Malware Analysis Report

2025-05-05 22:36

Sample ID 241229-zj32dsxjht
Target Craxs RATTED.7
SHA256 c7c16847de3660b072a71654312ad44f2015e31f4a53cdca60748104b94a4820
Tags
agilenet discovery
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

c7c16847de3660b072a71654312ad44f2015e31f4a53cdca60748104b94a4820

Threat Level: Shows suspicious behavior

The file Craxs RATTED.7 was found to be: Shows suspicious behavior.

Malicious Activity Summary

agilenet discovery

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Executes dropped EXE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Browser Information Discovery

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-29 20:48

Signatures

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-29 20:45

Reported

2024-12-29 20:52

Platform

win10v2004-20241007-en

Max time kernel

257s

Max time network

259s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Craxs RATTED.7z"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A
N/A N/A C:\CraxsRat_Bilder\platformBinary64\bin\java.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\CraxsRat_Bilder\platformBinary64\bin\zipalign.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.apk\DefaultIcon C:\Users\Admin\Desktop\a\CraxsRat V7.4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.apk C:\Users\Admin\Desktop\a\CraxsRat V7.4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.apk\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\a\\res\\Icons\\apk.ico" C:\Users\Admin\Desktop\a\CraxsRat V7.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings C:\Users\Admin\Desktop\a\CraxsRat V7.4.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\CraxsRat V7.4.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\CraxsRat V7.4.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\CraxsRat V7.4.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\CraxsRat V7.4.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\CraxsRat V7.4.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\CraxsRat V7.4.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\a\CraxsRat V7.4.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 440 wrote to memory of 2216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 2216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 5020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 2060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 2060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 440 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Craxs RATTED.7z"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Desktop\a\CraxsRat V7.4.exe

"C:\Users\Admin\Desktop\a\CraxsRat V7.4.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultae337791hab1ch4ac6h9586h1a836ce13429

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff8975146f8,0x7ff897514708,0x7ff897514718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13497831967190226983,1017290130885677122,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,13497831967190226983,1017290130885677122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,13497831967190226983,1017290130885677122,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe"

C:\CraxsRat_Bilder\platformBinary64\bin\java.exe

java -version

C:\CraxsRat_Bilder\platformBinary64\bin\java.exe

java -jar -Duser.language=en "C:\CraxsRat_Bilder\platformBinary64\bin\\apktool.jar" d temp.apk

C:\CraxsRat_Bilder\platformBinary64\bin\java.exe

java -jar -Duser.language=en "C:\CraxsRat_Bilder\platformBinary64\bin\\apktool.jar" b temp

C:\Users\Admin\AppData\Local\Temp\brut_util_Jar_41620928666831239068122135644137343611.tmp

C:\Users\Admin\AppData\Local\Temp\brut_util_Jar_41620928666831239068122135644137343611.tmp p --forced-package-id 127 --min-sdk-version 21 --target-sdk-version 29 --version-code 1000 --version-name 1.0.0.0 --no-version-vectors -F C:\Users\Admin\AppData\Local\Temp\APKTOOL8910802262240412459.tmp -e C:\Users\Admin\AppData\Local\Temp\APKTOOL7086920861786059835.tmp -0 arsc -I C:\Users\Admin\AppData\Local\apktool\framework\1.apk -S C:\CraxsRat_Bilder\platformBinary64\bin\temp\res -M C:\CraxsRat_Bilder\platformBinary64\bin\temp\AndroidManifest.xml

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /7

C:\CraxsRat_Bilder\platformBinary64\bin\java.exe

java -jar -Duser.language=en "C:\CraxsRat_Bilder\platformBinary64\bin\\apktool.jar" b temp

C:\Users\Admin\AppData\Local\Temp\brut_util_Jar_24646674828546211101704456592538505533.tmp

C:\Users\Admin\AppData\Local\Temp\brut_util_Jar_24646674828546211101704456592538505533.tmp p --forced-package-id 127 --min-sdk-version 21 --target-sdk-version 29 --version-code 1000 --version-name 1.0.0.0 --no-version-vectors -F C:\Users\Admin\AppData\Local\Temp\APKTOOL7009371440602478648.tmp -e C:\Users\Admin\AppData\Local\Temp\APKTOOL4557684181188646324.tmp -0 arsc -I C:\Users\Admin\AppData\Local\apktool\framework\1.apk -S C:\CraxsRat_Bilder\platformBinary64\bin\temp\res -M C:\CraxsRat_Bilder\platformBinary64\bin\temp\AndroidManifest.xml

C:\CraxsRat_Bilder\platformBinary64\bin\java.exe

java -jar temp\dist\Crypt.jar p -i "C:\CraxsRat_Bilder\platformBinary64\bin\temp\dist\temp.apk"

C:\CraxsRat_Bilder\platformBinary64\bin\zipalign.exe

zipalign.exe -v 4 C:\CraxsRat_Bilder\platformBinary64\bin\temp\dist\temp_protected.apk C:\CraxsRat_Bilder\platformBinary64\bin\temp\dist\tempzip.apk

C:\CraxsRat_Bilder\platformBinary64\bin\java.exe

java -jar C:\CraxsRat_Bilder\platformBinary64\bin\SignApk.jar sign --key C:\CraxsRat_Bilder\platformBinary64\bin\key.pk8 --cert C:\CraxsRat_Bilder\platformBinary64\bin\certificate.pem --v2-signing-enabled true --v3-signing-enabled true --out C:\CraxsRat_Bilder\platformBinary64\bin\output\ready.apk C:\CraxsRat_Bilder\platformBinary64\bin\temp\dist\temp_protected.apk

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 220.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 101.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 cxcs.microsoft.net udp
GB 88.221.135.32:443 www.bing.com tcp
GB 23.62.195.195:443 cxcs.microsoft.net tcp
US 8.8.8.8:53 32.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 195.195.62.23.in-addr.arpa udp
GB 23.62.195.195:443 cxcs.microsoft.net tcp
GB 88.221.135.32:443 www.bing.com tcp
GB 23.62.195.195:443 cxcs.microsoft.net tcp
GB 88.221.135.32:443 www.bing.com tcp

Files

C:\Users\Admin\Desktop\a\CraxsRat V7.4.exe.config

MD5 d1158d00747c63b29a91da068c16ac15
SHA1 540e2dec15f0735effa1288b9a57c56115dccc57
SHA256 633b6dc8625d1b14d46ddffc922f362fd668043e3aaab40193e61424e42a951a
SHA512 2966d1d3cc8d29ce964d71f7300e4c129b2ab2ef94fe4bdeab7fd3069cb4598a091682e08a1f060a0f958bfce7d12eb4ff3b67e1bd26e982169da6600359a74f

memory/3584-1055-0x00007FF894733000-0x00007FF894735000-memory.dmp

memory/3584-1056-0x0000025B603C0000-0x0000025B641CE000-memory.dmp

memory/3584-1058-0x0000025B7E5A0000-0x0000025B7E5AC000-memory.dmp

C:\Users\Admin\Desktop\a\LiveCharts.WinForms.dll

MD5 76c775d09b24798f6923452e920979b5
SHA1 3fe2c79512a0d1153fb07f6640b27106c90d333e
SHA256 a5b61c1726304e6b72e09a0f35ddbf52f89a75a4e28e6ed098c8d1df6081b4ad
SHA512 eacc093f8ac9401f617df7e07fd68a8a0f1f03aa150283de67ad8c338fcb1520b0f07335547cf533a646ff95f239c92b029f952a706e736bcd9508817c9be0f9

memory/3584-1059-0x0000025B7E5E0000-0x0000025B7E5FC000-memory.dmp

C:\Users\Admin\Desktop\a\LiveCharts.dll

MD5 9642899636959b7fc89bf34a8b998a90
SHA1 479a0254d1c9e5565c7d861bb77f54b7eae50c96
SHA256 9fcf89837b60f69c1c501e4cfa4d2860887afd0b8f325803367e795a4e3bc9ca
SHA512 435dccb57ff3e9d0663770768c866838b19fbaa5b8e79de0ca111d9c73276f016e016d1d268f72cf3435ecac122039764fada952e1a4f68f368b492bb866c9a2

C:\Users\Admin\Desktop\a\LiveCharts.Wpf.dll

MD5 e924f79f0b5f3e79c98477d75831813d
SHA1 64f71e20e1953b13c771d8a8e63549ad6d64216e
SHA256 1bdbb1b5c1a50653e5c26161e9b7c03edc518721a6e10ea180a84049d967106b
SHA512 063e9bdbdaf0accb46cef5fdb98b30a97b8a6ba097a80d43a9799ff73e820d1c56d41ca9f71d94497736e3def7fbd0109db4000ab1d9e46cdc96357bf3e15fd1

memory/3584-1061-0x0000025B7E730000-0x0000025B7E75C000-memory.dmp

memory/3584-1063-0x0000025B7E7A0000-0x0000025B7E7DC000-memory.dmp

memory/3584-1064-0x00007FF894730000-0x00007FF8951F1000-memory.dmp

C:\Users\Admin\Desktop\a\DrakeUI.Framework.dll

MD5 0562b4c97f643306df491a938ae636da
SHA1 0807c37b711374ed4814a9518c9e264517de89a0
SHA256 70e72477f7fe0018e043ce8fe2228a289459058ee41caecd6f05855898bc5b80
SHA512 c969cd274b6bf65a34f1d129b6531616a3485a1f153088609ad2369d380fdec37c3e88a423495912715a26e353dd5498f7f9e73c895e9f3f18fc7d1e65d2ecaf

memory/3584-1066-0x0000025B7F250000-0x0000025B7F3F6000-memory.dmp

memory/3584-1068-0x0000025B7EBE0000-0x0000025B7EC16000-memory.dmp

C:\Users\Admin\Desktop\a\GeoIPCitys.dll

MD5 c070f2421851420e832e4f5989a775a2
SHA1 d6af3c48ffbe0fa1e0e54860836d3bbf374b8b46
SHA256 d54fd6c5903eea49a75d620d4ba232f8effb1863f5f9c974e4ac0a8fb1904131
SHA512 75c3edeb4c16d8e82eedc5595b9c3fde4cbd4a3e9deae1967ad513474920a48e4e9275fdc76f44032b1be570a4ece1a6393c4680af8989f67bcdec039d06798e

C:\Users\Admin\Desktop\a\res\Config\Pass.inf

MD5 f13c9fd7401845bcfaca535744744440
SHA1 a0f1325a69f2c303449177932c43030a4b5991ff
SHA256 87c67159e71ef382bd47a763527c906c18a77f79fa66d9e18569d1ed0cbdd167
SHA512 8bd1dfc2df7e51ae7113f9b0212335614961716dc0b10f58433d8618b9dcc80e2aabad9e563b8106a3151314af593aea9fd0a401cde30d7b47bf4b71d3b9abb0

C:\Users\Admin\Desktop\a\res\GeoIP\GeoIP.dat

MD5 2fbec46d430f57befcde85b86c68b36e
SHA1 3ff9829e3242deb69a7fde0832b7d9345b925afc
SHA256 681ede512fe7ac21e976c754bfc1e1a75a9e02c3d931ce6849cfaa9d4080338a
SHA512 42036af6f57e446fec194ce71fa634dee9f4c77342f64a867fca8730d76349190960a7e7a5967ea59c250ca1b220d4845b4911dd63ee870f5620d9eb513b91d6

C:\Users\Admin\Desktop\a\res\GeoIP\GeoIPCity.dat

MD5 fab3cc04a19ffdf90d775e27967a7c25
SHA1 723c1635338bec7c1c876769618789268b8faad2
SHA256 bf41a0a700e3b35415609d090b15c5355e5cf4ca703ab119626b2d450997c608
SHA512 fe013386ff799cda195222341ee601d7b8b3c5c8abacf3c80e3fa03af52ac848f8a79a7dd87d8831d5a366243343f1025f704f49d858da4b02235968f834a9e6

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AD.ico

MD5 2cce7e02f2decbdcf648cc249eeabbfc
SHA1 4a9cc2ab3162a949d5f559ac2828813da7aaa6d2
SHA256 ffd5e4016c4bc247f49ded9d4ac463e7bd9d7f92c9889528f5f3a865dc8234e2
SHA512 be3d96046ec50bfd8e4399d1268856d0cc1f541635896ad128d660660294cfd98f79998dfa46849a2e6e5aa3e637626a94a062ab694444b7210f69b3a55d1686

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AS.ico

MD5 caba1e66c954bc8d784efe2a3c02d808
SHA1 ef1d5ba4735c99b55648503513d9ae7393a3a6d6
SHA256 4946c58e14318696ea03cf9bcb5d8a7334273c2f9e30173a3c7ae0bb7ee70bc4
SHA512 430806d048e383411e36a8e3777a27b7efc1819cca50c7d7eeba662d32351a366d3cc0b892f819b6a96db8281c5e249d3faef13e8a4ec3bef75e67b9567bd466

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AR.ico

MD5 bb4f489b2ae1f6601513296357fb478b
SHA1 b8337772e2e17d48412f44373ea8a821b85e9c54
SHA256 af2f591584f6c59da15fd42e5175dc136844442e1c755fac047b0efae3956c50
SHA512 547e0753a1ac4058ec609ddd2d6ce54b50cc47177ee319f5bcc82eca9e231d01d74b7c2d02de90557c08224bed962c74f8c4079a1292153cbff32db234ddf6a6

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AQ.ico

MD5 be6fa7ab4980735841141d4d3f642a4a
SHA1 c6d03cda7f73a959a3d20d0e3897595fbe2915e9
SHA256 3439ebcdd8e7a614f157f58d7f77d190aac7fe514129a01024a8b68b7008fbb2
SHA512 fbc116df306de7a04f43cb2becfecbbaf103d6b252336e0bd37f006506140ceb14f114cdf62e203bc12f78c25906066385eb6caa67f694d8526b341bcf3462f2

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AO.ico

MD5 a5c78266329a1eb0f3e52bc0343783b5
SHA1 e0b254e2176f0eab8d2b76213a64c24ba1788675
SHA256 550a1b6e2b97febd865cd130b0c0d484cf2fd02b8066ddf6d7290b9cffb35059
SHA512 61a7bf67f9019e5f4c653246e1844703619d6421c3625c963862ee9b0b3975b26ce2f785c9b3cc79e77181c098f0e3d60c9f0e21203928117c6cd45f104af36f

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AN.ico

MD5 ed05e0515da2b4c11d839493abf8d44b
SHA1 8862a2bd75632d916fdd049b31f2155ac7894524
SHA256 8f641c948721c9e7e92f28224b8b1beeb27382e5bac8a4014a57537dd7543a8d
SHA512 31613012f4ea1da8d1318f69e6e9a4be068e9e490f01ef0e1f880b33f50d715d92d7498ca99223ce81d6656ccc4293a7fbd272939e99dbc21d62176a6c6d9553

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AM.ico

MD5 16782d3d013fbdd1277424363dd8a0ad
SHA1 c26e1fd52de7ceb24af6f01fb4486d39e1932bfe
SHA256 faf3d661a09912ff0c1f6cc92dd8775c3d2be31e9a72fe0962c144d679021d86
SHA512 44bda0a5d59f1ead6939a6af13b81ab23b28be44a61e7e736d5e21cbfee813a3a44c5832b16036717f0e18a418dc449b5c3aa1e0f05c4830cb3b64698ce0901a

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AL.ico

MD5 5dbcdfb9a2f9120ba42006c997e22b42
SHA1 01fe537ccabec19b252e07ed6ab557a46a70e6df
SHA256 8f726d2132b2b7764936aaffb52ef7b0271abf857949588c36b32fb3c769bcc4
SHA512 519b0757a1bba205915aea9f8bb715072420fae126a4917f146c9ea7567fc231d74f93ded8dead86dcffb0fc293de1a4c85a161dd894b490e57806df67cf01da

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AI.ico

MD5 2d5ee470e51e769e649109d2721937d3
SHA1 89bb18a904dc2857e52cff3a384df50858d5e17c
SHA256 08afe88e8a0475e320c6da70ff530ada3a6fb426051a6337a769c14dc37ae316
SHA512 d6801a6b238a9779b0b8829f79412c227ed8480ec060e3d1992c9b1024c94a8f1f6ed32097c8a93a6f2600ad68b2ac537fba5f0982a41fef01a832994cc0cc20

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AG.ico

MD5 93f8d14b56bf5f257f87ea438c7a3601
SHA1 31b71ace333e016408af2f18290463389206d1c0
SHA256 8e36c85a8ba6b92ea906d4dcda412b492449e668fac3b05f5fc512118fa71e5f
SHA512 a70adeb933e65ba11b28d11fad9a2eae29a623013f9bd8383afa5c794f214a6820f797f03f1714759bd38356b160b9c1e159dfcecbfa7e95f4ce2b24bfb24cf5

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AF.ico

MD5 e18c650283441dfbdc3aa46a414f326c
SHA1 eda65607858d6b93db9ca4a9f20cac382cb685db
SHA256 ecf99e08bf15aca4325c4790ee20ccc674b6f4fc6dbbef0885f36bf8e6e8aa68
SHA512 f10cd2a31390bbb06546052214a817153f35ed9b5c5403995267e1e9b4987630c08ddf7db414146211b8cfb4769949cd660060bd2a5c8a51bf5bc381372a6673

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AE.ico

MD5 5c22046c8b4f37adbd0f41a811238d5e
SHA1 e3c49202f86ff0718f169ce4cb82570457891bd3
SHA256 0759c987d55b3e2bc78ea1761d451b0b40928865c5b5652ef7b304426bc1dab9
SHA512 655c129c7456ce083a9eec235e04b871a16c4226f7cb1aa2ac4b119770b24ac61036950b0a77257af96352318a991037a1b9b5e2925ca84272995dd8135abca8

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\-1.ico

MD5 410e4dba1b3e1acd689425d024f3fd56
SHA1 d38fcae133db0cff918dc455acd8ffa437989659
SHA256 e10518132ded7ee51739953121f6efe77412aa85bd744ea7b256a5a6da751e44
SHA512 cac41002ef9ffe4592a0949ebb3a21b3837645838e623d3a188f7e70b6c82b2253c586a6a9395007849da0ef94d6dc47bcfce9cde554e8b6becdaf21082cf014

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CW.ico

MD5 832d93cefd95c7d16d8a30f48436944b
SHA1 8ed2d6967ba2fbe26f0b6215f315b0539c01c3bf
SHA256 84bc2d33f86ca81cb3ab49d4cc2e8cc442432e1ac18e9b5eb2b171990eb272fb
SHA512 ecfcca4747226e2a0b72b9cd6a2a1b366430c8ebe7f921f636df6d8f8ada831f7853ef8647cff36b7a6f20a0855866312ac8a287191bdb64a71d1372acab45f8

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CV.ico

MD5 88e0b4a34cec1a586aa355bd72c4e0ec
SHA1 33c58b7b380b23fe1462d242ddeeb341d7eba3cc
SHA256 20b47c8ed6cef15198f758be3ceb8a54441eda8a4b0c61634a8b73d06654b187
SHA512 34420cbcc7c16bbe431b009b1ae43a91046510dcb1f41c8bd5d9776ae5be524b53591a157780532fb37704c7c0ac94cd55bc243b681115e0954c458c15e63857

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CU.ico

MD5 b133d25efacc1f50becdab1b727425a1
SHA1 f98c8cd3c1f0e6ee9462776202b0aa29b9f2d414
SHA256 8aa8589840ca738bf96233824b26d4af82f20c4db5feb554eb9c1bf4b0655a0c
SHA512 d81e7152a940b0d72f355cb2313aba5a8f4b408e1f84fb376793afd445b1179de4b5290b791b2522181cb0780ef3f184186c202acf96fd7ad2144ad001bce276

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CR.ico

MD5 7610187c8942adc6379ee8a928b5943e
SHA1 2e050bf0395a9eb762ff4e274b334c8dba86ae59
SHA256 c8eba9ba7479ed1675eae586687781d98c41edf3e9c29078ff849c17c8b43dc5
SHA512 b8b968c09a37714847e09518ce2741e400d47c934297a0726ff9076071d5368b68d4d9e006ec6f3ff57e44f27f64ac31a662c3afbe1c857a9cf46807a231fa6d

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CO.ico

MD5 b1e6c42481d83915d66beb12d2e5bce4
SHA1 1d3077f62d0db64e45713a33bec0b669cd620ffe
SHA256 6c255557f7d096c47fe2e7d12ddc95d2f143b1c8c42bdc1121e951dd5c306d4b
SHA512 03c7bd4337be7e53f98f4a16a3db558e6ff02b43c7203817897113a663006b005a5a6b31e2ee4e914991b65f1a3e5a3cb7faabea0df8cc12ce42654ca698ece7

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CN.ico

MD5 c38c10cdc79a19a1c6cb3edc6684069e
SHA1 f1682df8292b53ddf1b240b63ef74e75d1b64fce
SHA256 cb888a7fefc252365abc4ca04ff5e6704d1e70e7b19c282907085ec4ef461348
SHA512 12a7caa9b4b41cd2e1d1fb1f9e45c45b52f9dae498b0f4cf07c87ff25872da47f307bfbe61022d6fabd34cf36d349c4120734b23183b1eb06f7822e2fc9ef039

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CM.ico

MD5 dad6cfedba3ef1c9b983d4085159b0a9
SHA1 dbe742ba3d4ad1a16440b05456387024534ee50c
SHA256 20ba53d3c0953eb1c47842270d4fba6f7a514087fc0d16400df7cb033c75cd8f
SHA512 aee2f194ac62a8a7111805ade9785a2c7afd0a507331005a1936adcb52084478593e00d4091aa46318bfb90a466634fac36e34e71b892d53180c052e3f0ab0e0

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CL.ico

MD5 69076ebd2104d4feaacc90c116be22d4
SHA1 5bcda0bc0a3ce338cfdd9211f0c022acb1fa15dd
SHA256 ca76382bc3d8fc37de4f5b957a50e7f4c85afbdf990207c698dd8a28cbfba700
SHA512 f6405e1ce4664b94dc55b7f9e2aa9ac1c9f31249bd2dc455b7bb6c904fd69266bb2c7d00870e08b814a0fc4981b5faa13d724fe5edba73b8ccc75567322fe59b

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CK.ico

MD5 e298c18a1e686067dbdaa880f0d6d8aa
SHA1 617f5422777ff7de11581c117d917019c93188ee
SHA256 e17e1e1611e1de28707872a2287a45d108a48c9f6fd00574def682dd2fad0beb
SHA512 b72b67fe51e41cfc98d6d31618c19f618b9833f84ac54cda151519b025f5685b258c1393bcc190ae0b6cf5be70cfb71b6d27567807f5ae101e034bf1f57109b0

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CI.ico

MD5 08ebf16a5070b3dd3f99b5b595f8014f
SHA1 5ca1eb5e1392161b7bef86245be061107fdb6db0
SHA256 b682dbdd522f2b9e3edb7e2bc80fb82b973f6c913bf2c5992893d26a7b777e6c
SHA512 f1f5a4f6eacc6c773a8d1ff2631ba2505603eda68ef289b91ba9a872d6872e8581749dd2bf34ca56abeae20691bf01917af45496fa717c03a2999cd2e88668ba

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CH.ico

MD5 02bc13498f6d75a299da5afe6e14208c
SHA1 1306eb72cc25d7f6f1ed27374d06f48a034384b8
SHA256 c712b3b71aab3fd48b7d0256430b3177106a7bf5ec93d1ca39a912d6f5f9d877
SHA512 f71e7b005c1f6e751fc5a65e7c27574c5df548c3af35dc14995413f8bb8368ba515e5f55f0574064e2ee724b96352d3aba69237362383381eb7d9cb325051528

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CG.ico

MD5 713242b9378bcc70a07f166be42e0283
SHA1 d76fe8c0f13867ee0cd9aa824f9611ffb384e5b5
SHA256 8caaf67c31afba8703fbfb04a416e54720a7f015897daa733bd9d89ab55e7c63
SHA512 f13eddf4c656f982a2c98881cc1df769b67b0764242d85e3c76b355a6dc80e86ee6fdf6ce2956fe4d90f58402de605ef0809080ec28d365c64ca662f33d93bdc

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CF.ico

MD5 6431050f008d7af7d9d445a16959b3e0
SHA1 8fc15ba33e4f1e5332c8485da830bf788da575b0
SHA256 29218dbf97371f2d0282388a8c1f18df0cd59cff572e9a1d3833fa30dfca1210
SHA512 c9d9ed66847f2bff165d3ee13befaee58492950a3c326b94780803daf1d5792e5ebc79dc354b47531be700d703c207b4a7ea06b4ad7d60eb0e6a5eefd02dc122

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CD.ico

MD5 ce3a6c35e3c3c2e5a283e903378b9c47
SHA1 df642801fcfb8c444dd6268a3169cf0d5e3507a1
SHA256 50f6609606763761767bbbcaa7f845644a15612fd7a9228c384729691a14b350
SHA512 22c2eedd1ea6333e0475202ca1835372efe4312480996a02da8067a15cbf90384e455c424b371280fb87494d30a87d580eac7e5bdb42debd522553feb02f53d1

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CC.ico

MD5 549077dbd6355bdf02cf9ae94cd90d31
SHA1 447cee9c147f048529a2f654665e48d390d4ca61
SHA256 4c13e537ae62cfd9e6bf1690ad6fd7a0444ccdbebf9f29478c0238ba60c4bc58
SHA512 720a6f26cb64b4ba56c931370ae74ce0ec83756a1af0a33af2b11ee725ce4eea2945972283b49a908aec9aa42eb7f357e7eb7030465a11d4d63b5802ca6442d9

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\CA.ico

MD5 a28d60062ceb07e296f5c4ddd6e76fed
SHA1 e9306422c690eb6e773b9ce306c6e5eb545f6e1c
SHA256 642b7b575255c44fa96167b1268e69f2fa72e76d62aa8f15768eeebdd45d11d2
SHA512 73dfb8a1ca49d5b8e9a739fc36dc68f5ee7a66be7b851f38941c6a7b55af64187b3390d1e8962b850e6d3f3755b9c03c5103ae62cb0e29855b2cc7cc49b3105f

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BZ.ico

MD5 79c5d3202341bbd141ccd6543fe01983
SHA1 ea4b1accd5025dce621752bd23a5143b1128873e
SHA256 627bbd8aefb32eb4bd11c2519ad35427d5627bdbd54b68119827990ef66b4180
SHA512 790390d2e6bd15f35f7f414504a01f206b6114837388b8897cf74bb0191598b4dbe01f1a99a39e0f3a535bedc714d77b63dfbe1e368f744e04acfe93f938ae25

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BY.ico

MD5 4c2fd28b7d3e934b6979550174bf4f97
SHA1 5177886a85094d8446ff457e2956481a68b066db
SHA256 de9fb648d544aee8166232826f3ddf7973d957eedb70ce5100df5a969d7a6cc7
SHA512 fdafcec7528305f0aa03d83ec5888c19bbea333b116a142ade6fb53d2812f4cfe5735ffb2ba2158389751c04b3e172fd196648e9fc8e95892125fdac1183a976

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BW.ico

MD5 52744003db72b685d11c884f2f9e56b6
SHA1 310b6932dc8864a8a6b2811badfac88288609a79
SHA256 9c1c1186d19dd5c439351fcb756df877c4ea351dbf4aac1de226b98b3053ff01
SHA512 6bfa94f9e8905498fd503b55d67d87ad2778799b04c9129c5f15de45d3fbf75d3460b5b855f048d169e345766e4457b25e29b03abeff043ef68b4669822c6d8f

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BT.ico

MD5 6354a3e9500fd25c6b16d06ee185b4df
SHA1 cfc3cdf3c1dffc5b8e00751cd25ec2e25d4ebbbe
SHA256 ea70f8f17623daf8128eeee0fd9b91d942d928e5b20da5e1bbc7a5d7a4be5e1f
SHA512 941b4b4b61f6475dd10df924f6580fc0b351d6bcf3dc75e8a9ed6ad60d57931379483457bf5d3c998e8fcae23ad110160fd73cb1e876119a702c0aceefe3b486

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BS.ico

MD5 8e52a4c31bcf00be00030a8e22e0642c
SHA1 a6743ce24e9ccc60064ea3629d54593cda7309b3
SHA256 2f2cf7125492eb037d8c5bfa15c1584ad8b55047f46e5052b142674ce10e95c4
SHA512 c5fe2072d1c029f359f79e07835e528f5527ccffef1d85483760eea8556b842449dd5babdad3b6f3ced1fe5a6104bdb4d9a688630bd9e26c8e533bdacf6096dc

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BR.ico

MD5 b44d5f3b7562b900379302a2f8abe2e7
SHA1 93f2167eeb28510497a4cf6e731aadc1deb783cb
SHA256 29be53093407af0aa165535b196cd3233e19903e7d07c7487c3590feaf3806dd
SHA512 6654a62d640d0b20be490d05a871abe2cae150e3ebd9119c656a8e62deb8a820a417c06fad5fcfbbf5d942c73c9042a281affbd9c28240d85d17ffd1af709ef8

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BO.ico

MD5 ac44c7d4d6d1725f969c9aea026bbff1
SHA1 7796cd8f72ca40280d819cf4512a534eacf35b68
SHA256 a74d0a96d71485df49614b77a3a232af0c0984443cf2a3efd30d2a9b367271f6
SHA512 1a68ed03fd0bb79460fdb2c6a0c3677db9055f17a14da79eb3388fa3d4a61d17984ea3d0b7d69c9bc5b6a39be955fba62962993122d8df860355125b2e759242

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BN.ico

MD5 4af382e98b18f91caac79ae5240ccc40
SHA1 3158bae6579aa85151b67ab08687b64467c19e4b
SHA256 9cb1449764b3abaae85b2edb0e39afb9776e4c662591f3b241b741a502bb777b
SHA512 0a6daa2b22ee49819d0cda58cfe74343638c62041ef342b08918edd4e1e9e4e90ce2e72a09773b2d9a8859310d237cb8f765fa9658cdfa4adaf1b9e40bb5880a

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BM.ico

MD5 d3be823145f7a4b0424beecfff5c9e75
SHA1 0d279742a4c5468d58f2d141b5e3922699b165b7
SHA256 7f33f4d7cdbe5ac4745917badc34bb93d38a8e5abff6bcdc0c76d3171baf275a
SHA512 6f84de202333e036d1aa772a82448e3e0adb2b453d3f93eab5ed745b4399b74e07abd3a533862a68b57dcd1982941698545e239a6510e0f59a51a442adbd7009

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BL.ico

MD5 a5b94c9bcb4d88d9db4d0a568f80b079
SHA1 80167cfe16e20d0eda73b7b4627ce676911814be
SHA256 8165efe84da8f10193cadb266016cfb6ca87724614d00c70495a7b9afc172caf
SHA512 5a186a33e52870dbe2e58c889e913315add63486dd184b216cc3a8b2317169e3ffea8eaaf95084eef6ea04a0f3a791d6012bce6b0118143aa514820050577c54

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BJ.ico

MD5 994401f509db6b74c3ba205814ff1f02
SHA1 3334f65250c7ba7cbee20065bf4d52becdbd392d
SHA256 569c37c33bf5fe84cf1766c26c531be1398e80585551cd065dfb8dd62a57b608
SHA512 cbdf647eebcbbab5df5b8b68ffbb900534f2d41ec2f4d74e53e53eabbd2219caf83dce0cdbb53cd9c126ce1f88aa667439bce5a5a6ae5e6eb07acc8c8740d1d2

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BI.ico

MD5 f44e4ff32292c899f1dfc0d40946c945
SHA1 3e1c7d81166d64dcd6052a7fbe72dd6a56753682
SHA256 84145ca9e4595bdd4838af891ca65f3b88f4ce830f867b6d4f821780152b9c16
SHA512 aad82aee512ee6768ab98e83aeda9b6954d792e81273594d4c2f46183fc0f7df8c0fc4a8035a43c8989b61690dbebea8e286461b01eeafa3398ecbe61750fccb

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BH.ico

MD5 75c68788c23a5adf9efe2c1b70526710
SHA1 3750a765118359dd026580d071da6bd3ecd677f3
SHA256 2525fc71eb284013f3add2f13578363e8030ed41fec3a7fd599a96b2a8ba0d70
SHA512 c2a8ee014d1c9ed3ff09d6781c5062fd9aa2dd233c911358eefc2f27d24cee05883086420b2ecab27138a5f6d0143e045ea2b80a221b30b28eb02ecfe3b6c0d3

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BG.ico

MD5 8237c4778058a9bab26f406b8f06dca2
SHA1 4bc2b85679ea7e634af68b4e31135d3205ae01c6
SHA256 426c8b630bdc5916c5a687450e90a265d18a1042111c7f26a5a7d85d143044ad
SHA512 b64ec153ba921e2f91146ec1461a75b59fb8e71ddb27dc306144a9cc1aa271e6a61096210f4a3a8e56b45ced2f16343cf61a8bc594b52ccb1d9a0d5b312456ed

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BF.ico

MD5 afe862286a0c17305ca72a54bacc21ca
SHA1 e220c5912d11960c8e9ee38f44dca1361b729dd3
SHA256 5f865103ca695247ab7ea7e02a1942ef01cd65120973e17fa3fcc3e59f9f7eb9
SHA512 33905016ee79a2213a5dd03d553e0245058422d45861f4587f4b3aa2e9562686c209fd1e76575d7614a52388f3308907bbdf867223e15a7fe62d3650b130ce68

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BE.ico

MD5 f7ed63c5a74feb0ee727cab8d64e2ba2
SHA1 d06d03cc1f832a30c3b5ae51f164291498ff4df4
SHA256 bd0eefab4e51b0beae22d4557f8c43e2908c39b23158900d9c3d38d4a3c27b2d
SHA512 01bb6f850b6b213e365b55861f6a92442c15931db6989f6be03a009a97151abf066eb1298fbd6d130a7ff47970097ecda5855acd2f15fb750f1e5f6916b06e48

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BD.ico

MD5 7bb2410b8a58504b0645e9e869cb903e
SHA1 a1d49a900e2367817575d581c34a3f4b5282db25
SHA256 f8d767b5e74cde08d614d64bc51f4d9db90dc056dba1c38ad8b21aa6c598a286
SHA512 a629b6e3a5fc4cc0499e18139260a7c67c629d76c8264ffd3d99c62154354b50bcc5d73b0475891cf38b90809de996648c211a9c2df0aa4e885e536fe4d3f825

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BB.ico

MD5 a272b143736710d954a021e7b5b1fe41
SHA1 abf3a358da02a0d9786a022a1367d9bf805ae060
SHA256 f679b5b2dfe2c980b55b713a025936c10260db10254391c5b66dcec51dd97705
SHA512 9290ed552de75f080719d3e6f4954234b48cb1bf87952bf62d1799d64c0d0a2419fe6776d5a84f691f877a6e7ccb176824e7dd00f5ceec7da32458faf1ef6485

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\BA.ico

MD5 a603875f8aecceb0d62c9c346f250e62
SHA1 44b58245d17d8d205e6bc2015965b3ac9374245e
SHA256 b586dd987bd326d24ad3edddd1f649d2fc49eaf96028e62e6e14208591a31a9b
SHA512 62c218f9e7e30c056c02b0e9e35b39fa9b66faced7fa8c3a14e9636450d271da04aa5f04a627452be03d0df062b38db0bbeb4fcdedb0d7d820d0bb186cb38953

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AZ.ico

MD5 3abcf274a070469b7fd5cc1f60408c9d
SHA1 a2fbdbc0028f398a90b351fe5e3a2e4b31153b07
SHA256 d3cc5eeabeae7f54a8c5600b5c2354b355492634031e32e8ba981806b0494b61
SHA512 14be128eaa0b49b7ad07ad2230732e923a30c204faae1c3afac766088836845fc385a99ef50938f6261456e0e45afcd17c0661345ab72cca8b66bd710eb3035f

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AX.ico

MD5 19169001a889e72fef769900ca7a8b27
SHA1 e17d9c371cc34d19f05c46d81e06f7ae2159dc7f
SHA256 5ac8c61a8ad2d7ecc3e76927fd6d52b4f279c4d3a92dd32715395581c4615423
SHA512 4c8247ab0f37cafa90ae34aa865af45b6b388fdfa8ab96935d2ae2064c620240dbb8f93c9958844a34fbd249422a9b5751639179697bab44aabda8afc18b0454

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AW.ico

MD5 49d969f363a153b7e1cb4dc2cb742238
SHA1 2a8fbfd37be58690dc2e0ca2b3ce04c2d15d6eec
SHA256 f0d730a0d8ce85f049a6d8a52733c506a8cf48584b18838f3d677b09d9c09b52
SHA512 97f17ab20ee96ae4e71e31c7864c509ef0b714215606413c801b3608770415ab63d6d5be0980af7231e4c2e270407fd273c36e0e47d524e59126b933fafa4eac

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AU.ico

MD5 ae8189b2c04d783a2f68f0204f1baeab
SHA1 e5709598ed08427a1dd83e1d994330bba1b1b091
SHA256 047f9bd82ca7e2685c1dca4c065209977b5e8c32f78ee821bcc7aba12decb044
SHA512 ef1dd8330cf3cfa9840a5902e13c669e6de911ca9f383067506e2c106f05021aa79df60e2a867259bbd1dd056b9367d5814e9bcbafb242d718fa7fe0fe664248

C:\Users\Admin\Desktop\a\res\GeoIP\Flags\AT.ico

MD5 8effa2f5bbcecf6415b04f9408c0a65d
SHA1 3f3249fe921c1d4767b76b0c3a720cba0262b565
SHA256 236c59500b9bd83212375ca7514c0d62dc088203ed269e9cd55ca6349adbc8f0
SHA512 3f8a1f0683207ed616819a0e42b18e5b02eab0300fcf6eac1c399f0e5475f45d62e0bdebfe0055d411d529649938623acfd4b3b02fe80fc9da6a0492dcd31822

memory/3584-1125-0x00007FF894733000-0x00007FF894735000-memory.dmp

memory/3584-1126-0x00007FF894730000-0x00007FF8951F1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 61cef8e38cd95bf003f5fdd1dc37dae1
SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 dd64a69fefa70e1b968f2f7f98a8197a
SHA1 40fd364cc3b5839d94102e8fe651ff937f29a52e
SHA256 7149d463000c9e0afe2bd7eb0e30b11a4f640d16f483435958006266d24c610b
SHA512 44d0fa405116bb49968ba1558899009e2cb0acd96cebb2dc2c0b082f136e60ac2d177561e85eda95b0e4f2025af20b1d5cd8f1a6a44b6576f1e9f9b017dea465

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a384589c795db6a179c63cd58d77c90d
SHA1 6af6fb6d32970bd2d207f048f899184ad56fb9d0
SHA256 27350936f52004fb79185cc33e35d09ab344010a3eb3f84810ff9700ac765c08
SHA512 f8419789ba4a72027aceed3d1e877213403ace75ab09444d0d40b1cd6349e421480fdec1ed415935b34d3d44b73b0e0d2f582108ea31d8da2b9f12a8529b1622

memory/3584-1177-0x0000025B7E5D0000-0x0000025B7E5DA000-memory.dmp

memory/3584-1178-0x0000025B7E760000-0x0000025B7E772000-memory.dmp

C:\CraxsRat_Bilder\platformBinary32\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

C:\CraxsRat_Bilder\platformBinary64\bin\apktool.jar

MD5 c186ee0c87dbf197456cc010aeba99da
SHA1 fb9f342bccda27ba17b737b2f8e8fa77ba9f50b9
SHA256 7b4a8e1703e228d206db29644b71141687d8a111b55b039b08b02dfa443ab0f9
SHA512 f6268c7103e6c2a10416fc039ba087b9129a699136ff172fd5e386d46c6a1ab24e4bb0562a4e6862f0f2201877caa404ea7afc6a08501d3da890bd9fdb086c8f

C:\CraxsRat_Bilder\platformBinary64\bin\server\Xusage.txt

MD5 b3174769a9e9e654812315468ae9c5fa
SHA1 238b369dfc7eb8f0dc6a85cdd080ed4b78388ca8
SHA256 37cf4e6cdc4357cebb0ec8108d5cb0ad42611f675b926c819ae03b74ce990a08
SHA512 0815ca93c8cf762468de668ad7f0eb0bdd3802dcaa42d55f2fb57a4ae23d9b9e2fe148898a28fe22c846a4fcdf1ee5190e74bcdabf206f73da2de644ea62a5d3

memory/632-1752-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

memory/5076-1763-0x0000000002C50000-0x0000000002C51000-memory.dmp

memory/5076-1776-0x0000000002C50000-0x0000000002C51000-memory.dmp

C:\CraxsRat_Bilder\platformBinary64\bin\temp\res\values-ms\strings.xml

MD5 fb8f8b6b6af3fc4cc9e38049d29f68a1
SHA1 68fc85de9cfca09fd7e4ef4743107470d048eb5e
SHA256 93dc3f1043cd8ebbafc142591d8c0c1de4de841ff9d0728c681c9ce65651af01
SHA512 58554e18de5b75f0aa4624d35a1e44632379973709b2cc179e2d0523bcae038b4f8d3641459167d4b65937380e8b5aadc0636ee83b1514eec322e1ced087a13d

memory/5076-2099-0x0000000002C50000-0x0000000002C51000-memory.dmp

C:\CraxsRat_Bilder\platformBinary64\bin\temp\smali\android\support\test.1

MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

memory/5076-2956-0x0000000002C50000-0x0000000002C51000-memory.dmp

memory/5076-3067-0x0000000002C50000-0x0000000002C51000-memory.dmp

memory/5076-3072-0x0000000002C50000-0x0000000002C51000-memory.dmp

memory/3280-3402-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

memory/3280-3465-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

memory/3280-3626-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\manorj71.png

MD5 9a2bfd2a014257a0d6db2d2f792d0489
SHA1 e5557dc5ba5f6d0c4c8023185d9acc1b3f063ae0
SHA256 67618fdaa085253410592dbe82f1789b41070f69fe3148639e50112f6f0cd2ad
SHA512 de16a07add39820a814cf9a05a618fbb036bf726ab68eae7c95d41a286b3ce318423d8f46166a630c86fc1df7a2850b05e57fd25710f73619173d575fdfc99c3

C:\CraxsRat_Bilder\platformBinary64\bin\temp\dist\temp.apk.apktool_temp

MD5 aa1f9b84fbe2ca3aa7a43c9607bf933d
SHA1 0813944a33abaf219d4d36ed764814e4465cf4d4
SHA256 57e590734b2ffdc40bcfe8a691a5b33f56dee3ef8d9afc32f1fe89b0e9cf5b76
SHA512 59ea70d62741253b70fc592bd9e7608a5033f71d5bb6ce7c89766ac32b2fcc7e73aa7d87db8586ddce03d42ad1e5af037c790e27f2d3a7b71da57260a9573f5b

memory/3280-3851-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

memory/3280-3850-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\legislatureb1238.png

MD5 47c96949230e4c008200ebf3536f6db3
SHA1 26177a2f741b6486f01683fd79e0f2b8b28f99a8
SHA256 2ca1d946f5eb5601dbccd266493bc4570a139d174393a1d820f699129c9fafb2
SHA512 5c05a7c50abfd57be5f983e0bab7b60ce5125e43b65d7f0d048c46aba1eea7fcdfde41ffb9c5cbfd9b30a1ffcf3abd3e79493a9c126efd6617ef68ce507fbdcd

memory/1272-3858-0x000001936ED60000-0x000001936ED61000-memory.dmp

memory/1272-3860-0x000001936ED60000-0x000001936ED61000-memory.dmp

memory/1272-3859-0x000001936ED60000-0x000001936ED61000-memory.dmp

C:\CraxsRat_Bilder\platformBinary64\bin\temp\AndroidManifest.xml.orig

MD5 fe2038c2e311d4f1a06e104111d1e563
SHA1 062180f9c0cf5f942dbbd31c64dc12a923ed12ab
SHA256 1b72e60ef6bf87c3bd820eebb4d1c5f3c04bd9ffc7835f2c689550e49740afed
SHA512 1f812d894fd0469335c25060475cae7c83d414aab076b1cdbc20774d73569bd6a8e9cc3dbcd3183404f372d1933b161993b6b7b49f445bfe7d12cfd76af9b8f3

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-hdpi\notify_panel_notification_icon_bg.png

MD5 c0d309204db75f8f194cf7b5f781b3ac
SHA1 8a72b2861c9980eeb9eb8e4a47f387d3a97a7407
SHA256 a3d6ba61761e3957ef14110a4fb26fa2d0255605acf496e7133093e01392a069
SHA512 c374533670d795f4a10ba93021d765d5e233924c0c3fc2e2618659a332e844f2461e9c6bc8580361e48ff2821dda3f8d3d8def53a23b5307c96d67cbf359b13b

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-mdpi\notify_panel_notification_icon_bg.png

MD5 379a0adc8c29ff8e6aedb6dc54c292f0
SHA1 733d9c4e949bc54477e29902328dccedafa64979
SHA256 2e28693300c8cd5dbdd49cbc71970454e9ebd2aa3aa62ed97a97dc1f6894843c
SHA512 22adfe1725f05d862a3aac0a49f9eff75cf7b627e9d4564c05091227b05e2a6e25780238653e83b31644b9732bedc0d2fa3b61f1a7cd885d3c487b876e68ce96

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\ar_access.png

MD5 00bff1515731929a7c2254fc71c4d16b
SHA1 d0f24ebebad7a734945a9c71cc87940e9a5691e7
SHA256 a434d3daa641643d2dd5989463bcea7940053ece69381a8cb6e1e48773ba0475
SHA512 bc463bf073f87f8298afa2911df743cae55d94817f56354482be1a91be67c002bd6ee6d547da8fc2600cae379391c08576994d8c45545db3670f7fdca699a235

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\bakaro.png

MD5 531a21c44b66e195a1029b29b2aa1e79
SHA1 eb65f9000dbbcc345692b6c8343d202808b8375d
SHA256 3e6051eefccd1935db1d3bcaaca1538148d23ddf6eeb76d055b4c12877238666
SHA512 0b32cd0b86d5cfbb71c821c3ca441c37c1f7c306e6179936509e589465c0cc4b1c22c0738033c3f186592427a095844b04264e59c24e0680d2be56126c7484c9

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-xhdpi\notify_panel_notification_icon_bg.png

MD5 a0c2ca0fe4db91be21cc897f237c9373
SHA1 72e27e730966e503ba7eb0050236d2f70eb3849e
SHA256 6598a6e07bd8876909eb886ebb75529bb91fa8677e0e5718ac38eb2962833da3
SHA512 af6ca8471d76262a6232a420d186340ac7d61356a99796657b383eefdee241279e0b3563c8207f522f71f53aa91880e3628ffbafd82cd145c8e617153732f8f3

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\btnback.png

MD5 86bd066aec48f7179fe2b4e3cc305e64
SHA1 cae46eea99d8ce7080be6849495afc824363a022
SHA256 90449202d9fc1229626a244e45d7fcac854147ff87a6ffe8f2287d89299f0ea3
SHA512 7ebb00a67c50ed4e748f36d7e536ffd4aef8f78ec76cdc27524b5a6ca6525480666b7f0d750a7e9100a832cb4ac2a757198ae6d3d3b4adbfa5f90f8540c71cb1

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\del.png

MD5 3103a2f2c768ae3e1cb6a05dad51d2ae
SHA1 00ceb26ce636ab8090dcd2b8ca0ca1b5db82a403
SHA256 744738ffe92b1b2acaaf69991b00b6a2874f52e583a2cc820e392ca25a18b1f4
SHA512 4afe3d78d220ea5dac03c54a966fed4ab0feed8347acc1f7346036c26b13368154ca493d03b038634c25498fb896110aff933726bd296b9aab535b7c1e6ca8ba

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\cpas.png

MD5 b11de8eeec86780a704aebb574ff5b20
SHA1 bf5ec267ce3e18252d9d07b5b94b08ee9b66383a
SHA256 95af58ee4857dccd8d5409dd7b7f6ee4c5a82f96ae51c1a766729cc65f44b415
SHA512 8ea36caa44b406606356c954160944840aeba59f673187c0552100850f2da3e95f059df94d2616e61a9f36a2c318beaee0b50bb6aa8198d68f4eeffc7f099480

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\cn_access.png

MD5 32ea9de96b3b21869e851a055603ab4e
SHA1 9591ab5f86a60b3830bf2ca403bfd34b53de1967
SHA256 9dbc3a5501f2fad6d714cfaabb7765771b7bfc88044976e9326514f91ab7d9a3
SHA512 f6e74575f478d76b6f9b2e247003116f56cdf528413eb63608bcea0f00883dea82dff08d084620f60c2ff34566a7705c183232038825f8da02e9206e5d483a8a

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\en_access.png

MD5 f26a4122f269d0bac1c7f8b72dae5557
SHA1 78bbbdfca77b724886b58e238dab4e535ff975e8
SHA256 01b370f3f0ea9d66185e717f9e1e0963498bea4981a6035db73c62931953c803
SHA512 24941d9d634cfbc5ecc87964437fc38a9c7fc6715cbb83d9ad7138938f5b48b05f07d511726bec732fd3e0962dc3832dfb6cd21d7549edf3b5d08896af165f95

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\glob.png

MD5 5a454dba7025d65da265401ecb6c7607
SHA1 bb635246423c4287ef6bb10939cf53bad81ebf1a
SHA256 4c5a893698068ec39b013e40b4c290fba579b40684459b15ac19a5417e0cef9f
SHA512 7495aba136a7a004297d7792d90b94fafb5ed92747ca7cd38a50da227ca8d21564b0bea37ceb162a8db919bd2e3e04d3a6f25cf988600321543c73536aa25c68

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\nont.png

MD5 64660d754f805034a58bb25176d33273
SHA1 87a7d6fb75f334b10691ed78511811dae40206b8
SHA256 14b29e9370a4b4151d71d6e38713bcecf99de1436ead1bf4d8f169bca5c79a2f
SHA512 5402914cb829755b10f05d21a9e9fa41ae9b5f7ff01b1fc47a0d2d0a4731d003f33a3927ba4185c2244164f560f0095e2d9845378fc516549c24d53805bba717

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\newbtn.png

MD5 5e52dcb8d92f9f6e7d8b4ae0c08f4a1c
SHA1 666e652ee0363b167797086a5961651ab31e89e6
SHA256 6ce06189b4927ab29c05f690dbbb1675f5936dd49f6bc72c6a883b154ab00515
SHA512 4a19e65e742239479d380540a945c0524f8c4b34d5fc349fcef232d3317e352aa5734cddcd4ff6bb403f899275127dc73c5d0db74ce6a3c4db12794c8be3de79

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\keybakno.png

MD5 4ceab5c16dca3412747f41124c8464d0
SHA1 d9433ec326315df7479dfd295f806bc119cf7512
SHA256 6ad78c5f714a357b019e1beefe53859886ac55ef798d631c98a196a62c072c08
SHA512 5b09f5ac4492bb066f18b5918ffeb226e914f9e36dba864fd7f1b9b667ede94d2ee340518482c4c1e5d1e35741f3c1655602f11bd1b2b0ece269cb39e690b1d7

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\keyback.png

MD5 66d24f5d96ee09c300f57fba3268cd2d
SHA1 6668309843e3574bba49e557766004c8d1313c98
SHA256 511d2a2d97d54e3df15c6faeb165a80796af8f3118e6c59de91f50e39231eb2e
SHA512 6b2914ced65d2e1ab9ac5225f939546adf54b7a4ff7fd177c21631af1d9ad68ad4d6058e3fb3efc1765e0e23602ac41cd552de2fc4571f0ffa2dd242671930ea

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\oppo_bty_ar_1.jpg

MD5 efc13a6647b5474367b86b835fd4faf1
SHA1 2f2946d0274ec481c798c168ecd8fce588c7879a
SHA256 734250f3de8f40cb3145de509ae552eabc07f53368befab886f8b049c470edbb
SHA512 d99d2234ff967b3d691508fc6ac7409a459265d4c66d0eaa1836c1a156d7d26b61a8e79b3b92720a36fc6a5679e5583c7bc9bbafa477ff524332560ae5929c36

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\rpand.png

MD5 07efc149d9e0aec58d4691b04718f464
SHA1 0559be9d64306b03a4350af8db97c715bd0054bf
SHA256 c11fb632f4d6af016766f204069e25b5782baa2d0a5c9e550fb5e246d92b234c
SHA512 c2366f476c5e8b1d9a3294b9a38f2bc19a30ee141a5c1c6964859e0a812c209812df46cb5fd19402adcf7c469f33c1bdbb1ae0c13d6317d5c7b9c3c490d4f4e2

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\treelins.png

MD5 146619e7179d32ed2c56f749d38542d8
SHA1 42834afbc70437211015aa3de8a50b2b8813d2be
SHA256 15a771cda6439cbaebf85c8042686819931877047c7848d39a833e13e656fd89
SHA512 12186dd68bd30eb0f6c9b123ff68a44942f0a8fb16d49bbfcf2ec8f5635e7833d42f5931ac0181e2cac1233edeee47f3357092cd6b9c6628c4585a359dd7a10f

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\toggle.png

MD5 f21953ea0bae88db07b5552a5ad4dec4
SHA1 1e946e1167b0d3fa15af22b402e231af6f29c3b6
SHA256 999c9fe7c01758050e7ed0e8ef61199c9e482f436a9caff7a995ce8101a30a23
SHA512 9a38d637e9edd3b9996247a3900f6814a2a5993f7a2911ef7b0e3a09b8fba722b82fc3eecb5adb4ffe30a0ecd411329f07df3daf61259d41fa7fe05faad43224

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\remove.png

MD5 ce291781d9b3b824005a0c734fa2a034
SHA1 b09074f429072b5a6a0c5753bcbde8b40a7007cd
SHA256 61ea6524a86b21891fc7444c615da203639fe3447dabecc2c6c9f4a6e59974c8
SHA512 a3b3731e6135056872b6688c5770f75fd1d5602efa7cb5896a29d40720dd543d2b56ee2663f82f693ece8586ff8b5202d0cdd03ee7234b298388497e7327e307

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\oppo_bty_en_2.png

MD5 50c79d913be1e6e93220df9368d9b6c8
SHA1 f585a3f3c16952f5cb0d877fbf565c791016a351
SHA256 1f456d699383617c711aa5f0004b11a2ce5672a09d6618b80b27785d999a9fd6
SHA512 f54c3d462d8061e76cf204ec8493721eadf3d0eb44b1b5a7e5d3ce8599f881e7ddf833e152b1dc99df665e9b32c60f48ee8f81d805fbbfd0ee085d28616dcf65

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\oppo_bty_en_1.png

MD5 4f99302a19da90cc12c230f4601fb9c0
SHA1 6a3c3c548b682a78ea6f8bd1b989b14b492fc74d
SHA256 8c04c76f8fce35362cb4819c175ae81253d574cc5160b488b8b3aa872cec557a
SHA512 082dfb2d42244e9c4eca9d4ffce800b74e6f15a5151226382ff5bab9deadcbd3506d4cf80be27db8e3a116d2f3013b8e1d28598b14f900355889402a145ba70a

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\oppo_bty_cn_2.png

MD5 0d8630478e1f0c73e2b9c2f41a4f3816
SHA1 2d72b9e7ac9e10d7b7376ca82a6b789c6b2d6870
SHA256 9e86de042c926fd41d9c1e1cbc7a775af1a0835d8c182a0312bda3a77ae8fb68
SHA512 b42ca837b2a244ab7eba7cd842bc337c75362266b07c24402bc25d5fd290aa6f139913422d9ca8b28778ac99ed5f90fbc6d3baf05d10440ad03fc1aedf785b6b

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\oppo_bty_cn_1.png

MD5 f89a7dfaa4489dd06cf03f0eccb61516
SHA1 9fa34466e7a8a8bd2747ab68cde827d40e03342f
SHA256 0aa5fbccd5f246b408e5e863c5e63578722adb243e68559fcc1fffbba0c6b8b8
SHA512 f60048e4bf0c0fdbb42126764372e9d6a71c22370214e342bcedef9bcb5d1aae723814596bb3411f47d01381b196ddd368a7056f7382ce002541d4b90c86508a

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable\oppo_bty_ar_2.jpg

MD5 5dac58540858bf955775131648459ec8
SHA1 00d10ef0d343293a00ba686dca52c4c0d2d7b320
SHA256 afcc5c0213bdef5a0d1d5c09406972466ce5b76bd246f60d5937098f67d639b6
SHA512 9ad2042e91aa1e2404cbf565f467ccccd8d641ffd00ad940f2e6ba0e41bc687c45daa772cf71605f6181959ef9f820bc9681e3e0cf3368297f0705ff4d9b9505

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-xhdpi\notification_bg_normal.9.png

MD5 bf3a10daa260ba3f4cd3325b94f75cf7
SHA1 511cf72f3fed223300b577cd1e299670340b4ed4
SHA256 559bf783d765c02338e97952bdc9c6689c7ff99090b8c9813369118da8b080f0
SHA512 c558774509b6d6cd102fe5758fd8dbc242bd66efac8484399f2a11be604e4610be9a8bc51c682b22b71b226c50c70c000353dac011e5186fb456e938650b0eaa

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\resources.arsc

MD5 975f15b2fb1e0679e56f7f9190ae626a
SHA1 ad32a72f9878f98b9d798fd8fc7912031ff38e80
SHA256 9527123fcd1445ac5dda47249e483abc1f78b230167a162e23536467d268ed95
SHA512 bb5d46b57de76eb41ea6cb1f6e3ec73913abef0f0ee4e5fbc3014d268483b2e99b1911c26959cd41f93c8d39e596931881c68d17c5b6206126bc1f3218f746ee

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-xhdpi\notification_bg_normal_pressed.9.png

MD5 fa054cbba957c42a29528e848242f4fd
SHA1 344d8897537d06d483fd9ec163a727036da65521
SHA256 4a24d2180b1dfd48e40bd675e2b601fdb26099732b4700678984f59cbd67d417
SHA512 180bd0c909721fe183600dd2736b2703fccb4f4eec51440708a91f5feb7aadb45b67823325c7b7653b368060729a5a1c15e9c4d9cf8ba95aa66d489795b00600

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-xhdpi\notification_bg_low_pressed.9.png

MD5 668d179f248f33343f95b98ba90066a1
SHA1 07386f05e7edda430c9a0e1dc079396d840f662c
SHA256 3b79243ef0228d6a5b66a25416c980ba9620851c879093a9da4feb84b33961a0
SHA512 524c0f4be67bba44157a0a917f5521a3451254ecb41dd4d16e5a3746f80159d05f55e3698dddb57a930d4b0f7b04e4065924b4f52ff16d962c5fec002f2a15a1

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-xhdpi\notification_bg_low_normal.9.png

MD5 3d4e903880e581df0dff44a4cc07c65b
SHA1 76739b885ae4d43bed479546809590c04ea835ea
SHA256 3e09afa21c45372c035598c017c8fb405a6d678e6cb84dc857581cb3b40e482d
SHA512 88b24898f5206a6a4c2ec6b153e8cb2f082a88c685d48b2f9969b3cf109b8c3afe41bf30dac301fc58b28122eb4a83e41693fd61e27ae338f6eb3006b51ac3a6

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-mdpi\notification_bg_normal_pressed.9.png

MD5 34c35696bd285f91cb2a5506eb258afe
SHA1 5ccedf7866cc6be4fc127c0e54fe07e4de450dcd
SHA256 c7d9e7992b7fe7fad1ac8a469e0d3767e96336ae151a0f5cf85265a88f452605
SHA512 05453111699d0b6e4c15321f6f17c80aee0a018cdca19344352c6fbb6a62a285d918f84ed2a4f8adae2e5342ef4d30aca2afd315ead3d2c25939664c3110b805

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-mdpi\notification_bg_normal.9.png

MD5 b9272156e69985c12fb792d602828b8d
SHA1 5a5e2306486d3d2f44f89916692d063b2a0c6eec
SHA256 a8676a1793ac8310ffb12986232df66df092d29c242aeedc2b73556c010d38dc
SHA512 3ad0cf717a293a3f52cba088d8ffa7a21424ecbb3660306ac5543d3a26fc1cd1940e3e2b2dce5d2fbd02241b2c3a30abde71f826a074873f10e4a2957bbc3a87

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-mdpi\notification_bg_low_pressed.9.png

MD5 a07d2b366567cc7e6149d388f7897c9f
SHA1 1f95867eb54974b9006f736ad723a5f81e92925c
SHA256 452a417d7ba3af7292f03e7a8b73d8a9122fda7953425fd5603f5f6aa51e6a1a
SHA512 5ed078f25cfc5e02286daf8974f92ca9726f8388a270cad3ab8f9ebd478ce7deaf67ad23a0be40c619823964957323ac4386a610783735113f42acca3ea89628

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-mdpi\notification_bg_low_normal.9.png

MD5 becfcdc666bad2da32848991e97e1475
SHA1 b145c1483988c2b5615cc018b6c9a9300759b153
SHA256 2f7fbda0ba6e53e9a47e2fc0e24e32c447c613a5808c2d6285dc651e83a07ad7
SHA512 9df721e22a3845858500fa0da497a109c74ecc619b7a6bbd0cc57296859a470fd7a17dd3d5dc8858bfc99d680bb30b1461a1e45f5a36935d01eff4f78d038181

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-hdpi\notification_bg_normal_pressed.9.png

MD5 6e8af82f4c8393d50496361364f43542
SHA1 163e34d2001e4efc110ff1ec79c1980e60cbfcbd
SHA256 bbe825fae7ad565073981bb22700d71837708b515ebe99fe2fd0ed5ba5928a0f
SHA512 1577384c857936796e5915f2722453519b2f1301552e2f685eaad1c9dc7262ff1bc0845278f029793ae0ca55d3608c5800077b358b9c7afa9fb2bc341615f125

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-hdpi\notification_bg_normal.9.png

MD5 6c3c4b9d0b6c4f7019ce57cbc7e7aeab
SHA1 ada9458bfc632f36738a64a69401821405207db1
SHA256 0c6328c7b2420570a7ec38b3beb3bac9a29d895ac1ab7239315aba7266418593
SHA512 197a49aba9e31671e73709f0c18ab4732fdbf3c7bdfd33c411a80c3818fe5d787c25fb6dac1e758acaa8bbe498699630d5111746c4aeeea36adcdfd91283d6c4

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-hdpi\notification_bg_low_pressed.9.png

MD5 ddff200be4c8e0794003808eec48267c
SHA1 507c5f65f380dc8cbad0a5bcbe0e3085d34e3355
SHA256 859dbbc97eecb8c52d4a4cd299511d947ad9fd704687818d5c84a803b46eacda
SHA512 96fc42b457ca9d93d97410df478b7a7a12c5b0737a0b90c9f104da7082ce4396a7f8767f47d44970bda201812b3726beedf021c5e417957fd5ac24a6dd0cce9d

C:\CraxsRat_Bilder\platformBinary64\bin\temp\build\apk\res\drawable-hdpi\notification_bg_low_normal.9.png

MD5 9beb0f023e6da0e206be1340063cfd1a
SHA1 0f63e128ce75b58668f1aefdae22775e2503da77
SHA256 21f0b55280be10b187ceff8edef4a5a7047683e6e9fcf47de410aa3839f41094
SHA512 880ad614daca85f36d7e986bb32b1a8f678eed22570e7ff3962ab8161da9c6574580b17ecf6101e6f44668d07dd7392066b583e813a382ef5206e1a0f6af9324

C:\CraxsRat_Bilder\platformBinary64\bin\temp\dist\temp.apk.apktool_temp

MD5 e487c186b44bf7cd1c91e768b691cdcd
SHA1 92e16f14a876e05ca497baa03ab731d87bca58a8
SHA256 dfa263b08d5c66008ca34c0034d5fee14d6fe008a9c0b844e7199f383b876243
SHA512 c9762a2f542d5ccbeab467eef60954b2de3b80738ce5b20de99c948981b437b7bdd5f313859c77fe3f460e66b789e988c4b326fee259ae07e03b4614306374db

C:\CraxsRat_Bilder\platformBinary64\bin\temp\dist\tmp-804870544

MD5 d877c625070cc974851d7cd01c13174a
SHA1 310aec591d8d65326ded717c8b9081330b7635f4
SHA256 2b634ee0c70040b92ebe3306717fafc1a4b99571bbec55c2d4271d7806cea255
SHA512 c307535699509a7bb4c5efadc9167693fb97f5074eebafcf6e7f98ca3d7c7dd3e1f1a5c9f8aee373de89acf1550cfdb3000dac28ebb572b7c30cc0503ed57292

C:\CraxsRat_Bilder\platformBinary64\bin\zipalign.exe

MD5 81685347e5b418a412472456a2492046
SHA1 625bc3215df7635649454af2dc3db7ced6626624
SHA256 13f6f6be7d322483c967f79a35683baf024a26b5e7837e16e58c2d9626c8678a
SHA512 bf1a91670948c8e76ff0d5ff84f47ad359d9a9c713577033c26c76917d65a0d497d5b0b7dd3614f560664ed24d92669b364a4d4e3bb634e4986831401b05101e