button-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
button-setup.exe
Size 3.4MB
Sample261110-n3psbsxt5j
SHA256 363a20a55dc8fac7d0cee103d48ef4a7eb725d06ae7d2de4e46260451eb44446
MD5 7f4c5f6f443d596cc02d01e8ec2d9886
SHA1 cd10f577d7575dc79b8a757a859389a9e481abec
SHA512 cf77f5076c2c88fc722c3fb9ed3a42a00d51f0321c2eb4f4aa4a1e8bf765d1f9154a89c2a6b074da37107337f23f64fc91606ed258100ef950bac448ef3e9f92
SSDEEP 98304:pvceKpcWpEgodyeSy/zJiOabccFkKbEvabJzo:pvceKxvodZ/aooVYC1M
TLSH
T151F53396128424E3DBF70B73E8B29EF286C10A015F24D91E7A4CA91F6B473D5513E27B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
button-setup.exe
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/button.exe

File Explorer

button-setup.exe

.exe 3.4MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 33KB
button.exe

.exe 8.0MB

button-setup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 363a20a55dc8fac7d0cee103d48ef4a7eb725d06ae7d2de4e46260451eb44446
MD5 7f4c5f6f443d596cc02d01e8ec2d9886
SHA1 cd10f577d7575dc79b8a757a859389a9e481abec
SHA512 cf77f5076c2c88fc722c3fb9ed3a42a00d51f0321c2eb4f4aa4a1e8bf765d1f9154a89c2a6b074da37107337f23f64fc91606ed258100ef950bac448ef3e9f92
SSDEEP 98304:pvceKpcWpEgodyeSy/zJiOabccFkKbEvabJzo:pvceKxvodZ/aooVYC1M
TLSH
T151F53396128424E3DBF70B73E8B29EF286C10A015F24D91E7A4CA91F6B473D5513E27B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 d3e61c4df837625ac0503cea5b6765a04d37fc35399899a5503b53a3108bfbf6
MD5 7c8182ee99c93fc3a1bc41a52f5007ca
SHA1 05e9155694fcb8eb928632265199a4c8b315021f
SHA512 c1d4e5f86656b945442bae1386081d8ed225b6cea8161e1d061382fff58fc77261b88fce74a4292269ee8ea5ef4c032eee700b0dce48bb35c419a5cb9317c79e
SSDEEP 384:8rSQMCOUILnCaSPy/yhJzmGSMRWyOUKi0:8rSQMCOp0yamMRWysi0
TLSH
T14C623D16B62084F5CBB2167034D73B3E6BB28F6A292848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 39870682e7d1c026cd2b33ca25591db28250dde17de7eb1feec404222d534ffc
MD5 128e19d3f6bc32de40ee88a431cd4a5b
SHA1 44cdb6a3bb285d6502888bc4aaa6fa951b059d1c
SHA512 109d164db47ae525ad9361a28e9b3265977cfefef6504d456c8e0272f4b2ff70c534bbb5404ba7048a6895441b7a49012ab82a62785ec9ac45c24c6f2acaa135
SSDEEP 96:8It3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/d3lkCTcaqHCI:thE+A0+sF6piUFkABlncviI
TLSH
T1D8F1B776F3D20673F9AB437428632F231B2AF521576981A6490316CE7A61DA3FE34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
MD5 564e01f2c6edfb8475573e1b809cb5eb
SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
TLSH
T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb
MD5 79c27de4d1c6d295fefaa70f608f1c67
SHA1 feba90c93db3fedd450a81eb2603f793332d1a83
SHA512 fbd79f3946032821584ea2fa4b559ac5809ab45fdc9107eb47c9ff3fa3229d7748a7b2ed588709e59cce16a4f8e58ed98b46cb061acf1080e78434d184f51ec7
SSDEEP 96:oQEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YbNqkzfFc:oQEvCu5e81785qHFcU0PuAw0uyBIFc
TLSH
T1E612E892A2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

button.exe

IMPHASH dd588204cb5353285734698f67bab47c
SHA256 23726c0062b121182c6cf55f3d82958b9b213b3bee59015b662c53292c22aa82
MD5 e0723eac05d0f036b4f3952a3bc54054
SHA1 42cf40d9a4ddbbe8d8cceb95fdd57d00d68d7737
SHA512 10ef037817aa3f89ef8701677568ebcadd57778b7c2bed876621aadf91a5704818e6415af04a10271549a1a2b32f1af4858ccb64a9d4559706ef4a27fb73d445
SSDEEP 98304:qFOReNd+X+Ar4HDrUeFALlMYOcJdr792DdNq7rgWNquLf9CFW/zhzASitIhNzw8Q:qFdYxppayJezc7HiZNl
TLSH
T194866A43F26290F8C52AC135935A6233FA327C490B3579EB5BE04B353E65F90AB3DA54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5861248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

button.pdb

kernel32

RtlVirtualUnwind RtlCaptureContext SetEnvironmentVariableW GetUserDefaultUILanguage LCIDToLocaleName SystemTimeToFileTime LoadLibraryA SystemTimeToTzSpecificLocalTime QueryPerformanceCounter QueryPerformanceFrequency CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject AddVectoredExceptionHandler GetEnvironmentStringsW FindNextFileW MoveFileExW DeleteFileW GetTempPathW GetFileAttributesW CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle SetFileTime GlobalAlloc GlobalLock GlobalUnlock FindFirstFileExW GlobalFree GetFullPathNameW WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle CreateFileW FreeEnvironmentStringsW GetCommandLineW QueryFullProcessImageNameW GetCurrentProcess OpenProcess GetCurrentProcessId GetSystemTimePreciseAsFileTime lstrlenW CreateThread ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetCurrentThreadId SetThreadExecutionState CancelIoEx CreateMutexW WriteFile ReleaseMutex SetFileCompletionNotificationModes CreateIoCompletionPort GetOverlappedResult SetLastError SwitchToThread ReadFile PostQueuedCompletionStatus GetFinalPathNameByHandleW RtlPcToFileHeader GetQueuedCompletionStatusEx RaiseException FlsGetValue FindClose FlushFileBuffers GetModuleHandleW EncodePointer HeapReAlloc GetCurrentThread SetThreadStackGuarantee GetModuleHandleA GetCurrentDirectoryW Sleep GetProcAddress InitializeSListHead SetUnhandledExceptionFilter LoadLibraryExW LoadLibraryExA RtlUnwindEx OutputDebugStringW FormatMessageW OutputDebugStringA FreeLibrary GetLastError GetSystemInfo LoadLibraryW InitializeCriticalSectionEx CloseHandle HeapAlloc RtlLookupFunctionEntry WaitForSingleObjectEx CreateMutexA WideCharToMultiByte MultiByteToWideChar FlsAlloc GetModuleHandleExW IsThreadAFiber FlsSetValue FlsFree HeapFree SleepEx SetHandleInformation ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetModuleFileNameW DuplicateHandle GetEnvironmentVariableW GetProcessHeap DeleteCriticalSection

advapi32

RegGetValueW EventUnregister RegCloseKey RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyTransactedW RegOpenKeyExW RegQueryValueExW EventRegister RegSetValueExW RegDeleteValueW EventSetInformation RegQueryInfoKeyW RegEnumKeyExW GetTokenInformation EventWriteTransfer OpenProcessToken

oleaut32

SysFreeString SysStringLen GetErrorInfo SetErrorInfo

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile NtCancelIoFileEx NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile NtOpenFile NtCreateFile RtlGetVersion NtDeviceIoControlFile

user32

ShowWindow CreateAcceleratorTableW GetDC DrawIconEx GetWindowDC SystemParametersInfoA ReleaseDC GetMenuBarInfo DestroyAcceleratorTable DestroyMenu RemoveMenu RegisterWindowMessageA SetPropW RegisterHotKey GetAsyncKeyState AllowSetForegroundWindow UnregisterHotKey TranslateAcceleratorW GetUpdateRect ValidateRect GetRawInputData SetParent SetFocus CreateMenu CreatePopupMenu SetTimer KillTimer InsertMenuW SetWindowRgn AppendMenuW GetParent DrawTextW FindWindowExW GetWindow EnumWindows GetMenu ShowWindowAsync ToUnicodeEx MapWindowPoints GetSystemMetrics LoadImageW GetIconInfo DestroyIcon FindWindowW IsProcessDPIAware SendMessageTimeoutW GetDesktopWindow CreateIcon MapVirtualKeyExW GetKeyState TrackPopupMenu GetKeyboardState PostThreadMessageW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard SetWinEventHook DrawMenuBar SetMenu ChangeWindowMessageFilterEx ClipCursor RegisterClassW UnhookWinEvent CallNextHookEx GetClipCursor PeekMessageW GetMessageW PostQuitMessage TranslateMessage DispatchMessageW MsgWaitForMultipleObjectsEx PostMessageW UnhookWindowsHookEx GetCursorPos CheckMenuItem SetWindowsHookExW VkKeyScanW OffsetRect EnumChildWindows DispatchMessageA GetMessageA ShowCursor AdjustWindowRect GetMenuItemInfoW GetSystemMetricsForDpi GetDpiForSystem SetMenuItemInfoW GetKeyboardLayout GetClassNameW GetWindowThreadProcessId IsWindow SystemParametersInfoW SetWindowTextW EnableMenuItem MonitorFromRect CloseTouchInputHandle GetTouchInputInfo DestroyWindow TrackMouseEvent SetCapture ReleaseCapture FillRect GetWindowLongW ScreenToClient SetWindowLongW SetWindowDisplayAffinity SetWindowLongPtrW GetSystemMenu GetWindowTextW RegisterTouchWindow DefWindowProcW SetCursor LoadCursorW GetWindowPlacement SetWindowPlacement GetMonitorInfoW ChangeDisplaySettingsExW UpdateWindow InvalidateRect IsHungAppWindow SetCursorPos GetForegroundWindow InvalidateRgn SetWindowPos GetWindowRect GetClientRect FlashWindowEx GetActiveWindow ClientToScreen SendInput MapVirtualKeyW SetForegroundWindow CreateWindowExW AdjustWindowRectEx RegisterClassExW IsWindowEnabled EnableWindow GetWindowLongPtrW MonitorFromWindow IsIconic IsWindowVisible RedrawWindow RegisterRawInputDevices EnumDisplayMonitors MonitorFromPoint SendMessageW GetWindowTextLengthW

gdi32

CreateDIBSection BitBlt SetBkMode CombineRgn GetDIBits GetDeviceCaps SetTextColor CreateSolidBrush DeleteDC SelectObject DeleteObject CreateRectRgn CreateCompatibleDC

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ole32

CoCreateInstance CoUninitialize CoInitializeEx RevokeDragDrop RegisterDragDrop OleInitialize PropVariantClear

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

imm32

ImmGetContext ImmReleaseContext ImmGetCompositionStringW

shell32

SHGetKnownFolderPath Shell_NotifyIconW SHAppBarMessage Shell_NotifyIconGetRect ShellExecuteW SHCreateItemFromParsingName DragQueryFileW DragFinish SHGetStockIconInfo

comctl32

DefSubclassProc SetWindowSubclass TaskDialogIndirect RemoveWindowSubclass

shlwapi

SHCreateMemStream

combase

CoTaskMemAlloc CoIncrementMTAUsage CoTaskMemFree CoCreateFreeThreadedMarshaler

propsys

PropVariantToStringAlloc PropVariantToGUID

cfgmgr32

CM_Get_Device_ID_List_SizeW CM_Locate_DevNodeW CM_Get_DevNode_PropertyW CM_Get_Device_ID_ListW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

crypt32

CertEnumCertificatesInStore CertOpenStore CertFreeCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertVerifyCertificateChainPolicy CertFreeCertificateContext CertDuplicateCertificateChain CertGetCertificateChain CertAddCertificateContextToStore CertCloseStore

ws2_32

shutdown send recv freeaddrinfo getaddrinfo WSAStartup getsockopt connect WSASend WSAIoctl ioctlsocket WSASocketW setsockopt closesocket getsockname WSAGetLastError getpeername bind

secur32

FreeCredentialsHandle DecryptMessage InitializeSecurityContextW FreeContextBuffer ApplyControlToken QueryContextAttributesW DeleteSecurityContext AcceptSecurityContext EncryptMessage AcquireCredentialsHandleA

api-ms-win-crt-math-l1-1-0

trunc round fmod pow __setusermatherr floor roundf

api-ms-win-crt-string-l1-1-0

wcscmp wcslen _wcsicmp strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-runtime-l1-1-0

_c_exit exit _seh_filter_exe _set_app_type __p___argv __p___argc _configure_narrow_argv _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _initialize_narrow_environment _cexit _crt_atexit _get_initial_narrow_environment terminate _initterm _initterm_e abort _exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free calloc _callnewh

Sharing

General

Malware Config

Signatures

File Explorer

button-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

button.exe

kernel32

advapi32

oleaut32

api-ms-win-core-winrt-error-l1-1-0

bcryptprimitives

ntdll

user32

gdi32

api-ms-win-core-synch-l1-2-0

ole32

dwmapi

imm32

shell32

comctl32

shlwapi

combase

propsys

cfgmgr32

api-ms-win-core-winrt-l1-1-0

crypt32

ws2_32

secur32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic