXEPAUtag_RLE@1@@Z
?rle_clear@CxImageGIF@@IAEXPAUtag_RLE@1@@Z
?rle_compute_triangle_count@CxImageGIF@@IAEIII@Z
?rle_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z
?rle_flush_clearorrep@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z
?rle_flush_fromclear@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z
?rle_flush_withtable@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z
?rle_isqrt@CxImageGIF@@IAEII@Z
?rle_output@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z
?rle_output_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z
?rle_output_plain@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z
?rle_reset_out_clear@CxImageGIF@@IAEXPAUtag_RLE@1@@Z
?rle_write_block@CxImageGIF@@IAEXPAUtag_RLE@1@@Z
?seek_next_image@CxImageGIF@@IAEJPAVCxFile@@J@Z
CanReload
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetUpdaterAPI
MyUnregisterServer
TBStudioReg

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 372KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 256KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tbu02243/uninstall.exe
.exe windows:4 windows x86 arch:x86

7008eddda5114e98f3ecd92d21fbec89

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\vsp\toolbar\toolbar45\release_bin\uninstall.pdb

Imports

kernel32

CreateMutexW
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
CloseHandle
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
Sleep
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

ole32

CoInitialize
CoUninitialize

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tbu02243/version.txt

Sharing

General

Malware Config

Signatures

Files

a23455b2d570c1e80b11b92360e41c00

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 21KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 40KB

.rsrc Size: 18KB - Virtual size: 18KB

22140fc584ccdb7f79e8a8b825fbd4a3

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

Sections

.text Size: 28KB - Virtual size: 25KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 996B

7008eddda5114e98f3ecd92d21fbec89

Headers

File Characteristics

PDB Paths

Imports

kernel32

ole32

Sections

.text Size: 28KB - Virtual size: 24KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 1KB

22140fc584ccdb7f79e8a8b825fbd4a3

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

Sections

.text Size: 28KB - Virtual size: 25KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 996B

bc0ad0f98c6492f83bf0443c47f71e6d

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 92KB - Virtual size: 90KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 16KB - Virtual size: 21KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 18KB - Virtual size: 18KB

.text
Size: 28KB - Virtual size: 25KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 996B

.text
Size: 28KB - Virtual size: 24KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 25KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 996B

.text
Size: 92KB - Virtual size: 90KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 16KB - Virtual size: 21KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB

.text
Size: 264KB - Virtual size: 260KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 8KB - Virtual size: 22KB

.SHARED
Size: 4KB - Virtual size: 8B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 12KB - Virtual size: 11KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 372KB - Virtual size: 370KB

.data
Size: 36KB - Virtual size: 45KB

.SHARED
Size: 256KB - Virtual size: 253KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 76KB - Virtual size: 72KB

.text
Size: 28KB - Virtual size: 24KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 1KB