76f2dd354243fd2db76398cca4f297de50b322f0e6b88d1685fcfa388df45230

Analysis

max time kernel
97s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_558724595658fde7d7882190e8a7f5b0_elex_wannacry.exe
Size 116.3MB
Sample260810-vy523stfqe
SHA256 76f2dd354243fd2db76398cca4f297de50b322f0e6b88d1685fcfa388df45230
MD5 558724595658fde7d7882190e8a7f5b0
SHA1 6341fd2fbbf0f15d68ec852002abc46061f53184
SHA512 177cd31f326267e84fabe18ec8163b56f371146f84eb841dcb13e3fdb52939e947d05adf9d6bdf9be62ff6c82a1648baef3f5dc8691dff6e401ce466edf97a67
SSDEEP 3145728:6p5jJ0kvuEDx0emQfV0bb7FUNyHZULQKBZNiB:G0kvxd0g90DmtQKBeB
TLSH
T12048333370DBADBBC177C875A86685B651399DE51D220C2AF3B77C3518B0B88AB32345
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery execution persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	InstallerGUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	InstallerGUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WebConfigLoader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WebConfigLoader.exe

Executes dropped EXE 47 IoCs

pid	Process
820	MovaviVideoWI.exe
3800	InstallerGUI.exe
3376	crashpad_handler.exe
5368	CoreChecker.exe
1216	PluginChecker.exe
5668	PluginChecker.exe
5844	PluginChecker.exe
1512	PluginChecker.exe
4604	PluginChecker.exe
4872	PluginChecker.exe
5716	PluginChecker.exe
2868	PluginChecker.exe
3180	PluginChecker.exe
3204	PluginChecker.exe
4728	PluginChecker.exe
5796	PluginChecker.exe
6072	PluginChecker.exe
768	PluginChecker.exe
924	PluginChecker.exe
3180	PluginChecker.exe
1740	PluginChecker.exe
4308	PluginChecker.exe
3588	PluginChecker.exe
4124	PluginChecker.exe
3056	PluginChecker.exe
1428	PluginChecker.exe
2864	PluginChecker.exe
1932	PluginChecker.exe
4204	PluginChecker.exe
6132	PluginChecker.exe
1308	PluginChecker.exe
4804	PluginChecker.exe
5800	PluginChecker.exe
2616	PluginChecker.exe
4132	PluginChecker.exe
3556	PluginChecker.exe
4948	PluginChecker.exe
4268	PluginChecker.exe
5608	PluginChecker.exe
2700	PluginChecker.exe
896	WebConfigLoader.exe
2036	crashpad_handler.exe
2024	CodecChecker.exe
5588	CodecChecker.exe
2316	CodecChecker.exe
5412	CodecChecker.exe
4284	CodecChecker.exe

Loads dropped DLL 64 IoCs

pid	Process
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	InstallerGUI.exe
File opened for modification	\??\PhysicalDrive0	WebConfigLoader.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\FndDyLib.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\dll\powrprof.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\dll\NvidiaManager.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\dll\mpr.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\dll\DesktopNotification.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\FndTimeBoost.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\FndPointer.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\symbols\dll\CodecFactory.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\dll\dbghelp.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\symbols\dll\gdi32.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\ClientAPI.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\dll\CoreManager.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\exe\CodecChecker.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\symbols\dll\FndProperty.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\symbols\dll\cpr.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\symbols\dll\glu32.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\dll\FilterFactory.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\GeneralMovaviTrackerWrapper.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\CoreIntExt.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\Windows.Storage.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\dll\Windows.Storage.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\dll\Application.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\FndDataStore.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\dll\coml2.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\symbols\dll\FndException.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\dll\ColorUtils.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\CharsetRecode.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\glew32.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\IPCBaseProtocol.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\powrprof.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\dll\Qt5Widgets.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\ColorUtils.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\dll\CodecFactory.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\avcodec.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\dll\EncoderLossless.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\symbols\dll\mfperfhelper.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\FndException.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\symbols\dll\LUTInt.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\symbols\dll\MFWrapper.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\dll\Qt5Quick.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\DataHelpers.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\dll\ComputingResourceManager.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\crypt32.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\dll\MSAudDecMFTxHEAAC.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\symbols\dll\FndDataStore.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\sspicli.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\symbols\dll\FndString.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\dll\msvcp140.amd64.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\symbols\dll\msvcp140.amd64.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\symbols\dll\winhttp.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\apphelp.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\dll\ole32.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\symbols\dll\AppcoreTrackerWrapper.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\dll\ncryptsslp.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\msdmo.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\AppXDeploymentClient.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\dll\sspicli.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\Tracker.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\CodecChecker.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\dll\CoreLocalization.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\WINMMBASE.pdb	CodecChecker.exe
File opened for modification	C:\Windows\system32\FndOS.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\symbols\dll\dbghelp.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\system32\symbols\dll\PluginLoader.pdb	CodecChecker.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\symbols\dll\boost_locale-mt-x64.pdb	CodecChecker.exe
File opened for modification	C:\Windows\symbols\dll\AppcoreTrackerWrapper.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\DXCore.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\FndCrashHandler.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\dll\LUTInt.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\libcueify.pdb	CodecChecker.exe
File opened for modification	C:\Windows\shlwapi.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\dll\FndTime.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\dll\RegistrationDialog.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\symbols\dll\MediaTypes.pdb	CodecChecker.exe
File opened for modification	C:\Windows\crypt32.pdb	CodecChecker.exe
File opened for modification	C:\Windows\FndString.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\mpr.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\dbghelp.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\bcrypt.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\symbols\dll\AppLoggerBase.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\DLL\WMADMOD.pdb	CodecChecker.exe
File opened for modification	C:\Windows\NagScreen.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\DLL\winnsi.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\symbols\dll\Presets.pdb	CodecChecker.exe
File opened for modification	C:\Windows\dll\Kernel.Appcore.pdb	CodecChecker.exe
File opened for modification	C:\Windows\dll\MP4SDECD.pdb	CodecChecker.exe
File opened for modification	C:\Windows\symbols\DLL\vcomp140.amd64.pdb	CodecChecker.exe
File opened for modification	C:\Windows\symbols\dll\cryptsp.pdb	CodecChecker.exe
File opened for modification	C:\Windows\glu32.pdb	CodecChecker.exe
File opened for modification	C:\Windows\symbols\dll\EffectsMultiImpls.pdb	CodecChecker.exe
File opened for modification	C:\Windows\DecoderRAW.pdb	CodecChecker.exe
File opened for modification	C:\Windows\symbols\dll\CoreCheckerLauncher.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\dll\FndLogging.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\dll\Qt5Gui.pdb	CodecChecker.exe
File opened for modification	C:\Windows\ParserRAW.pdb	CodecChecker.exe
File opened for modification	C:\Windows\dll\Qt5Gui.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\symbols\dll\winmm.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\LUTInt.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\dll\comctl32v582.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\symbols\DLL\schannel.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\dll\powrprof.pdb	CodecChecker.exe
File opened for modification	C:\Windows\symbols\dll\propsys.pdb	CodecChecker.exe
File opened for modification	C:\Windows\dll\whisper.pdb	CodecChecker.exe
File opened for modification	C:\Windows\symbols\dll\CoreApp.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\vcruntime140_1.amd64.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\dll\Qt5Network.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\symbols\dll\Peer.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\symbols\dll\directxdatabasehelper.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\kernelbase.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\symbols\dll\msvcp140.amd64.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\dll\directxdatabasehelper.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\symbols\dll\ApplicationRegistry.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\ColorUtils.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\Policies.pdb	CodecChecker.exe
File opened for modification	C:\Windows\EffectsOgl.pdb	CodecChecker.exe
File opened for modification	C:\Windows\symbols\dll\IPCUtils.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\dll\wtsapi32.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\symbols\dll\comctl32v582.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\symbols\dll\ucrtbase.pdb	CodecChecker.exe
File opened for modification	C:\Windows\symbols\dll\version.pdb	CodecChecker.exe
File opened for modification	C:\Windows\symbols\dll\avfilter.pdb	CodecChecker.exe
File opened for modification	C:\Windows\symbols\dll\glew32.pdb	CodecChecker.exe
File opened for modification	C:\Windows\symbols\dll\WinTypes.pdb	CodecChecker.exe
File opened for modification	C:\Windows\wmvdecod.pdb	CodecChecker.exe
File opened for modification	C:\Windows\MuxerFF.pdb	CodecChecker.exe
File opened for modification	C:\Windows\imm32.pdb	InstallerGUI.exe
File opened for modification	C:\Windows\boost_thread-mt-x64.pdb	CodecChecker.exe
File opened for modification	C:\Windows\shcore.pdb	CodecChecker.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3940	powershell.exe
2160	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1236	cmd.exe
4500	cmd.exe
5832	cmd.exe
4176	cmd.exe
1476	cmd.exe
3484	cmd.exe
5444	cmd.exe
4740	cmd.exe
3736	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_558724595658fde7d7882190e8a7f5b0_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	CodecChecker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CodecChecker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CodecChecker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	CodecChecker.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepx	InstallerGUI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CcFWSettg.Category\CLSID\{8E78DB2C-19E1-044E-118A}\bqylltud = c69e76fea25dba8f6c4144af	InstallerGUI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CcFWSettg.Category\CLSID\{008A6387-6718-0527-9E19}\yfpsuftj = edd4595e1a733890d39fe6f1	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepj\DefaultIcon\	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepj\shell	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepx\shell\	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepb	InstallerGUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\.mepb\ = "Movavi Video Editor 25.edit_openwith.mepb"	InstallerGUI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CcFWSettg.Category\CLSID\{C7B3CE48-8BDA-3CFE-AC89}\fmxknjtp = ad20bedfc0d1401035719d51	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepj\shell\	InstallerGUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepx\shell\	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepx\shell\open\command\	InstallerGUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mpack\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\Movavi Video Editor 25\\VideoEditor.exe,0"	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mpack\shell\open	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\.mepj\	InstallerGUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CcFWSettg.Category\CLSID\{0F2E5205-D04A-439E-FE35}	WebConfigLoader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepx\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\Movavi Video Editor 25\\VideoEditor.exe,0"	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepx\shell	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepx\shell\open\command	InstallerGUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepb\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Movavi Video Editor 25\\VideoEditor.exe\" \"%1\""	InstallerGUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CcFWSettg.Category\CLSID\{008A6387-6718-0527-9E19}	WebConfigLoader.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{76C41D94-5798-4348-8F8B-E1AF9CBDB830}	CodecChecker.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{F4D3F739-D81F-4AF5-8636-8828E54AF54B}	CodecChecker.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{4D0DB1C8-EB42-4D86-86A5-8A49630AA0B1}	CodecChecker.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepj\shell\open\command	InstallerGUI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CcFWSettg.Category\CLSID\{008A6387-6718-0527-9E19}\yfpsuftj = 6d2bc65f80cf299075dca5f1	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepj\DefaultIcon	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepj\shell\open\command\	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepb\shell\	InstallerGUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepb\shell\	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepb\shell\open	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepb\shell\open\command	InstallerGUI.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{D7BBC0FC-6E73-46F9-9D55-8F0DEA014965}	PluginChecker.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepb\shell\open\command\	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mpack\shell	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mpack\shell\open\command\	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\.mpack\	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\videoeditorplus	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\videoeditorplus\shell	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\videoeditorplus\shell\open\command	InstallerGUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mpack\shell\	InstallerGUI.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{16BA050F-E6EB-42F1-80C5-8733ACC0AED3}	CodecChecker.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{A5291512-2308-4AEE-B5E0-866A125B811C}	CodecChecker.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepb\DefaultIcon\	InstallerGUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\.mpack\ = "Movavi Video Editor 25.edit_openwith.mpack"	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\videoeditorplus\DefaultIcon\	InstallerGUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\videoeditorplus\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Movavi Video Editor 25\\MovaviLinkHelper.exe\" \"%1\""	InstallerGUI.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{59FBA5C9-1A47-44AF-B6F3-0C3B0CE86A10}	CodecChecker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepj\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Movavi Video Editor 25\\VideoEditor.exe\" \"%1\""	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mepx\DefaultIcon\	InstallerGUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CcFWSettg.Category\CLSID\{0F2E5205-D04A-439E-FE35}	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\videoeditorplus\shell\open	InstallerGUI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CcFWSettg.Category\CLSID\{0F2E5205-D04A-439E-FE35}\oytkvumh = 26b9992ee28ce78f4c6cd2be	WebConfigLoader.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{56AF9C26-8303-4522-8943-E9F2D549AF01}	CodecChecker.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mpack	InstallerGUI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CcFWSettg.Category\CLSID\{0F2E5205-D04A-439E-FE35}\oytkvumh = b65d0d4a8030b76f4a537626	InstallerGUI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CcFWSettg.Category\CLSID\{008A6387-6718-0527-9E19}\yfpsuftj = edd455e000d3271ef503364e	WebConfigLoader.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{995A7696-B516-4186-97F4-DF128EEF2D90}	CodecChecker.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{918965CD-1684-4C48-834C-3BC67872D624}	CodecChecker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CcFWSettg.Category	InstallerGUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CcFWSettg.Category\CLSID	InstallerGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Movavi Video Editor 25.edit_openwith.mpack\DefaultIcon	InstallerGUI.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{B1922810-CFCF-4BD5-81F4-E2667F0A6479}	CoreChecker.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{BA4F0B90-855E-4F57-B166-B76B53FDC0E6}	CodecChecker.exe

Suspicious behavior: AddClipboardFormatListener 7 IoCs

pid	Process
3800	InstallerGUI.exe
1216	PluginChecker.exe
2024	CodecChecker.exe
5588	CodecChecker.exe
2316	CodecChecker.exe
4284	CodecChecker.exe
5412	CodecChecker.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3940	powershell.exe
3940	powershell.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
3800	InstallerGUI.exe
896	WebConfigLoader.exe
896	WebConfigLoader.exe
1220	wmic.exe
1220	wmic.exe
1220	wmic.exe
1220	wmic.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeIncreaseQuotaPrivilege	1220	wmic.exe
Token: SeSecurityPrivilege	1220	wmic.exe
Token: SeTakeOwnershipPrivilege	1220	wmic.exe
Token: SeLoadDriverPrivilege	1220	wmic.exe
Token: SeSystemProfilePrivilege	1220	wmic.exe
Token: SeSystemtimePrivilege	1220	wmic.exe
Token: SeProfSingleProcessPrivilege	1220	wmic.exe
Token: SeIncBasePriorityPrivilege	1220	wmic.exe
Token: SeCreatePagefilePrivilege	1220	wmic.exe
Token: SeBackupPrivilege	1220	wmic.exe
Token: SeRestorePrivilege	1220	wmic.exe
Token: SeShutdownPrivilege	1220	wmic.exe
Token: SeDebugPrivilege	1220	wmic.exe
Token: SeSystemEnvironmentPrivilege	1220	wmic.exe
Token: SeRemoteShutdownPrivilege	1220	wmic.exe
Token: SeUndockPrivilege	1220	wmic.exe
Token: SeManageVolumePrivilege	1220	wmic.exe
Token: 33	1220	wmic.exe
Token: 34	1220	wmic.exe
Token: 35	1220	wmic.exe
Token: 36	1220	wmic.exe
Token: SeIncreaseQuotaPrivilege	1220	wmic.exe
Token: SeSecurityPrivilege	1220	wmic.exe
Token: SeTakeOwnershipPrivilege	1220	wmic.exe
Token: SeLoadDriverPrivilege	1220	wmic.exe
Token: SeSystemProfilePrivilege	1220	wmic.exe
Token: SeSystemtimePrivilege	1220	wmic.exe
Token: SeProfSingleProcessPrivilege	1220	wmic.exe
Token: SeIncBasePriorityPrivilege	1220	wmic.exe
Token: SeCreatePagefilePrivilege	1220	wmic.exe
Token: SeBackupPrivilege	1220	wmic.exe
Token: SeRestorePrivilege	1220	wmic.exe
Token: SeShutdownPrivilege	1220	wmic.exe
Token: SeDebugPrivilege	1220	wmic.exe
Token: SeSystemEnvironmentPrivilege	1220	wmic.exe
Token: SeRemoteShutdownPrivilege	1220	wmic.exe
Token: SeUndockPrivilege	1220	wmic.exe
Token: SeManageVolumePrivilege	1220	wmic.exe
Token: 33	1220	wmic.exe
Token: 34	1220	wmic.exe
Token: 35	1220	wmic.exe
Token: 36	1220	wmic.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3836	2026-08-10_558724595658fde7d7882190e8a7f5b0_elex_wannacry.exe
3940	powershell.exe
3940	powershell.exe
3940	powershell.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3940	powershell.exe
3940	powershell.exe
3940	powershell.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3800	InstallerGUI.exe
1216	PluginChecker.exe
2024	CodecChecker.exe
5588	CodecChecker.exe
2316	CodecChecker.exe
4284	CodecChecker.exe
5412	CodecChecker.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 4500	3836	2026-08-10_558724595658fde7d7882190e8a7f5b0_elex_wannacry.exe	89
PID 4500 wrote to memory of 3940	4500	cmd.exe	91
PID 3836 wrote to memory of 820	3836	2026-08-10_558724595658fde7d7882190e8a7f5b0_elex_wannacry.exe	93
PID 820 wrote to memory of 3800	820	MovaviVideoWI.exe	94
PID 3800 wrote to memory of 3376	3800	InstallerGUI.exe	95
PID 3800 wrote to memory of 5368	3800	InstallerGUI.exe	96
PID 5368 wrote to memory of 1216	5368	CoreChecker.exe	98
PID 5368 wrote to memory of 5668	5368	CoreChecker.exe	100
PID 5368 wrote to memory of 5844	5368	CoreChecker.exe	102
PID 5368 wrote to memory of 1512	5368	CoreChecker.exe	104
PID 5368 wrote to memory of 4604	5368	CoreChecker.exe	139
PID 5368 wrote to memory of 4872	5368	CoreChecker.exe	108
PID 5368 wrote to memory of 5716	5368	CoreChecker.exe	110
PID 5368 wrote to memory of 2868	5368	CoreChecker.exe	112
PID 5368 wrote to memory of 3180	5368	CoreChecker.exe	128
PID 5368 wrote to memory of 3204	5368	CoreChecker.exe	116
PID 5368 wrote to memory of 4728	5368	CoreChecker.exe	118
PID 5368 wrote to memory of 5796	5368	CoreChecker.exe	135
PID 5368 wrote to memory of 6072	5368	CoreChecker.exe	122
PID 5368 wrote to memory of 768	5368	CoreChecker.exe	124
PID 5368 wrote to memory of 924	5368	CoreChecker.exe	126
PID 5368 wrote to memory of 3180	5368	CoreChecker.exe	128
PID 5368 wrote to memory of 1740	5368	CoreChecker.exe	130
PID 5368 wrote to memory of 4308	5368	CoreChecker.exe	132
PID 5368 wrote to memory of 3588	5368	CoreChecker.exe	134
PID 5368 wrote to memory of 4124	5368	CoreChecker.exe	136
PID 5368 wrote to memory of 3056	5368	CoreChecker.exe	138
PID 5368 wrote to memory of 1428	5368	CoreChecker.exe	140
PID 5368 wrote to memory of 2864	5368	CoreChecker.exe	142
PID 5368 wrote to memory of 1932	5368	CoreChecker.exe	144
PID 5368 wrote to memory of 4204	5368	CoreChecker.exe	146
PID 5368 wrote to memory of 6132	5368	CoreChecker.exe	148
PID 5368 wrote to memory of 1308	5368	CoreChecker.exe	150
PID 5368 wrote to memory of 4804	5368	CoreChecker.exe	152
PID 5368 wrote to memory of 5800	5368	CoreChecker.exe	154
PID 5368 wrote to memory of 2616	5368	CoreChecker.exe	156
PID 5368 wrote to memory of 4132	5368	CoreChecker.exe	158
PID 5368 wrote to memory of 3556	5368	CoreChecker.exe	160
PID 5368 wrote to memory of 4948	5368	CoreChecker.exe	162
PID 5368 wrote to memory of 4268	5368	CoreChecker.exe	164
PID 5368 wrote to memory of 5608	5368	CoreChecker.exe	166
PID 5368 wrote to memory of 2700	5368	CoreChecker.exe	169
PID 3800 wrote to memory of 896	3800	InstallerGUI.exe	168
PID 896 wrote to memory of 2036	896	WebConfigLoader.exe	172
PID 5368 wrote to memory of 5588	5368	CoreChecker.exe	174
PID 5368 wrote to memory of 2024	5368	CoreChecker.exe	173
PID 5368 wrote to memory of 2316	5368	CoreChecker.exe	175
PID 896 wrote to memory of 1220	896	WebConfigLoader.exe	179
PID 5368 wrote to memory of 5412	5368	CoreChecker.exe	181
PID 5368 wrote to memory of 4284	5368	CoreChecker.exe	182
PID 3836 wrote to memory of 5832	3836	2026-08-10_558724595658fde7d7882190e8a7f5b0_elex_wannacry.exe	186
PID 3836 wrote to memory of 4176	3836	2026-08-10_558724595658fde7d7882190e8a7f5b0_elex_wannacry.exe	188
PID 3836 wrote to memory of 1476	3836	2026-08-10_558724595658fde7d7882190e8a7f5b0_elex_wannacry.exe	190
PID 3836 wrote to memory of 3484	3836	2026-08-10_558724595658fde7d7882190e8a7f5b0_elex_wannacry.exe	192
PID 3836 wrote to memory of 1236	3836	2026-08-10_558724595658fde7d7882190e8a7f5b0_elex_wannacry.exe	194
PID 3836 wrote to memory of 5444	3836	2026-08-10_558724595658fde7d7882190e8a7f5b0_elex_wannacry.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-10_558724595658fde7d7882190e8a7f5b0_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_558724595658fde7d7882190e8a7f5b0_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if exist "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ( powershell -command "Add-Type -AssemblyName System.Windows.Forms;$NotifyIcon = New-Object System.Windows.Forms.NotifyIcon;$NotifyIcon.Icon = [System.Drawing.SystemIcons]::Warning;$NotifyIcon.BalloonTipTitle = 'Silentall Katılımsız Yükleyici'; $NotifyIcon.BalloonTipText = 'Program Yükleniyor !';$NotifyIcon.Visible = $true; $NotifyIcon.ShowBalloonTip(5000); Start-Sleep -Seconds 5; $NotifyIcon.Dispose()" )
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Add-Type -AssemblyName System.Windows.Forms;$NotifyIcon = New-Object System.Windows.Forms.NotifyIcon;$NotifyIcon.Icon = [System.Drawing.SystemIcons]::Warning;$NotifyIcon.BalloonTipTitle = 'Silentall Katılımsız Yükleyici'; $NotifyIcon.BalloonTipText = 'Program Yükleniyor !';$NotifyIcon.Visible = $true; $NotifyIcon.ShowBalloonTip(5000); Start-Sleep -Seconds 5; $NotifyIcon.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3940
- C:\ProgramData\xlwgwbv\MovaviVideoWI.exe
  "C:\ProgramData\xlwgwbv\MovaviVideoWI.exe" /S
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\InstallerGUI.exe
    C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\InstallerGUI.exe "--distrib-name=C:\ProgramData\xlwgwbv\MovaviVideoWI.exe" "/S" "--extractor-start=621273" "--installer-create-process=625351"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\crashpad_handler.exe
      C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\Movavi\Sentry\videoeditorplus\25.9.0\installer\0.7.2 --metrics-dir=C:\Users\Admin\AppData\Local\Movavi\Sentry\videoeditorplus\25.9.0\installer\0.7.2 --url=https://o474997.ingest.sentry.io:443/api/4504371526893568/minidump/?sentry_client=sentry.native/0.7.2&sentry_key=6af15c149d2cb5c537e5701aea72fdb4 --attachment=C:\Users\Admin\AppData\Local\Movavi\Sentry\videoeditorplus\25.9.0\installer\0.7.2\1364550e-7252-4b8d-12f1-04cc80e0cab5.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\Movavi\Sentry\videoeditorplus\25.9.0\installer\0.7.2\1364550e-7252-4b8d-12f1-04cc80e0cab5.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\Movavi\Sentry\videoeditorplus\25.9.0\installer\0.7.2\1364550e-7252-4b8d-12f1-04cc80e0cab5.run\__sentry-breadcrumb2 --initial-client-data=0x428,0x42c,0x430,0x404,0x434,0x7ff8dbe80018,0x7ff8dbe80030,0x7ff8dbe80048
      4⤵
      Executes dropped EXE
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CoreChecker.exe
      "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CoreChecker.exe" all "QSV, MEDIA_FOUNDATION_IMPL, VIDEO_TOOLBOX_HW_IMPL, VIDEO_TOOLBOX_SW_IMPL, AUDIO_TOOLBOX, NVENC, NVDEC, AMF, DIRECTX_IMPL" "CODEC_ID_AAC, CODEC_ID_AC3, CODEC_ID_H264, CODEC_ID_H265, CODEC_ID_WMV3" 60 15
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" OglManager OglManager
        5⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" FiltersFF AlgorithmFactory
        5⤵
        Executes dropped EXE
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" DecodersFF CodecFactory
        5⤵
        Executes dropped EXE
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" EncodersFF CodecFactory
        5⤵
        Executes dropped EXE
        
        PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" EncoderLossless CodecFactory
        5⤵
        Executes dropped EXE
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" EncoderNVENC CodecFactory
        5⤵
        Executes dropped EXE
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" DecoderNVDEC CodecFactory
        5⤵
        Executes dropped EXE
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" EncoderAMF CodecFactory
        5⤵
        Executes dropped EXE
        
        PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" EncoderQSV CodecFactory
        5⤵
        Executes dropped EXE
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" DecoderMF CodecFactory
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" EncoderMF CodecFactory
        5⤵
        Executes dropped EXE
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" EncoderDX CodecFactory
        5⤵
        Executes dropped EXE
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" DecoderRAW CodecFactory
        5⤵
        Executes dropped EXE
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" Effects EffectFactory
        5⤵
        Executes dropped EXE
        
        PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" EffectsFF EffectFactory
        5⤵
        Executes dropped EXE
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" EffectsOgl EffectFactory
        5⤵
        Executes dropped EXE
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" VideoInterop EffectFactory
        5⤵
        Executes dropped EXE
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" EffectsOnnxRT EffectFactory
        5⤵
        Executes dropped EXE
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" EffectsMultiImpls EffectFactory
        5⤵
        Executes dropped EXE
        
        PID:3588
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" Filters FilterFactory
        5⤵
        Executes dropped EXE
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" FiltersFF FilterFactory
        5⤵
        Executes dropped EXE
        
        PID:3056
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" FiltersOgl FilterFactory
        5⤵
        Executes dropped EXE
        
        PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" FiltersSpeex FilterFactory
        5⤵
        Executes dropped EXE
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" FiltersOnnxRT FilterFactory
        5⤵
        Executes dropped EXE
        
        PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" AnalyzerAudio AnalyzerFactory
        5⤵
        Executes dropped EXE
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" AnalyzerVideoOpenCV AnalyzerFactory
        5⤵
        Executes dropped EXE
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" AnalyzerVideoOnnxRT AnalyzerFactory
        5⤵
        Executes dropped EXE
        
        PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" AnalyzerSpeechToText AnalyzerFactory
        5⤵
        Executes dropped EXE
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" AnalyzerSilenceDetector AnalyzerFactory
        5⤵
        Executes dropped EXE
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" MuxerFF MuxerFactory
        5⤵
        Executes dropped EXE
        
        PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" MuxerHEIF MuxerFactory
        5⤵
        Executes dropped EXE
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" MuxerNetworkAPI MuxerFactory
        5⤵
        Executes dropped EXE
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" ParserFF ParserFactory
        5⤵
        Executes dropped EXE
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" ParserHEIF ParserFactory
        5⤵
        Executes dropped EXE
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" ParserRAW ParserFactory
        5⤵
        Executes dropped EXE
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\PluginChecker.exe" ParserCD ParserFactory
        5⤵
        Executes dropped EXE
        
        PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CodecChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CodecChecker.exe" 15 DECODER MEDIA_FOUNDATION_IMPL CODEC_ID_WMV3 ""
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Modifies registry class
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CodecChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CodecChecker.exe" 15 DECODER MEDIA_FOUNDATION_IMPL CODEC_ID_AAC ""
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CodecChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CodecChecker.exe" 15 DECODER MEDIA_FOUNDATION_IMPL CODEC_ID_H264 ""
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CodecChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CodecChecker.exe" 15 ENCODER MEDIA_FOUNDATION_IMPL CODEC_ID_AAC ""
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CodecChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CodecChecker.exe" 15 ENCODER MEDIA_FOUNDATION_IMPL CODEC_ID_H264 ""
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:4284
  - - C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\WebConfigLoader.exe
      "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\WebConfigLoader.exe" --send_statistics=1 --timeout=20000 --sid=260810-182606-319991
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:896
    - - C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\crashpad_handler.exe
        
        "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Local\Movavi\Sentry\videoeditorplus\25.9.0\0.7.2 --metrics-dir=C:\Users\Admin\AppData\Local\Movavi\Sentry\videoeditorplus\25.9.0\0.7.2 --url=https://o474997.ingest.us.sentry.io:443/api/6722881/minidump/?sentry_client=sentry.native/0.7.2&sentry_key=d9bdb62dd8e918e0af590c83a54779de --attachment=C:\Users\Admin\AppData\Local\Movavi\Sentry\videoeditorplus\25.9.0\0.7.2\8e60e1c4-1d43-42ff-d325-e915bc78b61d.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\Movavi\Sentry\videoeditorplus\25.9.0\0.7.2\8e60e1c4-1d43-42ff-d325-e915bc78b61d.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\Movavi\Sentry\videoeditorplus\25.9.0\0.7.2\8e60e1c4-1d43-42ff-d325-e915bc78b61d.run\__sentry-breadcrumb2 --initial-client-data=0x42c,0x430,0x434,0x408,0x438,0x7ff8c9cd0018,0x7ff8c9cd0030,0x7ff8c9cd0048
        5⤵
        Executes dropped EXE
        
        PID:2036
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic computersystem get ChassisSKUNumber,Manufacturer,Model,SystemFamily
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if exist "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\VideoEditor.exe" ( if not exist "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25" mkdir "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25" )
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if exist "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\VideoEditor.exe" ( if exist "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25" copy /y "C:\ProgramData\xlwgwbv\x64\AppActivation.dll" "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25" )
  2⤵
  - Executes a command shell one-liner
  PID:4176
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if exist "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\VideoEditor.exe" ( if not exist "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25" mkdir "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25" )
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if exist "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\VideoEditor.exe" ( if exist "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25" copy /y "C:\ProgramData\xlwgwbv\x64\EditorAppLogic.dll" "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25" )
  2⤵
  - Executes a command shell one-liner
  PID:3484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if exist "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\VideoEditor.exe" ( if not exist "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25" mkdir "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25" )
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if exist "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\VideoEditor.exe" ( if exist "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25" copy /y "C:\ProgramData\xlwgwbv\x64\EditorAppUtil.dll" "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25" )
  2⤵
  - Executes a command shell one-liner
  PID:5444
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if exist "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\VideoEditor.exe" ( if exist "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -command "Add-Type -AssemblyName System.Windows.Forms;$NotifyIcon = New-Object System.Windows.Forms.NotifyIcon;$NotifyIcon.Icon = [System.Drawing.SystemIcons]::Information;$NotifyIcon.BalloonTipTitle = 'Silentall Katılımsız Yükleyici'; $NotifyIcon.BalloonTipText = 'Kurulum Tamamlandı !';$NotifyIcon.Visible = $true; $NotifyIcon.ShowBalloonTip(5000); Start-Sleep -Seconds 5; $NotifyIcon.Dispose()" )
  2⤵
  - Executes a command shell one-liner
  PID:4740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Add-Type -AssemblyName System.Windows.Forms;$NotifyIcon = New-Object System.Windows.Forms.NotifyIcon;$NotifyIcon.Icon = [System.Drawing.SystemIcons]::Information;$NotifyIcon.BalloonTipTitle = 'Silentall Katılımsız Yükleyici'; $NotifyIcon.BalloonTipText = 'Kurulum Tamamlandı !';$NotifyIcon.Visible = $true; $NotifyIcon.ShowBalloonTip(5000); Start-Sleep -Seconds 5; $NotifyIcon.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if not exist "C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\VideoEditor.exe" ( if exist "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -command "Add-Type -AssemblyName System.Windows.Forms;$NotifyIcon = New-Object System.Windows.Forms.NotifyIcon;$NotifyIcon.Icon = [System.Drawing.SystemIcons]::Error;$NotifyIcon.BalloonTipTitle = 'Silentall Katılımsız Yükleyici'; $NotifyIcon.BalloonTipText = 'Kurulum Tamamlanamadı !';$NotifyIcon.Visible = $true; $NotifyIcon.ShowBalloonTip(5000); Start-Sleep -Seconds 5; $NotifyIcon.Dispose()" )
  2⤵
  - Executes a command shell one-liner
  PID:3736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__sentry-event

Path C:\Users\Admin\AppData\Local\Movavi\Sentry\videoeditorplus\25.9.0\0.7.2\8e60e1c4-1d43-42ff-d325-e915bc78b61d.run\__sentry-event
Size 471B
SHA256 d4538b338131ba728bca5b6d60a03a3e8da2a45309a5ceb26fdbf2c62c0d2761
MD5 6cb0c31e070fea6c46ae5c7a721f9ac0
SHA1 2ce4765a0b866f36a8ce3f0b63812ca78ecb01d2
SHA512 37c4f15a9cf7d662dc55c381fab9f69e1f3ad940039333ad01482f788763f805113f4cdab2a92f30891565dddaea34b96d50e2d33749c5b2c5129f65cf4c2564
TLSH
T1A3F0DCE341B0C31369131F07B4396281EB369E1A85801A0778908142CBC0E475B0A1A4
MD5 SHA1 SHA512 TLSH

Submit Download

__sentry-breadcrumb1

Path C:\Users\Admin\AppData\Local\Movavi\Sentry\videoeditorplus\25.9.0\installer\0.7.2\1364550e-7252-4b8d-12f1-04cc80e0cab5.run\__sentry-breadcrumb1
Size 2KB
SHA256 1e658bffd18e28779e8ae272aa7e47833777b55c91b9145388e048abbc0cb601
MD5 79895c36c68fb1c7b44d5d292a4749b4
SHA1 cbfa12bc6d43254d77e5400063f7d481eaa421f9
SHA512 ecba745955818970bfb1990eb20f5d7534fe493930e3f21f89263373d02639b077811a81a8c18cd4e6b1688444d0576ddc5e82d8d2d575bbb9824488e3e73aa2
TLSH
T158515BFA4C6D28870613E1CBA4CAA58503E2B1772A67BC933263C73841912C51DF1F6D
MD5 SHA1 SHA512 TLSH

Submit Download

__sentry-breadcrumb1

Path C:\Users\Admin\AppData\Local\Movavi\Sentry\videoeditorplus\25.9.0\installer\0.7.2\1364550e-7252-4b8d-12f1-04cc80e0cab5.run\__sentry-breadcrumb1
Size 5KB
SHA256 b122533880442a18a36482a69d6203e052645921e355e982ed652ef0e291c141
MD5 439b810bdd42b58f5ae6598714231af2
SHA1 488eda1944ff3e027b5962d160d09c7b4dfc17f4
SHA512 d6858dd05843e7a92e8887b9a1763c0676e49b2ed5a2c298afdf5c69bb3defdae81e0becabad90f34952dfbc7724ad31c68f98368773013a493a257e90737320
SSDEEP 96:rM2l38RWmigtvuTTggTVhOhUnQRnbR6hOnKhlnUW+WdN/gZ:nlMNigYTsZR0N/gZ
TLSH
T188B1A4F68C5D698B15039086E1CAA6C507E2A17B39E7BC937263CB7802812C51DF6F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3827883041287570.json

Path C:\Users\Admin\AppData\Local\Movavi\videoeditorplus25\EventsStorage\3827883041287570.json
Size 1KB
SHA256 a994fe59aedf2669298d8eef4117eb9082c399cf8574bed4d700db77f97c8ecb
MD5 3f258c3f45c39fdaa890eb772d3a9e3f
SHA1 d4ddb306471ef0cadc7d664c6f6ccc4d05f65443
SHA512 34a4ff58e19d717afd56d73b45a46c73cca7472341720cc79b6a054de43b8bc2ebf92827d6d4234cf61a08f436a9acfaf6a61d3ad1ccc19222e980b8163c69a0
TLSH
T1EE11C0E1DE813D18DAB080453621597B2C6DB144168B1F84E3DE7918B66C881AF236F0
MD5 SHA1 SHA512 TLSH

Submit Download

3827883052288561.json

Path C:\Users\Admin\AppData\Local\Movavi\videoeditorplus25\EventsStorage\3827883052288561.json
Size 907B
SHA256 a490bc04b89f7aed055095321749d06a7748e953a7719afb69a189fd5f7bd82a
MD5 2f19c2ce8c602696f19667cd607c7e85
SHA1 11a6397ee1ce1f1b6b1fc985c1302d626106572b
SHA512 34224873ee33889d0fdbe444a3b80ce518551bd4caa3b52abaea35d034a7928511c0f37a97bd7eb607677601fdc51b0e878363080b248b785d18312e21bddbe1
TLSH
T1AD1104E1CEC03D18DB70409436319A771C2D758A16CA5F84E7EB7848B29DCC1CF26A74
MD5 SHA1 SHA512 TLSH

Submit Download

3827883159867552.json

Path C:\Users\Admin\AppData\Local\Movavi\videoeditorplus25\EventsStorage\3827883159867552.json
Size 952B
SHA256 6f3fb12f6f8bf83a691c7f325fdcace5a602b2d5f80121332368dfb7dd29cb79
MD5 82786abcc38513d73bcae24ab7d88e4d
SHA1 abcc281cf82d5b723971b5ea819798921401088a
SHA512 adcfd679406cf4cbc5b80e73d99c23d1184cf14b50550929c8b3157e4ac75b9b11abddeab2148a9b15a4f765812938da2f4e1f8a0bbb159433cfba992be52184
TLSH
T17C1114E5CDC13D18DB6180953631AB761C6D364703C91B94D6EA7854F298CC1CF26A78
MD5 SHA1 SHA512 TLSH

Submit Download

3827883266717943.json

Path C:\Users\Admin\AppData\Local\Movavi\videoeditorplus25\EventsStorage\3827883266717943.json
Size 950B
SHA256 36fdd0f831cc204a42ec5d8c67fe28cd351e5ce50a32c8f0652df876c1d89f4f
MD5 a4dda37565e1eeb42bd9540ac584b57b
SHA1 52109ec40b130ac82f075bc37b3f7e626ddc8904
SHA512 b5bc7c35315e48f8f381575cbf4836238748891e2cf93dd20328a6958afb8c65bf22b049cd30b583966131bde23412db7f0d3a9d7bc505fc5c642c54627992a8
TLSH
T1C51154E4C9C17D188BA580853230BF720C6E364903DA5B44D2EA2814B29CCC1CF32A78
MD5 SHA1 SHA512 TLSH

Submit Download

3828074876522904.json

Path C:\Users\Admin\AppData\Local\Movavi\videoeditorplus25\EventsStorage\3828074876522904.json
Size 952B
SHA256 329f98376e3a921c777cca0b25a63b1a071eea5580c855387a0bb6cb9407fb47
MD5 cddf27b55530ae14cf86fed2aa269a36
SHA1 dce053fb19a5507e0f35d61be8ec4341b7d78d56
SHA512 5d826bc46ca9435a56be351e6bbf6e22a7e58675478a0cce8eceb3dfd10989724e99d8b8205f879e9d60df0c98212b05e2c08260e7db07c74d240c0209b06b14
TLSH
T1E71154D0D8827D18CFE540943530BE620C6E624A139B5E85D6EE2814724CCD1CF32A74
MD5 SHA1 SHA512 TLSH

Submit Download

3828075745041615.json

Path C:\Users\Admin\AppData\Local\Movavi\videoeditorplus25\EventsStorage\3828075745041615.json
Size 919B
SHA256 5b0016b7ffd348985c22d9afe6a0d43112aecc95a599e687249684cc12f4d3c1
MD5 aff8b8d7e6de70a93b211ab69d7b302f
SHA1 616678789bcc168f8dd9372e70a402fcad0db183
SHA512 ee9389e976829f4fa00466abcaca7630e3af5813c19329fb578044f6126d1eaa7849e4142b0a85dc4815e9f3c9171108e859628d55a21902159691ff9305d65c
TLSH
T1461110E0C9C17D28CFA480953570AEB21D6E6146138B5E85D6DA7854B29CCC18F27A74
MD5 SHA1 SHA512 TLSH

Submit Download

3828075751851926.json

Path C:\Users\Admin\AppData\Local\Movavi\videoeditorplus25\EventsStorage\3828075751851926.json
Size 951B
SHA256 bb7776ede4d4684284e8cf206b7915ef6ad3b8eb41cd13392bf4592d3dd79693
MD5 81cafb7f624047a474342caa6f0b498e
SHA1 a757e47ff2658da1732a1131f38616441a8a6cdc
SHA512 34d0425341f5669f553d531f0645fcc3083d3abb760c62bab875f57192b93fbc516fcc3fdb406a3dc64df84b536796b629a6d681467ee745ff701e16773ba1bf
TLSH
T1B41154D0D9C17D28CBA580842970AE721C6E224603CB1FC4D2D97954F19CCC1CF27674
MD5 SHA1 SHA512 TLSH

Submit Download

3828189314659807.json

Path C:\Users\Admin\AppData\Local\Movavi\videoeditorplus25\EventsStorage\3828189314659807.json
Size 943B
SHA256 b0f47eeff8e0515d833dfc592488c525393f3c75adae87ab0d643bf5a646788e
MD5 ee29b4dced0907d8d093456dc9d2f80f
SHA1 ac32110d8332c30a2194f9be3fdaea659dd2ca2f
SHA512 fc5ac5e7beb0dd2baa10cf8cbf49ab025398a51714b6bf99f99439510c23d39e01ead6ef69a2ddd62f7e50d0e860b7c556f6645676eb4994ca92dfc7767835de
TLSH
T1171110D1CDC17D19CFE140943A31AA661C6E664A03CA1A84D6DB6454B29CCC2CF33AB5
MD5 SHA1 SHA512 TLSH

Submit Download

3828189322066998.json

Path C:\Users\Admin\AppData\Local\Movavi\videoeditorplus25\EventsStorage\3828189322066998.json
Size 918B
SHA256 74fdfd5b9d3d6b55b22849850b66374f05ba7d344a7a6b56ff5e650630002624
MD5 22470b8f65580383c3c6c6fd40191793
SHA1 c7a2d7e83839d01f555b2faaaeac721662ca1e18
SHA512 1a385b64c041d7f18b4059b206800e7e805e14d413bb3c48f13b0f95df0a8551a2ed1bef5d698ecc80feb033e2393b2534d3e4dc2fa1050a8eb0c277dd95c761
TLSH
T1711110D1CDC07E28CFA050982A319A761D3EA649038A5E9896DB7858B2DCCC18F229B4
MD5 SHA1 SHA512 TLSH

Submit Download

Application.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\Application.dll
Size 4.4MB
SHA256 990d423fa835b251ba78325ee410053b7906c7bd97f1de0cedd8fd6f9a68771a
MD5 f693de8a0fecd346b39a7b9c832ce0c4
SHA1 5365107066682e3737116399b6f98cbd53815134
SHA512 8a7e5896f2ae365aba89cb2439631cfcdc05691b094bb8880d84cb46807b3e538008aabf6db4fd82109e4526b51a44881fa5670ec62498ccd9a1901397d44564
SSDEEP 49152:gtkKMZ2YBTFqnD/0zntjjx2iuoFt7J30S9sYT6FdHPfUwu6flwu+99999999999U:ZzdsoXN5ZMVUwu8lwu6CvkI
TLSH
T19226E15BB99C4088F1B782BECFC78E42D672701A0711DEDB06D5869E1E1BED84ABD710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApplicationRegistry.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\ApplicationRegistry.dll
Size 325KB
SHA256 a0e6785ef0843107064a5dd2c45425e3a81a8e0f2087c3b0b7d039037fc0ea9d
MD5 23fde851f2fd99ee8c4fdabc289cb7ff
SHA1 23520da9038b24f449fe3c9583d6c07dbec53450
SHA512 5a3e7c1e1627f435201afdcf780b77b571f5e8608e497d67199cc39828f2359b2b18e54f3588fbad7cdb100786026f5e1a5828cc65fdcb9e5025b6ce96a667b8
SSDEEP 6144:ddBElyUqXDd2hXki5CNupvbqtYWnJXhRb:drEsUqXp2Jki6HFhRb
TLSH
T1C264194F72184C99F577D1BDC6CB8E06EA7338464701D7CB06D1839E2E67ED899BA220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreApp.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CoreApp.dll
Size 732KB
SHA256 11c18024953bd46f53373abb3914759ffd34d41eb5db19200e72a181a0fb90bc
MD5 f3559cade4c620652eab1ef15c355246
SHA1 745ef8caaf3c63fe1be91386fa25d71e56c4c4aa
SHA512 ca02fb49bde008c508fd79ead2be765ee640e2804913cc58ffefc3960ec0e561bfe71de04abc0a41dba8fe91ed9655a18d692b84787fd79e14870c17f337268d
SSDEEP 12288:iyEzkivrfch2KGMAmwMd1KIhqTWgP84TC6:inXjfch2qXPKyqT7ky
TLSH
T106F4195B36980199E07B927CDAC34A16E6B774454312DBCB039183BE1F57BD89BBE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreCheckerLauncher.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CoreCheckerLauncher.dll
Size 339KB
SHA256 c2bff5c22bf2646dce1d0de1a54ed995274358174fdf836d0d656bff42b95eac
MD5 22bf1cd4dda4b7bb5a472b030f6ed43e
SHA1 c9555dc82830775d869a924c859d6c3e97536664
SHA512 0975bf050a7fc8c38f7b66fd46bbf808d11b74458e4c9766891c4006eb5b6d5135e784420c6251cdb3eeff6171e028ea223aeb3fa49d6f1e74596212f4142636
SSDEEP 3072:izWaAP/NWa8gGntyMvlygW+j6ipa4VKItcgpa0VMQXKjhDnoYgkuK8r2THZkPQqI:GWrP/f8Rle+jz0ItHK9JgbPr2THZK+
TLSH
T1B774074F72484C45F67B917DCAC7CA02E6B239528712E7CB16D5834E2F1BFD8897A221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashHandlerInitializer.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\CrashHandlerInitializer.dll
Size 184KB
SHA256 6b72993d9da61b8bb3709976249242cb2556a0099fecf4eed37afd2caba4160f
MD5 100e066eb2c94eec1abad4b2d438a097
SHA1 80e24e94098a4637708f70aa0c018071942a5d26
SHA512 2c28de6ae2aeef958ef24efa640311febcee9a0d4c17d6e289df789e4187feefd471e0bc1a4423458d408f5f433d8c1872454e09f531c7acae115751e4f194c7
SSDEEP 3072:ZoSGRU/fa7BxhUb6lJE4wq8g1HR0d8b8R8vWPAkBEvWop5wpiLeC/:ZcRU/i77B8g1Hpbk8MD+vWop5wp1C/
TLSH
T1B204284B36494069E17BE1BDCAC74E47F272344647119BCF069183BE1F27BC8ADBA660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FndAppLocations.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\FndAppLocations.dll
Size 46KB
SHA256 e910164c76dadb7ea760e6de01cffb2f10d523915e486511c6ea43ba57d17a0a
MD5 bf8ad373e4b5b52f26e59ddce726b43f
SHA1 f5f9e74fe8faa588ccfe942eee452bd7804b97c5
SHA512 ec0990191334896f0a96f33e26963c9bc3b507529fce08ad6687090a802b6522ec649b30a81e88d0f7624f0f54516770e6d37e2eb265dc1a8d91676e82519e2e
SSDEEP 768:ecB/jcDwBoZsUrkUWSKDsWi13nUWkyEsZJNUY/T6ElDFwI5ALh:r1MwBmsUrCSKU3UW1ExwTnG
TLSH
T1DC234B8F734580A9E937E17CD5AA0F87E5377195470193CB13A4428D0F62BC9ADBE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FndCrashHandler.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\FndCrashHandler.dll
Size 680KB
SHA256 9e40bb10b67978383456c6fa38b36b0595c8191873b2a33e743577279cc55c1b
MD5 6942f6eeaf82a3ed0dfb371fb2f6ef74
SHA1 23afe6d31b62b66cd6eb0384294c0680d744d633
SHA512 98ef9be026611761c1b3a6af217e7d2a5d556aabfe8bd4724871e98601ac1cd85cfe5564caf57b75a8c1815bc78bebe6c4d90545c1e672ad0ca6e230c891d69a
SSDEEP 12288:SFSBBlohYmkIix4TZm3+QMfoyZCr0arMBdZd:SFSBloxO4TZmOQvyZCAarMnj
TLSH
T10BE44B5E366801A9E17BC17DCA938A07E6B334064361D7CB07D183AA5F67ADC5B3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FndDyLib.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\FndDyLib.dll
Size 106KB
SHA256 0e4929b084d3d6d1752a37224b8331813541de16fac5353f20fc6622edb8ee98
MD5 681b0ac0e40c7bf3e77afe39887e8f6b
SHA1 98f9522887aab6e4e668b5c5c6d0dc2483c4974e
SHA512 6d394829961528f2269c664dde4f85a1491e88720e07c84c0cd07f0b9eac2c4c08b32bcead757c458c5cb80a634cae1d74e2e501edbb6de696f3a38c5ea94c3f
SSDEEP 1536:xOmy26j9PbktdqaazAAgfjOHiZKKnsSylDlanzCdoKeoPBDFM40KLn29W:xOmKbktVaMiHigKnsZDlXPBDFM8nmW
TLSH
T133B3396F76680058E13792BCD6D74E0AD3727545070297CB23E2839E0F27BD96DBE660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FndException.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\FndException.dll
Size 107KB
SHA256 ca074fa74676f6929cca6c251a50dfe6ae782366434026cb507651d668c53e5d
MD5 287c427dbae7298490bee673cf478d2f
SHA1 9b08c96d4ef5da79ecbfdf309e0baa38f752f71d
SHA512 59d73ca57c48ddd5bf52598ff943a3e844378913b3f294000d09c49fd621aa37b61762f08116d66e9d07e750a9727ed0dc5ca6b8cd699ce4c8b614887758c051
SSDEEP 1536:AOJe17LtcKjqIVDDg1h6YcfDw1+rxT8X1A:AOJe17L2KrBMzDcru+rxT8lA
TLSH
T15FB3394B36580099F577A2BCDAD78E06C77274464711A7CF17A083AD0F23BD8ACBE661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FndFilesystem.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\FndFilesystem.dll
Size 308KB
SHA256 c21e4951e439d4bd0bcea9d4054ef350e00ac144936b303d0a4e70008df6a75f
MD5 5b13cd0bcec086602363d8c42fb207c2
SHA1 72de697e0b4d514818be6d329e6f1bd4b5d85171
SHA512 6744e30fd30a4cb97cf08a630ded754405e4ecdf2bda03848ef2546d564f93863f5318a7d7fb0f7852b17d560b3a2adf27228b94e3fb462638fe9eff0be5039a
SSDEEP 6144:RxmbxSF4YWE4u1etRPiX5stF/zTtlpVtvaXStPn+p7Tob:ibxSF47zXftLmeb
TLSH
T14764371F72580DA8F577917CCAC78E06EAB238554312D7CB06D5439A1F27BD8A9BF220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FndHash.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\FndHash.dll
Size 90KB
SHA256 321533c5b36f8cefca33de4caf08683834eb996c93808b1fa4ae344f4e19292f
MD5 1f89359be5db639832e17b0c0799d872
SHA1 7c0916eaa738e8065c4613aa10e157a4a2fbe034
SHA512 b5868191030d9870f9d27b5af92d9f5c34852913f73a14f04fb71948c26854c16f2a5f505f97f4240a21821ecebb59913d900c1817ffec37ba05e1b7275548e6
SSDEEP 768:pJVv7umMgGTWpK9YcZssvwC9x0B7Qp2b1/WmUeAhhfqk9Iah+5PRUSZh54zK5ALv:pLKmMgiWwFss6Qp2WIAhMOM5PKceH
TLSH
T19793489F72480484F577D2BCC9C74E16D7B6B800874097CB1396879E1F23BD89DBAAA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FndOS.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\FndOS.dll
Size 204KB
SHA256 502c09b69042e89204393bdfab9954f311a2a8312b80c9fdc613e8f7428358e5
MD5 5efe07764199886abbe503e7a1270bb3
SHA1 e63963ffb5a65ec5db8cac1a05411950f479efe4
SHA512 af4b2cc19bb4fa3ba01c21a289737e8c91d74a26f24a854dce52d0fa7368d45e1b16d3d9bd71118f27fb2aaf6a9f59f5ce77cfe78c83469beba856ceb6852c47
SSDEEP 3072:7+OUvgankYYexdYuD6JDz0jZrS3QAzgSCoDTeZgHb5m6Igvwu:7+OUvgaV6J/0jRRfoDTeZgHbbx
TLSH
T18824095B32480169E57BA17DCAC75E02F6723406470197CF06D683BE0F6BBD8ADBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FndPointer.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\FndPointer.dll
Size 24KB
SHA256 f5a6b73d953891ea751aac8320b79f7f1f3f85637ac550e860f17ea201771f03
MD5 be646f889fc68e7d1eaaafb3fe62c1e8
SHA1 f802edbde0f78a44d77474475e03ef46751c2005
SHA512 36949eff2e6265b44be09690593a3f9ceca661f85b6cc54d87c0a878704f9b64a17758d52db6434ac912bff3fcecf4532337df551eb923676a72f662da5b083f
SSDEEP 384:4/rfMNlfMIiAtZvNwPNWDDLDIKtxq0KB+Zy8RbmL4nNynpB:WwNlfdNvaPNWDnDIgqh+5ALl
TLSH
T119B26D97F7544D86E8778038D8974E0AD972B6900B9283C72354866E0F973C23EBF759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FndString.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\FndString.dll
Size 43KB
SHA256 23d80ca828c956fcb1d9edac844755a2cf24504707bdd224fe4aeb58f70e65d9
MD5 44784ec9d41c88fa08ead923669514fb
SHA1 40aa703e0e5e42e888898eea7e736e7a2bce0eaa
SHA512 a34a2ba7b2a8762cad995acd01750bf024fdc69c650d292b1ae1d8375aa6e1df2f4450878134fe89718de3992207018e1cf0622ad648bd41771e1628d3f31a99
SSDEEP 768:wL55o0wGUHgXU5yPusehzjwCcT5xBgedGmD5ALG:wLz0XgmT0TTBgAN3
TLSH
T132133A4B721148A4E837D27DC6D79E2AD8B27119474097CF1392879F0F637C968BBAB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GeneralMovaviTrackerWrapper.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\GeneralMovaviTrackerWrapper.dll
Size 123KB
SHA256 cd898f3be726552e1a9d259013d53d801741fc0bd1cf8b0370f4bad9be2748f8
MD5 553448fa757dad4841c388f5483e9653
SHA1 c5a3d3256ee81c3e3daa851422df504854617b1e
SHA512 796780211c0bdb2fec5c43dd77e99fff9fa1888957cf5989f6a6dd4b1ab21247773901531e758a1ddbcdf4f11efa2c5bbd073c0ee23e46fa50ca68e2a4cd620a
SSDEEP 1536:lvHJndwwDeae7woLu5Bu4sNIyC+ZMG8sRNue0z4KShoYbe3cUkYFGyOXSuB:l9ckoLv4sNId+yG5Y4KShU1GBlB
TLSH
T11BC3F75F324940ADF4B7A27D9AC78E12E7757486070297CF02D4429E1F57BCD8EBA2A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallerGUI.exe

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\InstallerGUI.exe
Size 1.5MB
SHA256 5173f8e4b16afa9832443b6d02030693e745d41bd13c0a5774880b5c74a110d2
MD5 d91318d49858308d2813cb361a159ece
SHA1 0e53a8509f08eb6443967a7078bd3a71ea456b3e
SHA512 891535aa2dfff46ce410a8c9cd2a119b646d85d1b53ccb5d200c59406be62cb22cfaa4a67ee74f849d087ee6206e888968da83bbfc3f6b5a906f82f6730ef9cd
SSDEEP 24576:WswgFvLBXg2IubEe10yTwUmPfUmPIBNUmPvUmPvUmPnLUmPvUmPvUmPwUmPvUmPw:HFzaA22a7IBtrr/rrarCtB
TLSH
T11E759F1BB30003A6E2A2C37CD7835A8AFA3E709C53019ADB55E9811A1F53AD44E7F7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallerLib.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\InstallerLib.dll
Size 1.1MB
SHA256 86949e8f278be9a6acebe011c04335d63f0cab94cbf61112711fb68f01847652
MD5 6e2f900383beaea4282e784be2c3a333
SHA1 2d9b218aa18e9af80f62b58b13e3f870c4bddbf3
SHA512 b94e724060458fa5e9c41bbb47ade9124302ea92279afa242c383d93173edc123b48c5ce7fd303043a9ea467962c13d3d4c394fb71cc458900a41670067ea538
SSDEEP 24576:iQDNHKEiMHgHy6itdQg58jOAO2U8JCmy4lik1vsgb:imAHXu7mRzHJCU8gb
TLSH
T1D735490F365901A9F57BD1BDCBC78E46E5B2705A03118ECB06D1879E1E27BD84ABE720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MQtDownloadManager.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\MQtDownloadManager.dll
Size 142KB
SHA256 46eb01d255cd2ac03a2001dc2af3d5aed8a416fe3ca2ccd67ffd1c37360060e6
MD5 b28c81420ae864249cc323cd2baf65b0
SHA1 96dd5795188582d6ab81bc78b686246857151be8
SHA512 3f0aa19f2ef9e32556ab5d585351599b6cd326f0bbf54501aecf463068d65899ff65a4c3046d61bc6ac0f839af624d8032c0ccdfeb6e81744604d72cc80ecc38
SSDEEP 3072:4wRODWsdb9WO+BW1xuY6b3f4hxDzZHEofSfaqFOGCwTB/Far6JOE7:46ajb9WimfMxDFnfSfBF9TB/Far6JZ
TLSH
T1AAE3295F3255018AF57AC2BDC6CB4E06E3B2B006430297CF079687AE1F57BD46DBA261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MQtUtil.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\MQtUtil.dll
Size 709KB
SHA256 af4da623e9e47c1dcc1b0ad34a7d7d38cd53809a4e4b61b1042d7af43f4a4a51
MD5 70699f860344389f8dfa3cebd9ec6781
SHA1 d2a66e10f6dbcba22469e319f653eff53f0c7466
SHA512 55bc2275df770db6dddaccc88fded0c40f7b72f4b1c5a7086ead3c34493ef73ab339580bd464fb411b955a0a7a8240188f49198e01011edbeac977c1bfa82374
SSDEEP 12288:Kb3sGwmNrn6ryDh8jv+2jQBS6SW5DAIvA2:Kb3LwmNr3+jv+2sA1W5DAIz
TLSH
T1F8F4392B3A594295E17BD1BDCAC78A12E573700543029BCB02D587AE1F27BE96B7F310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\MSVCP140.dll
Size 552KB
SHA256 44a5af24f8d5f9c50a9e5a200a0486100afb6a0e86377e2e3e622a7bbb57cb04
MD5 29c6c243cfb1cec96b4a1008274f9600
SHA1 c54b10ef6305cc3814c68e6c8fd6daecbb27622a
SHA512 39c34554ea7b6d433c2aecfdeff87959e625e943bf7a446ebca8e5878eaf24198c1b188359a0343fb78478f2bc8b986ca4d0e69d39bac6ff80cb901fe4f113ee
SSDEEP 12288:D/Wn7JnU0QUgqtLe1fqSKnqEXG6IOaaal7wC/QaDWxncycIW6zLyBQEKZm+jWod0:bN59IW6zLyQEKZm+jWodEEYr
TLSH
T19BC41923B75D05E0E195A3B8A1838305D7F17C4A8312A3C792FB96AD2F673D56B3B190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\Qt5Core.dll
Size 5.8MB
SHA256 16ec0e33ddc91082480eca362fc4222496543cecbb40e24004774c9b5ac3f75f
MD5 2bf2b75ef4ae6884ae43b593b933f4f7
SHA1 45e4e6618fe46425abaf41eb4bcb24aa2117d3d7
SHA512 ce4ef5534bb01468759548c9d9a5455f0ee4b52f6301c520bfb60f61a00dc0e9c8fda3e05ed322cf89409d85b2c52909e3781e9f5e386e929d99791b6e7580f8
SSDEEP 98304:0yNQFpyxCNnSqr2HJsv6tWKFdu9CDihi2NPxqf1gwl:7QFpyxCNnSqr8Jsv6tWKFdu9CDQi2NPs
TLSH
T113568D8772AA0151D1B6C23CC9A78217F6B278129762CBCF125CA3495EB37F1A93F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\Qt5Gui.dll
Size 6.5MB
SHA256 351ae73838aea5da11af9e8ad5da01e346046c95efd16edcda513331267f0517
MD5 4231a76d5a65225eb51badf43661579a
SHA1 54458856a449a75b12befdd98d446e50e4bbe592
SHA512 71af14861555453d025923d3ef444aa7e41349e8e5e6f6402b6618adf9c62091c14e312bd686cb94e1be3d8457abba831b2242c5a5a548dab84b9140c59597f0
SSDEEP 49152:1l8Wxr3GaIGWlNPMycLWfAQ/5RSTJ8TRDmWQc9aYutFLMiHlZZGomWuLGOH4YlTn:3xrsIYp5MHdwWAlxs3WxyyFuXHuTsvM
TLSH
T18566299672596262C977E27E8B4F052EE1F3785283428BC748158B480F737EA1B7FE05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\Qt5Widgets.dll
Size 5.3MB
SHA256 94975fcaef3bf20e136781ba75a41aff45731060e3984d00d868c1e03461f650
MD5 44707938ee149eab097102b6015ad5e0
SHA1 a614e20170ce4090403df2c25c2bfcdce570c0ff
SHA512 d14070ad6e51ba95069f0883b043c43bf291e496b244f1ab71487ace558b2f6efb3f0ad739c8ec0c47181fd9034e75921ecc68136f206db673623a22eca7d837
SSDEEP 49152:3aiRpLXLmF7nHf2P5A42So8eQLilaAnWHEZa9nVt6/UT4gjJBmuKtGgm3rCOyFcu:qU82eQV2WyA3JoUgm3rCOyFcFQ
TLSH
T1EE466A97B3A54184C56BD23CCA8B8613D6B270044B229BDF256ACE592F737E12E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SessionTracker.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\SessionTracker.dll
Size 104KB
SHA256 5e1335d1e5da7831018b1b03acfe41bf09b4a6f2ce021e6db04a4f1eede2ae7c
MD5 61b5e11802b3839e6d1b3fc0a3a882b8
SHA1 72d333a4f6152c0a1f4c2741b3419c08ec28dc73
SHA512 9710e020a19800f6cf6d29430aa940277788afa3dbae0e87fdccae869cfb5328281c83776ac7f7af6083ad5efe940e1894c71fa889446481043531ab507e082a
SSDEEP 1536:U0QELsdwoVvLKujd1INgCS09eXnKgip4CCtHLdyosHMl5nanWnbAPRnQnSnunyXT:hQELseo1TlACnYgHaWeRQSuyp1
TLSH
T1CAA3F65F324940A9F576D1BCC6D79E06E276741A43028BCB03A6879E0F27EC91DFD6A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SessionTrackerInstance.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\SessionTrackerInstance.dll
Size 22KB
SHA256 11450d2d09ca7a0582c1c8e88e9a9bcfc77c713953afcad0a22726fce86bccc6
MD5 ed98d8f681332a9e63c3809535f88735
SHA1 54ab70d0b06eb1a5838e1fd2d97f0e73aca089c8
SHA512 1775ceddd10b65a027d44368bd47a48a59be2fd1b3a550995c1c3396b5bb9d415300f83a8fa51eda394d224ef8c89da339afd77435b2d87d4f12c0bd8b543e26
SSDEEP 384:uUEsSodAsJS0b9L1TNv16VviFcg9s1SCB+Mky8RbmL4nNyQtNf8V:uUE/oTS05v16UF9uVxk5ALC8V
TLSH
T110A25C87B68448D9E8778178E8964E17DE36B6214751D3C72368C2860FA33C17ABE36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TrackerFactory.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\TrackerFactory.dll
Size 38KB
SHA256 407d760465174e831ee6fca865cfac30a1d5c598e8d6b70d86963a70a34dd678
MD5 dab4206f9edce4496b5a737cc9bade00
SHA1 e9c9f390dfb50c53b572b8acb1b81700179a0921
SHA512 36180b35d2f28373b3360d682924f1b64166cebee35f0bfd30ef9b30061a35262dcaebd4a173d360e36945d4ba3d84a5d124c42f3833039ba58b928cb0997aab
SSDEEP 768:J7APoz8DEvNmX9mR8oYoxg7gVw3F5ALob:Jfz7NmX9mSoYoxgUVwz
TLSH
T114034B977384449DF833813DD5D79E15D837BA56038282CB036043AE1FA37D6AABE668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebUid.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\WebUid.dll
Size 431KB
SHA256 dbec318b90b79b67402ab1c031d731ea2ff089265bfab1faf2db8f9e58941e16
MD5 67cc04e0b9c9d183586fb05ada715f3c
SHA1 a70efa624cf33e32cdd4e25038f91ab73cc0ffea
SHA512 959710248d63dd41ffba5db28c59880c75f36acdecf602ef44d6468cca17441030cad62f86a2dc359f4ef4148d6413dbfea4c36c1e63657acef5725eb9895eab
SSDEEP 6144:VAaG1YJnc4v2Ndou4AvkyeUbKic0jYUaqu3Vm/Zwxb:VAaG2Jnc4vkau4Sgb/
TLSH
T1BE943A1BE25815E4E5BF91BCCAD7CE06F1B6344C434197CB02E092AA2E57EE9993F710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boost_filesystem-mt-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\boost_filesystem-mt-x64.dll
Size 149KB
SHA256 9b63a8fb86fd94a63112110e780381bb6ba27da1acf3b5e551cfa825f2fba85c
MD5 d3338038c38f8e3e907c10e0d131e1f7
SHA1 8afd9dcbab925d163b0ab534609c97f86b09b70c
SHA512 bbb5a2ffde2ea622f037a75218f81706d34339edef80619f69b4b24b8588da9e9ab05e996b01c07e57a545383a05e8cbf3f88060a1baa6f19aae698a6e5ebd32
SSDEEP 3072:TXXLDmI8mvANpsAU9cJcjQLr5XLtyJByKkDaGr:T6uAU9cJdOkDay
TLSH
T135E35B5AF29900B8D19BE27895878902F3B37889C3265BCF03D446355E573D4AFBF260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glog.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\glog.dll
Size 135KB
SHA256 5709deb8ea8cb51d728709369270ce864dc939063394a3313a21f34ef29d0b15
MD5 1714c815c404c053b4c8c85ee8deaf34
SHA1 7d801664f5dff43d87dcebeabe4f23f269eb6449
SHA512 4edf5ab0a8ae9b1a7e89726d1ce69033a5c987c0117c61391165a697b43a4703f028e6c1acb4aa2fb711602e4c00edb4a50f2242a51d82731a28db30cee660fa
SSDEEP 1536:sqS8t8FYHIC03vJgxXiFfkRLp+zqzf9edJDH2Gme7tqIZ:28t8FY1xZNpIOlSJDHZ7tqo
TLSH
T124D34A5B365A41BEE563E17CEA875B02D3B27405071297CF039242AA1F733D52E7ABB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\vcruntime140.dll
Size 94KB
SHA256 1729421a22585823493d5a125cd43a470889b952a2422f48a7bc8193f5c23b0f
MD5 02794a29811ba0a78e9687a0010c37ce
SHA1 97b5701d18bd5e25537851614099e2ffce25d6d8
SHA512 caf2a478e9c78c8e93dd2288ed98a9261fcf2b7e807df84f2e4d76f8130c2e503eb2470c947a678ac63e59d7d54f74e80e743d635428aa874ec2d06df68d0272
SSDEEP 1536:yPHLG4SsAzAvadZw+1Hcx8uIYNUzUgHR4xecbK/zJgXTG:yPrfZ+jPYNzgHR4xecbK/FgK
TLSH
T185935A4A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B646AA4F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\Movavi-installer-019d0e60-a6d1-4011-976a-41d9d79cfe14\vcruntime140_1.dll
Size 36KB
SHA256 26c29d01df73a8e35d32e430c892d925abb6e4ad62d3630ae42b69daacba1a0d
MD5 d8d1a08176ba2542c58669c1c04da1b7
SHA1 e0d0059baf23fb5e1d2dadedc12e2f53c930256d
SHA512 5308790fbcf6348e87e7d5b9235ed66942527326f7ba556c910d68d94617bdd247a4ed540b4b9f8d4e73d15cf4a7204c0a57d4fd348ec26e53f39b91be8617fb
SSDEEP 384:57nvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+Xf0suncS74GpWrLKWF14gHQ:yCm5yhUcwrHY/ntTxT6ove7q/r7/xqhd
TLSH
T12AF25B8463784086E46B95B4C4E36F27FB38F8616750938F0BA4865D2F637D0E63E31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VideoEditor.exe

Path C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\VideoEditor.exe
Size 9.6MB
SHA256 ee788795a81505cd3677e89da66250887e6eef5dd15703cfea63bf88a49bc051
MD5 551ccbbbba44e08a952aa31304cada57
SHA1 0182866936513d283722342462bb2fe52588ce2e
SHA512 b159bb6f74dad4dea545cd9043220e649a6b92eccc4f0bf2adb900dccc56795a7c18a084d4d0871cd34ab621d8ec46cb7e6d5b471a269a8b3a25fc1d574db510
SSDEEP 196608:Qf2WBXMVneXlkmAwBNtTXQanzJW1QWwa7BhSLho:Qf2WBXMVneVkyd9zJyB0q
TLSH
T188A6CF4BA2CB41CBE177817CC69A8632D6B178261F7097CBC5D79E6A1E379C40EB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meta.json

Path C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\resources\samples\stock\animations\All\05__Downward\meta.json
Size 57B
SHA256 ee8c7882ba0b39e936662a0b537b371888ece13fb07174688874a53cf333fb33
MD5 4f8135f11ccd766f922dc8b9f57a94cc
SHA1 5196d6a5290ab0a56681f2cc9e5306f99702cfd0
SHA512 44572598ef8a8441f974209afca226bd8b86b293d81d127ad6256bad8ab322ccde3124cf0114a5e4a30fd6d6bac7b79f7e46ce30536a387bfe02600cb4c83ccd
TLSH
T193900215DC445FB310F92729AD554542DF121B5311804509B40C61080F340351051F14
MD5 SHA1 SHA512 TLSH

Submit Download

meta.json

Path C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\resources\samples\stock\colorFilters\All\Preset_HotSun\meta.json
Size 45B
SHA256 b4e788f3e0050d3e2879bdb461faf89f09c5a0eb31ba2c2966bb0443f564857d
MD5 50e30a195d26a1f7cf52804ad7066363
SHA1 97d26f55697fcbdb07a9f9d274fd4d9bcb789683
SHA512 58e77d4cb8361fee7ebae44c1f4c09ef26bf07d631e9aa37e455a52b377c5ee66a523bd810144cc1454ef6eaa68c3ff8f6a8e429b7bce77f81e0df968ec417d1
MD5 SHA1 SHA512

Submit Download

meta.json

Path C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\resources\samples\stock\packages\Content\RemotePackages\MESFireandLightningPack\Special effects\all\{17840352-7e58-491f-9b84-d3f4354ed11b}\meta.json
Size 41B
SHA256 83ca418673f677e7024e56d6d1add8f8e62328c7fda874401002f2d2c744720c
MD5 12f5fe493c042f1e48c59ce1c2805552
SHA1 429e7e5ce5a7fe44fb93e03dd71fbcc44a9d62d1
SHA512 908a6228294f1cdb7eb2bfe071801c5d4e3265c1d99193ccfd56bbb120d99eaf6861266830057fb79abfcb0099eaed7feb10561b4df3bf8c2c8e705f54fc9528
MD5 SHA1 SHA512

Submit Download

version.xml

Path C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\resources\samples\stock\packages\Content\RemotePackages\MESSmartFiltersPack\effects\all\{7359f6cb-08d6-40e9-8480-1868cf6b5a1b}\version.xml
Size 112B
SHA256 667642b3c7e5c2ded361011c39692fd5f08e2866cd86006f2b168b0b894e5ccb
MD5 6c924b3d1a33c59cd99d177c6238d8c0
SHA1 befcdcc3a2bd77663daf027d049c0c737a3a82bd
SHA512 ce9898dce3a89991becfcb1143b22180ebc91ef0f56f6599f24c7dca36d70810ddc6b13d5c148b29aa5f5d946cc6c376929dc8e23f2898846faf4f6309ae83c1
TLSH
T1B6B012505DC1ED3306B05F20C718CD00F776B18A0449050478D1188B2F6A07F47CA301
MD5 SHA1 SHA512 TLSH

Submit Download

version.xml

Path C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\resources\samples\stock\packages\Content\RemotePackages\MESStockNewEffects2020\effects\all\{bbed1f60-10d7-4b68-a9e9-4c808f3b4fee}\version.xml
Size 111B
SHA256 3d8f290b1548b462c6ea73f1d075abc84ea951641e237e853f639268318c5e03
MD5 ee967846b96120d073ae5e8322a23b3e
SHA1 79d2551e78f09fcfbe3768bb785baca08d994bb6
SHA512 89b215294f0c498492d82c5a9fc62e30eac65299a760c9b73fcd693975eec1aab373b2d25e1fe75289d41620135c204beb605eb0726e2f3554fd7b35f924b162
TLSH
T13DB012545DC1ED3306B09F60CB14CE10F737F18E0045040478D11C8B2F6A03F46C6311
MD5 SHA1 SHA512 TLSH

Submit Download

fake_resource_5.txt

Path C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\resources\samples\stock\packages\Content\RemotePackages\MESStockNewEffects2020\resources\fake_resource_5.txt
Size 23B
SHA256 68aff16edf3c247425831f0f05291405b6642890d065b06d9ec7c7d2e3ee7b91
MD5 a87bda3f2c9d05d0f18c6b52f355d107
SHA1 91e9c125dc2e9141f0b7c785ebdc00b2e0d2035b
SHA512 de27cce1fbd8279c4635feb7364f6a0cda34a345f2709f19b15a0b5786915b45c9c4e79cdcca3e1b3b720fcd82d5c7ed1e81fe2cf00612b30dc60eebd826af86
MD5 SHA1 SHA512

Submit Download

version.xml

Path C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\resources\samples\stock\packages\Content\RemotePackages\MESStockThemesPack\imports\all\{475708e8-6e49-416f-b2e8-c08c5fd663da}\version.xml
Size 111B
SHA256 2fd01c6dc5ddb425d4c2e2a2c40f46cff667e2768385dbbae4d622dfe509a5f0
MD5 f4e01c472f397751b00783072ee3d41b
SHA1 7bbb4c67cdb42bc4ab9011c51ea5307dce46138e
SHA512 c63f1fe50d01b9171ce107262ab5e03db8e3b7ee922e48c21404d33b59f7b8893493bf39e35c4e4e2c99550f4e22510488b5e2b75f7d20f64372a436fb925d50
TLSH
T14BB012546DC1ED3306B09F24C714CD00F737B18B0045040478D1188B2F6A03F46CA311
MD5 SHA1 SHA512 TLSH

Submit Download

version.xml

Path C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\resources\samples\stock\packages\Content\RemotePackages\MESStockThemesPack\resources\randomTheme\theme\version.xml
Size 111B
SHA256 769cadc93b30fc0a019d7e6ae27f4191bfcd03d2dc05029303971183f3b55d23
MD5 40b03fd39ce75a817795881d9bb408db
SHA1 7a32668c8d74d470a16e5dd6bd53a85bd68d53e0
SHA512 8f9d027a765b2e7d00f74e35b1f97ae4df19db4d0b56da7c7213ac594ae9def7100aab74e86ce8dd92a3d13ee7d8f4069c891da4e9ff3ea650383c2a040f0803
TLSH
T17CB012545DC1ED3307B09F60C714CD00F777B18A0045050478D1188B2F6A03F46C6311
MD5 SHA1 SHA512 TLSH

Submit Download

version.xml

Path C:\Users\Admin\AppData\Roaming\Movavi Video Editor 25\resources\samples\stock\packages\Content\RemotePackages\MESStockWhooshTransitions\transitions\all\{1c3ea148-67bc-4ebf-a4c2-9386a130026c}\version.xml
Size 112B
SHA256 5b4e1bdb9ee1671d7f7dec17c1b17c6607b8a31999764ff9778373a42324ada9
MD5 46779c7c9ab3f229df6dc1bad78c120f
SHA1 c7139034d4495866a5fafb5d1a90be4d84906576
SHA512 f70749d786f1377130fe6daf2f38a65da7b906e1344adc6baf61bea5ec4bf3212e0dc6e1b2d6a0300f7e06ecfb1c2711693820925abf6138c2629815a9895586
TLSH
T1B5B012505DC1ED3306B05F24C714CD00F73AB18A0049050478D11C8B2F6A07F87CA301
MD5 SHA1 SHA512 TLSH

Submit Download

memory/768-1970-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/896-4933-0x00007FF8BFF10000-0x00007FF8C030D000-memory.dmp

Download

memory/896-4947-0x00007FF8B7BA0000-0x00007FF8B8187000-memory.dmp

Download

memory/896-4998-0x00007FF8B7BA0000-0x00007FF8B8187000-memory.dmp

Download

memory/896-4932-0x00007FF8BF1D0000-0x00007FF8BF71A000-memory.dmp

Download

memory/924-2294-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/1216-463-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/1308-4737-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/1428-3942-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/1512-482-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/1740-3059-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/1932-4280-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/2024-4965-0x000001BE61770000-0x000001BE61780000-memory.dmp

Download

memory/2024-4966-0x000001BE61770000-0x000001BE61780000-memory.dmp

Download

memory/2024-4964-0x000001BE61770000-0x000001BE61780000-memory.dmp

Download

memory/2024-4946-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/2160-5034-0x0000000005FF0000-0x000000000634B000-memory.dmp

Download

memory/2316-4945-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/2616-4744-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/2700-4924-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/2864-4171-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/2868-490-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/3056-3797-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/3180-492-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/3180-2903-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/3204-702-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/3556-4748-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/3588-3522-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/3800-4954-0x00007FF8CCB00000-0x00007FF8CD0E7000-memory.dmp

Download

memory/3800-436-0x00007FF8CCB00000-0x00007FF8CD0E7000-memory.dmp

Download

memory/3800-429-0x00007FF8CCB00000-0x00007FF8CD0E7000-memory.dmp

Download

memory/3800-412-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/3800-477-0x00007FF8CCB00000-0x00007FF8CD0E7000-memory.dmp

Download

memory/3940-19-0x0000000006A80000-0x0000000006A9E000-memory.dmp

Download

memory/3940-14-0x0000000006410000-0x0000000006476000-memory.dmp

Download

memory/3940-23-0x0000000009000000-0x00000000095BA000-memory.dmp

Download

memory/3940-9-0x00000000056A0000-0x00000000056D6000-memory.dmp

Download

memory/3940-24-0x0000000007E90000-0x0000000007F22000-memory.dmp

Download

memory/3940-28-0x00000000736C0000-0x0000000073E7C000-memory.dmp

Download

memory/3940-25-0x00000000736D2000-0x00000000736D3000-memory.dmp

Download

memory/3940-22-0x0000000006FD0000-0x0000000006FEA000-memory.dmp

Download

memory/3940-21-0x00000000083C0000-0x0000000008A3C000-memory.dmp

Download

memory/3940-20-0x0000000006AC0000-0x0000000006B0C000-memory.dmp

Download

memory/3940-18-0x00000000066B0000-0x0000000006A0B000-memory.dmp

Download

memory/3940-26-0x00000000736C0000-0x0000000073E7C000-memory.dmp

Download

memory/3940-11-0x0000000005D50000-0x000000000639A000-memory.dmp

Download

memory/3940-8-0x00000000736D2000-0x00000000736D3000-memory.dmp

Download

memory/3940-15-0x0000000006480000-0x00000000064E6000-memory.dmp

Download

memory/3940-10-0x00000000736C0000-0x0000000073E7C000-memory.dmp

Download

memory/3940-13-0x0000000005CC0000-0x0000000005CE2000-memory.dmp

Download

memory/3940-12-0x00000000736C0000-0x0000000073E7C000-memory.dmp

Download

memory/4124-3671-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/4132-4746-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/4204-4728-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/4268-4752-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/4284-4971-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/4308-3229-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/4604-484-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/4728-1191-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/4804-4740-0x000001BD858C0000-0x000001BD858C1000-memory.dmp

Download

memory/4804-4739-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/4872-486-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/4948-4750-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/5412-4972-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/5588-4948-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/5608-4754-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/5668-475-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/5716-488-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/5796-1436-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/5800-4742-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/5844-478-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/6072-1629-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download

memory/6132-4735-0x00007FF8D0110000-0x00007FF8D065A000-memory.dmp

Download