hxxps://cdn[.]discordapp[.]com/attachments/1185220135456346223/1228072527436320931/Movavi_Screen_Recorder_22[.]3[.]0[.]exe?ex=663d2bab&is=663bda2b&hm=8b9e11fb858db99800142b7f7d55623a94aa5c0ec5507d1ab36f68c12fbf35ae&

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ScreenRecorder.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ScreenRecorder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ScreenRecorder.exe

Executes dropped EXE 9 IoCs

pid	Process
4720	Movavi_Screen_Recorder_22.3.0.exe
1576	Movavi_Screen_Recorder_22.3.0.tmp
116	Movavi_Screen_Recorder_22.3.0.exe
4328	Movavi_Screen_Recorder_22.3.0.tmp
1780	Movavi_Screen_Recorder_22.3.0.exe
3580	Movavi_Screen_Recorder_22.3.0.tmp
1848	ScreenRecorder.exe
3028	RouterApplication.exe
4244	RouterApplication.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine	ScreenRecorder.exe

Loads dropped DLL 64 IoCs

pid	Process
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
3580	Movavi_Screen_Recorder_22.3.0.tmp
3580	Movavi_Screen_Recorder_22.3.0.tmp
3580	Movavi_Screen_Recorder_22.3.0.tmp
3580	Movavi_Screen_Recorder_22.3.0.tmp
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\movavi_srecorder_22.0.0_screenrecorder = "\"C:\\Users\\Admin\\AppData\\Roaming\\Movavi Screen Recorder\\ScreenRecorder.exe\" --hideAppToTrayOnStart=true"	Movavi_Screen_Recorder_22.3.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\movavi_srecorder_22.0.0_screenrecorder	Movavi_Screen_Recorder_22.3.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\movavi_srecorder_22.0.0_screenrecorder = "\"C:\\Users\\Admin\\AppData\\Roaming\\Movavi Screen Recorder\\ScreenRecorder.exe\" --hideAppToTrayOnStart=true"	Movavi_Screen_Recorder_22.3.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\movavi_srecorder_22.0.0_screenrecorder	Movavi_Screen_Recorder_22.3.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\movavi_srecorder_22.0.0_screenrecorder	Movavi_Screen_Recorder_22.3.0.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ScreenRecorder.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ScreenRecorder.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1848	ScreenRecorder.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\install16476.log	ScreenRecorder.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	ScreenRecorder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenRecorder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{675F31BB-1792-A42D-BCC3-B9E056BC}\ProdID = af31a39588388dfda8d8bc2420279e0253ad3dbe	ScreenRecorder.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96DE6504-479E-8A28-66EB-F84B192A}\ProdID = a04832de74b82302945833db1c0b1201a4e3100a	ScreenRecorder.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{675F31BB-1792-A42D-BCC3-B9E056BC}\ProdID = 2fce629380c233bbf274ab0cde5252ef235bb8b5	ScreenRecorder.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2804150937-2146708401-419095071-1000\{5B16A222-1A1D-4924-B838-61E9A5DC92BA}	ScreenRecorder.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2804150937-2146708401-419095071-1000\{776C801C-CC9B-4BED-A3CC-3DF4190E7F6A}	ScreenRecorder.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E03032F-C175-6758-DC24-B3EF8202}\ProdID = 58f89928ac240d3566b378232a76ba0e881cf204	ScreenRecorder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96DE6504-479E-8A28-66EB-F84B192A}	ScreenRecorder.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96DE6504-479E-8A28-66EB-F84B192A}\ProdID = 585732e14827f9cd0217c2c0d280e9f040eaa01f	ScreenRecorder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{675F31BB-1792-A42D-BCC3-B9E056BC}	ScreenRecorder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E03032F-C175-6758-DC24-B3EF8202}	ScreenRecorder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FAF37763-0C5C-644C-8298-FB4F17DC}	ScreenRecorder.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FAF37763-0C5C-644C-8298-FB4F17DC}\ProdID = 2f379f6ba4c6f08d7cc47dbca878d6ce53bd4b16	ScreenRecorder.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	ScreenRecorder.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	ScreenRecorder.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	ScreenRecorder.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 957130.crdownload:SmartScreen	msedge.exe

Runs .reg file with regedit 3 IoCs

pid	Process
184	regedit.exe
448	regedit.exe
2256	regedit.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1848	ScreenRecorder.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
5096	msedge.exe
5096	msedge.exe
1816	identity_helper.exe
1816	identity_helper.exe
4428	msedge.exe
4428	msedge.exe
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1848	ScreenRecorder.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3812	wmic.exe
Token: SeSecurityPrivilege	3812	wmic.exe
Token: SeTakeOwnershipPrivilege	3812	wmic.exe
Token: SeLoadDriverPrivilege	3812	wmic.exe
Token: SeSystemProfilePrivilege	3812	wmic.exe
Token: SeSystemtimePrivilege	3812	wmic.exe
Token: SeProfSingleProcessPrivilege	3812	wmic.exe
Token: SeIncBasePriorityPrivilege	3812	wmic.exe
Token: SeCreatePagefilePrivilege	3812	wmic.exe
Token: SeBackupPrivilege	3812	wmic.exe
Token: SeRestorePrivilege	3812	wmic.exe
Token: SeShutdownPrivilege	3812	wmic.exe
Token: SeDebugPrivilege	3812	wmic.exe
Token: SeSystemEnvironmentPrivilege	3812	wmic.exe
Token: SeRemoteShutdownPrivilege	3812	wmic.exe
Token: SeUndockPrivilege	3812	wmic.exe
Token: SeManageVolumePrivilege	3812	wmic.exe
Token: 33	3812	wmic.exe
Token: 34	3812	wmic.exe
Token: 35	3812	wmic.exe
Token: 36	3812	wmic.exe
Token: SeIncreaseQuotaPrivilege	3812	wmic.exe
Token: SeSecurityPrivilege	3812	wmic.exe
Token: SeTakeOwnershipPrivilege	3812	wmic.exe
Token: SeLoadDriverPrivilege	3812	wmic.exe
Token: SeSystemProfilePrivilege	3812	wmic.exe
Token: SeSystemtimePrivilege	3812	wmic.exe
Token: SeProfSingleProcessPrivilege	3812	wmic.exe
Token: SeIncBasePriorityPrivilege	3812	wmic.exe
Token: SeCreatePagefilePrivilege	3812	wmic.exe
Token: SeBackupPrivilege	3812	wmic.exe
Token: SeRestorePrivilege	3812	wmic.exe
Token: SeShutdownPrivilege	3812	wmic.exe
Token: SeDebugPrivilege	3812	wmic.exe
Token: SeSystemEnvironmentPrivilege	3812	wmic.exe
Token: SeRemoteShutdownPrivilege	3812	wmic.exe
Token: SeUndockPrivilege	3812	wmic.exe
Token: SeManageVolumePrivilege	3812	wmic.exe
Token: 33	3812	wmic.exe
Token: 34	3812	wmic.exe
Token: 35	3812	wmic.exe
Token: 36	3812	wmic.exe
Token: 33	4704	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4704	AUDIODG.EXE
Token: 33	1848	ScreenRecorder.exe
Token: SeIncBasePriorityPrivilege	1848	ScreenRecorder.exe
Token: SeIncreaseQuotaPrivilege	632	wmic.exe
Token: SeSecurityPrivilege	632	wmic.exe
Token: SeTakeOwnershipPrivilege	632	wmic.exe
Token: SeLoadDriverPrivilege	632	wmic.exe
Token: SeSystemProfilePrivilege	632	wmic.exe
Token: SeSystemtimePrivilege	632	wmic.exe
Token: SeProfSingleProcessPrivilege	632	wmic.exe
Token: SeIncBasePriorityPrivilege	632	wmic.exe
Token: SeCreatePagefilePrivilege	632	wmic.exe
Token: SeBackupPrivilege	632	wmic.exe
Token: SeRestorePrivilege	632	wmic.exe
Token: SeShutdownPrivilege	632	wmic.exe
Token: SeDebugPrivilege	632	wmic.exe
Token: SeSystemEnvironmentPrivilege	632	wmic.exe
Token: SeRemoteShutdownPrivilege	632	wmic.exe
Token: SeUndockPrivilege	632	wmic.exe
Token: SeManageVolumePrivilege	632	wmic.exe
Token: 33	632	wmic.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
1576	Movavi_Screen_Recorder_22.3.0.tmp
5096	msedge.exe
5096	msedge.exe
4328	Movavi_Screen_Recorder_22.3.0.tmp
3580	Movavi_Screen_Recorder_22.3.0.tmp
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4720	Movavi_Screen_Recorder_22.3.0.exe
1576	Movavi_Screen_Recorder_22.3.0.tmp
116	Movavi_Screen_Recorder_22.3.0.exe
1576	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
1576	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
4328	Movavi_Screen_Recorder_22.3.0.tmp
1780	Movavi_Screen_Recorder_22.3.0.exe
3580	Movavi_Screen_Recorder_22.3.0.tmp
3580	Movavi_Screen_Recorder_22.3.0.tmp
3580	Movavi_Screen_Recorder_22.3.0.tmp
3580	Movavi_Screen_Recorder_22.3.0.tmp
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
4244	RouterApplication.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
3028	RouterApplication.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
4244	RouterApplication.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe
1848	ScreenRecorder.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 2908	5096	msedge.exe	79
PID 5096 wrote to memory of 2908	5096	msedge.exe	79
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 3104	5096	msedge.exe	81
PID 5096 wrote to memory of 1772	5096	msedge.exe	82
PID 5096 wrote to memory of 1772	5096	msedge.exe	82
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83
PID 5096 wrote to memory of 4508	5096	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1185220135456346223/1228072527436320931/Movavi_Screen_Recorder_22.3.0.exe?ex=663d2bab&is=663bda2b&hm=8b9e11fb858db99800142b7f7d55623a94aa5c0ec5507d1ab36f68c12fbf35ae&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf0fc46f8,0x7ffaf0fc4708,0x7ffaf0fc4718
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2812 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Users\Admin\Downloads\Movavi_Screen_Recorder_22.3.0.exe
  "C:\Users\Admin\Downloads\Movavi_Screen_Recorder_22.3.0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4720
- - C:\Users\Admin\AppData\Local\Temp\is-9JPEL.tmp\Movavi_Screen_Recorder_22.3.0.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-9JPEL.tmp\Movavi_Screen_Recorder_22.3.0.tmp" /SL5="$60224,49014036,67072,C:\Users\Admin\Downloads\Movavi_Screen_Recorder_22.3.0.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1576
  - - C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\regedit.exe" /S "C:\Users\Admin\Downloads\settings.reg"
      4⤵
      Runs .reg file with regedit
      PID:448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lrepacks.net/
      4⤵
      PID:3312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffaf0fc46f8,0x7ffaf0fc4708,0x7ffaf0fc4718
        5⤵
        
        PID:2096
- C:\Users\Admin\Downloads\Movavi_Screen_Recorder_22.3.0.exe
  "C:\Users\Admin\Downloads\Movavi_Screen_Recorder_22.3.0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:116
- - C:\Users\Admin\AppData\Local\Temp\is-SLES3.tmp\Movavi_Screen_Recorder_22.3.0.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-SLES3.tmp\Movavi_Screen_Recorder_22.3.0.tmp" /SL5="$10256,49014036,67072,C:\Users\Admin\Downloads\Movavi_Screen_Recorder_22.3.0.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4328
  - - C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\regedit.exe" /S "C:\Users\Admin\Downloads\settings.reg"
      4⤵
      Runs .reg file with regedit
      PID:2256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lrepacks.net/
      4⤵
      PID:3316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaf0fc46f8,0x7ffaf0fc4708,0x7ffaf0fc4718
        5⤵
        
        PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5116 /prefetch:2
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1400 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15925987153296319464,6484296776698491826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:532

C:\Users\Admin\Downloads\Movavi_Screen_Recorder_22.3.0.exe
"C:\Users\Admin\Downloads\Movavi_Screen_Recorder_22.3.0.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1780
- C:\Users\Admin\AppData\Local\Temp\is-IQP4V.tmp\Movavi_Screen_Recorder_22.3.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IQP4V.tmp\Movavi_Screen_Recorder_22.3.0.tmp" /SL5="$E0214,49014036,67072,C:\Users\Admin\Downloads\Movavi_Screen_Recorder_22.3.0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3580
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\regedit.exe" /S "C:\Users\Admin\Downloads\settings.reg"
    3⤵
    - Runs .reg file with regedit
    PID:184
- - C:\Users\Admin\AppData\Roaming\Movavi Screen Recorder\ScreenRecorder.exe
    "C:\Users\Admin\AppData\Roaming\Movavi Screen Recorder\ScreenRecorder.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Checks processor information in registry
    - Modifies registry class
    - Modifies system certificate store
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1848
  - - C:\Users\Admin\AppData\Roaming\Movavi Screen Recorder\RouterApplication.exe
      "C:\Users\Admin\AppData\Roaming\Movavi Screen Recorder\RouterApplication.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3028
  - - C:\Users\Admin\AppData\Roaming\Movavi Screen Recorder\RouterApplication.exe
      "C:\Users\Admin\AppData\Roaming\Movavi Screen Recorder\RouterApplication.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4244
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic path win32_VideoController get description
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3812
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic path win32_VideoController get description
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lrepacks.net/
    3⤵
    PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaf0fc46f8,0x7ffaf0fc4708,0x7ffaf0fc4718
      4⤵
      PID:3364

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x3f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion