Analysis
- user interaction
yes - max time kernel
330s - max time network
326s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/04/2026, 01:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
blue.iris.6.0.3.4.[x64]-MPT.exe
Resource
win11-20260130-en
windows11-21h2-x64
30 signatures
150 seconds
General
- Target blue.iris.6.0.3.4.[x64]-MPT.exe
- Size 322KB
- Sample260418-bfsjgset81
- SHA256 568d318384d5e4913e6cc94247db22ed55de34d51751a0f688eb673b35517c35
- MD5 df76a07eedfc2c17db4c07b7ebe904b8
- SHA1 f93199291a66af2028dd5be60c4aae47ba5804a1
- SHA512 2de2ec96b82bb2ab8a8c3a5c752e79ab9cc46555f75099890f774075ac2871b2b2d5d7ad3da40c9e53f836c0fcfa7a417d63ab05e232ba2ff2df2a558ad1a976
- SSDEEP 6144:ddBkmt9pYr+NneB0GEtxeKWITYrCA6NP4t7bKGFXO7MM:dROia0GEtxVRYrz6NP4t7b1Fq
- TLSH T10E6412316B89D906CB124332F81BCBBD1B71898E7C6A9117F5A0BE1F697731BD927020
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes BlueIris.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 10 IoCs
pid Process 1344 BlueIris.exe 4164 BlueIris.exe 3480 vc_redist.x64.exe 4920 vc_redist.x64.exe 4828 VC_redist.x64.exe 1680 VC_redist.x64.exe 1044 VC_redist.x64.exe 764 VC_redist.x64.exe 3396 BlueIris.exe 1916 BlueIris.exe - Loads dropped DLL 59 IoCs
pid Process 4512 blue.iris.6.0.3.4.[x64]-MPT.exe 4512 blue.iris.6.0.3.4.[x64]-MPT.exe 4512 blue.iris.6.0.3.4.[x64]-MPT.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 1344 BlueIris.exe 4920 vc_redist.x64.exe 920 VC_redist.x64.exe 764 VC_redist.x64.exe 2088 MsiExec.exe 2088 MsiExec.exe 2088 MsiExec.exe 2088 MsiExec.exe 2088 MsiExec.exe 2088 MsiExec.exe 4908 MsiExec.exe 916 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 3460 MsiExec.exe 1184 blue.iris.6.0.3.4.[x64]-MPT.exe 1184 blue.iris.6.0.3.4.[x64]-MPT.exe 1184 blue.iris.6.0.3.4.[x64]-MPT.exe 4196 blue.iris.6.0.3.4.[x64]-MPT.exe 4196 blue.iris.6.0.3.4.[x64]-MPT.exe 4196 blue.iris.6.0.3.4.[x64]-MPT.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1256 regsvr32.exe 1916 BlueIris.exe 1916 BlueIris.exe - Windows security modification 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes BlueIris.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions BlueIris.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{b2f5e2cc-18af-40da-9bb9-c296da1cb96c} = "\"C:\\ProgramData\\Package Cache\\{b2f5e2cc-18af-40da-9bb9-c296da1cb96c}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: BlueIris.exe File opened (read-only) \??\T: BlueIris.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: BlueIris.exe File opened (read-only) \??\N: BlueIris.exe File opened (read-only) \??\O: BlueIris.exe File opened (read-only) \??\W: BlueIris.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: BlueIris.exe File opened (read-only) \??\K: BlueIris.exe File opened (read-only) \??\M: BlueIris.exe File opened (read-only) \??\Y: BlueIris.exe File opened (read-only) \??\V: BlueIris.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: BlueIris.exe File opened (read-only) \??\G: BlueIris.exe File opened (read-only) \??\M: BlueIris.exe File opened (read-only) \??\S: BlueIris.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: BlueIris.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: BlueIris.exe File opened (read-only) \??\I: BlueIris.exe File opened (read-only) \??\U: BlueIris.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: BlueIris.exe File opened (read-only) \??\Z: BlueIris.exe File opened (read-only) \??\H: BlueIris.exe File opened (read-only) \??\L: BlueIris.exe File opened (read-only) \??\J: BlueIris.exe File opened (read-only) \??\L: BlueIris.exe File opened (read-only) \??\W: BlueIris.exe File opened (read-only) \??\H: BlueIris.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: BlueIris.exe File opened (read-only) \??\B: BlueIris.exe File opened (read-only) \??\P: BlueIris.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: BlueIris.exe File opened (read-only) \??\N: BlueIris.exe File opened (read-only) \??\V: BlueIris.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: BlueIris.exe File opened (read-only) \??\S: BlueIris.exe File opened (read-only) \??\Z: BlueIris.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: BlueIris.exe File opened (read-only) \??\U: BlueIris.exe File opened (read-only) \??\J: BlueIris.exe File opened (read-only) \??\Q: BlueIris.exe File opened (read-only) \??\R: BlueIris.exe - Drops file in System32 directory 51 IoCs
description ioc Process File opened for modification C:\Windows\system32\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\system32\vcamp140.dll msiexec.exe File created C:\Windows\system32\msvcp140.dll msiexec.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140deu.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\vcruntime140_threads.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140enu.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfc140.dll msiexec.exe File created C:\Windows\system32\mfc140rus.dll msiexec.exe File created C:\Windows\system32\mfc140u.dll msiexec.exe File created C:\Windows\system32\mfcm140.dll msiexec.exe File created C:\Windows\system32\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140chs.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140rus.dll msiexec.exe File created C:\Windows\system32\mfc140deu.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140ita.dll msiexec.exe File created C:\Windows\system32\mfc140chs.dll msiexec.exe File created C:\Windows\system32\mfc140esn.dll msiexec.exe File created C:\Windows\system32\mfc140ita.dll msiexec.exe File created C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\vcomp140.dll msiexec.exe File created C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File created C:\Windows\system32\vcamp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140cht.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140fra.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\mfc140enu.dll msiexec.exe File created C:\Windows\system32\mfc140jpn.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File created C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140jpn.dll msiexec.exe File created C:\Windows\system32\mfc140cht.dll msiexec.exe File created C:\Windows\system32\mfc140fra.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140u.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Blue Iris\www\sounds\good-morning.mp3 msiexec.exe File created C:\Program Files\Blue Iris\www\sounds\springy.mp3 msiexec.exe File created C:\Program Files\Blue Iris\Sounds\not-kiddin.wav msiexec.exe File created C:\Program Files\Blue Iris\Sounds\sorted.wav msiexec.exe File created C:\Program Files\Blue Iris\www\cliplist.htm msiexec.exe File created C:\Program Files\Blue Iris\www\jpegpush.htm msiexec.exe File created C:\Program Files\Blue Iris\www\applet\logos\launcher-icon512.png BlueIris.exe File created C:\Program Files\Blue Iris\www\background.jpg msiexec.exe File created C:\Program Files\Blue Iris\www\login.htm BlueIris.exe File opened for modification C:\Program Files\Blue Iris\www\ui3\flag24.png BlueIris.exe File created C:\Program Files\Blue Iris\www\ui3\help\img\RecordingFilters.png BlueIris.exe File created C:\Program Files\Blue Iris\backup.reg BlueIris.exe File created C:\Program Files\Blue Iris\www\sounds\system-fault.mp3 msiexec.exe File opened for modification C:\Program Files\Blue Iris\www\ui3\help\js\help.js BlueIris.exe File created C:\Program Files\Blue Iris\Sounds\robot-walking.wav msiexec.exe File created C:\Program Files\Blue Iris\EASendMailObj.dll msiexec.exe File created C:\Program Files\Blue Iris\Sounds\alien-tune.wav msiexec.exe File created C:\Program Files\Blue Iris\Sounds\pop.wav msiexec.exe File created C:\Program Files\Blue Iris\www\ui3\help\help.html BlueIris.exe File opened for modification C:\Program Files\Blue Iris\www\ui3\help\help.html BlueIris.exe File opened for modification C:\Program Files\Blue Iris\www\ui3\help\css\help.css BlueIris.exe File created C:\Program Files\Blue Iris\www\ui3\help\img\ClipContextMenu.png BlueIris.exe File created C:\Program Files\Blue Iris\www\ui3\horror.png BlueIris.exe File opened for modification C:\Program Files\Blue Iris\www\ui3\trigger24.png BlueIris.exe File opened for modification C:\Program Files\Blue Iris\www\ui3\help\img\ExportStatus.png BlueIris.exe File created C:\Program Files\Blue Iris\www\sounds\determined.mp3 msiexec.exe File created C:\Program Files\Blue Iris\www\applet\logos\launcher-icon72.png BlueIris.exe File opened for modification C:\Program Files\Blue Iris\www\ui3\horror.png BlueIris.exe File created C:\Program Files\Blue Iris\www\preset3.png msiexec.exe File created C:\Program Files\Blue Iris\www\sounds\blocker.mp3 msiexec.exe File created C:\Program Files\Blue Iris\www\sounds\news-bringer.mp3 msiexec.exe File created C:\Program Files\Blue Iris\www\sounds\on-serious-matters.mp3 msiexec.exe File created C:\Program Files\Blue Iris\www\sounds\paranoid.mp3 msiexec.exe File created C:\Program Files\Blue Iris\www\applet\logos\launcher-icon168.png BlueIris.exe File created C:\Program Files\Blue Iris\www\ui3\LoadingImage.png BlueIris.exe File created C:\Program Files\Blue Iris\Sounds\determined.wav msiexec.exe File created C:\Program Files\Blue Iris\Sounds\high-pitch.wav msiexec.exe File created C:\Program Files\Blue Iris\Sounds\police.wav msiexec.exe File created C:\Program Files\Blue Iris\www\ui3\ui3.css BlueIris.exe File created C:\Program Files\Blue Iris\www\jpegpull.htm msiexec.exe File created C:\Program Files\Blue Iris\www\favicon.ico msiexec.exe File created C:\Program Files\Blue Iris\www\preset1.png msiexec.exe File created C:\Program Files\Blue Iris\www\sounds\alien-message.mp3 msiexec.exe File opened for modification C:\Program Files\Blue Iris\www\applet\logos\launcher-icon1024.webp BlueIris.exe File created C:\Program Files\Blue Iris\www\applet\logos\launcher-icon144.webp BlueIris.exe File opened for modification C:\Program Files\Blue Iris\www\clappr\clappr.min.js BlueIris.exe File created C:\Program Files\Blue Iris\www\ui3\openh264_decoder.js BlueIris.exe File created C:\Program Files\Blue Iris\www\applet\xcastinstall.exe msiexec.exe File created C:\Program Files\Blue Iris\www\sounds\sorted.mp3 msiexec.exe File created C:\Program Files\Blue Iris\DirectML.dll msiexec.exe File created C:\Program Files\Blue Iris\www\applet\logos\launcher-icon128.webp BlueIris.exe File opened for modification C:\Program Files\Blue Iris\www\applet\logos\launcher-icon96.png BlueIris.exe File created C:\Program Files\Blue Iris\www\ui3serviceworker.js BlueIris.exe File created C:\Program Files\Blue Iris\Sounds\good-morning.wav msiexec.exe File created C:\Program Files\Blue Iris\www\cell.htm msiexec.exe File created C:\Program Files\Blue Iris\www\sounds\munchausen.mp3 msiexec.exe File created C:\Program Files\Blue Iris\www\clappr\clappr.min.js BlueIris.exe File created C:\Program Files\Blue Iris\www\livestream.htm BlueIris.exe File created C:\Program Files\Blue Iris\www\ui3\flag24.png BlueIris.exe File opened for modification C:\Program Files\Blue Iris\www\ui3\libs-ui3.css BlueIris.exe File created C:\Program Files\Blue Iris\Sounds\goodbye.wav msiexec.exe File created C:\Program Files\Blue Iris\www\sounds\surprise-on-a-spring.mp3 msiexec.exe File created C:\Program Files\Blue Iris\www\ui3\libs-ui3.css BlueIris.exe File created C:\Program Files\Blue Iris\www\ui3\noimage.png BlueIris.exe - Drops file in Windows directory 44 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5b2826.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e5b2838.msi msiexec.exe File created C:\Windows\SystemTemp\~DF9345886241A9964F.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFA9038033F6A734B8.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI839C.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF496F364A3510700D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI2B15.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{9393725C-A0DA-47F1-8DB9-D1C223A0DD5A} msiexec.exe File created C:\Windows\Installer\e5b284f.msi msiexec.exe File created C:\Windows\Fonts\OCRAEXT.TTF msiexec.exe File opened for modification C:\Windows\Installer\{CA305419-B2DA-461B-BB23-90F7D713EF3F}\BlueIris.exe msiexec.exe File created C:\Windows\Installer\e5b2851.msi msiexec.exe File created C:\Windows\SystemTemp\~DF3022CAA0E8A64CFE.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFF0A03A1E62C8A10F.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5b284f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI829E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI834D.tmp msiexec.exe File created C:\Windows\Installer\{CA305419-B2DA-461B-BB23-90F7D713EF3F}\BlueIris.exe msiexec.exe File opened for modification C:\Windows\Installer\{CA305419-B2DA-461B-BB23-90F7D713EF3F}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\SystemTemp chrome.exe File created C:\Windows\Installer\SourceHash{0BCFDDE2-AA44-4087-8E77-E0025551AC6E} msiexec.exe File created C:\Windows\SystemTemp\~DFEBD1A500CED3AC31.TMP msiexec.exe File created C:\Windows\Installer\e5b2839.msi msiexec.exe File created C:\Windows\SystemTemp\~DF9767123F0807C881.TMP msiexec.exe File created C:\Windows\Installer\e5b284e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI83DB.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF5504A06247BDB1BA.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFC6489AC7DB38C6B7.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFC568ABDFC7A56FF3.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{CA305419-B2DA-461B-BB23-90F7D713EF3F} msiexec.exe File created C:\Windows\SystemTemp\~DF7CEEE5549B8F9E4A.TMP msiexec.exe File created C:\Windows\Installer\e5b2826.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFD1E5C3EE0866F6EE.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI2A0A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI830C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI833C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8AB2.tmp msiexec.exe File created C:\Windows\Installer\{CA305419-B2DA-461B-BB23-90F7D713EF3F}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\e5b2839.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2EDE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3037.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blue.iris.6.0.3.4.[x64]-MPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BlueIris.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blue.iris.6.0.3.4.[x64]-MPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BlueIris.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BlueIris.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blue.iris.6.0.3.4.[x64]-MPT.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4620 chrome.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005f9272311ec871480000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005f9272310000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809005f927231000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a5f927231000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5f927231000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 13 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209480172808947" chrome.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD6B3C53-1871-4ADF-9C71-24B682012371}\ = "SimpleJsonParser Class" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60534020-0887-486d-b6b7-0f177d43c00c}\TypeLib MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\914503ACAD2BB164BB32097F7D31FEF3\MICROSOFTVISUALC msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" blue.iris.6.0.3.4.[x64]-MPT.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} blue.iris.6.0.3.4.[x64]-MPT.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" blue.iris.6.0.3.4.[x64]-MPT.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EASendMailObj.CertificateCollection.1\CLSID\ = "{036C2F8C-8D3C-4F4B-9B36-3B6F1D29C0B4}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A386C7CB-8547-451E-A7DC-CD74BA675247}\TypeLib\ = "{8B5A2BD0-5638-4CCA-A7FF-91B9E6768AC4}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6C589C71-6FDC-4859-A9CD-F3A7EA2206D0}\TypeLib\ = "{8B5A2BD0-5638-4CCA-A7FF-91B9E6768AC4}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell OpenWith.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2EDDFCB044AA7804E8770E205515CAE6\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2EDDFCB044AA7804E8770E205515CAE6\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EASendMailObj.Certificate.1\CLSID MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD6B3C53-1871-4ADF-9C71-24B682012371}\InprocServer32\ = "C:\\Program Files\\Blue Iris\\EASendMailObj.dll" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EASendMailObj.DkimConfig\CurVer MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ blue.iris.6.0.3.4.[x64]-MPT.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60534020-0887-486d-b6b7-0f177d43c00c}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD6B3C53-1871-4ADF-9C71-24B682012371}\VersionIndependentProgID\ = "EASendMailObj.SimpleJsonParser" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{539c9dbc-57d4-4acb-8a91-329a2cc6270e}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DF8A4FE2-221A-4504-987A-3FD4720DB929}\VersionIndependentProgID regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" OpenWith.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2EDDFCB044AA7804E8770E205515CAE6\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60534020-0887-486d-b6b7-0f177d43c00c}\ProgID MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DA08318D-E853-4E45-AA3F-2B95CC51C16C}\ProxyStubClsid32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF80631D-E750-4C67-AFC3-5170AB72518B}\ = "FastSender Class" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA08318D-E853-4E45-AA3F-2B95CC51C16C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{036C2F8C-8D3C-4F4B-9B36-3B6F1D29C0B4}\TypeLib MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EASendMailObj.FastSender.1\ = "FastSender Class" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF80631D-E750-4C67-AFC3-5170AB72518B}\Programmable MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2809780-C98E-4C6D-A552-DAB146D4AD12}\ = "ICertificate" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EASendMailObj.BrowserUi.1\CLSID MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\BlueIris.exe BlueIris.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg blue.iris.6.0.3.4.[x64]-MPT.exe Set value (data) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 0100000000000000ffffffff OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65653aa2-8e17-4f5c-a8c3-1991e8856359} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6C589C71-6FDC-4859-A9CD-F3A7EA2206D0}\VersionIndependentProgID\ = "EASendMailObj.SimpleJsonArray" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A386C7CB-8547-451E-A7DC-CD74BA675247} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\UScreenCapture MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3E4C3A350BDF525418AC0BD5F29AEF2A msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell blue.iris.6.0.3.4.[x64]-MPT.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AD28FC9-0C71-4E89-85C9-CAECDE8BE3AB}\ProxyStubClsid32 MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65653aa2-8e17-4f5c-a8c3-1991e8856359} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{036C2F8C-8D3C-4F4B-9B36-3B6F1D29C0B4}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6C589C71-6FDC-4859-A9CD-F3A7EA2206D0}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08088DBB-A031-4DCE-A4DF-7683CBE706AF}\ProxyStubClsid32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{217785E8-1188-4FDD-BBB8-1EB104D32151}\TypeLib\ = "{8B5A2BD0-5638-4CCA-A7FF-91B9E6768AC4}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{011E1175-8AC1-40D5-BC61-903999FAAC8D}\ProxyStubClsid32 MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65653aa2-8e17-4f5c-a8c3-1991e8856359}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EASendMailObj.OAuthResponseParser\ = "OAuthResponseParser class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60534020-0887-486d-b6b7-0f177d43c00c}\Programmable MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68CB8B02-D4AA-4A16-97A0-6B9488F98189}\ = "_IMailEvents" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14 VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EASendMailObj.CertificateCollection\ = "CertificateCollection Class" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68CB8B02-D4AA-4A16-97A0-6B9488F98189}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU blue.iris.6.0.3.4.[x64]-MPT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2EDDFCB044AA7804E8770E205515CAE6\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EASendMailObj.OAuthResponseParser.1\CLSID\ = "{60534020-0887-486d-b6b7-0f177d43c00c}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2809780-C98E-4C6D-A552-DAB146D4AD12}\ProxyStubClsid32 MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\914503ACAD2BB164BB32097F7D31FEF3\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.50.35710" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B8C75E2-9631-4834-9D3B-32C51C7FB962}\TypeLib\ = "{8B5A2BD0-5638-4CCA-A7FF-91B9E6768AC4}" MsiExec.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Blue_Iris_.rar:Zone.Identifier chrome.exe - Runs .reg file with regedit 3 IoCs
pid Process 4596 regedit.exe 4764 regedit.exe 4708 regedit.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3984 chrome.exe 3984 chrome.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe 1344 BlueIris.exe - Suspicious behavior: GetForegroundWindowSpam 4 IoCs
pid Process 2824 OpenWith.exe 3880 7zFM.exe 1184 blue.iris.6.0.3.4.[x64]-MPT.exe 4196 blue.iris.6.0.3.4.[x64]-MPT.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 412 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 412 AUDIODG.EXE Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe - Suspicious use of SendNotifyMessage 22 IoCs
pid Process 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 1916 BlueIris.exe 1916 BlueIris.exe - Suspicious use of SetWindowsHookEx 34 IoCs
pid Process 4512 blue.iris.6.0.3.4.[x64]-MPT.exe 4512 blue.iris.6.0.3.4.[x64]-MPT.exe 4512 blue.iris.6.0.3.4.[x64]-MPT.exe 2824 OpenWith.exe 2824 OpenWith.exe 2824 OpenWith.exe 2824 OpenWith.exe 2824 OpenWith.exe 2824 OpenWith.exe 2824 OpenWith.exe 2824 OpenWith.exe 2824 OpenWith.exe 2824 OpenWith.exe 1184 blue.iris.6.0.3.4.[x64]-MPT.exe 4196 blue.iris.6.0.3.4.[x64]-MPT.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe 1916 BlueIris.exe - Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 4512 wrote to memory of 4764 4512 blue.iris.6.0.3.4.[x64]-MPT.exe 81 PID 3584 wrote to memory of 4232 3584 chrome.exe 83 PID 3584 wrote to memory of 4620 3584 chrome.exe 84 PID 3584 wrote to memory of 2704 3584 chrome.exe 85 PID 3584 wrote to memory of 2704 3584 chrome.exe 85 PID 3584 wrote to memory of 5036 3584 chrome.exe 86 PID 3584 wrote to memory of 5036 3584 chrome.exe 86 PID 3584 wrote to memory of 2508 3584 chrome.exe 87 PID 3584 wrote to memory of 2508 3584 chrome.exe 87 PID 3584 wrote to memory of 4880 3584 chrome.exe 88 PID 3584 wrote to memory of 4880 3584 chrome.exe 88 PID 3584 wrote to memory of 1948 3584 chrome.exe 89 PID 3584 wrote to memory of 1948 3584 chrome.exe 89 PID 3584 wrote to memory of 4212 3584 chrome.exe 92 PID 3584 wrote to memory of 4212 3584 chrome.exe 92 PID 3584 wrote to memory of 3568 3584 chrome.exe 93 PID 3584 wrote to memory of 648 3584 chrome.exe 95 PID 3584 wrote to memory of 648 3584 chrome.exe 95 PID 3584 wrote to memory of 3916 3584 chrome.exe 96 PID 3584 wrote to memory of 3916 3584 chrome.exe 96 PID 3584 wrote to memory of 4904 3584 chrome.exe 97 PID 3584 wrote to memory of 3952 3584 chrome.exe 98 PID 3584 wrote to memory of 1400 3584 chrome.exe 99 PID 3584 wrote to memory of 4628 3584 chrome.exe 100 PID 3584 wrote to memory of 4628 3584 chrome.exe 100 PID 3584 wrote to memory of 800 3584 chrome.exe 101 PID 3584 wrote to memory of 800 3584 chrome.exe 101 PID 3584 wrote to memory of 4652 3584 chrome.exe 102 PID 2824 wrote to memory of 3880 2824 OpenWith.exe 105 PID 3264 wrote to memory of 3460 3264 msiexec.exe 110 PID 3584 wrote to memory of 3984 3584 chrome.exe 111 PID 3460 wrote to memory of 4164 3460 MsiExec.exe 112 PID 1344 wrote to memory of 3480 1344 BlueIris.exe 113 PID 3480 wrote to memory of 4920 3480 vc_redist.x64.exe 114 PID 4920 wrote to memory of 4828 4920 vc_redist.x64.exe 115 PID 1680 wrote to memory of 1044 1680 VC_redist.x64.exe 124 PID 1044 wrote to memory of 764 1044 VC_redist.x64.exe 125 PID 4828 wrote to memory of 4452 4828 VC_redist.x64.exe 126 PID 4452 wrote to memory of 920 4452 VC_redist.x64.exe 127 PID 920 wrote to memory of 4480 920 VC_redist.x64.exe 128 PID 1344 wrote to memory of 3396 1344 BlueIris.exe 129 PID 3264 wrote to memory of 2088 3264 msiexec.exe 130 PID 3264 wrote to memory of 4908 3264 msiexec.exe 131 PID 3264 wrote to memory of 916 3264 msiexec.exe 132 PID 1184 wrote to memory of 4708 1184 blue.iris.6.0.3.4.[x64]-MPT.exe 135 PID 3584 wrote to memory of 2952 3584 chrome.exe 136 PID 3584 wrote to memory of 2952 3584 chrome.exe 136 PID 4196 wrote to memory of 4596 4196 blue.iris.6.0.3.4.[x64]-MPT.exe 144 PID 1916 wrote to memory of 1256 1916 BlueIris.exe 147 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\blue.iris.6.0.3.4.[x64]-MPT.exe"C:\Users\Admin\AppData\Local\Temp\blue.iris.6.0.3.4.[x64]-MPT.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\regedit.exe"C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\\regpatch.reg"2⤵
- Runs .reg file with regedit
PID:4764
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004B81⤵
- Suspicious use of AdjustPrivilegeToken
PID:412
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee1e5c728,0x7ffee1e5c734,0x7ffee1e5c7402⤵PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1856,i,785459617679746682,16831435789188665925,524288 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2120 /prefetch:112⤵
- System Time Discovery
PID:4620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,13357388576853765013,3897939497850269550,262144 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,11413379863677533658,9532333737008980442,524288 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2012 /prefetch:132⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,16598379887106179587,7146270321788633846,2097152 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,14045768816789361203,6793588342254155485,2097152 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4196,i,12613051071583961905,11624126154544877257,2097152 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4212 /prefetch:92⤵PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4608,i,1006059904834742850,11328124045741367002,2097152 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4612 /prefetch:12⤵PID:4212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,4076873623071902628,6392325718351060439,524288 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5388 /prefetch:142⤵PID:3568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5660,i,8261205897089155905,6645023867107461822,2097152 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5692 /prefetch:12⤵PID:648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3572,i,6034281956815925188,951773875221701693,2097152 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3568 /prefetch:12⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3316,i,16949588811228083819,4651638493280720025,524288 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3828 /prefetch:142⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,12213967587704843798,14170361558755829746,524288 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3184 /prefetch:142⤵PID:3952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,16122500683302349131,3635772270501331289,524288 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5848 /prefetch:142⤵PID:1400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3064,i,8105770438665659047,3399791732107201403,2097152 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:4628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6060,i,6418292147846797850,7233963598404043276,2097152 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6300,i,5478387768331153667,628019991351569282,524288 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5292 /prefetch:142⤵
- NTFS ADS
PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1208,i,14533484843201639960,1615283436266075100,262144 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3212 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:3984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6372,i,7592510984217934901,6003153913170079246,524288 --field-trial-handle=2088,i,9987619448309319853,1289378741496762927,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6288 /prefetch:142⤵PID:2952
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3056
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1692
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3152
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Blue_Iris_.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3880
-
-
C:\Users\Admin\Downloads\Blue_Iris_\BlueIris.exe"C:\Users\Admin\Downloads\Blue_Iris_\BlueIris.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Roaming\Perspective Software LLC\Blue Iris\prerequisites\Microsoft Visual C++ v14 Redistributable (x64) - 14.50.35710\vc_redist.x64.exe"C:\Users\Admin\AppData\Roaming\Perspective Software LLC\Blue Iris\prerequisites\Microsoft Visual C++ v14 Redistributable (x64) - 14.50.35710\vc_redist.x64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\Temp\{BD3FE7D9-0862-48EF-9442-60A95D5C8A38}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{BD3FE7D9-0862-48EF-9442-60A95D5C8A38}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Roaming\Perspective Software LLC\Blue Iris\prerequisites\Microsoft Visual C++ v14 Redistributable (x64) - 14.50.35710\vc_redist.x64.exe" -burn.filehandle.attached=696 -burn.filehandle.self=6923⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\Temp\{FDD08134-EBD9-437C-8914-31A6A27B849E}\.be\VC_redist.x64.exe"C:\Windows\Temp\{FDD08134-EBD9-437C-8914-31A6A27B849E}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{45A3FAAE-942F-4FAC-8312-B3CDC4B9174B} {5716E31A-06BC-4732-8590-5033289127F3} 49204⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={b2f5e2cc-18af-40da-9bb9-c296da1cb96c} -burn.filehandle.self=996 -burn.embedded BurnPipe.{5AE4B81E-577E-48A5-BC60-54638380B9F8} {90936FF7-8BAD-4B79-B513-98BB785DD777} 48285⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={b2f5e2cc-18af-40da-9bb9-c296da1cb96c} -burn.filehandle.self=996 -burn.embedded BurnPipe.{5AE4B81E-577E-48A5-BC60-54638380B9F8} {90936FF7-8BAD-4B79-B513-98BB785DD777} 48286⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{8A9E340B-1AD0-4AB2-8377-626F267E4D9F} {1DEF1DF2-32BC-4B1C-A3FA-E6284D0F2161} 9207⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4480
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\Blue_Iris_\BlueIris.exe"C:\Users\Admin\Downloads\Blue_Iris_\BlueIris.exe" /i "C:\Users\Admin\AppData\Roaming\Perspective Software LLC\Blue Iris 6.0.3.4\install\Blue Iris.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\Blue Iris" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blue Iris" SECONDSEQUENCE="1" CLIENTPROCESSID="1344" AI_MORE_CMD_LINE=12⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:3396
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4D0F3730655D9257DEB85462853E8721 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\Downloads\Blue_Iris_\BlueIris.exe"C:\Users\Admin\Downloads\Blue_Iris_\BlueIris.exe" /groupsextract:100; /out:"C:\Users\Admin\AppData\Roaming\Perspective Software LLC\Blue Iris\prerequisites" /callbackid:34603⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4164
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 17BD810217448659F97E74EAAED2BF412⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2088
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Blue Iris\EASendMailObj.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:4908
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Blue Iris\UScreenCapture.ax"2⤵
- Loads dropped DLL
- Modifies registry class
PID:916
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4956
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:3360
-
C:\ProgramData\Package Cache\{b2f5e2cc-18af-40da-9bb9-c296da1cb96c}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{b2f5e2cc-18af-40da-9bb9-c296da1cb96c}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\ProgramData\Package Cache\{b2f5e2cc-18af-40da-9bb9-c296da1cb96c}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{b2f5e2cc-18af-40da-9bb9-c296da1cb96c}\VC_redist.x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260418020904.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\ProgramData\Package Cache\{b2f5e2cc-18af-40da-9bb9-c296da1cb96c}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{b2f5e2cc-18af-40da-9bb9-c296da1cb96c}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{b2f5e2cc-18af-40da-9bb9-c296da1cb96c}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260418020904.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:764
-
-
-
C:\Users\Admin\Downloads\Blue_Iris_\Blue.Iris.6.0.3.4.[x64].Patch.And.Custom-MPT\blue.iris.6.0.3.4.[x64]-MPT.exe"C:\Users\Admin\Downloads\Blue_Iris_\Blue.Iris.6.0.3.4.[x64].Patch.And.Custom-MPT\blue.iris.6.0.3.4.[x64]-MPT.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\regedit.exe"C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\\regpatch.reg"2⤵
- Runs .reg file with regedit
PID:4708
-
-
C:\Program Files\Blue Iris\blue.iris.6.0.3.4.[x64]-MPT.exe"C:\Program Files\Blue Iris\blue.iris.6.0.3.4.[x64]-MPT.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\regedit.exe"C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\\regpatch.reg"2⤵
- Runs .reg file with regedit
PID:4596
-
-
C:\Program Files\Blue Iris\BlueIris.exe"C:\Program Files\Blue Iris\BlueIris.exe"1⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SYSTEM32\regsvr32.exeregsvr32 /s "C:\Program Files\Blue Iris\EASendMailObj.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:1256
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4656
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5b282b.rbs
- Size 19KB
- SHA256 2ef90a0b1fba6b09c275ea00d59158b9dd9982d0368a6fdbf58fd11cb6c2e77c
- MD5 f72fcc6b15eac933d389d3c2a66d4cbb
- SHA1 9afed34823c88fed0451705dcf448276e67fb51f
- SHA512 9b25b256576ba50ba417db8c14f19c5ff36b203b7b548a566111aa09ada1ef7ed8f8b68c9b3638e0b268601a5993fb761bc436cba9797340b640f9886013f32e
- SSDEEP 192:xnRIC1kRf15dXcFUADIc1f+W+y4+ogP3v7:xnRIC6RfTeC81f/c4v7
- TLSH T16A92FB42A680C9D2D8766B31CD631BA53B76DBD5A350438B50DC90308F93BCA2F9D69E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5b2837.rbs
- Size 19KB
- SHA256 2984cc21bf3c778f9bcfcae118a76d4928fdd23e8cf22da7d0d7b835906bf7fb
- MD5 9770aedaad05a454dd2db6e86679ff06
- SHA1 d74a651dc6d5c42de01e975ceadfc29639416ce1
- SHA512 4cd0996643733df91cae0ccef6a9263ae3753f0b1e3ee44c5e4e94b9c4fdcf5439faf7220da18140aafaa793769a6f3d2f67ae2541c1f1e8ddf6fe0c53e2383e
- SSDEEP 192:xGdn3vqwaJ+DAGRQnI0neqEgA3Cm90GIxV0GsxVREIsYpoEpf:xGV3vqwaJOAGRQnI0pC0zV0hppL
- TLSH T1B9921D417A04D693D8E22B71CD531B247772D7DAA716834B85CCC1308FA3BC62F8DA8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5b283e.rbs
- Size 21KB
- SHA256 23b1f98ee1f9923c806e7b8577654a08a725b195a0fc679f10dcbf9f4ed99002
- MD5 b97ed73fda8669dd39b313dc5878e176
- SHA1 878e7f77102cc385d03631ae9e3ce3ce1415cd65
- SHA512 8a047f79a2dc698c2baee92945115d2aed03062a461c6a29991da9d2cad03959e939b8d2d2dcd93d59d53c8a2e28199b1a04d029f6f24eeaf4f7dddb65284bb9
- SSDEEP 384:xKRrGRGnAKxNAUhUC7xJjrMNYPzIbSfo8cnKqRWLmPhkP:xKCSAKhkmT
- TLSH T111A21D03768199E3C86227B1DD671BA93B73D7D99350434B10ACD1388F633C72E5AA9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5b284d.rbs
- Size 21KB
- SHA256 987de43b93c79a768bb086016c60390a21fdfbd3d772340c2b91466569a84de6
- MD5 ab5ceff34ff83375d4cdef9da00c4d6d
- SHA1 c6d141f74c6871d6dceeb6107c9484c3e37bf930
- SHA512 d728263079cc5853bbc5f8da0e1cffcecbd6b3e967c13d67d4482ab0fc69fe4ef32482323e115848cf2a05ac4b418c5d4ee9fe3f24e42cb85d764a7135b8fbd4
- SSDEEP 384:x9kXfmuD6ewpe9njl4BsWpsalckU72eC6NRdsSdSUx9qUf:x9kXfmuD6ewpe9npEsWGRO29x9/f
- TLSH T16FA20F426600D6D3D4A62BB0CDA73B2637B6D3DAE395474B04CC80748F937C66F9D68A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5b2850.rbs
- Size 22KB
- SHA256 cfb83a75bf5b4105b89fc20fe5f09ea2645cad87e4c00b7dd0634024b25c3b6a
- MD5 1ccdc7e8f67d3f0c673625ffbc00a48e
- SHA1 2d0dc8e829276df3d3a9796972283cc6b4b38994
- SHA512 3e7958ca314beebe1be803b22f60183689815eb598c3706eaa39c408fefed1712ecfbe60885ca8b0f7ed1430c45daaf06af342532b8dfb1a94b384bb41c8c536
- SSDEEP 384:t7D+wSKFqaoiyRmWrBS9hTIeVWE282Blk:tGwSKFqaDyRmWrBS9hTjWE3yk
- TLSH T19CA2E1918D40EAC5F2133A714F626B1963A6CD88271C1D27738C833F6DC3B62167E9B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Blue Iris\BlueIrisAdmin.exe
- Size 185KB
- SHA256 18678a054e87b83bde216b3f2e267a89889745e762791211df9a5cbbf28d3336
- MD5 63efa5b767321443600131c37fe31a96
- SHA1 6b972e202c6c82b4d377afa6aaa474497b1f4437
- SHA512 758b048163dbff8c5ad64ac46a8648f2a024db3372bb3eb465162b881a7543f803cc5d229a3ec9bfb1c5930851012ba4cb6ad3cec7a7a2c0e5c8a073cb50705f
- SSDEEP 3072:PmmgaxpZNVgrSE4cIiIepbngtdo95ma0xkCurDSnK1v:TxpvWWKpbgta95NskCUSnK1
- TLSH T10504BEC6F50089A9F86440B22027F9B376677C65D5818ABA33E4BF0F397319349E7B46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 8053cd41a6beff1f60d57263c992d942bc0eefaee377b8cf1ea3bbe1ab98ef1b
- MD5 7bf6979a76b06b346f5688812f358414
- SHA1 84dd2619189778b03ce696d55eaca86dd6a4aa6e
- SHA512 7002193d3e70c4329c3419bf7c8afe0c9d6c8f431d20fc724f188c0014b1db73460d5131fb6ab883c6c87e9374a903853a55e847e6682485d148758ff567685d
- TLSH T10DE02BAACA71DC371AFD0B2950500746F661139B2B60545F3A3D910C8FF2A3A498695C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 528B
- SHA256 1b0b2dd9f7979c5baf378dd2cc226ac3bf074e5c29220456ebf94d5d1c7a4ee1
- MD5 9dc02b679497fae8b7a5a1ddd14a6536
- SHA1 dd101fe8603c549f9580b082ca4c4eefb042aaab
- SHA512 c3d0fdc260bc35cc6eef469ae170fef37734fbcbb32b45d6dbf4e8fae8c11a5589aa164f71f125693e44d238984d43fa27bdbd19260eb6b2330b99960a7c1628
- TLSH T180F0ABCD6220E350DB64027070D10C7E266C28E0B213236FC0D945AD76C7EF813D6043
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 ec398166d6de3a610b21057e91f3a69f0c42fc5368a0f955273ab6e18636b016
- MD5 da486b5ab5cc43af0e431393bb9ff582
- SHA1 c6856c5e4b13e52c89a069c748d5af5e2857e40d
- SHA512 28a8761ad570feb82ceb488f81e34489cc7557aac52caebd6113570c84e3a4f6e1d6f599aa942b33cd7956feb67447edda3db53df32ee1d9a2ca3d66772ac215
- SSDEEP 96:DBe+oaJ8y8Iaan6kmOpHyXtRzxIyFCyZr:DBe+oaJ81Iaan6kmOpHyXtRzxIyFCy5
- TLSH T1B6C17AF3C3E4862D895196F4AB156F1ECE290A14432C3C66C9E4EE5B93E2872E20175E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 5e553d84b853ade1ea99795b9d2e9d39f66c2b721619c22a9a6acc40393a8bdc
- MD5 038d5d10eb964d7ed4677a30ee88c8cb
- SHA1 d1e7e69cc91a65759e2acc6611acd1974cdf3c43
- SHA512 a9fe3d1ad0054ca8355646b5adc32a5e87b4c8ff3709ef51f75c64836ea6f908c9dfb655672a1f1435c55116c2def4b6c2ee35ca2927e5e58d100f3aaf392899
- SSDEEP 192:xRhcBzf62HvvXVIdvv7HYpAPRp2Nj098Hsb+WNnRG4T42t+IkwIVE+VyIsnAUgtK:xRhmzfF0nEUXf6w4L2UIoi28
- TLSH T1EA52D72EBA24657B6DCAC22EF922BB57E7F1103161941E84EAFC8A1C14E79CD2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 746d5a4a0a846709eb14a326207baa50e331e49928c4158eed3059c210cba51f
- MD5 357eb05bf95786e216692f27d6e53fdc
- SHA1 4485e9294235aac8dc9098cc6f95e4d73aee4530
- SHA512 4b906c1788662af2a3be06733e57dc206785e9c3eca921eb67610aceb939544470eb6a17cb4edf0b4015aa1da161c6fe07f1258c39f5c9657a08dab20b72ccdd
- SSDEEP 192:xRhcBzf62HvvXVIddv7HYpePRpgNjww98Hsb+WNnRGRwP+T42X+IkwIVw+8yIsnb:xRhmzfF0dEWXs6w4SJ2OIoe5vE
- TLSH T1A052E82EBA24697B6DC7C22EF912BB67E7F1103165D01E84EAFC8A1C14E79CD2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 d90e124eee1182ee75594ae1dd2cf9226fc93bb11c529d0f4108a295fca83929
- MD5 499a7f5b202287af8b1d0f369d677b45
- SHA1 dbef40d6f99197359c10b7a76d6f65c3aa0e7bfb
- SHA512 6a95ed07de730b9467a3576cbf36f74456d19512edf051008264250531cc09fcf239def9d580219e1492d883dc5be2909222e4daa6b9802c905c90dbe952715b
- SSDEEP 192:xRhcBzT62HvvXVIddv7HYpePRpgNjww98Hsb+WNPZu1RGRwP+T42e+IkwIVw+8yN:xRhmzTF0dEWXs6w0GSJ25Ioe5vE
- TLSH T11862E82EB924A97B6DC7C21EF916BB67E7F11031A5D01E84EAFC8A1C10E79CD2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 2328ea9073549adab02fe99e0127dcb5999d2517b99cac1f85861fd5d1268867
- MD5 40aba898dc4efcd9988ec53e06a8b15c
- SHA1 af8b73cd37e29a8d0b68b474702174d179201fac
- SHA512 1f184dc588afff9f591e8a55398deb52c19ccb2c739739b1384e2a6da49836e5a8171b750e21fad998d39b550d8f4906b846178327f24be8db946220ec5b5a8f
- SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLuLcif3yXODVw+ErU3L5HGcHRXD:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pq
- TLSH T1D172FA676C4C9A770F94CACCDD27BF4FADB9024B65E9886443FA981903D5ACB010A1F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 02d754a1f4deb7574da55cfceef0121a4a7a031acacc4b984f1be2cd7b676fe4
- MD5 48571cd31b177ca1fe5908127b3bb1f8
- SHA1 7cba77530b709a4fec739df08b572b30f685e92a
- SHA512 c9f876ef913a960b974265a20ab47bc6a142458af171180830ce592fc22d07ee2f30b48282e867637fc5a87b7b313da0e49ea7580ad5589a5cd1373307256c72
- TLSH T118B0129080429955C02302F825D2048C31189F11E705130153F06A79E8672908024150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595337.TMP
- Size 96B
- SHA256 78b63a7019675f5ba7f36edc5f028caf3597bf643c938a48f220460169a6efb1
- MD5 73b6fa0fa97154b123f7566dd20acfb1
- SHA1 bcd77c3aae0dc1e5b1f22b5cec547aa360c9fe1d
- SHA512 2cf3e10baca150ec12064251cc9f6082b43779d7ed33c50ced669ab54237e16f375c8aa857d1ec51f62aeca8e341dd52e05e50133b039a5aa5b9d482d1a44412
- TLSH T19AB02200C002A202C00A03B02AA083C83220CF30C2030203A2F00E2ACCA83200220028
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 194KB
- SHA256 8e8f26c7fb25a3441462a0aa169f524b019bff1a3abc89f0b253f85b6e9c3392
- MD5 981a67ceab073e7da16305ac24304978
- SHA1 64aea5935ed540b379518bfae6c5f79403c241dc
- SHA512 83c16d30f3e09c08d72075971d7e05cc0db0945f5616dfa05b8bb9a2afdc1cb6894fa181ea6b0ecf7254c0cd638bcf0835923851c13b54d6db4cb2479cb8f83c
- SSDEEP 3072:5qYcxLAWHVIj479TwN1eI3HXk++J3qUQm08KMWF0bFTcVHr6zA:5rgIuyN1eIHk++JjcMW2VcVL/
- TLSH T1C81412B9901FBC140F27DB2615539F294DB1E9DB171421FC32C76F6A184ABC08B279AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 193KB
- SHA256 d3d2838e21a3b6224a7d29a864c964645ef11f598a90fdba9364374e26b151bc
- MD5 ad09b3ddce8bd7856907811b3b1eb80a
- SHA1 4d8dbb382591fc34a1a74e3c8039e126a573c1c2
- SHA512 cfb3b048a09cdd73116b5c63b5c271aa15e2b401a341a812af48a7c96d76d2cdcc5dc333068fb8972b5268e9e6c06d04b2e91352856976d32f83d2ef7bd2adf7
- SSDEEP 3072:sqYcxLAWHVIj479TwN1eI3HXk++J3qUQm08KMWF0bFTcVHr6zA:srgIuyN1eIHk++JjcMW2VcVL/
- TLSH T1D51422A9941FBC240B27EB3715679E2949B0A9DD135021FC32C36F7B184BB8147279AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 194KB
- SHA256 f76d1604508410c3f4b3519791462ea0868f036b5b8e94bca0cdd0af6435b4de
- MD5 3552493c65a10d5734d855151c907aac
- SHA1 0429bd2fa35e715adf48eccf3f14d65ba05960f9
- SHA512 a389d834f8c460e47f534623121d68738e5f226e27e3aa298d1eb394d262dd9f62357eaae9220d78d201e3cc6648fd1b0b25f33fce738cfc2289f0461e864f0d
- SSDEEP 3072:pqYcxLAWHVIj479TwN1eI3HXk++J3qUQm08KMWF0bFTcVHr6zA:prgIuyN1eIHk++JjcMW2VcVL/
- TLSH T1391412B9901FB8240F27DB3615539F294DB1E9DB171421FC32C76F6A144ABC08B279AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 11985d142cda6e38bed75f66644fd0c78f00307c85c319932fbfa5ec84ce4c5b
- MD5 5f6d62caeb1bc97cf2f10dceefbbe60b
- SHA1 8cf34fc25dad0dac3f279d1c117fc1ece61edd04
- SHA512 a4a0bff3514b328606603449746cb5b5d8b426b1763c0cc5f50a1c34a76e3396da7d95ad93f22fa31b4c73114268cb45be940623fbd547caa04703f7fdf6d8fd
- SSDEEP 1536:wSPP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:J++J3qUQm08KMWF0bFTcVHr6zf
- TLSH T1129312B9991E7D39236EC396A0179CAC8CD3DCDE151411BC30C76F1E14BB392A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 193KB
- SHA256 a6d839253e9ed1b3b2a0addb1e214c47a825e1bffef493c389de904c61999403
- MD5 67164434d00062597977bab08a260695
- SHA1 cebe3012e8f614ae500f44e02b1f183c7429724c
- SHA512 140a1a7d9ab555eb76601778f698f7bcb88eaa0a9b7a703517e471541656738c06c716a377b860ac9c10d76870595b61ec5db76bb5512f601c0964bcf55d05f5
- SSDEEP 3072:hqYcxLAWHVIj479TwN1eI3HXk++J3qUQm08KMWF0bFTcVHr6zA:hrgIuyN1eIHk++JjcMW2VcVL/
- TLSH T1911422A9D41FBC240B27EB3715279E2949B1A9DD135021FC32C36F7B184BB8147279AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 193KB
- SHA256 6114564c4be6eb445d30fd642d434520cea4ca80d8d95cddb92a171884d1b945
- MD5 3d1555b5c794b2c8660ad3c8392ba0d0
- SHA1 4858d94214333bebc34a226673e1607c04f80183
- SHA512 bda7b47436cdcf46e8216a125c4b0c5c6bac75066e0ba2b66a48596f2132b4bc570b5e6ab5be94e67fd846a1615df6d2f9e0063f97be260ba01055bb1ef93f16
- SSDEEP 3072:HqYcxLAWHVIj479TwN1eI3HXk++J3qUQm08KMWF0bFTcVHr6zA:HrgIuyN1eIHk++JjcMW2VcVL/
- TLSH T1C21422A9941FBC240B27EB3715279E2949B1A9DD135021FC32C36F7B184BB8147279AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 28KB
- SHA256 204c7982620ddea42bd5f17c2ffb7710fa1a7b9fbaf9c20b252fb84016ffe817
- MD5 d24ccfc4fc2a7618aad4cf2fbe54193d
- SHA1 a3a849e9ba626fa3b2c5ed9550c18e01329d5891
- SHA512 c30cbb5d07d7ef389f72011b098d8dfc52a7e487a01ebac5a5742ebec057e5bcda1b4358e5f2c0747e58eb4bef3c02b0e2aff7998426410a6a0d93e41c6e6262
- SSDEEP 96:AOThl2q0AHyM4GeOGBzP/EUGxsDDAVbyu+i8BqBdFFp:A+hT0AS9OG3Ga8yjf4BdHp
- TLSH T199D27352B884DA16DD092C769FEBD6EC62313E26CD2B131379D1B77F09BB1C00D18984
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 28KB
- SHA256 fc0d7accdb6f65f6fd76056af3a91ee8d3493e84518df05db5c234e989b45cf4
- MD5 fbe51662b42d406b36abb407e951423e
- SHA1 e8cae3bd4cd9f07e2114c5a4bae2cf14d81bfe12
- SHA512 4347a74d253821a3d761c0671ad161ee605b4b897c0ddef31d1f7b3aee34d5d54ff8dbc7efa0bbf9025acab583ce9b68fffd1b31a6371ccd9fe795a3c911976b
- SSDEEP 96:pWTgl2q0AHyM4GeOGBzP/EUGdsDDAVbyu+i8BqBdFFp:pmgT0AS9OG3Gu8yjf4BdHp
- TLSH T185D27452B844DA16DD492C769FEBD6EC62313E26CD2B131379D1B77F0ABB1C00D18584
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 28KB
- SHA256 27613047499f45c25c5ea9fb501bc01c3d955713e032896831b6e2ebe281cd6c
- MD5 1eccc85f4a04034ca9af17dc5ee054fb
- SHA1 9461d1951c8db821198558f87cf77dda2d81a165
- SHA512 6e2b64f22bef0c7ecfee162b87eb9702cea7c92861e97b6020de1b3179cfef64b0d771fa711f70e759d775a916414beca12cf8e7b17e1bb593577910bdead185
- SSDEEP 96:rWYR3l2q0U9HyMKGeOGEZP/EUG5sDDAuGby0L+i8ErBdFFO:rP3T0aSzOGgGyay06fuBdHO
- TLSH T1DED2B752B844DA26ED0D2C76AFE7E6DC62313E26DD6B131375D1B77E09BB1C00D18984
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7CEB9B2A0E395BD64E74381485A106AF.dll
- Size 3KB
- SHA256 125fc74e03435b3e0ede0ff523d625d9c1fbb299286e9e2dbd1442e506150da6
- MD5 5afb011d9db047bb0400c5c5ca2e450b
- SHA1 3e8631283d2242376bf1485f41bf65f1c12da30c
- SHA512 20b6cae40a54f5c82992b33abdb309c366e17b28427caa0200de19905c48c0504aa3b998c54fb0d22e441391bfdfbfeb892e8bff8384610c1f9e131cc9e261f7
- TLSH T1377112633B71967BE27907B123474EA2EB35061402A2C81C0BC54B56BCB66675F13B82
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1344\leftbanner.bmp
- Size 1.0MB
- SHA256 25f90cd95e8b175f8503cf4f43ebe2f8332857d1c788ed3cd24fdac3ccac45e8
- MD5 b8ae8af1972d802be1a957eda4dc6909
- SHA1 0d23ff900cfbc31cb640599071019e98715072a4
- SHA512 08f6aa0cd692bfc7d462c6e2bb2ea4ed2c8f634bfcc13ac668d06ef72542f0f838221fda664d513e422165f09f4e000bb50f6f744732ab79648c0827e78b7128
- SSDEEP 1536:L/IUrALhc4qTA0gvzI62aqVugLfsiSl/FdKvbRfw/1X3SSkQIWAWyNhw1IdBg2Lc:L/Ipi4gaq0KfsN/Fdb
- TLSH T1D435909974108C2ACC30C9B8F81AB0DD0EEA3D95748627C61F19FF4E6B7548989F4B72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1344\squarebanner2.bmp
- Size 200KB
- SHA256 c15148a6194c371e42821f1cdca9c79e3f8910947fac5115973b3d09ef3786c5
- MD5 bf4a634e00a98c43d0098edb7196e196
- SHA1 e3e3399405a7ef0e29ac888679f63a0cffa6a7e9
- SHA512 5b82a8398ae925cfc7258a4763dd7ec8bdd4a955a5af29b020a5973a4a2566396e439d3f2b002923765b88bef8e6ac11eb62139e9129fd2ea51a2209f51f0598
- SSDEEP 384:pI5Lli26aTXGpkIXCpSl1VPuuW6eNBjbsrR:oLc2JGpkIXCCfPrEpgR
- TLSH T12B149EAD45A900B6CA91D261B641799D1B276F66F8847316F938F00D2F7E3EE0DC285C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Berlin Sans FB.TTF
- Size 95KB
- SHA256 0b6044c72e67aaae9c2ae3c8b4bb06d066fdbc02779c68e3883984acbbe24cb8
- MD5 fe2027c27b6a24505f548c6fd2e1076d
- SHA1 6e361031397047f6ab260247309a05e4f02abdd5
- SHA512 b35912065cbb8c7436d9e0374d8b0d5ad06d7c061a96fc0eadef8d4d2b8e8b441e93ffa438365666690150839bb1e26fa905d6e9212042839575a7e9f091ca0d
- SSDEEP 1536:E8fQGJDTu923TkXjZnH2/PbakADw8hnZlNZtCCw8KkY2rkvifrt:hfnRTq238FnWv3otCC1Nkvifrt
- TLSH T1D693AECAE3AAE80EF36AE230C524F7274DE7B284D32543BEDD4E614DF544590C5AA325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC229.tmp
- Size 1.2MB
- SHA256 89f8ee379f48fa13a1399554134d382c3a941b9068452e9add869e90d4660d53
- MD5 ef078e7d7402f378c00758cec61f05ea
- SHA1 2c05cf85d1051c735f045a6131bf59d75484e769
- SHA512 7a550c13c512b7b1e717c9dfe371d6c760a05a743a068c049f34553d666a096327805483f5bccc7dfbcd7fc89c6e9f5b8a4f2e73d50e75bd3fb6e84adc2f7072
- SSDEEP 24576:u2XzOxmKuxMik23TPw51kJFn9b538h0lhSMXl5qifSp2ek7pQytfXg:uczOxfuxFLPFn9bvpjfSp2ek7pQytfXg
- TLSH T11F458C313A8EC02BE66E15B02A3DDF9A912EBD764B7144C7A3D46DAB64714C21732F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC2A9.tmp
- Size 1.2MB
- SHA256 1d517bcb6c1b23ccfe73b4aac36cebedcc81316b61c8296760f814b61c6bc4a7
- MD5 f28bb7b982ee871884d29f7449cbca65
- SHA1 e22219c3f347bf34876a9effb237cb81ad7adef3
- SHA512 fd9ff004cbb1bde4679da50b0551f413a87e77d7a44d3f4035485ae5f25ea511fdc470e60fbb77e44ffa243ae5d25d34c4661fc5803a8c00f0a00573889c62d4
- SSDEEP 24576:hwy8Y4zHmvfd5/SyjBVu9ksmW/TGdcM7dwoNLDOfXISbTgkrqzf5/UtN92Tqa1oh:0hksmW/TGdcM7dhNLyfYSXgkrqzf5/UT
- TLSH T1E445E716386C4972EE5F057097A6622AFF5D29DABF628CDB82E4CC4D27315C34231F86
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC2BA.tmp
- Size 1.0MB
- SHA256 5020775dc2a86193f221098b007f7858f9896dc8a216fb439827f42314c4d991
- MD5 3be4ddef265c271a3d76e4eb2914477d
- SHA1 a3f141e5e322b2729f990c3910d39465ad16cdde
- SHA512 84a79a0cc657e723d9e83e969e8a6997d03f976ddd74ee858b09b6ab978daa0ac57ffe9c5c0adcf67c4a738d49a406bdc935fbdfd118814799406f2d44a1f21f
- SSDEEP 24576:glkuPFqEdTipGCIVPxx57j6XKn0GTo9MNVfh0lhSMXlgfLSCCxxN9GC64:zuPxVPxP7WX00G09MN4QDSFxxN9GC64
- TLSH T1E5356D20398AC435E52D11F12A2DDFA7D17DBEB10FB284C763D4AD6A58708C2523AF5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bassmod.dll
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll
- Size 288KB
- SHA256 b39cfee7cb6624c4b5831c8c6e6babb5a6640097e9270fe71398bb61f6a98c2e
- MD5 f68dea06b7dcbcf57c6f30fa0e210f51
- SHA1 ec99b2ff48b33fb0b5b4ad0406f6f3c4431f99bb
- SHA512 9f632d2b07186c01273627bcea47ce8a34ef2b2e711351a0620c441932835739e791604385e76d5991d4da2d9af3ece3ea70233b59a59b59f8482d9546c1705f
- SSDEEP 6144:kkxpdyKCGg7DmFBU0DOd3Pf6qR8OIR3FPSdEJ0f:JyG4iBU023Pyq/YpSn
- TLSH T18A5422835A254094E4D01BBB4DFFC49C93A2BE12F62C5A116BA97B1F7D37929C2C0B24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\regpatch.reg
- Size 547B
- SHA256 3eed8631345dd96ca311dff662fae789b3bd949ea20cd39d8dec35a64d458dad
- MD5 3937b292018536820d52b407453d262d
- SHA1 047f4a2c310572cdb361f6da4d0ba0df73c5dc23
- SHA512 efb9b6452dcbb096795ab2ae12460332894acccdd7f853e3b9e333fdd7ce39a2bbf8223cb8a6d716eabb5293c40cd8f58d48eccb61d9a85d5b3b2cf36f77c5df
- TLSH T1E9F02EB849729A9DC2C16401D741F6063695F16731EA8D8F31F475562155C93B025B4F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\shi8123.tmp
- Size 5.0MB
- SHA256 06285446d57089fe85b3b6127bbc92508773af458ad5cf20abf4570d41c0fee7
- MD5 b40e4304f279119d9345be970babce41
- SHA1 f76f5b30e7c333efcba1d4e19215ef1fd21d6943
- SHA512 ad7e6b30b3ba32d641737f499874f23ccda7c4539def0465d1723d579c79c5e3e981df8526d31f2eb79dc0fe572eb4b71a780eb63df11170d4b6a0786f588299
- SSDEEP 49152:MYsVB8iClmCxs6eymR9t9MF4sUe4/xdlIG1+MhbuNKm7g+eTr0fEJJh+XLT8VAMV:id0m0JyR90FNUXVAEi9w
- TLSH T1F436AF5563FE1398F6F78A38A9BA55559C76BC22EB11CBCF011201190AB2EC19F74F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Perspective Software LLC\Blue Iris 6.0.3.4\install\Blue Iris.msi
- Size 5.3MB
- SHA256 67d75d0eae1f3c0112aabaac66706468f5ac29ce5fcd964ebe2fc86f008eab18
- MD5 4ee037c36e2ebf42a8ce60e3997914b3
- SHA1 b63d8ebd432809f2dabfb4808940d196ca9dd36e
- SHA512 195c232f890762df3936b9418ccaff7cbb1cfcdf0f61dee36a26a8ab2c8a02410be5c90ad0bfc309d1585e2f53d3195ab740c6fc0396b989fb62b3887de97173
- SSDEEP 49152:gzkgI2czOxfuxFLPFn9bvpjfSp2ek7pQytfXAhksmW/TGdcM7dhNLyfYSXgkrqz3:0czIfuxFLL21kXcab2CWVpP74P990
- TLSH T100467C11395EC836EA2E00B0A62AEB5EEA2D7DA61F7148D753E4FD5E16304C21372F53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Perspective Software LLC\Blue Iris\prerequisites\Microsoft Visual C++ v14 Redistributable (x64) - 14.50.35710\vc_redist.x64.exe
- Size 17.7MB
- SHA256 ce1a6f9f3eb3f9581a100be793ad4d7d043632e1776fb40cb654c59504776151
- MD5 6e5aa2fcf541e0b0a5c51a3da4fcbf50
- SHA1 01e492d63bc8360bd22d70ae74f91d103d9c9151
- SHA512 aa420688efabfb3f999bc2d2d6049668ee12cc4e9d3cc9d1ea04f1d91ca7f8b027d0e5f1d680c2e208f9aa2f1f91f5c63cd4c8f0d0c915dc28a5fb07ec2be334
- SSDEEP 393216:jywJQC4sU2OcMFcdpc0UfcsgJdfrMLdCcIcAXTjIQpgUZFAZEDyTc:jywhUgMFcE0ZsozbcIcAjjxpzT6Tc
- TLSH T1AE173332A4A44127EBF40177D934A6383E6CE33C2B5495FDEAD4AC1D3969D4223FB252
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Blue_Iris_.rar:Zone.Identifier
- Size 119B
- SHA256 3293d0fa9bb1f2993227e5b1a6e4d355d2579713b3e32c1eab8b4bd785fdbc56
- MD5 ad7ff689875ac8481cabd58db28b55d2
- SHA1 3620744ccd8107d7f7dc32e472cb6fcbe4ad379e
- SHA512 d82ff040d4923ef5bafff427dc0e1df036e3d5d31900a321cb9fe041ba317fc4a42cfc8f49cf5d955248fb5aec5d7d012df5567a9e2c664cafe9d31e4786e74e
- TLSH T1DEB012E34C44D61C478F35D400D9975CB24FA54BADAAD580DC64C397DD8406CE4EDA27
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e5b2838.msi
- Size 208KB
- SHA256 f48b4f7a78e5d69f12523b0fb9700befb290655c7dc1ce065639a7eed07df5e3
- MD5 0359019bdb5947ab0d355169f4cd5e9c
- SHA1 094d2e09cfb09ee59ef73db369f6c9fb8cbb56d7
- SHA512 ad4d438bcbd6980e105da1f6e369469c1b760ca7f647d2c8c3174615fb447e2e3c9df3f29d86ab69e99b0dae0db0d1ff602135ff7539f457a76e5e05eb1f1296
- SSDEEP 3072:39laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTYrn:tlaZeKFxCnBheIdlu8
- TLSH T11A24AF12B5808033DAFE1A310578DB615F3DBE608F54899B6364B6AC1E717C08F36AB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{2B1C1C18-E777-4BB2-B0D1-E3E32955EE47}\.ba\wixstdba.dll
- Size 215KB
- SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
- MD5 f68f43f809840328f4e993a54b0d5e62
- SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
- SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
- SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
- TLSH T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{BD3FE7D9-0862-48EF-9442-60A95D5C8A38}\.cr\vc_redist.x64.exe
- Size 615KB
- SHA256 f63d1a385251f6f11e9b4fadeb97a8ae6815d929d49ddcae9351409f3e374917
- MD5 68d1cc869e440d384c3371758d92a34f
- SHA1 6c6eac4586c155292625aece308843c7fc7d83cf
- SHA512 87b54539f93bb94bcdfeb6da401895b82127999c60b1eff073ac80e96d01c2673f8ff30860b2e1fafdf844b3f0d0e04a6d2c8d82f6d861f303f20eb20bfc0461
- SSDEEP 12288:s3mgqnIZuYfCYqFet4CovkM7g1YnEvdqFxVKLxYGHLNA:s3WnIZuMCxezot7qgIdqFxVKLxk
- TLSH T174D48D32A5614033F7F105B3B928A6303E7CE7282B5189A9D7D4BD1D7EA84C1A7F7216
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{FDD08134-EBD9-437C-8914-31A6A27B849E}\.ba\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- TLSH T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
- MD5 SHA1 SHA512 TLSH
