final_payload.bin

Description:

Authors:

Version:

Architecture: 32-bit

Operating System:

SHA256: d4fc267f328ec82b4bdd851c09fd160f

File Size: 1.4 MB

Uploaded At: April 27, 2026, 5:09 p.m.

Views: 43

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

No exported functions.

Imported DLLs & Functions

ADVAPI32.dll

CreateProcessWithTokenW (Address: 0x52400c)
DuplicateTokenEx (Address: 0x524010)
GetTokenInformation (Address: 0x524004)
GetUserNameA (Address: 0x524000)
OpenProcessToken (Address: 0x524024)
RegCloseKey (Address: 0x52401c)
RegCreateKeyA (Address: 0x524008)
RegDeleteTreeA (Address: 0x524018)
RegOpenKeyExA (Address: 0x524014)
RegSetValueExA (Address: 0x524020)

bcrypt.dll

BCryptCloseAlgorithmProvider (Address: 0x524374)
BCryptDecrypt (Address: 0x524364)
BCryptDestroyKey (Address: 0x524360)
BCryptGenerateSymmetricKey (Address: 0x524368)
BCryptGetProperty (Address: 0x524378)
BCryptOpenAlgorithmProvider (Address: 0x524370)
BCryptSetProperty (Address: 0x52436c)

d3d11.dll

D3D11CreateDevice (Address: 0x524380)

dxgi.dll

CreateDXGIFactory1 (Address: 0x524388)

GDI32.dll

BitBlt (Address: 0x524038)
CreateCompatibleBitmap (Address: 0x52402c)
CreateCompatibleDC (Address: 0x524030)
CreateSolidBrush (Address: 0x52403c)
DeleteDC (Address: 0x524040)
DeleteObject (Address: 0x524044)
GetDIBits (Address: 0x524048)
SelectObject (Address: 0x524034)
SetStretchBltMode (Address: 0x524050)
StretchBlt (Address: 0x52404c)

IPHLPAPI.DLL

GetExtendedTcpTable (Address: 0x52405c)
GetExtendedUdpTable (Address: 0x524058)

KERNEL32.dll

AcquireSRWLockExclusive (Address: 0x524258)
CloseHandle (Address: 0x524100)
CompareStringW (Address: 0x5240a8)
CopyFileW (Address: 0x5241b0)
CreateDirectoryW (Address: 0x5241a8)
CreateEventW (Address: 0x524228)
CreateFileA (Address: 0x5241c8)
CreateFileW (Address: 0x524124)
CreateProcessA (Address: 0x524194)
CreateProcessW (Address: 0x5241fc)
CreateThread (Address: 0x524088)
CreateToolhelp32Snapshot (Address: 0x5241b4)
DecodePointer (Address: 0x524064)
DeleteCriticalSection (Address: 0x524218)
DeleteFileA (Address: 0x5241d4)
DeleteFileW (Address: 0x524208)
EncodePointer (Address: 0x5240a0)
EnterCriticalSection (Address: 0x52420c)
ExitProcess (Address: 0x524170)
ExitThread (Address: 0x524084)
FileTimeToLocalFileTime (Address: 0x524130)
FileTimeToSystemTime (Address: 0x524134)
FindClose (Address: 0x52414c)
FindFirstFileA (Address: 0x5241a4)
FindFirstFileExW (Address: 0x5240b4)
FindFirstFileW (Address: 0x524144)
FindNextFileA (Address: 0x5241dc)
FindNextFileW (Address: 0x524148)
FlushFileBuffers (Address: 0x5240e4)
FreeEnvironmentStringsW (Address: 0x5240cc)
FreeLibrary (Address: 0x5241d0)
FreeLibraryAndExitThread (Address: 0x524080)
GetACP (Address: 0x5240bc)
GetCommandLineA (Address: 0x524070)
GetCommandLineW (Address: 0x52406c)
GetComputerNameA (Address: 0x524104)
GetConsoleMode (Address: 0x5240ec)
GetConsoleOutputCP (Address: 0x5240e8)
GetCPInfo (Address: 0x5240c4)
GetCurrentProcess (Address: 0x5240fc)
GetCurrentProcessId (Address: 0x524234)
GetCurrentThreadId (Address: 0x5240f4)
GetEnvironmentStringsW (Address: 0x5240c8)
GetEnvironmentVariableA (Address: 0x52419c)
GetEnvironmentVariableW (Address: 0x5241ac)
GetExitCodeThread (Address: 0x524264)
GetFileAttributesA (Address: 0x5241a0)
GetFileAttributesExW (Address: 0x524120)
GetFileAttributesW (Address: 0x52418c)
GetFileSize (Address: 0x524128)
GetFileSizeEx (Address: 0x5241f8)
GetFileType (Address: 0x524068)
GetLastError (Address: 0x524158)
GetModuleFileNameA (Address: 0x524154)
GetModuleFileNameW (Address: 0x524074)
GetModuleHandleA (Address: 0x524114)
GetModuleHandleExW (Address: 0x52407c)
GetModuleHandleW (Address: 0x52422c)
GetOEMCP (Address: 0x5240c0)
GetProcAddress (Address: 0x524118)
GetProcessHeap (Address: 0x524108)
GetProcessTimes (Address: 0x5241ec)
GetStartupInfoW (Address: 0x524248)
GetStdHandle (Address: 0x524078)
GetStringTypeW (Address: 0x5240d8)
GetSystemDirectoryA (Address: 0x524198)
GetSystemDirectoryW (Address: 0x5241e0)
GetSystemInfo (Address: 0x524138)
GetSystemTimeAsFileTime (Address: 0x5241d8)
GetSystemTimes (Address: 0x5241e8)
GetTempFileNameA (Address: 0x5241c4)
GetTempPathA (Address: 0x5241c0)
GetTempPathW (Address: 0x524188)
GetTickCount (Address: 0x524180)
GetTickCount64 (Address: 0x524140)
GetWindowsDirectoryA (Address: 0x524190)
GlobalLock (Address: 0x524174)
GlobalMemoryStatusEx (Address: 0x52413c)
GlobalUnlock (Address: 0x524178)
HeapAlloc (Address: 0x52410c)
HeapFree (Address: 0x524110)
HeapReAlloc (Address: 0x5240e0)
HeapSize (Address: 0x5240dc)
InitializeCriticalSectionAndSpinCount (Address: 0x524214)
InitializeCriticalSectionEx (Address: 0x52425c)
InitializeSListHead (Address: 0x524238)
InitializeSRWLock (Address: 0x524250)
IsDebuggerPresent (Address: 0x52423c)
IsProcessorFeaturePresent (Address: 0x52424c)
IsValidCodePage (Address: 0x5240b8)
K32GetProcessMemoryInfo (Address: 0x5241e4)
LCMapStringW (Address: 0x5240b0)
LeaveCriticalSection (Address: 0x524210)
LoadLibraryA (Address: 0x5241cc)
LoadLibraryExW (Address: 0x52408c)
lstrlenA (Address: 0x52415c)
MultiByteToWideChar (Address: 0x524150)
OpenProcess (Address: 0x524160)
Process32First (Address: 0x5241b8)
Process32Next (Address: 0x5241bc)
QueryFullProcessImageNameA (Address: 0x5241f0)
QueryPerformanceCounter (Address: 0x524230)
RaiseException (Address: 0x5240ac)
ReadFile (Address: 0x52412c)
ReleaseSRWLockExclusive (Address: 0x524254)
RemoveDirectoryW (Address: 0x524200)
ResetEvent (Address: 0x524220)
RtlUnwind (Address: 0x5240f0)
SetEndOfFile (Address: 0x52416c)
SetEnvironmentVariableW (Address: 0x5240d0)
SetEvent (Address: 0x52421c)
SetFileAttributesW (Address: 0x524204)
SetFilePointer (Address: 0x524164)
SetFilePointerEx (Address: 0x5241f4)
SetLastError (Address: 0x5240a4)
SetStdHandle (Address: 0x5240d4)
SetUnhandledExceptionFilter (Address: 0x524244)
Sleep (Address: 0x5240f8)
TerminateProcess (Address: 0x52417c)
TlsAlloc (Address: 0x52409c)
TlsFree (Address: 0x524090)
TlsGetValue (Address: 0x524098)
TlsSetValue (Address: 0x524094)
TryEnterCriticalSection (Address: 0x524260)
UnhandledExceptionFilter (Address: 0x524240)
WaitForSingleObjectEx (Address: 0x524224)
WideCharToMultiByte (Address: 0x52411c)
WriteConsoleW (Address: 0x524184)
WriteFile (Address: 0x524168)

ole32.dll

CoCreateInstance (Address: 0x524394)
CoGetObject (Address: 0x524398)
CoInitializeEx (Address: 0x5243a4)
CoTaskMemFree (Address: 0x52439c)
CoUninitialize (Address: 0x5243a0)
CreateStreamOnHGlobal (Address: 0x524390)

SHELL32.dll

ShellExecuteA (Address: 0x524270)
ShellExecuteExA (Address: 0x52426c)
ShellExecuteW (Address: 0x524274)
SHGetKnownFolderPath (Address: 0x524278)

USER32.dll

ChildWindowFromPoint (Address: 0x5242dc)
ClientToScreen (Address: 0x524308)
CloseClipboard (Address: 0x5242d4)
CloseDesktop (Address: 0x5242a0)
CreateDesktopA (Address: 0x524280)
EnumDisplayDevicesA (Address: 0x5242bc)
EnumDisplayMonitors (Address: 0x5242ac)
ExitWindowsEx (Address: 0x5242c0)
FillRect (Address: 0x524290)
GetAncestor (Address: 0x524304)
GetClassNameA (Address: 0x524300)
GetClipboardData (Address: 0x524310)
GetDC (Address: 0x5242b4)
GetForegroundWindow (Address: 0x5242e0)
GetShellWindow (Address: 0x5242d0)
GetSystemMetrics (Address: 0x5242b0)
GetThreadDesktop (Address: 0x524284)
GetTopWindow (Address: 0x52428c)
GetWindow (Address: 0x524294)
GetWindowPlacement (Address: 0x5242f0)
GetWindowRect (Address: 0x52429c)
GetWindowThreadProcessId (Address: 0x5242cc)
IsWindow (Address: 0x52430c)
IsWindowVisible (Address: 0x524298)
MapVirtualKeyA (Address: 0x5242e8)
OpenClipboard (Address: 0x5242c4)
OpenDesktopA (Address: 0x5242c8)
PostMessageA (Address: 0x5242fc)
PrintWindow (Address: 0x5242d8)
ReleaseDC (Address: 0x5242b8)
ScreenToClient (Address: 0x5242a8)
SendMessageA (Address: 0x5242f4)
SetFocus (Address: 0x5242f8)
SetThreadDesktop (Address: 0x524288)
SetWindowPlacement (Address: 0x5242ec)
WindowFromPoint (Address: 0x5242a4)
wsprintfA (Address: 0x5242e4)

WININET.dll

InternetCloseHandle (Address: 0x524318)
InternetOpenA (Address: 0x524324)
InternetOpenUrlA (Address: 0x524320)
InternetReadFile (Address: 0x52431c)

WS2_32.dll

closesocket (Address: 0x524348)
freeaddrinfo (Address: 0x524344)
getaddrinfo (Address: 0x52434c)
inet_ntop (Address: 0x52432c)
ntohs (Address: 0x524330)
recv (Address: 0x524334)
send (Address: 0x524358)
setsockopt (Address: 0x524338)
shutdown (Address: 0x524340)
socket (Address: 0x524350)
WSAIoctl (Address: 0x52433c)
WSAStartup (Address: 0x524354)