xtremerat | 7c3252900a812ea3f7e77e78195dd178a36ca779d60acdc2a66dcacface7ca8e

Analysis

max time kernel
158s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d4605c927cdb55570cbadbaeb08ce13.exe
Size

82KB
MD5

3d4605c927cdb55570cbadbaeb08ce13
SHA1

2cf5de7f026cfa02981a5af7e59e0a3613dda79e
SHA256

7c3252900a812ea3f7e77e78195dd178a36ca779d60acdc2a66dcacface7ca8e
SHA512

6c6919427ed4856a3c8a6f1466e3b77f82c0541e16adef32a997cb5601365bc42153776672b5cccea09b462af976668ae61b98764a1f7e4a38e25d4fd9f002cf
SSDEEP

1536:bleFkLjr+fEQclXjwXkXhULR+VXG6te793kBKuIyZthhTVmjQqop:bxL3Xp2R+JQBfupthhBmUj

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 64 IoCs

resource	yara_rule
behavioral2/memory/4544-5-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4544-4-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/720-9-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4544-12-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4984-18-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4984-31-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/2620-42-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4416-51-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4740-57-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/2620-59-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1920-69-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4372-74-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4740-78-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/2108-88-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1920-93-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4372-95-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/2108-105-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/924-111-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/2204-115-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4540-122-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/924-127-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4676-133-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4540-139-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1588-145-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/2272-154-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1588-158-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4676-160-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4132-166-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/3796-176-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/2272-181-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1320-187-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4132-192-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5216-198-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/3796-204-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5428-210-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5520-219-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1320-224-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5676-230-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5216-234-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5520-235-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5428-236-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5676-246-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5448-251-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5608-259-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5448-262-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/6120-265-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5764-270-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5888-277-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5764-280-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5608-281-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/464-286-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5888-290-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1432-294-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/464-297-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5348-302-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1432-306-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5348-318-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1028-319-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1656-322-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1656-327-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5552-332-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/2696-339-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1028-342-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/5552-347-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe

Checks computer location settings 2 TTPs 47 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	3d4605c927cdb55570cbadbaeb08ce13.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Camval.exe

Executes dropped EXE 64 IoCs

pid	Process
4532	Camval.exe
4984	Camval.exe
676	Camval.exe
852	Camval.exe
4416	Camval.exe
2620	Camval.exe
4672	Camval.exe
1220	Camval.exe
4740	Camval.exe
2056	Camval.exe
1920	Camval.exe
4372	Camval.exe
4404	Camval.exe
2108	Camval.exe
4064	Camval.exe
3704	Camval.exe
2204	Camval.exe
924	Camval.exe
4580	Camval.exe
4540	Camval.exe
4328	Camval.exe
4676	Camval.exe
3704	Camval.exe
4496	Camval.exe
1588	Camval.exe
2272	Camval.exe
1936	Camval.exe
4132	Camval.exe
5076	Camval.exe
3796	Camval.exe
4676	Camval.exe
1320	Camval.exe
5148	Camval.exe
5216	Camval.exe
5344	Camval.exe
5408	Camval.exe
5428	Camval.exe
5520	Camval.exe
5620	Camval.exe
5676	Camval.exe
6076	Camval.exe
6120	Camval.exe
5300	Camval.exe
5448	Camval.exe
5548	Camval.exe
5608	Camval.exe
5656	Camval.exe
5764	Camval.exe
5768	Camval.exe
5888	Camval.exe
1220	Camval.exe
464	Camval.exe
5364	Camval.exe
5480	Camval.exe
1432	Camval.exe
5348	Camval.exe
5852	Camval.exe
4672	Camval.exe
1028	Camval.exe
1656	Camval.exe
2524	Camval.exe
5552	Camval.exe
5248	Camval.exe
2696	Camval.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4544-1-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4544-5-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4544-4-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4544-3-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/720-9-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4544-12-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4984-18-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4984-31-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/2620-42-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4416-51-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4740-57-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/2620-59-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1920-69-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4372-74-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4740-78-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/2108-88-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1920-93-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4372-95-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/2204-101-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/2108-105-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/924-111-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/2204-115-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4540-122-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/924-127-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4676-133-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4540-139-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1588-145-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/2272-154-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1588-158-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4676-160-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4132-166-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/3796-176-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/2272-181-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1320-187-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4132-192-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5216-198-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/3796-204-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5428-210-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5520-219-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1320-224-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5676-230-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5216-234-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5520-235-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5428-236-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5676-246-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5448-251-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5608-259-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5448-262-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/6120-265-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5764-270-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5888-277-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5764-280-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5608-281-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/464-286-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5888-290-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1432-294-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/464-297-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5348-302-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1432-306-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5348-318-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1028-319-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1656-322-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1656-327-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/5552-332-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\system32\\InstallDir\\Camval.exe"	3d4605c927cdb55570cbadbaeb08ce13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\system32\\InstallDir\\Camval.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\system32\\InstallDir\\Camval.exe"	3d4605c927cdb55570cbadbaeb08ce13.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 4588 set thread context of 4544	4588	3d4605c927cdb55570cbadbaeb08ce13.exe	89
PID 4532 set thread context of 4984	4532	Camval.exe	105
PID 676 set thread context of 4416	676	Camval.exe	119
PID 852 set thread context of 2620	852	Camval.exe	120
PID 4672 set thread context of 4740	4672	Camval.exe	139
PID 1220 set thread context of 1920	1220	Camval.exe	142
PID 2056 set thread context of 4372	2056	Camval.exe	143
PID 4404 set thread context of 2108	4404	Camval.exe	160
PID 4064 set thread context of 2204	4064	Camval.exe	167
PID 3704 set thread context of 924	3704	Camval.exe	169
PID 4580 set thread context of 4540	4580	Camval.exe	177
PID 4328 set thread context of 4676	4328	Camval.exe	184
PID 3704 set thread context of 1588	3704	Camval.exe	197
PID 4496 set thread context of 2272	4496	Camval.exe	200
PID 1936 set thread context of 4132	1936	Camval.exe	207
PID 5076 set thread context of 3796	5076	Camval.exe	217
PID 4676 set thread context of 1320	4676	Camval.exe	224
PID 5148 set thread context of 5216	5148	Camval.exe	235
PID 5344 set thread context of 5428	5344	Camval.exe	247
PID 5408 set thread context of 5520	5408	Camval.exe	251
PID 5620 set thread context of 5676	5620	Camval.exe	259
PID 6076 set thread context of 6120	6076	Camval.exe	268
PID 5300 set thread context of 5448	5300	Camval.exe	279
PID 5548 set thread context of 5608	5548	Camval.exe	287
PID 5656 set thread context of 5764	5656	Camval.exe	292
PID 5768 set thread context of 5888	5768	Camval.exe	305
PID 1220 set thread context of 464	1220	Camval.exe	309
PID 5364 set thread context of 1432	5364	Camval.exe	326
PID 5480 set thread context of 5348	5480	Camval.exe	328
PID 5852 set thread context of 1028	5852	Camval.exe	345
PID 4672 set thread context of 1656	4672	Camval.exe	347
PID 2524 set thread context of 5552	2524	Camval.exe	350
PID 5248 set thread context of 2696	5248	Camval.exe	368
PID 5996 set thread context of 920	5996	Camval.exe	375
PID 5424 set thread context of 4676	5424	Camval.exe	379
PID 4120 set thread context of 2932	4120	Camval.exe	392
PID 1512 set thread context of 1804	1512	Camval.exe	402
PID 376 set thread context of 1432	376	Camval.exe	405
PID 5820 set thread context of 6064	5820	Camval.exe	416
PID 920 set thread context of 4360	920	Camval.exe	419
PID 6000 set thread context of 920	6000	Camval.exe	432
PID 5980 set thread context of 6200	5980	Camval.exe	446
PID 6192 set thread context of 6332	6192	Camval.exe	451
PID 6300 set thread context of 6388	6300	Camval.exe	453
PID 6616 set thread context of 6680	6616	Camval.exe	475
PID 6672 set thread context of 6800	6672	Camval.exe	480
PID 6792 set thread context of 6900	6792	Camval.exe	482
PID 7040 set thread context of 7072	7040	Camval.exe	490
PID 7112 set thread context of 5144	7112	Camval.exe	494
PID 6344 set thread context of 6440	6344	Camval.exe	510
PID 6428 set thread context of 6688	6428	Camval.exe	513
PID 6348 set thread context of 1920	6348	Camval.exe	526
PID 6720 set thread context of 6956	6720	Camval.exe	530
PID 7132 set thread context of 5620	7132	Camval.exe	541
PID 2380 set thread context of 6712	2380	Camval.exe	550
PID 6788 set thread context of 1296	6788	Camval.exe	557
PID 7128 set thread context of 1468	7128	Camval.exe	572
PID 956 set thread context of 6184	956	Camval.exe	575
PID 4220 set thread context of 4876	4220	Camval.exe	582
PID 7228 set thread context of 7316	7228	Camval.exe	602
PID 7292 set thread context of 7440	7292	Camval.exe	605
PID 7380 set thread context of 7504	7380	Camval.exe	607
PID 7640 set thread context of 7704	7640	Camval.exe	615
PID 7956 set thread context of 8016	7956	Camval.exe	630

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4544	4588	3d4605c927cdb55570cbadbaeb08ce13.exe	89
PID 4588 wrote to memory of 4544	4588	3d4605c927cdb55570cbadbaeb08ce13.exe	89
PID 4588 wrote to memory of 4544	4588	3d4605c927cdb55570cbadbaeb08ce13.exe	89
PID 4588 wrote to memory of 4544	4588	3d4605c927cdb55570cbadbaeb08ce13.exe	89
PID 4588 wrote to memory of 4544	4588	3d4605c927cdb55570cbadbaeb08ce13.exe	89
PID 4588 wrote to memory of 4544	4588	3d4605c927cdb55570cbadbaeb08ce13.exe	89
PID 4588 wrote to memory of 4544	4588	3d4605c927cdb55570cbadbaeb08ce13.exe	89
PID 4588 wrote to memory of 4544	4588	3d4605c927cdb55570cbadbaeb08ce13.exe	89
PID 4544 wrote to memory of 720	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	91
PID 4544 wrote to memory of 720	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	91
PID 4544 wrote to memory of 720	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	91
PID 4544 wrote to memory of 720	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	91
PID 4544 wrote to memory of 1292	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	92
PID 4544 wrote to memory of 1292	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	92
PID 4544 wrote to memory of 1292	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	92
PID 4544 wrote to memory of 1128	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	93
PID 4544 wrote to memory of 1128	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	93
PID 4544 wrote to memory of 1128	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	93
PID 4544 wrote to memory of 1196	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	94
PID 4544 wrote to memory of 1196	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	94
PID 4544 wrote to memory of 1196	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	94
PID 4544 wrote to memory of 3152	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	95
PID 4544 wrote to memory of 3152	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	95
PID 4544 wrote to memory of 3152	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	95
PID 4544 wrote to memory of 2484	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	96
PID 4544 wrote to memory of 2484	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	96
PID 4544 wrote to memory of 2484	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	96
PID 4544 wrote to memory of 4592	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	99
PID 4544 wrote to memory of 4592	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	99
PID 4544 wrote to memory of 4592	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	99
PID 4544 wrote to memory of 1224	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	100
PID 4544 wrote to memory of 1224	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	100
PID 4544 wrote to memory of 1224	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	100
PID 4544 wrote to memory of 3504	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	103
PID 4544 wrote to memory of 3504	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	103
PID 4544 wrote to memory of 4532	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	104
PID 4544 wrote to memory of 4532	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	104
PID 4544 wrote to memory of 4532	4544	3d4605c927cdb55570cbadbaeb08ce13.exe	104
PID 4532 wrote to memory of 4984	4532	Camval.exe	105
PID 4532 wrote to memory of 4984	4532	Camval.exe	105
PID 4532 wrote to memory of 4984	4532	Camval.exe	105
PID 4532 wrote to memory of 4984	4532	Camval.exe	105
PID 4532 wrote to memory of 4984	4532	Camval.exe	105
PID 4532 wrote to memory of 4984	4532	Camval.exe	105
PID 4532 wrote to memory of 4984	4532	Camval.exe	105
PID 4532 wrote to memory of 4984	4532	Camval.exe	105
PID 4984 wrote to memory of 3668	4984	Camval.exe	106
PID 4984 wrote to memory of 3668	4984	Camval.exe	106
PID 4984 wrote to memory of 3668	4984	Camval.exe	106
PID 4984 wrote to memory of 3368	4984	Camval.exe	107
PID 4984 wrote to memory of 3368	4984	Camval.exe	107
PID 4984 wrote to memory of 3368	4984	Camval.exe	107
PID 4984 wrote to memory of 4340	4984	Camval.exe	108
PID 4984 wrote to memory of 4340	4984	Camval.exe	108
PID 4984 wrote to memory of 4340	4984	Camval.exe	108
PID 4984 wrote to memory of 2684	4984	Camval.exe	110
PID 4984 wrote to memory of 2684	4984	Camval.exe	110
PID 4984 wrote to memory of 2684	4984	Camval.exe	110
PID 4984 wrote to memory of 232	4984	Camval.exe	111
PID 4984 wrote to memory of 232	4984	Camval.exe	111
PID 4984 wrote to memory of 232	4984	Camval.exe	111
PID 4984 wrote to memory of 4108	4984	Camval.exe	112
PID 4984 wrote to memory of 4108	4984	Camval.exe	112
PID 4984 wrote to memory of 4108	4984	Camval.exe	112

C:\Users\Admin\AppData\Local\Temp\3d4605c927cdb55570cbadbaeb08ce13.exe
"C:\Users\Admin\AppData\Local\Temp\3d4605c927cdb55570cbadbaeb08ce13.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\3d4605c927cdb55570cbadbaeb08ce13.exe
  C:\Users\Admin\AppData\Local\Temp\3d4605c927cdb55570cbadbaeb08ce13.exe
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Adds Run key to start application
    PID:720
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:676
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4416
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4368
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1604
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2868
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4744
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2068
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:312
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1220
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4064
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3432
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:4672
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4740
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4288
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      PID:4404
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2108
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2520
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4920
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:4580
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:4540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2444
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2064
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2616
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:220
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3808
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4496
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:2272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:4676
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5188
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5620
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        
        PID:5676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5300
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        13⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5648
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:3704
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        
        PID:1588
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1204
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5076
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3796
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1380
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4088
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1760
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5328
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5376
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5408
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:5520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5668
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      PID:5344
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5428
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5512
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5632
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5708
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:6076
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        
        PID:6120
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5180
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5152
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3544
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5536
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5412
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5656
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5764
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5880
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5548
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5608
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5748
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5496
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2228
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3008
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5780
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5836
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5856
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1220
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5456
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      PID:5768
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5888
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4316
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6084
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6104
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6132
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5352
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5480
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:5348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5788
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2524
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        9⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        10⤵
        Suspicious use of SetThreadContext
        
        PID:5424
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        11⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:4676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:2528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:4996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:4904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:2756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        12⤵
        Suspicious use of SetThreadContext
        
        PID:376
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        13⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Drops file in System32 directory
        
        PID:1432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:1528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:2432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        14⤵
        Suspicious use of SetThreadContext
        
        PID:6000
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        15⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:4348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:6020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:4896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:6168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:6320
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      PID:5364
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1432
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4940
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5580
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4780
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5872
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5432
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:4672
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Executes dropped EXE
        
        PID:1656
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5852
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1028
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3696
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5684
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5724
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5876
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3232
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5828
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5608
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5936
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Suspicious use of SetThreadContext
        
        PID:5996
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:1512
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:1804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5968
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      PID:5248
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2696
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4620
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4012
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:4120
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2932
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5248
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5004
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3216
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5344
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1320
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Suspicious use of SetThreadContext
        
        PID:920
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:4360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        Suspicious use of SetThreadContext
        
        PID:6300
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:6388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        10⤵
        Suspicious use of SetThreadContext
        
        PID:7112
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        11⤵
        Adds Run key to start application
        
        PID:5144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:2948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6316
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      PID:5820
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Checks computer location settings
        Adds Run key to start application
        
        PID:6064
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1512
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3384
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1804
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5552
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6000
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6156
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:6192
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Checks computer location settings
        Adds Run key to start application
        
        PID:6332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        Suspicious use of SetThreadContext
        
        PID:6792
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        
        PID:6900
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:5980
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        
        PID:6200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6372
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6508
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6536
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6564
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6592
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6636
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Suspicious use of SetThreadContext
        
        PID:6672
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Modifies Installed Components in the registry
        
        PID:6800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7164
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      PID:6616
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:6680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6768
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:7040
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Drops file in System32 directory
        
        PID:7072
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7156
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4596
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6260
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5692
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6072
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6400
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Suspicious use of SetThreadContext
        
        PID:6428
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        
        PID:6688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        8⤵
        Suspicious use of SetThreadContext
        
        PID:7132
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        9⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:5620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6720
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:6344
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:6440
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6628
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6620
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6652
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6356
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6784
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6852
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:6720
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:6956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        8⤵
        Suspicious use of SetThreadContext
        
        PID:6788
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        9⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        
        PID:1296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        10⤵
        Suspicious use of SetThreadContext
        
        PID:4220
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        11⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:4876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        12⤵
        Suspicious use of SetThreadContext
        
        PID:7640
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        13⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:7704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:7760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:7820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:7856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:7940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:8008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:8148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:7272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        14⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        15⤵
        Checks computer location settings
        
        PID:2152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:7376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:7600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:7628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:7728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:1764
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:7876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:7924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        16⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        17⤵
        
        PID:7468
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:6348
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:1920
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6952
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:2380
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:6712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6796
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7080
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7040
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7060
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6328
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:956
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:6184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        Suspicious use of SetThreadContext
        
        PID:7380
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        
        PID:7504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:8044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        10⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        11⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:7372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5764
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:2668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        12⤵
        Drops file in System32 directory
        
        PID:7936
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        13⤵
        
        PID:7908
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:7128
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6060
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6348
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:628
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7252
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:7292
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:7440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        Drops file in System32 directory
        
        PID:8124
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7232
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      PID:7228
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Drops file in System32 directory
        
        PID:7316
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7408
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:7956
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:8016
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:8096
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:8184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7348
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7328
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7420
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7416
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6460
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7648
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Drops file in System32 directory
        
        PID:7620
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        
        PID:7428
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      PID:4876
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        
        PID:7808
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Drops file in System32 directory
      PID:2380
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:7544
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7248
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6928
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5792
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7744
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7404
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:8064
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7316
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7480
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Adds Run key to start application
        
        PID:7672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7516
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      PID:8164
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Drops file in System32 directory
        
        PID:7724
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:512
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7344
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5812
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3440
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:8020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7868
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        6⤵
        
        PID:7996
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      PID:3536
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:7352
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\InstallDir\Camval.exe
    "C:\Windows\system32\InstallDir\Camval.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      C:\Windows\SysWOW64\InstallDir\Camval.exe
      4⤵
      Modifies Installed Components in the registry
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:852
      - C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        6⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4324
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2056
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        8⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:2820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:2592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:2192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3704
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:5008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4328
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        12⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:4676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:3376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:2108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:2080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:2204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:3972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1936
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5148
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        16⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:5284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:5320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:5356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:5484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:5568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:5660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SuhwW.cfg

Filesize
1KB

MD5
9cd24878580e1cf3376b1b2c2c45b479

SHA1
1db9fead200b8b8683b2d45b46656639b19fcf8b

SHA256
907c0f27bd8c8a1234605c774310f47179b97a24fa9f58b3339d301bdfd4fedc

SHA512
ad8e4dc56ea8e3f9a3f0321b8d02b142808ce17e97f0f0ca8bdf8b8918e776fbc874889829a2c9cc9dc8bd4004d9e358d8d73f0f55872180235df4cf7f118c0b

Download Submit
C:\Windows\SysWOW64\InstallDir\Camval.exe

Filesize
82KB

MD5
3d4605c927cdb55570cbadbaeb08ce13

SHA1
2cf5de7f026cfa02981a5af7e59e0a3613dda79e

SHA256
7c3252900a812ea3f7e77e78195dd178a36ca779d60acdc2a66dcacface7ca8e

SHA512
6c6919427ed4856a3c8a6f1466e3b77f82c0541e16adef32a997cb5601365bc42153776672b5cccea09b462af976668ae61b98764a1f7e4a38e25d4fd9f002cf

Download Submit
memory/464-286-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/464-297-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/720-9-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/924-127-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/924-111-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1028-342-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1028-319-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1320-187-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1320-224-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1432-306-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1432-294-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1588-158-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1588-145-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1656-322-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1656-327-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1920-69-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1920-93-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2108-88-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2108-105-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2204-115-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2204-101-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2272-181-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2272-154-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2620-59-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2620-42-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2696-339-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3796-204-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3796-176-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4132-192-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4132-166-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4372-74-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4372-95-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4416-51-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4540-139-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4540-122-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4544-5-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4544-1-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4544-4-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4544-3-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4544-12-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4588-0-0x00000000005E0000-0x00000000005E4000-memory.dmp

Filesize
16KB

Download
memory/4676-160-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4676-133-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4740-78-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4740-57-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4984-18-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4984-31-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5216-198-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5216-234-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5348-302-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5348-318-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5428-210-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5428-236-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5448-262-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5448-251-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5520-235-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5520-219-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5552-332-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5552-347-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5608-259-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5608-281-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5676-246-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5676-230-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5764-280-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5764-270-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5888-290-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5888-277-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/6120-265-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads