zgrat | 222a0ad2708775b55bb0ca82bee641b624acb8fc96ca5082e2d1759d44de2f35

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEW PURCHASE ORDER RFQ-0982928_1.scr
Size

112KB
MD5

54f71c7479218838fedb673fc8cf3ca3
SHA1

ef95cd965489f904f796513993295aef40e868b1
SHA256

222a0ad2708775b55bb0ca82bee641b624acb8fc96ca5082e2d1759d44de2f35
SHA512

4ea06b747a32e0feb368853597ab92ca69e3b31f04b979cf5845208aecf6515455c3f37382dd50b48bc3bfaef00b7439465ca290bd7d9a477e3e5986f72b5f37
SSDEEP

1536:vwKxTUge0zKmiEn8SvR+chVcf7eWZt+qxpqojTwXK:vFd99iEn8SRVcDe1qx8ATwXK

Score

10^/10

zgrat collection persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2408-3-0x0000000020770000-0x0000000020A5C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-4-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-5-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-49-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-7-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-61-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-63-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-9-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-11-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-13-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-15-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-17-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-19-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-21-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-23-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-25-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-27-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-29-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-31-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-47-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-45-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-67-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-65-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-59-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-57-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-55-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-53-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-51-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-43-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-41-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-39-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-37-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-35-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1
behavioral1/memory/2408-33-0x0000000020770000-0x0000000020A55000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs

collection

Email Collection

T1114

Processes:

NEW PURCHASE ORDER RFQ-0982928_1.scr

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

powershell.exeNEW PURCHASE ORDER RFQ-0982928_1.scr

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\NEW PURCHASE ORDER RFQ-0982928_1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEW PURCHASE ORDER RFQ-0982928_1.scr"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wnvqvdihtrh = "C:\\Users\\Admin\\AppData\\Roaming\\Wnvqvdihtrh.exe"	NEW PURCHASE ORDER RFQ-0982928_1.scr

Suspicious use of SetThreadContext 1 IoCs

Processes:

NEW PURCHASE ORDER RFQ-0982928_1.scr

description pid process target process

PID 2408 set thread context of 1708 2408 NEW PURCHASE ORDER RFQ-0982928_1.scr NEW PURCHASE ORDER RFQ-0982928_1.scr

description	pid	process	target process
PID 2408 set thread context of 1708	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

NEW PURCHASE ORDER RFQ-0982928_1.scrNEW PURCHASE ORDER RFQ-0982928_1.scrpowershell.exe

pid	process
2408	NEW PURCHASE ORDER RFQ-0982928_1.scr
2408	NEW PURCHASE ORDER RFQ-0982928_1.scr
2408	NEW PURCHASE ORDER RFQ-0982928_1.scr
2408	NEW PURCHASE ORDER RFQ-0982928_1.scr
2408	NEW PURCHASE ORDER RFQ-0982928_1.scr
2408	NEW PURCHASE ORDER RFQ-0982928_1.scr
2408	NEW PURCHASE ORDER RFQ-0982928_1.scr
2408	NEW PURCHASE ORDER RFQ-0982928_1.scr
1708	NEW PURCHASE ORDER RFQ-0982928_1.scr
1708	NEW PURCHASE ORDER RFQ-0982928_1.scr
1708	NEW PURCHASE ORDER RFQ-0982928_1.scr
4704	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

NEW PURCHASE ORDER RFQ-0982928_1.scrNEW PURCHASE ORDER RFQ-0982928_1.scrpowershell.exe

description	pid	process
Token: SeDebugPrivilege	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr
Token: SeDebugPrivilege	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr
Token: SeDebugPrivilege	1708	NEW PURCHASE ORDER RFQ-0982928_1.scr
Token: SeDebugPrivilege	4704	powershell.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

NEW PURCHASE ORDER RFQ-0982928_1.scrNEW PURCHASE ORDER RFQ-0982928_1.scr

outlook_office_path 1 IoCs

Processes:

NEW PURCHASE ORDER RFQ-0982928_1.scr

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr

outlook_win_path 1 IoCs

Processes:

NEW PURCHASE ORDER RFQ-0982928_1.scr

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NEW PURCHASE ORDER RFQ-0982928_1.scr

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr" /S
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr"
2⤵
PID:2944

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr"
2⤵
PID:2672

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr"
2⤵
PID:1672

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr"
2⤵
PID:2500

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr"
2⤵
PID:2024

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr"
2⤵
PID:2784

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr"
2⤵
PID:1568

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr"
2⤵
PID:1780

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'NEW PURCHASE ORDER RFQ-0982928_1';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'NEW PURCHASE ORDER RFQ-0982928_1' -Value '"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER RFQ-0982928_1.scr"' -PropertyType 'String'
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Zzsvgl.tmpdb
Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
memory/1708-4907-0x00000000027D0000-0x00000000028E6000-memory.dmp

Filesize
1.1MB

Download
memory/1708-5187-0x000007FEF4C60000-0x000007FEF564C000-memory.dmp

Filesize
9.9MB

Download
memory/1708-5023-0x000007FEF4C60000-0x000007FEF564C000-memory.dmp

Filesize
9.9MB

Download
memory/1708-7217-0x000000001B070000-0x000000001B10E000-memory.dmp

Filesize
632KB

Download
memory/1708-7218-0x0000000000F70000-0x0000000000F9C000-memory.dmp

Filesize
176KB

Download
memory/1708-7257-0x000007FEF4C60000-0x000007FEF564C000-memory.dmp

Filesize
9.9MB

Download
memory/1708-7219-0x000000001C010000-0x000000001C08A000-memory.dmp

Filesize
488KB

Download
memory/2408-31-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-59-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-5-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-49-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-7-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-61-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-63-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-9-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-11-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-13-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-15-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-17-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-19-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-21-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-23-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-25-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-27-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-29-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-3-0x0000000020770000-0x0000000020A5C000-memory.dmp

Filesize
2.9MB

Download
memory/2408-47-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-45-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-67-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-65-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-4-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-4885-0x0000000000870000-0x00000000008BC000-memory.dmp

Filesize
304KB

Download
memory/2408-4884-0x0000000001190000-0x00000000012B8000-memory.dmp

Filesize
1.2MB

Download
memory/2408-57-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-55-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-53-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-51-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-43-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-41-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-39-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-37-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-35-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-2-0x000007FEF4C60000-0x000007FEF564C000-memory.dmp

Filesize
9.9MB

Download
memory/2408-1-0x00000000013B0000-0x00000000013D0000-memory.dmp

Filesize
128KB

Download
memory/2408-33-0x0000000020770000-0x0000000020A55000-memory.dmp

Filesize
2.9MB

Download
memory/2408-4886-0x000007FEF4C63000-0x000007FEF4C64000-memory.dmp

Filesize
4KB

Download
memory/2408-4887-0x000007FEF4C60000-0x000007FEF564C000-memory.dmp

Filesize
9.9MB

Download
memory/2408-4888-0x0000000000E90000-0x0000000000EE4000-memory.dmp

Filesize
336KB

Download
memory/2408-4908-0x000007FEF4C60000-0x000007FEF564C000-memory.dmp

Filesize
9.9MB

Download
memory/2408-0-0x000007FEF4C63000-0x000007FEF4C64000-memory.dmp

Filesize
4KB

Download
memory/4704-7256-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/4704-7255-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download

description	pid	process	target process
PID 2408 wrote to memory of 2944	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 2944	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 2944	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 2672	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 2672	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 2672	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1672	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1672	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1672	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 2500	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 2500	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 2500	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 2024	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 2024	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 2024	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 2784	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 2784	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 2784	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1568	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1568	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1568	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1780	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1780	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1780	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1708	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1708	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1708	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1708	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1708	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1708	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1708	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 2408 wrote to memory of 1708	2408	NEW PURCHASE ORDER RFQ-0982928_1.scr	NEW PURCHASE ORDER RFQ-0982928_1.scr
PID 1708 wrote to memory of 4704	1708	NEW PURCHASE ORDER RFQ-0982928_1.scr	powershell.exe
PID 1708 wrote to memory of 4704	1708	NEW PURCHASE ORDER RFQ-0982928_1.scr	powershell.exe
PID 1708 wrote to memory of 4704	1708	NEW PURCHASE ORDER RFQ-0982928_1.scr	powershell.exe