warzonerat | b9c205ac1dc948cb5cfa1976b97d531df0b99d8e5d58be4eabbefdf8005984b3

Analysis

max time kernel
121s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2023, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GreatJob.exe
Size 1.1MB
Sample230109-d8rtrsch44
SHA256 b9c205ac1dc948cb5cfa1976b97d531df0b99d8e5d58be4eabbefdf8005984b3
MD5 49ee7c9b60ca4477b46b9377e1eb6fa7
SHA1 d3ed64f6e2dee82b559eed4d2a45f14946e9eaa8
SHA512 c6c502a068e1a1c2fd170b41fc99e40284fd81eb3110e91ad02ebe75cde22b10815c6ac2019bafff7a991e92a9fac4647816790a2bdcc7c8a9246433f53e9b9a
SSDEEP 24576:H0rVJRR1i3e2acyq6nc/Xwio+bYYKXtjPKpksJokdppfGwCmy:H0rVJRR1xLq6UXwiM5XtjPiJvpuwhy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat evasion infostealer persistence rat upx

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Executes dropped EXE 3 IoCs

pid	Process
4220	greenw.exe
4284	msgt.exe
760	3.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4556	netsh.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\Microsoft DN1\\sqlmap.dll"	msgt.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0003000000000735-175.dat	upx
behavioral2/files/0x0003000000000735-174.dat	upx
behavioral2/memory/760-177-0x0000000000DB0000-0x0000000000DDD000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	GreatJob.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	msgt.exe

Loads dropped DLL 1 IoCs

pid	Process
2692	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GreenWar = "C:\\Users\\Admin\\Documents\\msgt.exe"	greenw.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	msgt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	msgt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\zlBCFnw = "0"	msgt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	msgt.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	msgt.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft DN1\sqlmap.dll	msgt.exe
File created	C:\Program Files\Microsoft DN1\rdpwrap.ini	msgt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	760	WerFault.exe	99

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4980	powershell.exe
4980	powershell.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
1688	GreatJob.exe
3928	powershell.exe
3928	powershell.exe
3924	powershell.exe
3924	powershell.exe
2692	svchost.exe
2692	svchost.exe
2692	svchost.exe
2692	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	1688	GreatJob.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	4284	msgt.exe
Token: SeAuditPrivilege	2692	svchost.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 4980	1688	GreatJob.exe	81
PID 1688 wrote to memory of 4980	1688	GreatJob.exe	81
PID 1688 wrote to memory of 4220	1688	GreatJob.exe	90
PID 1688 wrote to memory of 4220	1688	GreatJob.exe	90
PID 1688 wrote to memory of 4220	1688	GreatJob.exe	90
PID 4220 wrote to memory of 3928	4220	greenw.exe	91
PID 4220 wrote to memory of 3928	4220	greenw.exe	91
PID 4220 wrote to memory of 3928	4220	greenw.exe	91
PID 4220 wrote to memory of 4284	4220	greenw.exe	93
PID 4220 wrote to memory of 4284	4220	greenw.exe	93
PID 4220 wrote to memory of 4284	4220	greenw.exe	93
PID 4284 wrote to memory of 3924	4284	msgt.exe	94
PID 4284 wrote to memory of 3924	4284	msgt.exe	94
PID 4284 wrote to memory of 3924	4284	msgt.exe	94
PID 4284 wrote to memory of 3880	4284	msgt.exe	96
PID 4284 wrote to memory of 3880	4284	msgt.exe	96
PID 4284 wrote to memory of 3880	4284	msgt.exe	96
PID 4284 wrote to memory of 3880	4284	msgt.exe	96
PID 4284 wrote to memory of 3880	4284	msgt.exe	96
PID 4284 wrote to memory of 760	4284	msgt.exe	99
PID 4284 wrote to memory of 760	4284	msgt.exe	99
PID 4284 wrote to memory of 760	4284	msgt.exe	99
PID 760 wrote to memory of 4556	760	3.exe	100
PID 760 wrote to memory of 4556	760	3.exe	100
PID 760 wrote to memory of 4556	760	3.exe	100

C:\Users\Admin\AppData\Local\Temp\GreatJob.exe
"C:\Users\Admin\AppData\Local\Temp\GreatJob.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4980
- C:\Users\Admin\AppData\Local\Temp\greenw.exe
  "C:\Users\Admin\AppData\Local\Temp\greenw.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- - C:\Users\Admin\Documents\msgt.exe
    "C:\Users\Admin\Documents\msgt.exe"
    3⤵
    - Executes dropped EXE
    - Sets DLL path for service in the registry
    - Checks computer location settings
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath C:\
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3924
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\3.exe
      "C:\Users\Admin\AppData\Local\Temp\3.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:760
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="3389" dir=in action=allow protocol=TCP localport=3389
        5⤵
        Modifies Windows Firewall
        
        PID:4556
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 288
        5⤵
        Program crash
        
        PID:2116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:3956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 760 -ip 760
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sqlmap.dll

Path C:\Program Files\Microsoft DN1\sqlmap.dll
Size 114KB
SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
MD5 461ade40b800ae80a40985594e1ac236
SHA1 b3892eef846c044a2b0785d54a432b3e93a968c8
SHA512 421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
SSDEEP 3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 218d487f881ce9640acd16f7476b445471b83671569e99973f77d0bbf6c42ffa
MD5 3db5a3b556b01c59c5812cb86abb674e
SHA1 3848e5419d5c47879f159247e4f1b08005674cf0
SHA512 3eb6575d3e476053a65b2631b0cd0d584056ca476058ee2706c69fe10b0502460c40f8985f1f4666e42fba2809924f6dc34ba2e9b2629217542e45cb3640adcd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 632239bf4d6978193172e71530fc69c012d74151c380a794745f0ed557e8fdc3
MD5 b08f59a50fd270d56afca688c344f7ff
SHA1 68cc5a23b11d7550925afc804d29a371279c19bf
SHA512 f997f5f251c01244aa6d6661f8e859bc134066ac92b7168c35328af290714bb8f3d1c836f297058f0ac4a95b14bda33693401b359bdde299eaff23aa9992cf0d
SSDEEP 384:36+BO9i+wOOdiQNTOVmxqKTgThK6seYLME/N03SoZmfYSvcjEDkyd0gdEtkKhD:qohQQV9xdTgThNgrWSR5CEDOCe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

3.exe

Path C:\Users\Admin\AppData\Local\Temp\3.exe
Size 70KB
SHA256 0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c
MD5 ca96229390a0e6a53e8f2125f2c01114
SHA1 a54b1081cf58724f8cb292b4d165dfee2fb1c9f6
SHA512 e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef
SSDEEP 1536:tjL6b1xoQ66K+jLMqPHULq87qdGN2B30GfDQ+1FIRXWHH0:t0BVbjQaNpd82xpLQ+126H0
MD5 SHA1 SHA512 SSDEEP

Submit Download

3.exe

Path C:\Users\Admin\AppData\Local\Temp\3.exe
Size 70KB
SHA256 0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c
MD5 ca96229390a0e6a53e8f2125f2c01114
SHA1 a54b1081cf58724f8cb292b4d165dfee2fb1c9f6
SHA512 e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef
SSDEEP 1536:tjL6b1xoQ66K+jLMqPHULq87qdGN2B30GfDQ+1FIRXWHH0:t0BVbjQaNpd82xpLQ+126H0
MD5 SHA1 SHA512 SSDEEP

Submit Download

greenw.exe

Path C:\Users\Admin\AppData\Local\Temp\greenw.exe
Size 141KB
SHA256 21d7fa3dd28eb5d3eb3facd4673eb75021ae4853fbdd5e9c95cf0ceef193f27b
MD5 75ff251476dfccb1ce39a78d4ab00b4b
SHA1 18c27b54bee0b41d290215812d59613ef928e41d
SHA512 f3e418164067324a6bceadc44a4d762c412000cef7b44d471edaa09c95f61305f19458b2d2db8b82857f4703379e86f5c900179db7a5d5325203e70d361cbcd0
SSDEEP 3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

greenw.exe

Path C:\Users\Admin\AppData\Local\Temp\greenw.exe
Size 141KB
SHA256 21d7fa3dd28eb5d3eb3facd4673eb75021ae4853fbdd5e9c95cf0ceef193f27b
MD5 75ff251476dfccb1ce39a78d4ab00b4b
SHA1 18c27b54bee0b41d290215812d59613ef928e41d
SHA512 f3e418164067324a6bceadc44a4d762c412000cef7b44d471edaa09c95f61305f19458b2d2db8b82857f4703379e86f5c900179db7a5d5325203e70d361cbcd0
SSDEEP 3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

msgt.exe

Path C:\Users\Admin\Documents\msgt.exe
Size 141KB
SHA256 21d7fa3dd28eb5d3eb3facd4673eb75021ae4853fbdd5e9c95cf0ceef193f27b
MD5 75ff251476dfccb1ce39a78d4ab00b4b
SHA1 18c27b54bee0b41d290215812d59613ef928e41d
SHA512 f3e418164067324a6bceadc44a4d762c412000cef7b44d471edaa09c95f61305f19458b2d2db8b82857f4703379e86f5c900179db7a5d5325203e70d361cbcd0
SSDEEP 3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

msgt.exe

Path C:\Users\Admin\Documents\msgt.exe
Size 141KB
SHA256 21d7fa3dd28eb5d3eb3facd4673eb75021ae4853fbdd5e9c95cf0ceef193f27b
MD5 75ff251476dfccb1ce39a78d4ab00b4b
SHA1 18c27b54bee0b41d290215812d59613ef928e41d
SHA512 f3e418164067324a6bceadc44a4d762c412000cef7b44d471edaa09c95f61305f19458b2d2db8b82857f4703379e86f5c900179db7a5d5325203e70d361cbcd0
SSDEEP 3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

rdpwrap.ini

Path \??\c:\program files\microsoft dn1\rdpwrap.ini
Size 299KB
SHA256 1c4930123ec2a809b3bd93969967d6c321d8d65fc7b886e062b2581c741944e5
MD5 fca6ba93c780afa00a5703df9ac65754
SHA1 3ed423763fdd9722ff8bed3667ffa93f77390138
SHA512 538b0995be3796737575a2fd3aaa1644b3e6566e4cd5ed5c4df9e0a586368e7ceea8f0284de53f7c3f0874fc90b9a194d2ea1438bc9d7779eb12d00b8807f595
SSDEEP 768:yUiQVQpXQq4WDi9SUnpB8fbQnxJcy8RMFdKKb5x8Rr/d6gl/+f8jZ0ftlFi4p7QK:fjt33L+McIiG4IvREWddadl/Fj8
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlmap.dll

Path \??\c:\program files\microsoft dn1\sqlmap.dll
Size 114KB
SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
MD5 461ade40b800ae80a40985594e1ac236
SHA1 b3892eef846c044a2b0785d54a432b3e93a968c8
SHA512 421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
SSDEEP 3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/760-177-0x0000000000DB0000-0x0000000000DDD000-memory.dmp

Download

memory/1688-137-0x00007FF82DF10000-0x00007FF82E9D1000-memory.dmp

Download

memory/1688-172-0x000001F5E0BBA000-0x000001F5E0BBF000-memory.dmp

Download

memory/1688-144-0x000001F5E0BBA000-0x000001F5E0BBF000-memory.dmp

Download

memory/1688-140-0x000001F5FB690000-0x000001F5FB70F000-memory.dmp

Download

memory/1688-132-0x000001F5DEF70000-0x000001F5DF084000-memory.dmp

Download

memory/1688-134-0x000001F5FCE90000-0x000001F5FCEB2000-memory.dmp

Download

memory/1688-133-0x00007FF82DF10000-0x00007FF82E9D1000-memory.dmp

Download

memory/3880-171-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download

memory/3924-167-0x00000000708E0000-0x000000007092C000-memory.dmp

Download

memory/3928-166-0x0000000007700000-0x0000000007708000-memory.dmp

Download

memory/3928-150-0x0000000005A90000-0x0000000005AF6000-memory.dmp

Download

memory/3928-159-0x0000000007A30000-0x00000000080AA000-memory.dmp

Download

memory/3928-160-0x00000000073E0000-0x00000000073FA000-memory.dmp

Download

memory/3928-161-0x0000000007450000-0x000000000745A000-memory.dmp

Download

memory/3928-162-0x0000000007660000-0x00000000076F6000-memory.dmp

Download

memory/3928-157-0x00000000708E0000-0x000000007092C000-memory.dmp

Download

memory/3928-164-0x0000000007610000-0x000000000761E000-memory.dmp

Download

memory/3928-165-0x0000000007720000-0x000000000773A000-memory.dmp

Download

memory/3928-152-0x00000000060E0000-0x00000000060FE000-memory.dmp

Download

memory/3928-156-0x0000000007090000-0x00000000070C2000-memory.dmp

Download

memory/3928-158-0x0000000006690000-0x00000000066AE000-memory.dmp

Download

memory/3928-149-0x0000000005A20000-0x0000000005A86000-memory.dmp

Download

memory/3928-148-0x0000000005120000-0x0000000005142000-memory.dmp

Download

memory/3928-147-0x0000000005380000-0x00000000059A8000-memory.dmp

Download

memory/3928-146-0x00000000027C0000-0x00000000027F6000-memory.dmp

Download

memory/4980-139-0x00007FF82DF10000-0x00007FF82E9D1000-memory.dmp

Download

memory/4980-138-0x00007FF82DF10000-0x00007FF82E9D1000-memory.dmp

Download

memory/4980-136-0x00007FF82DF10000-0x00007FF82E9D1000-memory.dmp

Download