0fd0fedc1c314629e83f3e2ef6867e5cbaf15c4bd6235a8d9fadfc79bd441611

Analysis

max time kernel
135s
max time network
50s
platform
windows10_x64
resource
win10v200430
submitted
19/07/2020, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zeus 2_2.0.8.9.vir.exe
Size 434KB
Sample200719-l6exwat86s
SHA256 0fd0fedc1c314629e83f3e2ef6867e5cbaf15c4bd6235a8d9fadfc79bd441611
MD5 53f5409ca57ffd734074ce61a247e714
SHA1 79230e747bce5553f8ecb011ed2cc27019156e6d
SHA512 b811045f223bef809edf0c8830d74692cd5c3b78fee2b1079c908966ecffc8474d198e39d52456b37de1d0cf59b85a7c630d212925a0564e01f849a2a00b9090
MD5 SHA1 SHA512

Score

8^/10

upx

Malware Config

Signatures

Suspicious use of WriteProcessMemory 622 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 1276	664	zeus 2_2.0.8.9.vir.exe	68
PID 664 wrote to memory of 1276	664	zeus 2_2.0.8.9.vir.exe	68
PID 664 wrote to memory of 1276	664	zeus 2_2.0.8.9.vir.exe	68
PID 664 wrote to memory of 1532	664	zeus 2_2.0.8.9.vir.exe	70
PID 664 wrote to memory of 1532	664	zeus 2_2.0.8.9.vir.exe	70
PID 664 wrote to memory of 1532	664	zeus 2_2.0.8.9.vir.exe	70
PID 664 wrote to memory of 1600	664	zeus 2_2.0.8.9.vir.exe	71
PID 664 wrote to memory of 1600	664	zeus 2_2.0.8.9.vir.exe	71
PID 664 wrote to memory of 1600	664	zeus 2_2.0.8.9.vir.exe	71
PID 664 wrote to memory of 1648	664	zeus 2_2.0.8.9.vir.exe	72
PID 664 wrote to memory of 1648	664	zeus 2_2.0.8.9.vir.exe	72
PID 664 wrote to memory of 1648	664	zeus 2_2.0.8.9.vir.exe	72
PID 664 wrote to memory of 1648	664	zeus 2_2.0.8.9.vir.exe	72
PID 664 wrote to memory of 1648	664	zeus 2_2.0.8.9.vir.exe	72
PID 664 wrote to memory of 1648	664	zeus 2_2.0.8.9.vir.exe	72
PID 664 wrote to memory of 1648	664	zeus 2_2.0.8.9.vir.exe	72
PID 664 wrote to memory of 1648	664	zeus 2_2.0.8.9.vir.exe	72
PID 664 wrote to memory of 1648	664	zeus 2_2.0.8.9.vir.exe	72
PID 664 wrote to memory of 1648	664	zeus 2_2.0.8.9.vir.exe	72
PID 664 wrote to memory of 1648	664	zeus 2_2.0.8.9.vir.exe	72
PID 664 wrote to memory of 1648	664	zeus 2_2.0.8.9.vir.exe	72
PID 664 wrote to memory of 1648	664	zeus 2_2.0.8.9.vir.exe	72
PID 664 wrote to memory of 1080	664	zeus 2_2.0.8.9.vir.exe	73
PID 664 wrote to memory of 1080	664	zeus 2_2.0.8.9.vir.exe	73
PID 664 wrote to memory of 1080	664	zeus 2_2.0.8.9.vir.exe	73
PID 664 wrote to memory of 2120	664	zeus 2_2.0.8.9.vir.exe	74
PID 664 wrote to memory of 2120	664	zeus 2_2.0.8.9.vir.exe	74
PID 664 wrote to memory of 2120	664	zeus 2_2.0.8.9.vir.exe	74
PID 664 wrote to memory of 2144	664	zeus 2_2.0.8.9.vir.exe	75
PID 664 wrote to memory of 2144	664	zeus 2_2.0.8.9.vir.exe	75
PID 664 wrote to memory of 2144	664	zeus 2_2.0.8.9.vir.exe	75
PID 664 wrote to memory of 2188	664	zeus 2_2.0.8.9.vir.exe	76
PID 664 wrote to memory of 2188	664	zeus 2_2.0.8.9.vir.exe	76
PID 664 wrote to memory of 2188	664	zeus 2_2.0.8.9.vir.exe	76
PID 664 wrote to memory of 2160	664	zeus 2_2.0.8.9.vir.exe	77
PID 664 wrote to memory of 2160	664	zeus 2_2.0.8.9.vir.exe	77
PID 664 wrote to memory of 2160	664	zeus 2_2.0.8.9.vir.exe	77
PID 664 wrote to memory of 2168	664	zeus 2_2.0.8.9.vir.exe	78
PID 664 wrote to memory of 2168	664	zeus 2_2.0.8.9.vir.exe	78
PID 664 wrote to memory of 2168	664	zeus 2_2.0.8.9.vir.exe	78
PID 664 wrote to memory of 2204	664	zeus 2_2.0.8.9.vir.exe	79
PID 664 wrote to memory of 2204	664	zeus 2_2.0.8.9.vir.exe	79
PID 664 wrote to memory of 2204	664	zeus 2_2.0.8.9.vir.exe	79
PID 664 wrote to memory of 2208	664	zeus 2_2.0.8.9.vir.exe	80
PID 664 wrote to memory of 2208	664	zeus 2_2.0.8.9.vir.exe	80
PID 664 wrote to memory of 2208	664	zeus 2_2.0.8.9.vir.exe	80
PID 664 wrote to memory of 2388	664	zeus 2_2.0.8.9.vir.exe	81
PID 664 wrote to memory of 2388	664	zeus 2_2.0.8.9.vir.exe	81
PID 664 wrote to memory of 2388	664	zeus 2_2.0.8.9.vir.exe	81
PID 664 wrote to memory of 2496	664	zeus 2_2.0.8.9.vir.exe	82
PID 664 wrote to memory of 2496	664	zeus 2_2.0.8.9.vir.exe	82
PID 664 wrote to memory of 2496	664	zeus 2_2.0.8.9.vir.exe	82
PID 664 wrote to memory of 2592	664	zeus 2_2.0.8.9.vir.exe	83
PID 664 wrote to memory of 2592	664	zeus 2_2.0.8.9.vir.exe	83
PID 664 wrote to memory of 2592	664	zeus 2_2.0.8.9.vir.exe	83
PID 664 wrote to memory of 2604	664	zeus 2_2.0.8.9.vir.exe	84
PID 664 wrote to memory of 2604	664	zeus 2_2.0.8.9.vir.exe	84
PID 664 wrote to memory of 2604	664	zeus 2_2.0.8.9.vir.exe	84
PID 664 wrote to memory of 2732	664	zeus 2_2.0.8.9.vir.exe	85
PID 664 wrote to memory of 2732	664	zeus 2_2.0.8.9.vir.exe	85
PID 664 wrote to memory of 2732	664	zeus 2_2.0.8.9.vir.exe	85
PID 664 wrote to memory of 2764	664	zeus 2_2.0.8.9.vir.exe	86
PID 664 wrote to memory of 2764	664	zeus 2_2.0.8.9.vir.exe	86
PID 664 wrote to memory of 2764	664	zeus 2_2.0.8.9.vir.exe	86
PID 664 wrote to memory of 2780	664	zeus 2_2.0.8.9.vir.exe	87
PID 664 wrote to memory of 2780	664	zeus 2_2.0.8.9.vir.exe	87
PID 664 wrote to memory of 2780	664	zeus 2_2.0.8.9.vir.exe	87
PID 664 wrote to memory of 2784	664	zeus 2_2.0.8.9.vir.exe	88
PID 664 wrote to memory of 2784	664	zeus 2_2.0.8.9.vir.exe	88
PID 664 wrote to memory of 2784	664	zeus 2_2.0.8.9.vir.exe	88
PID 664 wrote to memory of 2884	664	zeus 2_2.0.8.9.vir.exe	89
PID 664 wrote to memory of 2884	664	zeus 2_2.0.8.9.vir.exe	89
PID 664 wrote to memory of 2884	664	zeus 2_2.0.8.9.vir.exe	89
PID 664 wrote to memory of 3004	664	zeus 2_2.0.8.9.vir.exe	90
PID 664 wrote to memory of 3004	664	zeus 2_2.0.8.9.vir.exe	90
PID 664 wrote to memory of 3004	664	zeus 2_2.0.8.9.vir.exe	90
PID 664 wrote to memory of 3516	664	zeus 2_2.0.8.9.vir.exe	91
PID 664 wrote to memory of 3516	664	zeus 2_2.0.8.9.vir.exe	91
PID 664 wrote to memory of 3516	664	zeus 2_2.0.8.9.vir.exe	91
PID 664 wrote to memory of 3708	664	zeus 2_2.0.8.9.vir.exe	92
PID 664 wrote to memory of 3708	664	zeus 2_2.0.8.9.vir.exe	92
PID 664 wrote to memory of 3708	664	zeus 2_2.0.8.9.vir.exe	92
PID 664 wrote to memory of 3848	664	zeus 2_2.0.8.9.vir.exe	93
PID 664 wrote to memory of 3848	664	zeus 2_2.0.8.9.vir.exe	93
PID 664 wrote to memory of 3848	664	zeus 2_2.0.8.9.vir.exe	93
PID 664 wrote to memory of 3888	664	zeus 2_2.0.8.9.vir.exe	94
PID 664 wrote to memory of 3888	664	zeus 2_2.0.8.9.vir.exe	94
PID 664 wrote to memory of 3888	664	zeus 2_2.0.8.9.vir.exe	94
PID 664 wrote to memory of 3924	664	zeus 2_2.0.8.9.vir.exe	95
PID 664 wrote to memory of 3924	664	zeus 2_2.0.8.9.vir.exe	95
PID 664 wrote to memory of 3924	664	zeus 2_2.0.8.9.vir.exe	95
PID 664 wrote to memory of 3016	664	zeus 2_2.0.8.9.vir.exe	96
PID 664 wrote to memory of 3016	664	zeus 2_2.0.8.9.vir.exe	96
PID 664 wrote to memory of 3016	664	zeus 2_2.0.8.9.vir.exe	96
PID 664 wrote to memory of 4044	664	zeus 2_2.0.8.9.vir.exe	97
PID 664 wrote to memory of 4044	664	zeus 2_2.0.8.9.vir.exe	97
PID 664 wrote to memory of 4044	664	zeus 2_2.0.8.9.vir.exe	97
PID 664 wrote to memory of 2244	664	zeus 2_2.0.8.9.vir.exe	98
PID 664 wrote to memory of 2244	664	zeus 2_2.0.8.9.vir.exe	98
PID 664 wrote to memory of 2244	664	zeus 2_2.0.8.9.vir.exe	98
PID 664 wrote to memory of 3000	664	zeus 2_2.0.8.9.vir.exe	99
PID 664 wrote to memory of 3000	664	zeus 2_2.0.8.9.vir.exe	99
PID 664 wrote to memory of 3000	664	zeus 2_2.0.8.9.vir.exe	99
PID 664 wrote to memory of 3976	664	zeus 2_2.0.8.9.vir.exe	100
PID 664 wrote to memory of 3976	664	zeus 2_2.0.8.9.vir.exe	100
PID 664 wrote to memory of 3976	664	zeus 2_2.0.8.9.vir.exe	100
PID 664 wrote to memory of 3908	664	zeus 2_2.0.8.9.vir.exe	101
PID 664 wrote to memory of 3908	664	zeus 2_2.0.8.9.vir.exe	101
PID 664 wrote to memory of 3908	664	zeus 2_2.0.8.9.vir.exe	101
PID 664 wrote to memory of 3852	664	zeus 2_2.0.8.9.vir.exe	102
PID 664 wrote to memory of 3852	664	zeus 2_2.0.8.9.vir.exe	102
PID 664 wrote to memory of 3852	664	zeus 2_2.0.8.9.vir.exe	102
PID 664 wrote to memory of 3864	664	zeus 2_2.0.8.9.vir.exe	103
PID 664 wrote to memory of 3864	664	zeus 2_2.0.8.9.vir.exe	103
PID 664 wrote to memory of 3864	664	zeus 2_2.0.8.9.vir.exe	103
PID 664 wrote to memory of 984	664	zeus 2_2.0.8.9.vir.exe	104
PID 664 wrote to memory of 984	664	zeus 2_2.0.8.9.vir.exe	104
PID 664 wrote to memory of 984	664	zeus 2_2.0.8.9.vir.exe	104
PID 664 wrote to memory of 3964	664	zeus 2_2.0.8.9.vir.exe	105
PID 664 wrote to memory of 3964	664	zeus 2_2.0.8.9.vir.exe	105
PID 664 wrote to memory of 3964	664	zeus 2_2.0.8.9.vir.exe	105
PID 664 wrote to memory of 3352	664	zeus 2_2.0.8.9.vir.exe	106
PID 664 wrote to memory of 3352	664	zeus 2_2.0.8.9.vir.exe	106
PID 664 wrote to memory of 3352	664	zeus 2_2.0.8.9.vir.exe	106
PID 664 wrote to memory of 4028	664	zeus 2_2.0.8.9.vir.exe	107
PID 664 wrote to memory of 4028	664	zeus 2_2.0.8.9.vir.exe	107
PID 664 wrote to memory of 4028	664	zeus 2_2.0.8.9.vir.exe	107
PID 664 wrote to memory of 296	664	zeus 2_2.0.8.9.vir.exe	108
PID 664 wrote to memory of 296	664	zeus 2_2.0.8.9.vir.exe	108
PID 664 wrote to memory of 296	664	zeus 2_2.0.8.9.vir.exe	108
PID 664 wrote to memory of 3344	664	zeus 2_2.0.8.9.vir.exe	109
PID 664 wrote to memory of 3344	664	zeus 2_2.0.8.9.vir.exe	109
PID 664 wrote to memory of 3344	664	zeus 2_2.0.8.9.vir.exe	109
PID 664 wrote to memory of 3816	664	zeus 2_2.0.8.9.vir.exe	110
PID 664 wrote to memory of 3816	664	zeus 2_2.0.8.9.vir.exe	110
PID 664 wrote to memory of 3816	664	zeus 2_2.0.8.9.vir.exe	110
PID 664 wrote to memory of 1900	664	zeus 2_2.0.8.9.vir.exe	111
PID 664 wrote to memory of 1900	664	zeus 2_2.0.8.9.vir.exe	111
PID 664 wrote to memory of 1900	664	zeus 2_2.0.8.9.vir.exe	111
PID 664 wrote to memory of 3484	664	zeus 2_2.0.8.9.vir.exe	112
PID 664 wrote to memory of 3484	664	zeus 2_2.0.8.9.vir.exe	112
PID 664 wrote to memory of 3484	664	zeus 2_2.0.8.9.vir.exe	112
PID 664 wrote to memory of 3324	664	zeus 2_2.0.8.9.vir.exe	113
PID 664 wrote to memory of 3324	664	zeus 2_2.0.8.9.vir.exe	113
PID 664 wrote to memory of 3324	664	zeus 2_2.0.8.9.vir.exe	113
PID 664 wrote to memory of 1476	664	zeus 2_2.0.8.9.vir.exe	114
PID 664 wrote to memory of 1476	664	zeus 2_2.0.8.9.vir.exe	114
PID 664 wrote to memory of 1476	664	zeus 2_2.0.8.9.vir.exe	114
PID 664 wrote to memory of 2328	664	zeus 2_2.0.8.9.vir.exe	115
PID 664 wrote to memory of 2328	664	zeus 2_2.0.8.9.vir.exe	115
PID 664 wrote to memory of 2328	664	zeus 2_2.0.8.9.vir.exe	115
PID 664 wrote to memory of 1872	664	zeus 2_2.0.8.9.vir.exe	116
PID 664 wrote to memory of 1872	664	zeus 2_2.0.8.9.vir.exe	116
PID 664 wrote to memory of 1872	664	zeus 2_2.0.8.9.vir.exe	116
PID 664 wrote to memory of 3556	664	zeus 2_2.0.8.9.vir.exe	117
PID 664 wrote to memory of 3556	664	zeus 2_2.0.8.9.vir.exe	117
PID 664 wrote to memory of 3556	664	zeus 2_2.0.8.9.vir.exe	117
PID 664 wrote to memory of 1912	664	zeus 2_2.0.8.9.vir.exe	118
PID 664 wrote to memory of 1912	664	zeus 2_2.0.8.9.vir.exe	118
PID 664 wrote to memory of 1912	664	zeus 2_2.0.8.9.vir.exe	118
PID 664 wrote to memory of 1836	664	zeus 2_2.0.8.9.vir.exe	119
PID 664 wrote to memory of 1836	664	zeus 2_2.0.8.9.vir.exe	119
PID 664 wrote to memory of 1836	664	zeus 2_2.0.8.9.vir.exe	119
PID 664 wrote to memory of 3528	664	zeus 2_2.0.8.9.vir.exe	120
PID 664 wrote to memory of 3528	664	zeus 2_2.0.8.9.vir.exe	120
PID 664 wrote to memory of 3528	664	zeus 2_2.0.8.9.vir.exe	120
PID 664 wrote to memory of 2252	664	zeus 2_2.0.8.9.vir.exe	121
PID 664 wrote to memory of 2252	664	zeus 2_2.0.8.9.vir.exe	121
PID 664 wrote to memory of 2252	664	zeus 2_2.0.8.9.vir.exe	121
PID 664 wrote to memory of 3692	664	zeus 2_2.0.8.9.vir.exe	122
PID 664 wrote to memory of 3692	664	zeus 2_2.0.8.9.vir.exe	122
PID 664 wrote to memory of 3692	664	zeus 2_2.0.8.9.vir.exe	122
PID 664 wrote to memory of 3012	664	zeus 2_2.0.8.9.vir.exe	123
PID 664 wrote to memory of 3012	664	zeus 2_2.0.8.9.vir.exe	123
PID 664 wrote to memory of 3012	664	zeus 2_2.0.8.9.vir.exe	123
PID 664 wrote to memory of 2976	664	zeus 2_2.0.8.9.vir.exe	124
PID 664 wrote to memory of 2976	664	zeus 2_2.0.8.9.vir.exe	124
PID 664 wrote to memory of 2976	664	zeus 2_2.0.8.9.vir.exe	124
PID 664 wrote to memory of 3440	664	zeus 2_2.0.8.9.vir.exe	125
PID 664 wrote to memory of 3440	664	zeus 2_2.0.8.9.vir.exe	125
PID 664 wrote to memory of 3440	664	zeus 2_2.0.8.9.vir.exe	125
PID 664 wrote to memory of 3492	664	zeus 2_2.0.8.9.vir.exe	126
PID 664 wrote to memory of 3492	664	zeus 2_2.0.8.9.vir.exe	126
PID 664 wrote to memory of 3492	664	zeus 2_2.0.8.9.vir.exe	126
PID 664 wrote to memory of 3444	664	zeus 2_2.0.8.9.vir.exe	127
PID 664 wrote to memory of 3444	664	zeus 2_2.0.8.9.vir.exe	127
PID 664 wrote to memory of 3444	664	zeus 2_2.0.8.9.vir.exe	127
PID 664 wrote to memory of 64	664	zeus 2_2.0.8.9.vir.exe	128
PID 664 wrote to memory of 64	664	zeus 2_2.0.8.9.vir.exe	128
PID 664 wrote to memory of 64	664	zeus 2_2.0.8.9.vir.exe	128
PID 664 wrote to memory of 3728	664	zeus 2_2.0.8.9.vir.exe	129
PID 664 wrote to memory of 3728	664	zeus 2_2.0.8.9.vir.exe	129
PID 664 wrote to memory of 3728	664	zeus 2_2.0.8.9.vir.exe	129
PID 664 wrote to memory of 412	664	zeus 2_2.0.8.9.vir.exe	130
PID 664 wrote to memory of 412	664	zeus 2_2.0.8.9.vir.exe	130
PID 664 wrote to memory of 412	664	zeus 2_2.0.8.9.vir.exe	130
PID 664 wrote to memory of 2264	664	zeus 2_2.0.8.9.vir.exe	131
PID 664 wrote to memory of 2264	664	zeus 2_2.0.8.9.vir.exe	131
PID 664 wrote to memory of 2264	664	zeus 2_2.0.8.9.vir.exe	131
PID 664 wrote to memory of 2272	664	zeus 2_2.0.8.9.vir.exe	132
PID 664 wrote to memory of 2272	664	zeus 2_2.0.8.9.vir.exe	132
PID 664 wrote to memory of 2272	664	zeus 2_2.0.8.9.vir.exe	132
PID 664 wrote to memory of 3312	664	zeus 2_2.0.8.9.vir.exe	133
PID 664 wrote to memory of 3312	664	zeus 2_2.0.8.9.vir.exe	133
PID 664 wrote to memory of 3312	664	zeus 2_2.0.8.9.vir.exe	133
PID 664 wrote to memory of 2052	664	zeus 2_2.0.8.9.vir.exe	134
PID 664 wrote to memory of 2052	664	zeus 2_2.0.8.9.vir.exe	134
PID 664 wrote to memory of 2052	664	zeus 2_2.0.8.9.vir.exe	134
PID 664 wrote to memory of 632	664	zeus 2_2.0.8.9.vir.exe	135
PID 664 wrote to memory of 632	664	zeus 2_2.0.8.9.vir.exe	135
PID 664 wrote to memory of 632	664	zeus 2_2.0.8.9.vir.exe	135
PID 664 wrote to memory of 568	664	zeus 2_2.0.8.9.vir.exe	136
PID 664 wrote to memory of 568	664	zeus 2_2.0.8.9.vir.exe	136
PID 664 wrote to memory of 568	664	zeus 2_2.0.8.9.vir.exe	136
PID 664 wrote to memory of 496	664	zeus 2_2.0.8.9.vir.exe	137
PID 664 wrote to memory of 496	664	zeus 2_2.0.8.9.vir.exe	137
PID 664 wrote to memory of 496	664	zeus 2_2.0.8.9.vir.exe	137
PID 664 wrote to memory of 3996	664	zeus 2_2.0.8.9.vir.exe	138
PID 664 wrote to memory of 3996	664	zeus 2_2.0.8.9.vir.exe	138
PID 664 wrote to memory of 3996	664	zeus 2_2.0.8.9.vir.exe	138
PID 664 wrote to memory of 3032	664	zeus 2_2.0.8.9.vir.exe	139
PID 664 wrote to memory of 3032	664	zeus 2_2.0.8.9.vir.exe	139
PID 664 wrote to memory of 3032	664	zeus 2_2.0.8.9.vir.exe	139
PID 664 wrote to memory of 3644	664	zeus 2_2.0.8.9.vir.exe	140
PID 664 wrote to memory of 3644	664	zeus 2_2.0.8.9.vir.exe	140
PID 664 wrote to memory of 3644	664	zeus 2_2.0.8.9.vir.exe	140
PID 664 wrote to memory of 3640	664	zeus 2_2.0.8.9.vir.exe	141
PID 664 wrote to memory of 3640	664	zeus 2_2.0.8.9.vir.exe	141
PID 664 wrote to memory of 3640	664	zeus 2_2.0.8.9.vir.exe	141
PID 664 wrote to memory of 3992	664	zeus 2_2.0.8.9.vir.exe	142
PID 664 wrote to memory of 3992	664	zeus 2_2.0.8.9.vir.exe	142
PID 664 wrote to memory of 3992	664	zeus 2_2.0.8.9.vir.exe	142
PID 664 wrote to memory of 3880	664	zeus 2_2.0.8.9.vir.exe	143
PID 664 wrote to memory of 3880	664	zeus 2_2.0.8.9.vir.exe	143
PID 664 wrote to memory of 3880	664	zeus 2_2.0.8.9.vir.exe	143
PID 664 wrote to memory of 3808	664	zeus 2_2.0.8.9.vir.exe	144
PID 664 wrote to memory of 3808	664	zeus 2_2.0.8.9.vir.exe	144
PID 664 wrote to memory of 3808	664	zeus 2_2.0.8.9.vir.exe	144
PID 664 wrote to memory of 3796	664	zeus 2_2.0.8.9.vir.exe	145
PID 664 wrote to memory of 3796	664	zeus 2_2.0.8.9.vir.exe	145
PID 664 wrote to memory of 3796	664	zeus 2_2.0.8.9.vir.exe	145
PID 664 wrote to memory of 3776	664	zeus 2_2.0.8.9.vir.exe	146
PID 664 wrote to memory of 3776	664	zeus 2_2.0.8.9.vir.exe	146
PID 664 wrote to memory of 3776	664	zeus 2_2.0.8.9.vir.exe	146
PID 664 wrote to memory of 1420	664	zeus 2_2.0.8.9.vir.exe	147
PID 664 wrote to memory of 1420	664	zeus 2_2.0.8.9.vir.exe	147
PID 664 wrote to memory of 1420	664	zeus 2_2.0.8.9.vir.exe	147
PID 664 wrote to memory of 1456	664	zeus 2_2.0.8.9.vir.exe	148
PID 664 wrote to memory of 1456	664	zeus 2_2.0.8.9.vir.exe	148
PID 664 wrote to memory of 1456	664	zeus 2_2.0.8.9.vir.exe	148
PID 664 wrote to memory of 1452	664	zeus 2_2.0.8.9.vir.exe	149
PID 664 wrote to memory of 1452	664	zeus 2_2.0.8.9.vir.exe	149
PID 664 wrote to memory of 1452	664	zeus 2_2.0.8.9.vir.exe	149
PID 664 wrote to memory of 1416	664	zeus 2_2.0.8.9.vir.exe	150
PID 664 wrote to memory of 1416	664	zeus 2_2.0.8.9.vir.exe	150
PID 664 wrote to memory of 1416	664	zeus 2_2.0.8.9.vir.exe	150
PID 664 wrote to memory of 2104	664	zeus 2_2.0.8.9.vir.exe	151
PID 664 wrote to memory of 2104	664	zeus 2_2.0.8.9.vir.exe	151
PID 664 wrote to memory of 2104	664	zeus 2_2.0.8.9.vir.exe	151
PID 664 wrote to memory of 3136	664	zeus 2_2.0.8.9.vir.exe	152
PID 664 wrote to memory of 3136	664	zeus 2_2.0.8.9.vir.exe	152
PID 664 wrote to memory of 3136	664	zeus 2_2.0.8.9.vir.exe	152
PID 664 wrote to memory of 1968	664	zeus 2_2.0.8.9.vir.exe	153
PID 664 wrote to memory of 1968	664	zeus 2_2.0.8.9.vir.exe	153
PID 664 wrote to memory of 1968	664	zeus 2_2.0.8.9.vir.exe	153
PID 664 wrote to memory of 4100	664	zeus 2_2.0.8.9.vir.exe	154
PID 664 wrote to memory of 4100	664	zeus 2_2.0.8.9.vir.exe	154
PID 664 wrote to memory of 4100	664	zeus 2_2.0.8.9.vir.exe	154
PID 664 wrote to memory of 4108	664	zeus 2_2.0.8.9.vir.exe	155
PID 664 wrote to memory of 4108	664	zeus 2_2.0.8.9.vir.exe	155
PID 664 wrote to memory of 4108	664	zeus 2_2.0.8.9.vir.exe	155
PID 664 wrote to memory of 4116	664	zeus 2_2.0.8.9.vir.exe	156
PID 664 wrote to memory of 4116	664	zeus 2_2.0.8.9.vir.exe	156
PID 664 wrote to memory of 4116	664	zeus 2_2.0.8.9.vir.exe	156
PID 664 wrote to memory of 4124	664	zeus 2_2.0.8.9.vir.exe	157
PID 664 wrote to memory of 4124	664	zeus 2_2.0.8.9.vir.exe	157
PID 664 wrote to memory of 4124	664	zeus 2_2.0.8.9.vir.exe	157
PID 664 wrote to memory of 4132	664	zeus 2_2.0.8.9.vir.exe	158
PID 664 wrote to memory of 4132	664	zeus 2_2.0.8.9.vir.exe	158
PID 664 wrote to memory of 4132	664	zeus 2_2.0.8.9.vir.exe	158
PID 664 wrote to memory of 4140	664	zeus 2_2.0.8.9.vir.exe	159
PID 664 wrote to memory of 4140	664	zeus 2_2.0.8.9.vir.exe	159
PID 664 wrote to memory of 4140	664	zeus 2_2.0.8.9.vir.exe	159
PID 664 wrote to memory of 4148	664	zeus 2_2.0.8.9.vir.exe	160
PID 664 wrote to memory of 4148	664	zeus 2_2.0.8.9.vir.exe	160
PID 664 wrote to memory of 4148	664	zeus 2_2.0.8.9.vir.exe	160
PID 664 wrote to memory of 4156	664	zeus 2_2.0.8.9.vir.exe	161
PID 664 wrote to memory of 4156	664	zeus 2_2.0.8.9.vir.exe	161
PID 664 wrote to memory of 4156	664	zeus 2_2.0.8.9.vir.exe	161
PID 664 wrote to memory of 4164	664	zeus 2_2.0.8.9.vir.exe	162
PID 664 wrote to memory of 4164	664	zeus 2_2.0.8.9.vir.exe	162
PID 664 wrote to memory of 4164	664	zeus 2_2.0.8.9.vir.exe	162
PID 664 wrote to memory of 4172	664	zeus 2_2.0.8.9.vir.exe	163
PID 664 wrote to memory of 4172	664	zeus 2_2.0.8.9.vir.exe	163
PID 664 wrote to memory of 4172	664	zeus 2_2.0.8.9.vir.exe	163
PID 664 wrote to memory of 4180	664	zeus 2_2.0.8.9.vir.exe	164
PID 664 wrote to memory of 4180	664	zeus 2_2.0.8.9.vir.exe	164
PID 664 wrote to memory of 4180	664	zeus 2_2.0.8.9.vir.exe	164
PID 664 wrote to memory of 4188	664	zeus 2_2.0.8.9.vir.exe	165
PID 664 wrote to memory of 4188	664	zeus 2_2.0.8.9.vir.exe	165
PID 664 wrote to memory of 4188	664	zeus 2_2.0.8.9.vir.exe	165
PID 664 wrote to memory of 4196	664	zeus 2_2.0.8.9.vir.exe	166
PID 664 wrote to memory of 4196	664	zeus 2_2.0.8.9.vir.exe	166
PID 664 wrote to memory of 4196	664	zeus 2_2.0.8.9.vir.exe	166
PID 664 wrote to memory of 4204	664	zeus 2_2.0.8.9.vir.exe	167
PID 664 wrote to memory of 4204	664	zeus 2_2.0.8.9.vir.exe	167
PID 664 wrote to memory of 4204	664	zeus 2_2.0.8.9.vir.exe	167
PID 664 wrote to memory of 4212	664	zeus 2_2.0.8.9.vir.exe	168
PID 664 wrote to memory of 4212	664	zeus 2_2.0.8.9.vir.exe	168
PID 664 wrote to memory of 4212	664	zeus 2_2.0.8.9.vir.exe	168
PID 664 wrote to memory of 4220	664	zeus 2_2.0.8.9.vir.exe	169
PID 664 wrote to memory of 4220	664	zeus 2_2.0.8.9.vir.exe	169
PID 664 wrote to memory of 4220	664	zeus 2_2.0.8.9.vir.exe	169
PID 664 wrote to memory of 4228	664	zeus 2_2.0.8.9.vir.exe	170
PID 664 wrote to memory of 4228	664	zeus 2_2.0.8.9.vir.exe	170
PID 664 wrote to memory of 4228	664	zeus 2_2.0.8.9.vir.exe	170
PID 664 wrote to memory of 4236	664	zeus 2_2.0.8.9.vir.exe	171
PID 664 wrote to memory of 4236	664	zeus 2_2.0.8.9.vir.exe	171
PID 664 wrote to memory of 4236	664	zeus 2_2.0.8.9.vir.exe	171
PID 664 wrote to memory of 4244	664	zeus 2_2.0.8.9.vir.exe	172
PID 664 wrote to memory of 4244	664	zeus 2_2.0.8.9.vir.exe	172
PID 664 wrote to memory of 4244	664	zeus 2_2.0.8.9.vir.exe	172
PID 664 wrote to memory of 4252	664	zeus 2_2.0.8.9.vir.exe	173
PID 664 wrote to memory of 4252	664	zeus 2_2.0.8.9.vir.exe	173
PID 664 wrote to memory of 4252	664	zeus 2_2.0.8.9.vir.exe	173
PID 664 wrote to memory of 4260	664	zeus 2_2.0.8.9.vir.exe	174
PID 664 wrote to memory of 4260	664	zeus 2_2.0.8.9.vir.exe	174
PID 664 wrote to memory of 4260	664	zeus 2_2.0.8.9.vir.exe	174
PID 664 wrote to memory of 4268	664	zeus 2_2.0.8.9.vir.exe	175
PID 664 wrote to memory of 4268	664	zeus 2_2.0.8.9.vir.exe	175
PID 664 wrote to memory of 4268	664	zeus 2_2.0.8.9.vir.exe	175
PID 664 wrote to memory of 4276	664	zeus 2_2.0.8.9.vir.exe	176
PID 664 wrote to memory of 4276	664	zeus 2_2.0.8.9.vir.exe	176
PID 664 wrote to memory of 4276	664	zeus 2_2.0.8.9.vir.exe	176
PID 664 wrote to memory of 4284	664	zeus 2_2.0.8.9.vir.exe	177
PID 664 wrote to memory of 4284	664	zeus 2_2.0.8.9.vir.exe	177
PID 664 wrote to memory of 4284	664	zeus 2_2.0.8.9.vir.exe	177
PID 664 wrote to memory of 4292	664	zeus 2_2.0.8.9.vir.exe	178
PID 664 wrote to memory of 4292	664	zeus 2_2.0.8.9.vir.exe	178
PID 664 wrote to memory of 4292	664	zeus 2_2.0.8.9.vir.exe	178
PID 664 wrote to memory of 4300	664	zeus 2_2.0.8.9.vir.exe	179
PID 664 wrote to memory of 4300	664	zeus 2_2.0.8.9.vir.exe	179
PID 664 wrote to memory of 4300	664	zeus 2_2.0.8.9.vir.exe	179
PID 664 wrote to memory of 4308	664	zeus 2_2.0.8.9.vir.exe	180
PID 664 wrote to memory of 4308	664	zeus 2_2.0.8.9.vir.exe	180
PID 664 wrote to memory of 4308	664	zeus 2_2.0.8.9.vir.exe	180
PID 664 wrote to memory of 4316	664	zeus 2_2.0.8.9.vir.exe	181
PID 664 wrote to memory of 4316	664	zeus 2_2.0.8.9.vir.exe	181
PID 664 wrote to memory of 4316	664	zeus 2_2.0.8.9.vir.exe	181
PID 664 wrote to memory of 4324	664	zeus 2_2.0.8.9.vir.exe	182
PID 664 wrote to memory of 4324	664	zeus 2_2.0.8.9.vir.exe	182
PID 664 wrote to memory of 4324	664	zeus 2_2.0.8.9.vir.exe	182
PID 664 wrote to memory of 4332	664	zeus 2_2.0.8.9.vir.exe	183
PID 664 wrote to memory of 4332	664	zeus 2_2.0.8.9.vir.exe	183
PID 664 wrote to memory of 4332	664	zeus 2_2.0.8.9.vir.exe	183
PID 664 wrote to memory of 4340	664	zeus 2_2.0.8.9.vir.exe	184
PID 664 wrote to memory of 4340	664	zeus 2_2.0.8.9.vir.exe	184
PID 664 wrote to memory of 4340	664	zeus 2_2.0.8.9.vir.exe	184
PID 664 wrote to memory of 4348	664	zeus 2_2.0.8.9.vir.exe	185
PID 664 wrote to memory of 4348	664	zeus 2_2.0.8.9.vir.exe	185
PID 664 wrote to memory of 4348	664	zeus 2_2.0.8.9.vir.exe	185
PID 664 wrote to memory of 4356	664	zeus 2_2.0.8.9.vir.exe	186
PID 664 wrote to memory of 4356	664	zeus 2_2.0.8.9.vir.exe	186
PID 664 wrote to memory of 4356	664	zeus 2_2.0.8.9.vir.exe	186
PID 664 wrote to memory of 4364	664	zeus 2_2.0.8.9.vir.exe	187
PID 664 wrote to memory of 4364	664	zeus 2_2.0.8.9.vir.exe	187
PID 664 wrote to memory of 4364	664	zeus 2_2.0.8.9.vir.exe	187
PID 664 wrote to memory of 4372	664	zeus 2_2.0.8.9.vir.exe	188
PID 664 wrote to memory of 4372	664	zeus 2_2.0.8.9.vir.exe	188
PID 664 wrote to memory of 4372	664	zeus 2_2.0.8.9.vir.exe	188
PID 664 wrote to memory of 4380	664	zeus 2_2.0.8.9.vir.exe	189
PID 664 wrote to memory of 4380	664	zeus 2_2.0.8.9.vir.exe	189
PID 664 wrote to memory of 4380	664	zeus 2_2.0.8.9.vir.exe	189
PID 664 wrote to memory of 4388	664	zeus 2_2.0.8.9.vir.exe	190
PID 664 wrote to memory of 4388	664	zeus 2_2.0.8.9.vir.exe	190
PID 664 wrote to memory of 4388	664	zeus 2_2.0.8.9.vir.exe	190
PID 664 wrote to memory of 4396	664	zeus 2_2.0.8.9.vir.exe	191
PID 664 wrote to memory of 4396	664	zeus 2_2.0.8.9.vir.exe	191
PID 664 wrote to memory of 4396	664	zeus 2_2.0.8.9.vir.exe	191
PID 664 wrote to memory of 4404	664	zeus 2_2.0.8.9.vir.exe	192
PID 664 wrote to memory of 4404	664	zeus 2_2.0.8.9.vir.exe	192
PID 664 wrote to memory of 4404	664	zeus 2_2.0.8.9.vir.exe	192
PID 664 wrote to memory of 4412	664	zeus 2_2.0.8.9.vir.exe	193
PID 664 wrote to memory of 4412	664	zeus 2_2.0.8.9.vir.exe	193
PID 664 wrote to memory of 4412	664	zeus 2_2.0.8.9.vir.exe	193
PID 664 wrote to memory of 4420	664	zeus 2_2.0.8.9.vir.exe	194
PID 664 wrote to memory of 4420	664	zeus 2_2.0.8.9.vir.exe	194
PID 664 wrote to memory of 4420	664	zeus 2_2.0.8.9.vir.exe	194
PID 664 wrote to memory of 4428	664	zeus 2_2.0.8.9.vir.exe	195
PID 664 wrote to memory of 4428	664	zeus 2_2.0.8.9.vir.exe	195
PID 664 wrote to memory of 4428	664	zeus 2_2.0.8.9.vir.exe	195
PID 664 wrote to memory of 4436	664	zeus 2_2.0.8.9.vir.exe	196
PID 664 wrote to memory of 4436	664	zeus 2_2.0.8.9.vir.exe	196
PID 664 wrote to memory of 4436	664	zeus 2_2.0.8.9.vir.exe	196
PID 664 wrote to memory of 4444	664	zeus 2_2.0.8.9.vir.exe	197
PID 664 wrote to memory of 4444	664	zeus 2_2.0.8.9.vir.exe	197
PID 664 wrote to memory of 4444	664	zeus 2_2.0.8.9.vir.exe	197
PID 664 wrote to memory of 4452	664	zeus 2_2.0.8.9.vir.exe	198
PID 664 wrote to memory of 4452	664	zeus 2_2.0.8.9.vir.exe	198
PID 664 wrote to memory of 4452	664	zeus 2_2.0.8.9.vir.exe	198
PID 664 wrote to memory of 4460	664	zeus 2_2.0.8.9.vir.exe	199
PID 664 wrote to memory of 4460	664	zeus 2_2.0.8.9.vir.exe	199
PID 664 wrote to memory of 4460	664	zeus 2_2.0.8.9.vir.exe	199
PID 664 wrote to memory of 4468	664	zeus 2_2.0.8.9.vir.exe	200
PID 664 wrote to memory of 4468	664	zeus 2_2.0.8.9.vir.exe	200
PID 664 wrote to memory of 4468	664	zeus 2_2.0.8.9.vir.exe	200
PID 664 wrote to memory of 4476	664	zeus 2_2.0.8.9.vir.exe	201
PID 664 wrote to memory of 4476	664	zeus 2_2.0.8.9.vir.exe	201
PID 664 wrote to memory of 4476	664	zeus 2_2.0.8.9.vir.exe	201
PID 664 wrote to memory of 4484	664	zeus 2_2.0.8.9.vir.exe	202
PID 664 wrote to memory of 4484	664	zeus 2_2.0.8.9.vir.exe	202
PID 664 wrote to memory of 4484	664	zeus 2_2.0.8.9.vir.exe	202
PID 664 wrote to memory of 4492	664	zeus 2_2.0.8.9.vir.exe	203
PID 664 wrote to memory of 4492	664	zeus 2_2.0.8.9.vir.exe	203
PID 664 wrote to memory of 4492	664	zeus 2_2.0.8.9.vir.exe	203
PID 664 wrote to memory of 4500	664	zeus 2_2.0.8.9.vir.exe	204
PID 664 wrote to memory of 4500	664	zeus 2_2.0.8.9.vir.exe	204
PID 664 wrote to memory of 4500	664	zeus 2_2.0.8.9.vir.exe	204
PID 664 wrote to memory of 4508	664	zeus 2_2.0.8.9.vir.exe	205
PID 664 wrote to memory of 4508	664	zeus 2_2.0.8.9.vir.exe	205
PID 664 wrote to memory of 4508	664	zeus 2_2.0.8.9.vir.exe	205
PID 664 wrote to memory of 4516	664	zeus 2_2.0.8.9.vir.exe	206
PID 664 wrote to memory of 4516	664	zeus 2_2.0.8.9.vir.exe	206
PID 664 wrote to memory of 4516	664	zeus 2_2.0.8.9.vir.exe	206
PID 664 wrote to memory of 4524	664	zeus 2_2.0.8.9.vir.exe	207
PID 664 wrote to memory of 4524	664	zeus 2_2.0.8.9.vir.exe	207
PID 664 wrote to memory of 4524	664	zeus 2_2.0.8.9.vir.exe	207
PID 664 wrote to memory of 4532	664	zeus 2_2.0.8.9.vir.exe	208
PID 664 wrote to memory of 4532	664	zeus 2_2.0.8.9.vir.exe	208
PID 664 wrote to memory of 4532	664	zeus 2_2.0.8.9.vir.exe	208
PID 664 wrote to memory of 4540	664	zeus 2_2.0.8.9.vir.exe	209
PID 664 wrote to memory of 4540	664	zeus 2_2.0.8.9.vir.exe	209
PID 664 wrote to memory of 4540	664	zeus 2_2.0.8.9.vir.exe	209
PID 664 wrote to memory of 4548	664	zeus 2_2.0.8.9.vir.exe	210
PID 664 wrote to memory of 4548	664	zeus 2_2.0.8.9.vir.exe	210
PID 664 wrote to memory of 4548	664	zeus 2_2.0.8.9.vir.exe	210
PID 664 wrote to memory of 4556	664	zeus 2_2.0.8.9.vir.exe	211
PID 664 wrote to memory of 4556	664	zeus 2_2.0.8.9.vir.exe	211
PID 664 wrote to memory of 4556	664	zeus 2_2.0.8.9.vir.exe	211
PID 664 wrote to memory of 4564	664	zeus 2_2.0.8.9.vir.exe	212
PID 664 wrote to memory of 4564	664	zeus 2_2.0.8.9.vir.exe	212
PID 664 wrote to memory of 4564	664	zeus 2_2.0.8.9.vir.exe	212
PID 664 wrote to memory of 4572	664	zeus 2_2.0.8.9.vir.exe	213
PID 664 wrote to memory of 4572	664	zeus 2_2.0.8.9.vir.exe	213
PID 664 wrote to memory of 4572	664	zeus 2_2.0.8.9.vir.exe	213
PID 664 wrote to memory of 4580	664	zeus 2_2.0.8.9.vir.exe	214
PID 664 wrote to memory of 4580	664	zeus 2_2.0.8.9.vir.exe	214
PID 664 wrote to memory of 4580	664	zeus 2_2.0.8.9.vir.exe	214
PID 664 wrote to memory of 4588	664	zeus 2_2.0.8.9.vir.exe	215
PID 664 wrote to memory of 4588	664	zeus 2_2.0.8.9.vir.exe	215
PID 664 wrote to memory of 4588	664	zeus 2_2.0.8.9.vir.exe	215
PID 664 wrote to memory of 4596	664	zeus 2_2.0.8.9.vir.exe	216
PID 664 wrote to memory of 4596	664	zeus 2_2.0.8.9.vir.exe	216
PID 664 wrote to memory of 4596	664	zeus 2_2.0.8.9.vir.exe	216
PID 664 wrote to memory of 4604	664	zeus 2_2.0.8.9.vir.exe	217
PID 664 wrote to memory of 4604	664	zeus 2_2.0.8.9.vir.exe	217
PID 664 wrote to memory of 4604	664	zeus 2_2.0.8.9.vir.exe	217
PID 664 wrote to memory of 4612	664	zeus 2_2.0.8.9.vir.exe	218
PID 664 wrote to memory of 4612	664	zeus 2_2.0.8.9.vir.exe	218
PID 664 wrote to memory of 4612	664	zeus 2_2.0.8.9.vir.exe	218
PID 664 wrote to memory of 4620	664	zeus 2_2.0.8.9.vir.exe	219
PID 664 wrote to memory of 4620	664	zeus 2_2.0.8.9.vir.exe	219
PID 664 wrote to memory of 4620	664	zeus 2_2.0.8.9.vir.exe	219
PID 664 wrote to memory of 4628	664	zeus 2_2.0.8.9.vir.exe	220
PID 664 wrote to memory of 4628	664	zeus 2_2.0.8.9.vir.exe	220
PID 664 wrote to memory of 4628	664	zeus 2_2.0.8.9.vir.exe	220
PID 664 wrote to memory of 4636	664	zeus 2_2.0.8.9.vir.exe	221
PID 664 wrote to memory of 4636	664	zeus 2_2.0.8.9.vir.exe	221
PID 664 wrote to memory of 4636	664	zeus 2_2.0.8.9.vir.exe	221
PID 664 wrote to memory of 4644	664	zeus 2_2.0.8.9.vir.exe	222
PID 664 wrote to memory of 4644	664	zeus 2_2.0.8.9.vir.exe	222
PID 664 wrote to memory of 4644	664	zeus 2_2.0.8.9.vir.exe	222
PID 664 wrote to memory of 4652	664	zeus 2_2.0.8.9.vir.exe	223
PID 664 wrote to memory of 4652	664	zeus 2_2.0.8.9.vir.exe	223
PID 664 wrote to memory of 4652	664	zeus 2_2.0.8.9.vir.exe	223
PID 664 wrote to memory of 4660	664	zeus 2_2.0.8.9.vir.exe	224
PID 664 wrote to memory of 4660	664	zeus 2_2.0.8.9.vir.exe	224
PID 664 wrote to memory of 4660	664	zeus 2_2.0.8.9.vir.exe	224
PID 664 wrote to memory of 4668	664	zeus 2_2.0.8.9.vir.exe	225
PID 664 wrote to memory of 4668	664	zeus 2_2.0.8.9.vir.exe	225
PID 664 wrote to memory of 4668	664	zeus 2_2.0.8.9.vir.exe	225
PID 664 wrote to memory of 4676	664	zeus 2_2.0.8.9.vir.exe	226
PID 664 wrote to memory of 4676	664	zeus 2_2.0.8.9.vir.exe	226
PID 664 wrote to memory of 4676	664	zeus 2_2.0.8.9.vir.exe	226
PID 664 wrote to memory of 4684	664	zeus 2_2.0.8.9.vir.exe	227
PID 664 wrote to memory of 4684	664	zeus 2_2.0.8.9.vir.exe	227
PID 664 wrote to memory of 4684	664	zeus 2_2.0.8.9.vir.exe	227
PID 664 wrote to memory of 4692	664	zeus 2_2.0.8.9.vir.exe	228
PID 664 wrote to memory of 4692	664	zeus 2_2.0.8.9.vir.exe	228
PID 664 wrote to memory of 4692	664	zeus 2_2.0.8.9.vir.exe	228
PID 664 wrote to memory of 4700	664	zeus 2_2.0.8.9.vir.exe	229
PID 664 wrote to memory of 4700	664	zeus 2_2.0.8.9.vir.exe	229
PID 664 wrote to memory of 4700	664	zeus 2_2.0.8.9.vir.exe	229
PID 664 wrote to memory of 4708	664	zeus 2_2.0.8.9.vir.exe	230
PID 664 wrote to memory of 4708	664	zeus 2_2.0.8.9.vir.exe	230
PID 664 wrote to memory of 4708	664	zeus 2_2.0.8.9.vir.exe	230
PID 664 wrote to memory of 4716	664	zeus 2_2.0.8.9.vir.exe	231
PID 664 wrote to memory of 4716	664	zeus 2_2.0.8.9.vir.exe	231
PID 664 wrote to memory of 4716	664	zeus 2_2.0.8.9.vir.exe	231
PID 664 wrote to memory of 4724	664	zeus 2_2.0.8.9.vir.exe	232
PID 664 wrote to memory of 4724	664	zeus 2_2.0.8.9.vir.exe	232
PID 664 wrote to memory of 4724	664	zeus 2_2.0.8.9.vir.exe	232
PID 664 wrote to memory of 4732	664	zeus 2_2.0.8.9.vir.exe	233
PID 664 wrote to memory of 4732	664	zeus 2_2.0.8.9.vir.exe	233
PID 664 wrote to memory of 4732	664	zeus 2_2.0.8.9.vir.exe	233
PID 664 wrote to memory of 4740	664	zeus 2_2.0.8.9.vir.exe	234
PID 664 wrote to memory of 4740	664	zeus 2_2.0.8.9.vir.exe	234
PID 664 wrote to memory of 4740	664	zeus 2_2.0.8.9.vir.exe	234
PID 664 wrote to memory of 4748	664	zeus 2_2.0.8.9.vir.exe	235
PID 664 wrote to memory of 4748	664	zeus 2_2.0.8.9.vir.exe	235
PID 664 wrote to memory of 4748	664	zeus 2_2.0.8.9.vir.exe	235
PID 664 wrote to memory of 4756	664	zeus 2_2.0.8.9.vir.exe	236
PID 664 wrote to memory of 4756	664	zeus 2_2.0.8.9.vir.exe	236
PID 664 wrote to memory of 4756	664	zeus 2_2.0.8.9.vir.exe	236
PID 664 wrote to memory of 4764	664	zeus 2_2.0.8.9.vir.exe	237
PID 664 wrote to memory of 4764	664	zeus 2_2.0.8.9.vir.exe	237
PID 664 wrote to memory of 4764	664	zeus 2_2.0.8.9.vir.exe	237
PID 664 wrote to memory of 4772	664	zeus 2_2.0.8.9.vir.exe	238
PID 664 wrote to memory of 4772	664	zeus 2_2.0.8.9.vir.exe	238
PID 664 wrote to memory of 4772	664	zeus 2_2.0.8.9.vir.exe	238
PID 664 wrote to memory of 4780	664	zeus 2_2.0.8.9.vir.exe	239
PID 664 wrote to memory of 4780	664	zeus 2_2.0.8.9.vir.exe	239
PID 664 wrote to memory of 4780	664	zeus 2_2.0.8.9.vir.exe	239
PID 664 wrote to memory of 4788	664	zeus 2_2.0.8.9.vir.exe	240
PID 664 wrote to memory of 4788	664	zeus 2_2.0.8.9.vir.exe	240
PID 664 wrote to memory of 4788	664	zeus 2_2.0.8.9.vir.exe	240
PID 664 wrote to memory of 4796	664	zeus 2_2.0.8.9.vir.exe	241
PID 664 wrote to memory of 4796	664	zeus 2_2.0.8.9.vir.exe	241
PID 664 wrote to memory of 4796	664	zeus 2_2.0.8.9.vir.exe	241
PID 664 wrote to memory of 4804	664	zeus 2_2.0.8.9.vir.exe	242
PID 664 wrote to memory of 4804	664	zeus 2_2.0.8.9.vir.exe	242
PID 664 wrote to memory of 4804	664	zeus 2_2.0.8.9.vir.exe	242
PID 664 wrote to memory of 4812	664	zeus 2_2.0.8.9.vir.exe	243
PID 664 wrote to memory of 4812	664	zeus 2_2.0.8.9.vir.exe	243
PID 664 wrote to memory of 4812	664	zeus 2_2.0.8.9.vir.exe	243
PID 664 wrote to memory of 4820	664	zeus 2_2.0.8.9.vir.exe	244
PID 664 wrote to memory of 4820	664	zeus 2_2.0.8.9.vir.exe	244
PID 664 wrote to memory of 4820	664	zeus 2_2.0.8.9.vir.exe	244
PID 664 wrote to memory of 4828	664	zeus 2_2.0.8.9.vir.exe	245
PID 664 wrote to memory of 4828	664	zeus 2_2.0.8.9.vir.exe	245
PID 664 wrote to memory of 4828	664	zeus 2_2.0.8.9.vir.exe	245
PID 664 wrote to memory of 4836	664	zeus 2_2.0.8.9.vir.exe	246
PID 664 wrote to memory of 4836	664	zeus 2_2.0.8.9.vir.exe	246
PID 664 wrote to memory of 4836	664	zeus 2_2.0.8.9.vir.exe	246
PID 664 wrote to memory of 4844	664	zeus 2_2.0.8.9.vir.exe	247
PID 664 wrote to memory of 4844	664	zeus 2_2.0.8.9.vir.exe	247
PID 664 wrote to memory of 4844	664	zeus 2_2.0.8.9.vir.exe	247
PID 664 wrote to memory of 4852	664	zeus 2_2.0.8.9.vir.exe	248
PID 664 wrote to memory of 4852	664	zeus 2_2.0.8.9.vir.exe	248
PID 664 wrote to memory of 4852	664	zeus 2_2.0.8.9.vir.exe	248
PID 664 wrote to memory of 4860	664	zeus 2_2.0.8.9.vir.exe	249
PID 664 wrote to memory of 4860	664	zeus 2_2.0.8.9.vir.exe	249
PID 664 wrote to memory of 4860	664	zeus 2_2.0.8.9.vir.exe	249
PID 664 wrote to memory of 4868	664	zeus 2_2.0.8.9.vir.exe	250
PID 664 wrote to memory of 4868	664	zeus 2_2.0.8.9.vir.exe	250
PID 664 wrote to memory of 4868	664	zeus 2_2.0.8.9.vir.exe	250
PID 664 wrote to memory of 4876	664	zeus 2_2.0.8.9.vir.exe	251
PID 664 wrote to memory of 4876	664	zeus 2_2.0.8.9.vir.exe	251
PID 664 wrote to memory of 4876	664	zeus 2_2.0.8.9.vir.exe	251
PID 664 wrote to memory of 4884	664	zeus 2_2.0.8.9.vir.exe	252
PID 664 wrote to memory of 4884	664	zeus 2_2.0.8.9.vir.exe	252
PID 664 wrote to memory of 4884	664	zeus 2_2.0.8.9.vir.exe	252
PID 664 wrote to memory of 4892	664	zeus 2_2.0.8.9.vir.exe	253
PID 664 wrote to memory of 4892	664	zeus 2_2.0.8.9.vir.exe	253
PID 664 wrote to memory of 4892	664	zeus 2_2.0.8.9.vir.exe	253
PID 664 wrote to memory of 4900	664	zeus 2_2.0.8.9.vir.exe	254
PID 664 wrote to memory of 4900	664	zeus 2_2.0.8.9.vir.exe	254
PID 664 wrote to memory of 4900	664	zeus 2_2.0.8.9.vir.exe	254
PID 664 wrote to memory of 4908	664	zeus 2_2.0.8.9.vir.exe	255
PID 664 wrote to memory of 4908	664	zeus 2_2.0.8.9.vir.exe	255
PID 664 wrote to memory of 4908	664	zeus 2_2.0.8.9.vir.exe	255
PID 664 wrote to memory of 4916	664	zeus 2_2.0.8.9.vir.exe	256
PID 664 wrote to memory of 4916	664	zeus 2_2.0.8.9.vir.exe	256
PID 664 wrote to memory of 4916	664	zeus 2_2.0.8.9.vir.exe	256
PID 664 wrote to memory of 4924	664	zeus 2_2.0.8.9.vir.exe	257
PID 664 wrote to memory of 4924	664	zeus 2_2.0.8.9.vir.exe	257
PID 664 wrote to memory of 4924	664	zeus 2_2.0.8.9.vir.exe	257
PID 664 wrote to memory of 4932	664	zeus 2_2.0.8.9.vir.exe	258
PID 664 wrote to memory of 4932	664	zeus 2_2.0.8.9.vir.exe	258
PID 664 wrote to memory of 4932	664	zeus 2_2.0.8.9.vir.exe	258
PID 664 wrote to memory of 4940	664	zeus 2_2.0.8.9.vir.exe	259
PID 664 wrote to memory of 4940	664	zeus 2_2.0.8.9.vir.exe	259
PID 664 wrote to memory of 4940	664	zeus 2_2.0.8.9.vir.exe	259
PID 664 wrote to memory of 4948	664	zeus 2_2.0.8.9.vir.exe	260
PID 664 wrote to memory of 4948	664	zeus 2_2.0.8.9.vir.exe	260
PID 664 wrote to memory of 4948	664	zeus 2_2.0.8.9.vir.exe	260
PID 664 wrote to memory of 4956	664	zeus 2_2.0.8.9.vir.exe	261
PID 664 wrote to memory of 4956	664	zeus 2_2.0.8.9.vir.exe	261
PID 664 wrote to memory of 4956	664	zeus 2_2.0.8.9.vir.exe	261
PID 664 wrote to memory of 4964	664	zeus 2_2.0.8.9.vir.exe	262
PID 664 wrote to memory of 4964	664	zeus 2_2.0.8.9.vir.exe	262
PID 664 wrote to memory of 4964	664	zeus 2_2.0.8.9.vir.exe	262
PID 664 wrote to memory of 4972	664	zeus 2_2.0.8.9.vir.exe	263
PID 664 wrote to memory of 4972	664	zeus 2_2.0.8.9.vir.exe	263
PID 664 wrote to memory of 4972	664	zeus 2_2.0.8.9.vir.exe	263
PID 664 wrote to memory of 4980	664	zeus 2_2.0.8.9.vir.exe	264
PID 664 wrote to memory of 4980	664	zeus 2_2.0.8.9.vir.exe	264
PID 664 wrote to memory of 4980	664	zeus 2_2.0.8.9.vir.exe	264
PID 664 wrote to memory of 4988	664	zeus 2_2.0.8.9.vir.exe	265
PID 664 wrote to memory of 4988	664	zeus 2_2.0.8.9.vir.exe	265
PID 664 wrote to memory of 4988	664	zeus 2_2.0.8.9.vir.exe	265
PID 664 wrote to memory of 4996	664	zeus 2_2.0.8.9.vir.exe	266
PID 664 wrote to memory of 4996	664	zeus 2_2.0.8.9.vir.exe	266
PID 664 wrote to memory of 4996	664	zeus 2_2.0.8.9.vir.exe	266
PID 664 wrote to memory of 5004	664	zeus 2_2.0.8.9.vir.exe	267
PID 664 wrote to memory of 5004	664	zeus 2_2.0.8.9.vir.exe	267
PID 664 wrote to memory of 5004	664	zeus 2_2.0.8.9.vir.exe	267
PID 664 wrote to memory of 5012	664	zeus 2_2.0.8.9.vir.exe	268
PID 664 wrote to memory of 5012	664	zeus 2_2.0.8.9.vir.exe	268
PID 664 wrote to memory of 5012	664	zeus 2_2.0.8.9.vir.exe	268
PID 664 wrote to memory of 5020	664	zeus 2_2.0.8.9.vir.exe	269
PID 664 wrote to memory of 5020	664	zeus 2_2.0.8.9.vir.exe	269
PID 664 wrote to memory of 5020	664	zeus 2_2.0.8.9.vir.exe	269
PID 664 wrote to memory of 5028	664	zeus 2_2.0.8.9.vir.exe	270
PID 664 wrote to memory of 5028	664	zeus 2_2.0.8.9.vir.exe	270
PID 664 wrote to memory of 5028	664	zeus 2_2.0.8.9.vir.exe	270
PID 664 wrote to memory of 5036	664	zeus 2_2.0.8.9.vir.exe	271
PID 664 wrote to memory of 5036	664	zeus 2_2.0.8.9.vir.exe	271
PID 664 wrote to memory of 5036	664	zeus 2_2.0.8.9.vir.exe	271
PID 664 wrote to memory of 5044	664	zeus 2_2.0.8.9.vir.exe	272
PID 664 wrote to memory of 5044	664	zeus 2_2.0.8.9.vir.exe	272
PID 664 wrote to memory of 5044	664	zeus 2_2.0.8.9.vir.exe	272

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
664	zeus 2_2.0.8.9.vir.exe
664	zeus 2_2.0.8.9.vir.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 664 set thread context of 1648	664	zeus 2_2.0.8.9.vir.exe	72

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1648-1-0x0000000000400000-0x00000000009DC000-memory.dmp	upx
behavioral2/memory/1648-3-0x0000000000400000-0x00000000009DC000-memory.dmp	upx
behavioral2/memory/1648-4-0x0000000000400000-0x00000000009DC000-memory.dmp	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Checks whether UAC is enabled 1 IoCs

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
664	zeus 2_2.0.8.9.vir.exe
1648	iexplore.exe
1648	iexplore.exe
1648	iexplore.exe
1648	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  PID:1276
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:1532
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:1600
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Checks whether UAC is enabled
  - Suspicious use of SetWindowsHookEx
  PID:1648
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:1080
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2120
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2144
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2188
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2160
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2168
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2204
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2208
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2388
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2496
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2592
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2732
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2764
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2780
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2784
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2884
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3004
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3516
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3708
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3848
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3888
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3924
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3016
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4044
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2244
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3000
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3976
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3908
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3852
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3864
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:984
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3964
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3352
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4028
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:296
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3344
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3816
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3484
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3324
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:1476
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2328
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:1872
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3556
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:1836
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3528
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2252
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3692
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3012
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2976
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3440
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3492
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3444
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:64
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3728
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:412
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2264
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2272
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3312
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2052
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:632
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:568
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:496
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3996
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3644
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3640
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3992
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3880
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3808
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3796
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3776
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:1420
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:1456
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:1452
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:1416
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:2104
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:3136
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:1968
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4100
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4108
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4116
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4124
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4132
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4140
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4148
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4156
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4164
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4172
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4180
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4188
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4196
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4204
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4212
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4220
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4228
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4236
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4244
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4252
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4260
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4268
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4276
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4284
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4292
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4300
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4308
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4316
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4324
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4332
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4340
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4348
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4356
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4364
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4372
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4380
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4388
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4396
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4404
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4412
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4420
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4428
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4436
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4444
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4452
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4460
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4468
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4476
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4484
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4492
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4500
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4508
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4516
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4524
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4532
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4540
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4548
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4556
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4564
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4572
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4580
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4588
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4596
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4604
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4612
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4620
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4628
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4636
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4644
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4652
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4660
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4668
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4676
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4684
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4692
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4700
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4708
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4716
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4724
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4732
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4740
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4748
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4756
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4764
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4772
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4780
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4788
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4796
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4804
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4812
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4820
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4828
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4836
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4844
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4852
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4860
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4868
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4876
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4884
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4900
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4908
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4916
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4924
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4932
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4940
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4948
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4956
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4972
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4980
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4988
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:4996
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:5004
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:5012
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:5020
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:5028
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:5036
- C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.9.vir.exe"
  2⤵
  PID:5044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-1-0x0000000000400000-0x00000000009DC000-memory.dmp

Download

memory/1648-3-0x0000000000400000-0x00000000009DC000-memory.dmp

Download

memory/1648-4-0x0000000000400000-0x00000000009DC000-memory.dmp

Download