xtremerat | 7c3252900a812ea3f7e77e78195dd178a36ca779d60acdc2a66dcacface7ca8e

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/01/2025, 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe
Size

82KB
MD5

3d4605c927cdb55570cbadbaeb08ce13
SHA1

2cf5de7f026cfa02981a5af7e59e0a3613dda79e
SHA256

7c3252900a812ea3f7e77e78195dd178a36ca779d60acdc2a66dcacface7ca8e
SHA512

6c6919427ed4856a3c8a6f1466e3b77f82c0541e16adef32a997cb5601365bc42153776672b5cccea09b462af976668ae61b98764a1f7e4a38e25d4fd9f002cf
SSDEEP

1536:bleFkLjr+fEQclXjwXkXhULR+VXG6te793kBKuIyZthhTVmjQqop:bxL3Xp2R+JQBfupthhBmUj

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/2796-9-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2944-16-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2796-20-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2560-32-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2560-42-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\system32\\InstallDir\\Camval.exe restart"	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe restart"	Camval.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{FJEGWCB3-10D7-UD3T-8N1N-WW12753340Q6}	Camval.exe

Executes dropped EXE 64 IoCs

pid	Process
2660	Camval.exe
2560	Camval.exe
2028	Camval.exe
1220	Camval.exe
2524	Camval.exe
2372	Camval.exe
1684	Camval.exe
1672	Camval.exe
396	Camval.exe
1716	Camval.exe
2184	Camval.exe
2240	Camval.exe
340	Camval.exe
1364	Camval.exe
2512	Camval.exe
372	Camval.exe
2300	Camval.exe
1404	Camval.exe
884	Camval.exe
2788	Camval.exe
2504	Camval.exe
2348	Camval.exe
2952	Camval.exe
2724	Camval.exe
2840	Camval.exe
2912	Camval.exe
2372	Camval.exe
2188	Camval.exe
2100	Camval.exe
2368	Camval.exe
2044	Camval.exe
1404	Camval.exe
2512	Camval.exe
824	Camval.exe
1804	Camval.exe
2160	Camval.exe
3064	Camval.exe
2076	Camval.exe
2052	Camval.exe
3040	Camval.exe
3008	Camval.exe
3060	Camval.exe
372	Camval.exe
2252	Camval.exe
1820	Camval.exe
2276	Camval.exe
2456	Camval.exe
1528	Camval.exe
2816	Camval.exe
824	Camval.exe
2252	Camval.exe
1976	Camval.exe
928	Camval.exe
2076	Camval.exe
2652	Camval.exe
1516	Camval.exe
1924	Camval.exe
3060	Camval.exe
3160	Camval.exe
3192	Camval.exe
3216	Camval.exe
3228	Camval.exe
3300	Camval.exe
3380	Camval.exe

Loads dropped DLL 64 IoCs

pid	Process
2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe
2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe
2560	Camval.exe
2560	Camval.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2372	Camval.exe
2188	Camval.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
3300	Camval.exe
3380	Camval.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
3668	Camval.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
4636	Camval.exe
4712	Camval.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
5360	Camval.exe
5436	Camval.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe
2944	svchost.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\system32\\InstallDir\\Camval.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4599834597 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\SysWOW64\\InstallDir\\Camval.exe"	Camval.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1454234355 = "C:\\Windows\\system32\\InstallDir\\Camval.exe"	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File created	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Camval.exe	Camval.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 2796	1948	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	30
PID 2660 set thread context of 2560	2660	Camval.exe	41
PID 2028 set thread context of 2524	2028	Camval.exe	52
PID 1220 set thread context of 2372	1220	Camval.exe	54
PID 1684 set thread context of 1716	1684	Camval.exe	73
PID 1672 set thread context of 2184	1672	Camval.exe	75
PID 396 set thread context of 2240	396	Camval.exe	77
PID 340 set thread context of 2300	340	Camval.exe	104
PID 1364 set thread context of 1404	1364	Camval.exe	105
PID 2512 set thread context of 884	2512	Camval.exe	107
PID 372 set thread context of 2788	372	Camval.exe	109
PID 2504 set thread context of 2840	2504	Camval.exe	136
PID 2348 set thread context of 2912	2348	Camval.exe	137
PID 2952 set thread context of 2372	2952	Camval.exe	139
PID 2724 set thread context of 2188	2724	Camval.exe	141
PID 2100 set thread context of 2512	2100	Camval.exe	168
PID 2368 set thread context of 824	2368	Camval.exe	169
PID 2044 set thread context of 1804	2044	Camval.exe	171
PID 1404 set thread context of 2160	1404	Camval.exe	173
PID 3064 set thread context of 3040	3064	Camval.exe	199
PID 2076 set thread context of 3060	2076	Camval.exe	202
PID 2052 set thread context of 372	2052	Camval.exe	204
PID 3008 set thread context of 2252	3008	Camval.exe	206
PID 1820 set thread context of 1528	1820	Camval.exe	233
PID 2276 set thread context of 824	2276	Camval.exe	235
PID 2456 set thread context of 2252	2456	Camval.exe	237
PID 2816 set thread context of 1976	2816	Camval.exe	239
PID 928 set thread context of 2652	928	Camval.exe	256
PID 2076 set thread context of 1924	2076	Camval.exe	260
PID 1516 set thread context of 3060	1516	Camval.exe	262
PID 3160 set thread context of 3228	3160	Camval.exe	287
PID 3192 set thread context of 3300	3192	Camval.exe	289
PID 3216 set thread context of 3380	3216	Camval.exe	291
PID 3564 set thread context of 3600	3564	Camval.exe	308
PID 3588 set thread context of 3700	3588	Camval.exe	312
PID 3680 set thread context of 3780	3680	Camval.exe	314
PID 4008 set thread context of 4076	4008	Camval.exe	339
PID 4040 set thread context of 1924	4040	Camval.exe	341
PID 4064 set thread context of 3196	4064	Camval.exe	343
PID 3552 set thread context of 3724	3552	Camval.exe	369
PID 3664 set thread context of 3804	3664	Camval.exe	371
PID 3588 set thread context of 3656	3588	Camval.exe	373
PID 3796 set thread context of 1204	3796	Camval.exe	375
PID 3372 set thread context of 3176	3372	Camval.exe	392
PID 1948 set thread context of 3820	1948	Camval.exe	396
PID 3668 set thread context of 2416	3668	Camval.exe	398
PID 3268 set thread context of 3664	3268	Camval.exe	424
PID 3888 set thread context of 3692	3888	Camval.exe	425
PID 2728 set thread context of 3668	2728	Camval.exe	427
PID 1620 set thread context of 2148	1620	Camval.exe	445
PID 4060 set thread context of 4196	4060	Camval.exe	448
PID 4144 set thread context of 4272	4144	Camval.exe	450
PID 4500 set thread context of 4560	4500	Camval.exe	475
PID 4524 set thread context of 4636	4524	Camval.exe	477
PID 4548 set thread context of 4712	4548	Camval.exe	479
PID 4960 set thread context of 5040	4960	Camval.exe	506
PID 4976 set thread context of 5088	4976	Camval.exe	507
PID 5000 set thread context of 3808	5000	Camval.exe	509
PID 5028 set thread context of 4232	5028	Camval.exe	511
PID 4660 set thread context of 4724	4660	Camval.exe	537
PID 4272 set thread context of 4564	4272	Camval.exe	540
PID 4696 set thread context of 5052	4696	Camval.exe	542
PID 2652 set thread context of 1796	2652	Camval.exe	544
PID 4664 set thread context of 4232	4664	Camval.exe	569

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2796-6-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2796-3-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2796-2-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2796-8-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2796-10-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2796-9-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2944-16-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2796-20-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2560-32-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2560-42-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camval.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2796	1948	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	30
PID 1948 wrote to memory of 2796	1948	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	30
PID 1948 wrote to memory of 2796	1948	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	30
PID 1948 wrote to memory of 2796	1948	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	30
PID 1948 wrote to memory of 2796	1948	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	30
PID 1948 wrote to memory of 2796	1948	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	30
PID 1948 wrote to memory of 2796	1948	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	30
PID 1948 wrote to memory of 2796	1948	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	30
PID 2796 wrote to memory of 2944	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	31
PID 2796 wrote to memory of 2944	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	31
PID 2796 wrote to memory of 2944	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	31
PID 2796 wrote to memory of 2944	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	31
PID 2796 wrote to memory of 2944	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	31
PID 2796 wrote to memory of 2768	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	32
PID 2796 wrote to memory of 2768	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	32
PID 2796 wrote to memory of 2768	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	32
PID 2796 wrote to memory of 2768	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	32
PID 2796 wrote to memory of 2768	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	32
PID 2796 wrote to memory of 2772	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	33
PID 2796 wrote to memory of 2772	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	33
PID 2796 wrote to memory of 2772	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	33
PID 2796 wrote to memory of 2772	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	33
PID 2796 wrote to memory of 2772	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	33
PID 2796 wrote to memory of 2736	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	34
PID 2796 wrote to memory of 2736	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	34
PID 2796 wrote to memory of 2736	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	34
PID 2796 wrote to memory of 2736	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	34
PID 2796 wrote to memory of 2736	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	34
PID 2796 wrote to memory of 2572	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	35
PID 2796 wrote to memory of 2572	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	35
PID 2796 wrote to memory of 2572	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	35
PID 2796 wrote to memory of 2572	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	35
PID 2796 wrote to memory of 2572	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	35
PID 2796 wrote to memory of 2832	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	36
PID 2796 wrote to memory of 2832	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	36
PID 2796 wrote to memory of 2832	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	36
PID 2796 wrote to memory of 2832	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	36
PID 2796 wrote to memory of 2832	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	36
PID 2796 wrote to memory of 2684	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	37
PID 2796 wrote to memory of 2684	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	37
PID 2796 wrote to memory of 2684	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	37
PID 2796 wrote to memory of 2684	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	37
PID 2796 wrote to memory of 2684	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	37
PID 2796 wrote to memory of 2764	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	38
PID 2796 wrote to memory of 2764	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	38
PID 2796 wrote to memory of 2764	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	38
PID 2796 wrote to memory of 2764	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	38
PID 2796 wrote to memory of 2764	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	38
PID 2796 wrote to memory of 2716	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	39
PID 2796 wrote to memory of 2716	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	39
PID 2796 wrote to memory of 2716	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	39
PID 2796 wrote to memory of 2716	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	39
PID 2796 wrote to memory of 2660	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	40
PID 2796 wrote to memory of 2660	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	40
PID 2796 wrote to memory of 2660	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	40
PID 2796 wrote to memory of 2660	2796	JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe	40
PID 2660 wrote to memory of 2560	2660	Camval.exe	41
PID 2660 wrote to memory of 2560	2660	Camval.exe	41
PID 2660 wrote to memory of 2560	2660	Camval.exe	41
PID 2660 wrote to memory of 2560	2660	Camval.exe	41
PID 2660 wrote to memory of 2560	2660	Camval.exe	41
PID 2660 wrote to memory of 2560	2660	Camval.exe	41
PID 2660 wrote to memory of 2560	2660	Camval.exe	41
PID 2660 wrote to memory of 2560	2660	Camval.exe	41

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d4605c927cdb55570cbadbaeb08ce13.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    PID:2944
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:1220
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2372
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2036
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2116
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2748
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2532
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2344
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2388
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2644
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:932
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:396
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2240
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1720
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1700
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:616
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:968
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1792
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:780
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:372
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2788
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2672
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2600
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2612
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2668
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2292
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1632
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2724
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2188
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2424
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1284
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1040
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1956
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2168
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1188
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2024
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1404
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        13⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        
        PID:2160
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2352
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2528
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:572
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2312
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:1096
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2936
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3008
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        15⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2252
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:2732
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      PID:1672
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        
        PID:2184
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2232
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2516
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:840
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:376
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1932
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2392
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1788
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1072
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2512
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1644
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2140
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2588
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3012
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1828
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:404
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2952
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2372
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2080
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1312
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1812
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:676
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2044
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        
        PID:1804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2144
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1964
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2224
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2952
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:672
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2052
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        13⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:372
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:1664
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2864
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2788
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3064
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2192
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:1712
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2816
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        15⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1976
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:2704
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:2276
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:2752
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:1524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:1748
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:2448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1516
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        17⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:2908
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:2076
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:372
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:3088
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:3116
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:3140
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:3180
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1364
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Executes dropped EXE
        
        PID:1404
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2504
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2840
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2396
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2336
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:988
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2200
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1152
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1580
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2240
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1760
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:2368
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Executes dropped EXE
        
        PID:824
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:2100
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Executes dropped EXE
        
        PID:2512
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3036
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1704
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1668
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2912
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1684
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1148
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1960
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1672
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2076
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        
        PID:3060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1436
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1824
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2892
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2840
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:2456
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2252
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2676
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2100
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3008
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1420
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:824
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2124
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:796
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2076
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1924
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:396
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1516
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:928
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2956
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3100
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3124
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3152
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3216
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        13⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3380
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3464
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3484
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3500
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3520
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3536
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3556
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        14⤵
        Suspicious use of SetThreadContext
        
        PID:3680
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        15⤵
        Adds Run key to start application
        
        PID:3780
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3856
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3880
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3908
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3932
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3964
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3988
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4028
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3064
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3040
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2976
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2700
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2860
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2692
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1972
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:856
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2236
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2160
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:2276
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Executes dropped EXE
        
        PID:824
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:1820
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1528
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1404
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:928
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        
        PID:2652
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2228
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3048
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3040
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1820
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3080
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3108
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3132
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3168
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3192
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3364
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3456
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3472
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3508
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3528
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        8⤵
        Suspicious use of SetThreadContext
        
        PID:3588
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        
        PID:3700
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3772
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3864
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3892
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3972
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4000
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        10⤵
        Suspicious use of SetThreadContext
        
        PID:4064
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        11⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3196
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3352
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3392
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3420
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3276
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3348
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3568
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3644
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        12⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3796
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        13⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1204
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4048
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3236
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3260
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4068
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3192
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3324
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        14⤵
        Suspicious use of SetThreadContext
        
        PID:3668
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        15⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3996
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:956
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3844
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:1640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:1212
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3336
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3848
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3160
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3228
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3288
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      PID:3564
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3600
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3672
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3828
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3872
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3900
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3924
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3956
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3980
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4016
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:4040
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Adds Run key to start application
        
        PID:1924
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3280
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3216
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3408
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3444
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3480
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3616
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3632
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3656
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4084
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3164
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3248
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3272
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3312
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3340
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        10⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:1948
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        11⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3820
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:836
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4008
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2576
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3836
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2280
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2484
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3784
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        12⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2728
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        13⤵
        Loads dropped DLL
        Adds Run key to start application
        
        PID:3668
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3724
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3748
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3752
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3596
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2476
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:1636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3588
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        14⤵
        Suspicious use of SetThreadContext
        
        PID:4144
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        15⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4272
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4344
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4372
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4396
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4424
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4476
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4512
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:4008
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        
        PID:4076
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2800
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3220
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3400
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3436
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3228
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3304
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3624
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3648
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:3664
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3804
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3552
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3724
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1832
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:3372
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Drops file in System32 directory
        
        PID:3176
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3792
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3600
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3800
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2920
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4044
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3696
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3604
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3660
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:3888
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3268
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Drops file in System32 directory
        
        PID:3664
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2632
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3360
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2452
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2472
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3692
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2728
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3940
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3816
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Suspicious use of SetThreadContext
        
        PID:4060
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Drops file in System32 directory
        
        PID:4196
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4256
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4352
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4380
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4404
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4432
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4456
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4484
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        Suspicious use of SetThreadContext
        
        PID:4548
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        Loads dropped DLL
        
        PID:4712
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4832
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4856
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4912
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        10⤵
        Suspicious use of SetThreadContext
        
        PID:5028
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        11⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4232
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4308
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4420
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4268
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4504
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4612
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4652
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        12⤵
        Suspicious use of SetThreadContext
        
        PID:2652
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        13⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4136
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4208
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4144
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4288
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4500
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4528
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2008
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:5064
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        15⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        
        PID:4732
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4708
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4156
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4736
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5112
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4116
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3668
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5068
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:1620
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2148
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4180
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4320
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4360
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4388
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4412
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4440
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4464
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4492
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Suspicious use of SetThreadContext
        
        PID:4524
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4700
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4824
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4848
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4904
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4932
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        8⤵
        Suspicious use of SetThreadContext
        
        PID:5000
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Drops file in System32 directory
        
        PID:3808
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4216
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4192
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2148
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4196
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4576
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4600
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4644
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        10⤵
        Suspicious use of SetThreadContext
        
        PID:4696
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        
        PID:5052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4976
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5000
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4248
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3708
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4276
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4692
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        12⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        13⤵
        Boot or Logon Autostart Execution: Active Setup
        Drops file in System32 directory
        
        PID:3788
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5040
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5024
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:1796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5096
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2652
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4724
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        15⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4732
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4104
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4980
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5148
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5172
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5200
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5236
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      PID:4500
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Drops file in System32 directory
        
        PID:4560
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4620
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4788
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4812
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4840
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4864
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4896
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4920
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4952
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Suspicious use of SetThreadContext
        
        PID:4976
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        
        PID:5088
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:4960
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        
        PID:5040
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4120
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4336
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3664
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4544
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4568
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4592
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4532
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4332
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:4272
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        
        PID:4564
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5048
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4176
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5036
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4284
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4128
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4204
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        
        PID:5076
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5092
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4100
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5084
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1836
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1928
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4820
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        11⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4272
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4672
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5104
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4712
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5128
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5156
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5180
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5208
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        12⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        13⤵
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5436
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5500
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5540
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5560
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5576
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5596
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5612
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        15⤵
        Boot or Logon Autostart Execution: Active Setup
        
        PID:5832
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5908
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5936
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5960
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5988
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:6012
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:6040
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:6076
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        16⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        17⤵
        Adds Run key to start application
        
        PID:5476
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:5628
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:5700
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:5436
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:5776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:5820
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:5860
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:5668
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:5292
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        19⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:5728
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:5304
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:4272
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:6112
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:5284
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:6108
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:5320
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:4660
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        
        PID:4724
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4632
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:4664
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        
        PID:4232
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4960
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4060
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4664
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4716
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5088
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2568
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5080
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5140
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5164
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5192
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5228
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5360
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5424
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5512
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5532
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5548
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5568
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5604
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        8⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        9⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5824
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5968
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5996
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:6020
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:6048
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        11⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5680
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5708
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5648
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5784
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5720
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5868
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        13⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5520
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4552
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5220
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5328
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:6116
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5404
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5416
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5480
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        14⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5392
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5384
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:6136
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5672
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:5620
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:6160
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:6212
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        16⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        17⤵
        Boot or Logon Autostart Execution: Active Setup
        Drops file in System32 directory
        
        PID:6488
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:6556
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:6572
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:6592
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:6608
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:6628
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:6644
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:6696
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        18⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        19⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        
        PID:6900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:6964
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:6988
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:7016
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:7040
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:7068
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:7092
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:7164
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        21⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:6400
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:6536
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:6676
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:6656
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      PID:5216
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        
        PID:5288
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5348
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      PID:5620
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        
        PID:5668
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5740
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5880
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5928
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5952
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5980
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6004
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6032
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6056
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        
        PID:4552
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4772
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5592
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5676
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5440
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5800
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5848
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5392
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5464
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5296
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5076
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4236
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5412
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5456
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        10⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        11⤵
        
        PID:6064
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5756
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5272
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4664
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:5344
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1252
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:6168
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:6236
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        13⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:6408
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:6468
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      PID:6064
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        
        PID:6128
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5332
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5468
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5688
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5508
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5644
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5792
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5844
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5904
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        
        PID:4236
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5876
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Drops file in System32 directory
        
        PID:6064
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5368
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5256
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      Drops file in System32 directory
      PID:5408
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5188
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5292
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5812
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5640
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5252
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5888
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6152
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6184
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6200
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        
        PID:6296
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      PID:6176
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Adds Run key to start application
        
        PID:6248
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6364
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6480
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6564
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6580
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6600
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6616
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6636
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6664
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        Drops file in System32 directory
        
        PID:6680
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6772
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:6848
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:6888
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:6980
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:7004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:7032
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:7056
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:7084
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7152
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        9⤵
        Adds Run key to start application
        
        PID:6356
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:6240
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:6220
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:6624
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:6716
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      PID:6656
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:6704
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6764
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6880
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6972
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6996
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:7024
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:7048
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:7076
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:7100
      - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        "C:\Windows\SysWOW64\InstallDir\Camval.exe"
        6⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:6176
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:6336
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:6452
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      "C:\Windows\system32\InstallDir\Camval.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7108
    - - C:\Windows\SysWOW64\InstallDir\Camval.exe
        
        C:\Windows\SysWOW64\InstallDir\Camval.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6084
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6308
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6428
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6548
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6352
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6672
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2768
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2772
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2736
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2572
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2832
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2684
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2764
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\InstallDir\Camval.exe
    "C:\Windows\system32\InstallDir\Camval.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\SysWOW64\InstallDir\Camval.exe
      C:\Windows\SysWOW64\InstallDir\Camval.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2560
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:3024
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:3028
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1552
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:276
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1392
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2848
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:892
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1764
    - - C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2028
      - C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2120
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1676
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2828
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2364
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2608
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:532
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2176
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2500
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:904
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2072
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1368
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:708
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1476
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:340
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2932
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2556
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2620
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2068
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2564
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2348
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\Camval.exe
        12⤵
        Executes dropped EXE
        
        PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SuhwW.cfg

Filesize
1KB

MD5
9cd24878580e1cf3376b1b2c2c45b479

SHA1
1db9fead200b8b8683b2d45b46656639b19fcf8b

SHA256
907c0f27bd8c8a1234605c774310f47179b97a24fa9f58b3339d301bdfd4fedc

SHA512
ad8e4dc56ea8e3f9a3f0321b8d02b142808ce17e97f0f0ca8bdf8b8918e776fbc874889829a2c9cc9dc8bd4004d9e358d8d73f0f55872180235df4cf7f118c0b

Download Submit
C:\Windows\SysWOW64\InstallDir\Camval.exe

Filesize
82KB

MD5
3d4605c927cdb55570cbadbaeb08ce13

SHA1
2cf5de7f026cfa02981a5af7e59e0a3613dda79e

SHA256
7c3252900a812ea3f7e77e78195dd178a36ca779d60acdc2a66dcacface7ca8e

SHA512
6c6919427ed4856a3c8a6f1466e3b77f82c0541e16adef32a997cb5601365bc42153776672b5cccea09b462af976668ae61b98764a1f7e4a38e25d4fd9f002cf

Download Submit
memory/1948-0-0x0000000000230000-0x0000000000234000-memory.dmp

Filesize
16KB

Download
memory/2560-42-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2560-32-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2796-8-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2796-2-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2796-10-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2796-9-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2796-3-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2796-20-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2796-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2796-6-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2796-1-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2944-16-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads