File name:

WARZONE RAT 3.03.7z

Full analysis: https://app.any.run/tasks/7e279dd7-2f03-47db-a7d1-019b7f2c3c75
Verdict: Malicious activity
Threats:

WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.

Malware Trends Tracker     >>>
Analysis date: July 15, 2024, 17:59:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
themida
warzone
trojan
rat
stealer
avemaria
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

BAA48B7B4F818EAC1961077A5A8DEC7B

SHA1:

DFB920F433043FC37C52C41BEEF84A7C3F5FEA51

SHA256:

3ACCE18FA1327B1E89C47997FE1DA62A86A1211D893F5128B4C59FA44D57B335

SSDEEP:

98304:TTzw3lMQ5RT71rIomca39H6/EvF/kUprELTFdDWAvQOzUhP2b8W8SPq4rLXsDj/s:QEo0sohXE+q+Oa3AgN/Xh9IQ/KgSj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3332)
      • WARZONE RAT 3.03 Cracked.exe (PID: 2420)
      • test.exe (PID: 2832)
      • cmd.exe (PID: 3328)
      • cmd.exe (PID: 348)

    • WARZONE has been detected (YARA)

      • WARZONE RAT 3.03 Cracked.exe (PID: 2420)
      • images.exe (PID: 3712)

    • Avemaria is detected

      • test.exe (PID: 2832)
      • images.exe (PID: 3924)

    • Changes the autorun value in the registry

      • test.exe (PID: 2832)

    • Runs injected code in another process

      • images.exe (PID: 3924)
      • images.exe (PID: 3712)

    • Application was injected by another process

      • explorer.exe (PID: 1296)

    • The process bypass UAC

      • Dism.exe (PID: 3784)
      • Dism.exe (PID: 2776)

    • Adds path to the Windows Defender exclusion list

      • images.exe (PID: 3712)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3332)

    • The process drops Mozilla's DLL files

      • WinRAR.exe (PID: 3332)

    • There is functionality for taking screenshot (YARA)

      • WARZONE RAT 3.03 Cracked.exe (PID: 2420)

    • Executable content was dropped or overwritten

      • WARZONE RAT 3.03 Cracked.exe (PID: 2420)
      • cmd.exe (PID: 3328)
      • test.exe (PID: 2832)
      • dllhost.exe (PID: 3832)
      • cmd.exe (PID: 348)

    • The process checks if it is being run in the virtual environment

      • WARZONE RAT 3.03 Cracked.exe (PID: 2420)

    • Starts CMD.EXE for commands execution

      • test.exe (PID: 2832)
      • images.exe (PID: 3924)

    • Reads the BIOS version

      • WARZONE RAT 3.03 Cracked.exe (PID: 3988)
      • WARZONE RAT 3.03 Cracked.exe (PID: 2420)

    • Reads the Internet Settings

      • WARZONE RAT 3.03 Cracked.exe (PID: 2420)
      • cmd.exe (PID: 3328)
      • cmd.exe (PID: 348)
      • powershell.exe (PID: 2672)

    • Starts itself from another location

      • test.exe (PID: 2832)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 2672)

    • Starts POWERSHELL.EXE for commands execution

      • images.exe (PID: 3712)

    • Script adds exclusion path to Windows Defender

      • images.exe (PID: 3712)

  • INFO

    • Checks supported languages

      • WARZONE Password Viewer 1.0.exe (PID: 3128)
      • WARZONE RAT 3.03 Cracked.exe (PID: 2420)
      • WARZONE RAT 3.03 Cracked.exe (PID: 3988)
      • test.exe (PID: 2832)
      • images.exe (PID: 3924)
      • wmpnscfg.exe (PID: 3556)
      • images.exe (PID: 3888)
      • images.exe (PID: 3712)
      • images.exe (PID: 3764)
      • test.exe (PID: 2452)
      • images.exe (PID: 1916)

    • Reads the computer name

      • WARZONE Password Viewer 1.0.exe (PID: 3128)
      • wmpnscfg.exe (PID: 3556)
      • WARZONE RAT 3.03 Cracked.exe (PID: 3988)
      • test.exe (PID: 2832)
      • images.exe (PID: 3924)
      • WARZONE RAT 3.03 Cracked.exe (PID: 2420)
      • images.exe (PID: 3888)
      • images.exe (PID: 3712)
      • images.exe (PID: 3764)
      • test.exe (PID: 2452)
      • images.exe (PID: 1916)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3332)

    • Create files in a temporary directory

      • WARZONE RAT 3.03 Cracked.exe (PID: 2420)
      • makecab.exe (PID: 3836)
      • makecab.exe (PID: 2780)

    • Reads the machine GUID from the registry

      • WARZONE RAT 3.03 Cracked.exe (PID: 2420)
      • WARZONE Password Viewer 1.0.exe (PID: 3128)

    • Reads Windows Product ID

      • WARZONE RAT 3.03 Cracked.exe (PID: 2420)

    • Manual execution by a user

      • test.exe (PID: 2832)
      • wmpnscfg.exe (PID: 3556)
      • test.exe (PID: 2452)
      • images.exe (PID: 3764)
      • images.exe (PID: 1916)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1296)

    • Checks transactions between databases Windows and Oracle

      • cmd.exe (PID: 3328)
      • cmd.exe (PID: 348)

    • Drops the executable file immediately after the start

      • dllhost.exe (PID: 3832)

    • Themida protector has been detected

      • WARZONE RAT 3.03 Cracked.exe (PID: 2420)

    • Creates files in the program directory

      • images.exe (PID: 3712)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

WarZone

(PID) Process(3712) images.exe
C2 (1)127.0.0.1:5200
Options
Install FlagTrue
Startup FlagFalse
Startup nameimages.exeQAQLDTXYUK
Reverse Proxy local portNone
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
77
Monitored processes
25
Malicious processes
10
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe warzone password viewer 1.0.exe no specs THREAT warzone rat 3.03 cracked.exe wmpnscfg.exe no specs warzone rat 3.03 cracked.exe #AVEMARIA test.exe cmd.exe #AVEMARIA images.exe no specs Copy/Move/Rename/Delete/Link Object pkgmgr.exe no specs pkgmgr.exe cmd.exe dism.exe no specs makecab.exe no specs images.exe no specs pkgmgr.exe no specs pkgmgr.exe dism.exe no specs makecab.exe no specs #WARZONE images.exe no specs powershell.exe no specs images.exe no specs images.exe no specs test.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
348"C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe
images.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1296C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1804"C:\Windows\system32\pkgmgr.exe" /n:%temp%\ellocnak.xmlC:\Windows\System32\PkgMgr.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Package Manager
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\pkgmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1916"C:\Users\admin\Documents\images.exe"C:\Users\admin\Documents\images.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\documents\images.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\webservices.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2396"C:\Windows\system32\pkgmgr.exe" /n:%temp%\ellocnak.xmlC:\Windows\System32\PkgMgr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Package Manager
Exit code:
3221226540
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\pkgmgr.exe
c:\windows\system32\ntdll.dll
2420"C:\Users\admin\AppData\Local\Temp\Rar$EXb3332.24240\WARZONE RAT 3.03\WARZONE RAT 3.03 Cracked.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3332.24240\WARZONE RAT 3.03\WARZONE RAT 3.03 Cracked.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3332.24240\warzone rat 3.03\warzone rat 3.03 cracked.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
2452"C:\Users\admin\Desktop\test.exe" C:\Users\admin\Desktop\test.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\test.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\webservices.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2672powershell Add-MpPreference -ExclusionPath C:\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—images.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2776"C:\Windows\system32\dism.exe" /online /norestart /apply-unattend:"C:\Users\admin\AppData\Local\Temp\ellocnak.xml"C:\Windows\System32\Dism.exe—PkgMgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Image Servicing Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dism.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2780"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240715180325.log C:\Windows\Logs\CBS\CbsPersist_20240715180325.cabC:\Windows\System32\makecab.exe—PkgMgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Cabinet Maker
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\makecab.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
22 735
Read events
22 509
Write events
221
Delete events
5

Modification events

(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3332) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\WARZONE RAT 3.03.7z
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
54
Suspicious files
26
Text files
4
Unknown types
2

Dropped files

PID
Process
Filename
Type
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3332.22689\WARZONE RAT 3.03\Datas\firefox.dllsexecutable
MD5:A26861558315278D5960FE1BF58B1950
SHA256:B52720863EC78E0F7BFF98E6C809FDF50AB2D0EA361E95EB5341E870AAFB0354
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3332.22689\WARZONE RAT 3.03\Datas\geoip\GeoIP.datbinary
MD5:42368516B6BD3C337AA64A012FBA8C3D
SHA256:57B31E52D36571CF8D52BA6ECAB8D0DC8C6705B5ED94D9F7F98B01F40863E5A0
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3332.22689\WARZONE RAT 3.03\cratclient.binexecutable
MD5:AEDB2E69D91D2C8AFF792E5C0B2396A0
SHA256:E76B0D04117DAA58544D87B69427AAA6A78D90461470A2A55C80616842180451
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3332.22689\WARZONE RAT 3.03\Datas\rdpwrap.inibinary
MD5:4D18179C3E64E912A2ECD80A8AED4AA7
SHA256:2DE7C3DB2E91021BAE6E16D67677EA9EF123809EED237F804D4F7B3C0315BA5C
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3332.22689\WARZONE RAT 3.03\Datas\options.vncini
MD5:6243B2004273137CB880196F4472268B
SHA256:11C79026B86D78DF113DD84848065175BC39EFADD48DF4C9768CA685E8FAFFC4
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3332.22689\WARZONE RAT 3.03\cratclientd.binexecutable
MD5:F6DBE80A1B68A734C92375FBBCF4BE88
SHA256:D364FE03510F34C22E8B5D25784BA80DECAE568BD939DB66E4CD8B90538D60BE
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3332.22689\WARZONE RAT 3.03\Datas\rvncviewer.exeexecutable
MD5:27561E722C736AB5A77110790402999B
SHA256:5E49A7FEC8C9F81B191E5FA69BDB1A627814631813FEDFC4136C71E55CD57C0F
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3332.22689\WARZONE RAT 3.03\sqllite3.binbinary
MD5:3FF5EB1505911A17716FE10A9CA96CB4
SHA256:467B77FB1D8559AB4A6D9C2DE21575E81E39D07E617F1AA2E5F47FA86F80D92C
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3332.22689\WARZONE RAT 3.03\License.dllexecutable
MD5:CB63D02B2189EEEF93F7ABDD88450095
SHA256:8E680C2074E5E701174F801125CB438C55A4A65649B4C7307E10DE61879CBE65
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3332.22689\WARZONE RAT 3.03\Datas\rdpwrap64.dllexecutable
MD5:C4063372AFE486D5E9A11C5B68E0524F
SHA256:FC1F3FC182CEF9BCEF5192E4FA4569697E27852CBFFB7A55EA6118C603DDC420
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
15
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
whitelisted
1060
svchost.exe
GET
304
217.20.57.34:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fbe613066ac7852b
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
239.255.255.250:3702
—
—
—
whitelisted
1372
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1372
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1372
svchost.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown
1372
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
1060
svchost.exe
217.20.57.34:80
ctldl.windowsupdate.com
—
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
dns.msftncsi.com
  • 131.107.255.255
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
  • 217.20.57.34
  • 217.20.57.18
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
microsoft.com
  • 20.70.246.20
  • 20.236.44.162
  • 20.76.201.171
  • 20.231.239.246
  • 20.112.250.133
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WARZONE RAT 3.03.7z