Nayix-Services-Setup-x64[.]exe

resource
Nayix-Services-Setup-x64.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/Nayix Services.exe

Nayix-Services-Setup-x64.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 d977740e676b93ff5249173225679982535b688ed9c1fffee7d5f51c91b3da01
MD5 61bc3488b3ce93042278772dd5fe21e2
SHA1 c80a36fcb7a4a47fef5cfadb5cadd04ad709460f
SHA512 30047cfba5ad3beb9a77dc5b1a30d094d6283dc974f0f54ed5947475946434a7e2b51fc7e8bf2b86c624a0479f3caada36436cc9e2c329d64dd884ba4896f9c3
SSDEEP 49152:axeRjJ/x9C/YbejuNsO1kD7FzmR0Z/eq5hDEXDtpvfujGdj878BsLsP/ZyIXJiDE:aQR2V+SF5ThwXD/nNdWyJ05lB67
TLSH
T1EFF5334171B4A86EF3B668326BB84D3194DF9033E8FA2A0D1B44ED17349752FD2626CD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
MD5 564e01f2c6edfb8475573e1b809cb5eb
SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
TLSH
T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb
MD5 79c27de4d1c6d295fefaa70f608f1c67
SHA1 feba90c93db3fedd450a81eb2603f793332d1a83
SHA512 fbd79f3946032821584ea2fa4b559ac5809ab45fdc9107eb47c9ff3fa3229d7748a7b2ed588709e59cce16a4f8e58ed98b46cb061acf1080e78434d184f51ec7
SSDEEP 96:oQEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YbNqkzfFc:oQEvCu5e81785qHFcU0PuAw0uyBIFc
TLSH
T1E612E892A2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Licenses/Dear-ImGui.txt

SHA256 f20418b409e53c8c9f4e90917ff395554a60320d4dfbf833da89b339cad8628a
MD5 7013e38a736873df7ab9cd8d185f0dcc
SHA1 8afba2a93dc85cef0306de45730c29b689315c5d
SHA512 909c286928bf5c8020275756fd903cc0b5138314118aab6d57e75a53245344aed3ea95e2481c61a5a6b0bea96e16151965fb4042937c2f63f888d5d539b3f117
TLSH
T16D11B61EB2560363188257600569ECC5F23BB04E7F6F1984346EF2051326458C5FFC68
MD5 SHA1 SHA512 TLSH

Licenses/Geist-OFL.txt

SHA256 1781d2806a07d91c4edf4740b88449fab7d0eadad53f7c351b94cd4d4eb8c00f
MD5 fe4cc681382eff30e91c042d87f245aa
SHA1 66ec2dfda6b19f7f060c8e06034ae720552d715a
SHA512 75382819e5f130ef3989284edc9c06066c08940f61bb7f06aa56210a0c7aaa08a1cac44a85e881e4818e4221fea20b2693d89b76b917bc8bef560192f4aa5953
SSDEEP 96:CnH6UibMxxUDfGkKnjfRU88f+BktjVKvR1wyQeQHDZo9:ersMPZW88f+XvR9QHt6
TLSH
T1FC91B92A3F4423B519C0D242F737E9DEE31A522D37AB69C9505AC16C23A6D2803FE390
MD5 SHA1 SHA512 SSDEEP TLSH

Licenses/ImGui-Shader.md

SHA256 dbc3142f8ab5ac8d1b60c71d230b174c3df20f9fc7c2c86fdc60d96ccbb54b2d
MD5 6fe4bb507f8acb954fdf033bb55b4164
SHA1 47777a61b36d13afa2b496e042330ec21be87400
SHA512 d2c8ae970e9bf3d81b83defc2ed2296ad3f32e746aa62cfaf5c4dd3afd96da9a56f6f846cdd90124a5055f4d2d5ff874fbd0277e3e7225bffbdc0fc512f13fb4
TLSH
T184F0C06A1281DE422FD300E5A902A99EC03C560C599E04F42841915C4374C7887B253F
MD5 SHA1 SHA512 TLSH

Licenses/Inter-OFL.txt

SHA256 5b9321a4298cfeb6b34354164a1c3afc3db114569984c502b9b35d988fd58c57
MD5 5e95cb23ed621124015c5d23224ba2d3
SHA1 cdd01b7e68db81d663f1c3820b6f7c40028900dd
SHA512 b602a341ac786c66c198f45fe3d20f7e1265f9b4512bb8cdf32230e6e3a4c59433282979b6ea2c912b81d453b3375360bfe67aa0bce2d83e11b5ce5202f8b75e
SSDEEP 96:Stn4UibMxxUDfGkKnjfRU88f+BktjVKvR1wyQeQHDZoN:SnsMPZW88f+XvR9QHtE
TLSH
T14791B92B3F4423B519C0D252F737F9DEE61A512D37AB69C9506AC16C23A6D2803FE790
MD5 SHA1 SHA512 SSDEEP TLSH

Licenses/JetBrainsMono-OFL.txt

SHA256 30f0c136e3c88e422d0791acd97238870f9054a9729bc34cf2ff0d4ed8cac4ad
MD5 43dc1a748ef82aa746d6a645d52578a9
SHA1 35e88dc68a9284b42fff88613e72b3ce7eef97a2
SHA512 b5dd9fec3988681a38c57fa6852155b0d701db77923bd39375e7ae17002674eb48377a49a3f360a8d9c3e0723758405bfc046e6f435e86365ddd29f5db7e7cfc
SSDEEP 96:dn4UibMxxUDfGkKnjfRU88f+BktjVKvR1wyQeQHDZoN:3sMPZW88f+XvR9QHtE
TLSH
T1F191C92B3F4423B519C0E242F737E9DEE21A512D37AB69C9505AC16C23A6D2803FE690
MD5 SHA1 SHA512 SSDEEP TLSH

Licenses/LazyUI.md

SHA256 8b8aca017527ef13af4b05e2627c50c86e22142ba21b520c4b0416e8f0498c44
MD5 e901c291990abf93addb933a158cb7b2
SHA1 272b059e678f6d2dbdb5f40f5b9fd074c8d94101
SHA512 c0171a4b29999756a8da034a5869a982968547759f5194f0c509b823f8d3d9910c0654bb3c87121ee3e5b1a982cbbea03d52bb58cc71d2a9e15df073bf850877
TLSH
T178F02D3E53C873B18A314D24828C6ADAF71B11081B6BEF822294444F33BBB5282F7438
MD5 SHA1 SHA512 TLSH

Licenses/Roboto-OFL.txt

SHA256 061402327a96aadb0bfb694a960ed289ecd38d383e396243831ab81feb109c41
MD5 d0d30e4860cc10440e095be065c2b0e3
SHA1 8bb4fe6d98df62b3a8d082c438b393d961ca94a6
SHA512 915b4a148dc1ae107e8330086a70eff3be67a4e2c395b3a5444e32e1682aa8df507ff6deb7a76ccad09a862efc9af3264f45871ea5077d2a3c63bee38de3312f
SSDEEP 96:msnH6UibMxxUDfGkKnjfRU88f+BktjVKvR1wyQeQHDZoN:HrsMPZW88f+XvR9QHtE
TLSH
T14991B82A7F4423F519C1D242F737E9DEE21A513D33AB69C9506AC16C23A6D2803FE290
MD5 SHA1 SHA512 SSDEEP TLSH

Nayix Services.exe

IMPHASH 485212551db8b6c948daa00e48f86530
SHA256 cf1d33252b25f03bb98c3ef3d211c6a52d58bf28ad0a2e2ded44eb8c8669a23b
MD5 c44dbb8d5cb82157ee951fb89f1433df
SHA1 27d179f92831fce5f4316ee46cd6824a64f95e43
SHA512 7c1fe10e24b229a3df48c7526ab597ecc9042318ce4e8ee465839e6fe37877b8f8a5fc4e5fa2870bcd308796cbe26ce229bb59f0351e9818164994a72aacccc2
SSDEEP 98304:nwC4byspxKtNz6lDEytOOBo0kjNLcax+Jsf7KjJ3pDxpG:np42JtNzSDEyZexg1ppV
TLSH
T1A546F106F7468349DD275D3487A7E356B362F8441B16C2CBA3681B989E872F80D7B3C9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

555024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\rethix\Downloads\ImGui\bin\x64\Release\Nayix Services.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoCreateInstance CoInitializeEx CoUninitialize

kernel32

GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedPushEntrySList RtlUnwindEx RtlLookupFunctionEntry GlobalAlloc OutputDebugStringW GetLastError Sleep SetLastError ExitProcess GetModuleFileNameW GetStdHandle WriteFile HeapFree SetFilePointerEx GetConsoleMode ReadConsoleW GetFileType HeapAlloc VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetFileSizeEx IsValidCodePage GetACP GetOEMCP HeapReAlloc MultiByteToWideChar OutputDebugStringA RtlUnwind IsDebuggerPresent UnhandledExceptionFilter GetCurrentProcess TerminateProcess ReadFile CreateFileW HeapSize WriteConsoleW SetEndOfFile FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle

user32

GetClientRect DispatchMessageW RegisterClassExW PostQuitMessage ShowWindow TranslateMessage DestroyIcon GetWindowLongPtrW GetKeyState GetMessageExtraInfo GetMonitorInfoW ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow PeekMessageW LoadCursorW SetCapture SetCursor SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard GetCursorPos GetSystemMetrics EmptyClipboard GetClipboardData SetWindowPos UnregisterClassW SetClipboardData GetWindowRect DefWindowProcW PostMessageW IsIconic DestroyWindow LoadImageW IsWindowVisible MonitorFromWindow UpdateWindow SetWindowLongPtrW SetWindowRgn CreateWindowExW SetLayeredWindowAttributes

gdi32

CreateRoundRectRgn DeleteObject

advapi32

CredWriteW CredDeleteW CredFree RegSetKeyValueW CredReadW RegGetValueW

shell32

ShellExecuteW

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader

api-ms-win-core-errorhandling-l1-1-0

RaiseException SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId GetStartupInfoW GetCurrentProcessId

api-ms-win-core-threadpool-l1-2-0

FreeLibraryWhenCallbackReturns CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetModuleHandleExW

api-ms-win-core-synch-l1-2-0

InitOnceComplete WakeAllConditionVariable InitOnceBeginInitialize SleepConditionVariableSRW

api-ms-win-core-localization-l1-2-0

GetCPInfo LCMapStringEx

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-string-l1-1-0

GetStringTypeW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

oleaut32

SetErrorInfo SysFreeString SysStringLen GetErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

734KB

Virtual Size

733KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer