stage2.dll

Description: [File deleted after analysis due to size limit > 20MB]

Authors:

Version:

Architecture: 64-bit

Operating System:

SHA256: 0a3aacbfb0236634cc424a3fdc7cf22a

File Size: 20.5 MB

Uploaded At: July 16, 2026, 11:40 p.m.

Views: 24

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

No exported functions.

Imported DLLs & Functions

ADVAPI32.dll
  • AdjustTokenPrivileges (Address: 0x180daf590)
  • ChangeServiceConfigA (Address: 0x180daf568)
  • CloseServiceHandle (Address: 0x180daf578)
  • ControlService (Address: 0x180daf560)
  • ControlTraceA (Address: 0x180daf5b0)
  • EnumServicesStatusA (Address: 0x180daf558)
  • LookupPrivilegeValueW (Address: 0x180daf588)
  • OpenProcessToken (Address: 0x180daf598)
  • OpenSCManagerA (Address: 0x180daf570)
  • OpenServiceA (Address: 0x180daf5b8)
  • RegCloseKey (Address: 0x180daf580)
  • RegCreateKeyA (Address: 0x180daf5a0)
  • RegDeleteTreeA (Address: 0x180daf5a8)
CRYPT32.dll
  • CertFreeCertificateChain (Address: 0x180daf650)
  • CertFreeCertificateContext (Address: 0x180daf658)
  • CertGetCertificateChain (Address: 0x180daf660)
  • CryptHashCertificate2 (Address: 0x180daf648)
dxgi.dll
  • CreateDXGIFactory (Address: 0x180daf670)
IPHLPAPI.DLL
  • FreeMibTable (Address: 0x180daf0b0)
  • GetAdaptersAddresses (Address: 0x180daf090)
  • GetIpForwardTable2 (Address: 0x180daf0a0)
  • ResolveIpNetEntry2 (Address: 0x180daf0a8)
  • SendARP (Address: 0x180daf098)
KERNEL32.dll
  • AcquireSRWLockExclusive (Address: 0x180daf4a8)
  • AddVectoredExceptionHandler (Address: 0x180daf310)
  • CloseHandle (Address: 0x180daf1f8)
  • CompareStringW (Address: 0x180daf370)
  • CreateFileA (Address: 0x180daf288)
  • CreateFileW (Address: 0x180daf1c8)
  • CreateProcessW (Address: 0x180daf140)
  • CreateThread (Address: 0x180daf2a8)
  • CreateToolhelp32Snapshot (Address: 0x180daf268)
  • DeleteCriticalSection (Address: 0x180daf2c0)
  • DeleteFileW (Address: 0x180daf1f0)
  • DeviceIoControl (Address: 0x180daf238)
  • DisableThreadLibraryCalls (Address: 0x180daf290)
  • DuplicateHandle (Address: 0x180daf1d0)
  • EncodePointer (Address: 0x180daf490)
  • EnterCriticalSection (Address: 0x180daf2d8)
  • ExitProcess (Address: 0x180daf428)
  • FillConsoleOutputAttribute (Address: 0x180daf2b0)
  • FillConsoleOutputCharacterW (Address: 0x180daf458)
  • FindClose (Address: 0x180daf1c0)
  • FindFirstFileExW (Address: 0x180daf378)
  • FindFirstFileW (Address: 0x180daf180)
  • FindFirstStreamW (Address: 0x180daf2f8)
  • FindNextFileW (Address: 0x180daf190)
  • FindNextStreamW (Address: 0x180daf300)
  • FlsAlloc (Address: 0x180daf408)
  • FlsFree (Address: 0x180daf3f0)
  • FlsGetValue (Address: 0x180daf400)
  • FlsSetValue (Address: 0x180daf3f8)
  • FlushFileBuffers (Address: 0x180daf170)
  • FreeEnvironmentStringsW (Address: 0x180daf3c8)
  • FreeLibrary (Address: 0x180daf460)
  • GetACP (Address: 0x180daf388)
  • GetCommandLineA (Address: 0x180daf3a0)
  • GetCommandLineW (Address: 0x180daf3a8)
  • GetConsoleCP (Address: 0x180daf430)
  • GetConsoleMode (Address: 0x180daf160)
  • GetConsoleOutputCP (Address: 0x180daf168)
  • GetConsoleScreenBufferInfo (Address: 0x180daf218)
  • GetCPInfo (Address: 0x180daf398)
  • GetCurrentProcess (Address: 0x180daf198)
  • GetCurrentProcessId (Address: 0x180daf210)
  • GetCurrentThreadId (Address: 0x180daf500)
  • GetDiskFreeSpaceExA (Address: 0x180daf2c8)
  • GetDriveTypeA (Address: 0x180daf248)
  • GetEnvironmentStringsW (Address: 0x180daf3c0)
  • GetEnvironmentVariableW (Address: 0x180daf1b8)
  • GetExitCodeProcess (Address: 0x180daf148)
  • GetFileAttributesExW (Address: 0x180daf138)
  • GetFileSize (Address: 0x180daf208)
  • GetFileSizeEx (Address: 0x180daf130)
  • GetFileType (Address: 0x180daf410)
  • GetFirmwareEnvironmentVariableW (Address: 0x180daf360)
  • GetLastError (Address: 0x180daf2f0)
  • GetModuleFileNameW (Address: 0x180daf418)
  • GetModuleHandleA (Address: 0x180daf1d8)
  • GetModuleHandleExW (Address: 0x180daf420)
  • GetModuleHandleW (Address: 0x180daf318)
  • GetOEMCP (Address: 0x180daf390)
  • GetProcAddress (Address: 0x180daf200)
  • GetProcessHeap (Address: 0x180daf350)
  • GetStartupInfoW (Address: 0x180daf4f8)
  • GetStdHandle (Address: 0x180daf228)
  • GetStringTypeW (Address: 0x180daf3d8)
  • GetSystemFirmwareTable (Address: 0x180daf338)
  • GetSystemTimeAsFileTime (Address: 0x180daf508)
  • GetTempPathW (Address: 0x180daf258)
  • HeapAlloc (Address: 0x180daf348)
  • HeapFree (Address: 0x180daf340)
  • HeapReAlloc (Address: 0x180daf450)
  • HeapSize (Address: 0x180daf448)
  • InitializeCriticalSection (Address: 0x180daf250)
  • InitializeCriticalSectionAndSpinCount (Address: 0x180daf488)
  • InitializeCriticalSectionEx (Address: 0x180daf3e8)
  • InitializeSListHead (Address: 0x180daf510)
  • InterlockedFlushSList (Address: 0x180daf498)
  • IsDebuggerPresent (Address: 0x180daf4f0)
  • IsProcessorFeaturePresent (Address: 0x180daf4e8)
  • IsValidCodePage (Address: 0x180daf380)
  • LCMapStringW (Address: 0x180daf368)
  • LeaveCriticalSection (Address: 0x180daf2e0)
  • LoadLibraryA (Address: 0x180daf2e8)
  • LoadLibraryExW (Address: 0x180daf438)
  • MultiByteToWideChar (Address: 0x180daf3b0)
  • OpenProcess (Address: 0x180daf1e0)
  • Process32FirstW (Address: 0x180daf2a0)
  • Process32NextW (Address: 0x180daf278)
  • QueryPerformanceCounter (Address: 0x180daf328)
  • RaiseException (Address: 0x180daf528)
  • ReadConsoleInputW (Address: 0x180daf150)
  • ReadFile (Address: 0x180daf178)
  • ReleaseSRWLockExclusive (Address: 0x180daf4a0)
  • RemoveDirectoryW (Address: 0x180daf280)
  • RemoveVectoredExceptionHandler (Address: 0x180daf308)
  • RtlCaptureContext (Address: 0x180daf4c0)
  • RtlDeleteFunctionTable (Address: 0x180daf320)
  • RtlLookupFunctionEntry (Address: 0x180daf4c8)
  • RtlPcToFileHeader (Address: 0x180daf520)
  • RtlUnwind (Address: 0x180daf3b8)
  • RtlUnwindEx (Address: 0x180daf518)
  • RtlVirtualUnwind (Address: 0x180daf4d0)
  • SetConsoleCursorPosition (Address: 0x180daf2d0)
  • SetConsoleMode (Address: 0x180daf158)
  • SetConsoleTextAttribute (Address: 0x180daf220)
  • SetCurrentConsoleFontEx (Address: 0x180daf230)
  • SetEnvironmentVariableW (Address: 0x180daf3d0)
  • SetFileAttributesW (Address: 0x180daf1e8)
  • SetFilePointerEx (Address: 0x180daf1b0)
  • SetLastError (Address: 0x180daf330)
  • SetStdHandle (Address: 0x180daf440)
  • SetUnhandledExceptionFilter (Address: 0x180daf4e0)
  • Sleep (Address: 0x180daf270)
  • SleepConditionVariableSRW (Address: 0x180daf4b8)
  • TerminateProcess (Address: 0x180daf240)
  • TerminateThread (Address: 0x180daf298)
  • TlsAlloc (Address: 0x180daf480)
  • TlsFree (Address: 0x180daf468)
  • TlsGetValue (Address: 0x180daf478)
  • TlsSetValue (Address: 0x180daf470)
  • UnhandledExceptionFilter (Address: 0x180daf4d8)
  • VirtualAlloc (Address: 0x180daf1a8)
  • VirtualFree (Address: 0x180daf188)
  • VirtualProtect (Address: 0x180daf3e0)
  • WaitForSingleObject (Address: 0x180daf260)
  • WakeAllConditionVariable (Address: 0x180daf4b0)
  • WideCharToMultiByte (Address: 0x180daf358)
  • WriteConsoleW (Address: 0x180daf2b8)
  • WriteFile (Address: 0x180daf1a0)
Secur32.dll
  • AcquireCredentialsHandleW (Address: 0x180daf5f8)
  • ApplyControlToken (Address: 0x180daf618)
  • DecryptMessage (Address: 0x180daf608)
  • DeleteSecurityContext (Address: 0x180daf610)
  • EncryptMessage (Address: 0x180daf628)
  • FreeContextBuffer (Address: 0x180daf638)
  • FreeCredentialsHandle (Address: 0x180daf620)
  • InitializeSecurityContextW (Address: 0x180daf600)
  • QueryContextAttributesW (Address: 0x180daf630)
SETUPAPI.dll
  • SetupDiDestroyDeviceInfoList (Address: 0x180daf690)
  • SetupDiEnumDeviceInfo (Address: 0x180daf688)
  • SetupDiGetClassDevsW (Address: 0x180daf698)
  • SetupDiGetDeviceRegistryPropertyW (Address: 0x180daf680)
SHELL32.dll
  • (Address: 0x180daf5c8)
SHLWAPI.dll
  • PathFileExistsW (Address: 0x180daf5e0)
  • StrStrIA (Address: 0x180daf5d8)
  • StrStrIW (Address: 0x180daf5e8)
USER32.dll
  • MessageBoxA (Address: 0x180daf540)
  • wsprintfA (Address: 0x180daf538)
  • wsprintfW (Address: 0x180daf548)
WINHTTP.dll
  • WinHttpCloseHandle (Address: 0x180daf108)
  • WinHttpConnect (Address: 0x180daf0d0)
  • WinHttpCrackUrl (Address: 0x180daf0c8)
  • WinHttpOpen (Address: 0x180daf0e0)
  • WinHttpOpenRequest (Address: 0x180daf0f8)
  • WinHttpQueryDataAvailable (Address: 0x180daf0c0)
  • WinHttpQueryHeaders (Address: 0x180daf0e8)
  • WinHttpQueryOption (Address: 0x180daf120)
  • WinHttpReadData (Address: 0x180daf0f0)
  • WinHttpReceiveResponse (Address: 0x180daf0d8)
  • WinHttpSendRequest (Address: 0x180daf110)
  • WinHttpSetOption (Address: 0x180daf100)
  • WinHttpSetTimeouts (Address: 0x180daf118)
WS2_32.dll
  • __WSAFDIsSet (Address: 0x180daf020)
  • closesocket (Address: 0x180daf030)
  • connect (Address: 0x180daf060)
  • getsockname (Address: 0x180daf018)
  • getsockopt (Address: 0x180daf070)
  • htons (Address: 0x180daf078)
  • inet_pton (Address: 0x180daf048)
  • ioctlsocket (Address: 0x180daf010)
  • recv (Address: 0x180daf068)
  • select (Address: 0x180daf038)
  • send (Address: 0x180daf080)
  • setsockopt (Address: 0x180daf008)
  • shutdown (Address: 0x180daf040)
  • socket (Address: 0x180daf058)
  • WSAGetLastError (Address: 0x180daf000)
  • WSAIoctl (Address: 0x180daf028)
  • WSAStartup (Address: 0x180daf050)