Overview

overview

7

Static

static

3

NewBlueFX ...a1.exe

windows10-2004-x64

7

NewBlueFX ...a1.exe

windows11-ltsc_2024-x64

7

Resubmissions

17/07/2026, 00:02

260717-abk36sbx6w7

17/07/2026, 00:00

260717-aaaaaags8p7

Analysis

  • max time kernel
    152s
  • max time network
    160s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/07/2026, 00:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    NewBlueFX 2012 Beta1.exe
  • Size 175.0MB
  • Sample260717-aaaaaags8p
  • SHA256 edecebb1ee75f6be629a36a31c41323d50d387b51aec6e7ae076304279d37c0f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NewBlueFX 2012 Beta1.exe
    "C:\Users\Admin\AppData\Local\Temp\NewBlueFX 2012 Beta1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:6544
    • C:\Users\Admin\AppData\Local\Temp\is-JMT6V.tmp\NewBlueFX 2012 Beta1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-JMT6V.tmp\NewBlueFX 2012 Beta1.tmp" /SL5="$500F6,183041948,57344,C:\Users\Admin\AppData\Local\Temp\NewBlueFX 2012 Beta1.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3308
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_3DExplosions.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4128
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_3DExplosions64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1264
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_3DExplosions64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:2316
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_3DTransformations.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:6412
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_3DTransformations64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4780
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_3DTransformations64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:460
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_ArtBlends.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2516
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_ArtBlends64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4676
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_ArtBlends64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:6100
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_ArtEffects.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:5100
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_ArtEffects64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4320
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_ArtEffects64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:5048
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_FilmEffects.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3468
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_FilmEffects64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4696
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_FilmEffects64.dll"
          4⤵
          • Loads dropped DLL
          PID:4700
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_LightBlends.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:6664
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_LightBlends64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6112
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_LightBlends64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:6084
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_LightEffects.dll"
        3⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:6024
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_LightEffects64.dll"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4624
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_LightEffects64.dll"
          4⤵
          • Modifies registry class
          PID:6296
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_MotionBlends.dll"
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4500
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_MotionBlends64.dll"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1608
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_MotionBlends64.dll"
          4⤵
            PID:1372
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_MotionEffects.dll"
          3⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:7096
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_MotionEffects64.dll"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5844
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_MotionEffects64.dll"
            4⤵
            • Modifies registry class
            PID:7116
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_PaintBlends.dll"
          3⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4412
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_PaintBlends64.dll"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2300
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_PaintBlends64.dll"
            4⤵
            • Modifies registry class
            PID:6132
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_PaintEffects.dll"
          3⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4124
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_PaintEffects64.dll"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5548
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_PaintEffects64.dll"
            4⤵
            • Modifies registry class
            PID:3400
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_SamplerPack.dll"
          3⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3056
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_SamplerPack64.dll"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:832
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_SamplerPack64.dll"
            4⤵
            • Modifies registry class
            PID:1228
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_Stabilizer.dll"
          3⤵
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Modifies registry class
          PID:5484
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_Stabilizer64.dll"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4132
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_Stabilizer64.dll"
            4⤵
              PID:3508
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials1.dll"
            3⤵
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:4120
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials164.dll"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:996
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials164.dll"
              4⤵
              • Modifies registry class
              PID:1092
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials2.dll"
            3⤵
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:5080
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials264.dll"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4572
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials264.dll"
              4⤵
                PID:6884
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials3.dll"
              3⤵
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:2492
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials364.dll"
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2400
              • C:\Windows\system32\regsvr32.exe
                /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials364.dll"
                4⤵
                • Modifies registry class
                PID:4188
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials4.dll"
              3⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:5040
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials464.dll"
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1804
              • C:\Windows\system32\regsvr32.exe
                /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials464.dll"
                4⤵
                • Modifies registry class
                PID:2688
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials5.dll"
              3⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4932
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials564.dll"
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2896
              • C:\Windows\system32\regsvr32.exe
                /s "C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_VideoEssentials564.dll"
                4⤵
                • Modifies registry class
                PID:1312
            • C:\Windows\SysWOW64\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewBlueFX 2012\Instructions\Adobe After Effects.txt
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2080
            • C:\Windows\SysWOW64\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewBlueFX 2012\Instructions\Adobe Premiere.txt
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3808
            • C:\Windows\SysWOW64\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewBlueFX 2012\Instructions\Corel VideoStudio.txt
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1676
            • C:\Windows\SysWOW64\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewBlueFX 2012\Instructions\Grass Valley Edius.txt
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2172
            • C:\Windows\SysWOW64\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewBlueFX 2012\Instructions\Sony Vegas.txt
              3⤵
              • System Location Discovery: System Language Discovery
              PID:6416

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              ArtBlends.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\ArtBlends.dll
              • Size 10.5MB
              • SHA256 97ebd129c47aea8880426ae50d9d583a5ec9e62b764f1958b59623edd2f90b6a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ArtBlends64.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\ArtBlends64.dll
              • Size 9.7MB
              • SHA256 7312a955a48cd37f87cb6ba449863ff822346227af9f5db057b2dfeaf7163b7e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ArtEffects.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\ArtEffects.dll
              • Size 10.5MB
              • SHA256 b82f9196dfa87caad286795c816d5cc296bb0859cc3408c99d68dc51fe6271af
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ArtEffects64.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\ArtEffects64.dll
              • Size 9.7MB
              • SHA256 306b1ae189466ddf6928f4a22edbd790fa7b313d68ab142335e03c73221ab64f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              D3DExplosions.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\D3DExplosions.dll
              • Size 10.6MB
              • SHA256 e165031afa2cd2d8b680b2ae056628ec4edf546f63d5ba829d4466cfcdb44a61
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              D3DExplosions64.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\D3DExplosions64.dll
              • Size 9.9MB
              • SHA256 25d8ab4668960481ceb8d857efaacd8edc4b811afc950a4eba346b2d0d33a798
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              D3DTransformations.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\D3DTransformations.dll
              • Size 10.6MB
              • SHA256 9495582c26723909223459d889627bd6ded0d130e8c50a017ccb8054e31f9481
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              D3DTransformations64.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\D3DTransformations64.dll
              • Size 9.8MB
              • SHA256 23bd2232b84091487dd7585b260ea7c1c9f6ac4d0116cf3d82e7970f1cf6fd60
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FilmEffects.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\FilmEffects.dll
              • Size 10.5MB
              • SHA256 9f493b2bc3db5ad3d93fdbe8c708c4ac8ca8fb30fa2c1ad3d99bf5574b0f50a3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NewBlue_3DExplosions.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_3DExplosions.dll
              • Size 1.3MB
              • SHA256 c32e886a7ab11feb9ab7f7e7161240056ba567eee637ba2898d11090d03e9da4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NewBlue_3DExplosions64.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_3DExplosions64.dll
              • Size 1.5MB
              • SHA256 39fa44bd2443b3db3345f20e22856e2c7987fab6a79a4913eadceb4a97870041
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NewBlue_3DTransformations.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_3DTransformations.dll
              • Size 1.3MB
              • SHA256 0058b24575f38c0b9850bf093f137986793ce3850ebc9f256b92dc1894cafc17
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NewBlue_3DTransformations64.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_3DTransformations64.dll
              • Size 1.5MB
              • SHA256 5a335e796a798e7f40e6589a842920f334632e618f9a16cc0111de12a34313e4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NewBlue_ArtBlends.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_ArtBlends.dll
              • Size 1.2MB
              • SHA256 c421de1a41390fe4bc88b82865e08a492f9b43b4dcc483079f772cc3ef7e69a4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NewBlue_ArtBlends64.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_ArtBlends64.dll
              • Size 1.4MB
              • SHA256 4e198b8e1bde055f936492e11ff41583c8f06081e081f03e75d485e5bd43b922
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NewBlue_ArtEffects.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_ArtEffects.dll
              • Size 1.1MB
              • SHA256 d1e0e244df131919f413ece6c9d205b8b80db70849f02e0b657eec0c2fd5e2d7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NewBlue_ArtEffects64.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_ArtEffects64.dll
              • Size 1.2MB
              • SHA256 2023c6e67233f884095859642125f20fa3f89b4f569d6efca0f9b59c215d73d9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NewBlue_FilmEffects.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\Plug-ins\NewBlueFX_2012_Vegas\NewBlue_FilmEffects.dll
              • Size 1.1MB
              • SHA256 5e67b37dee36179d75b2673bceb087fc9cb936f96d51f5fd5fa26f3be603ecd8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Resources64.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\Resources64.dll
              • Size 228KB
              • SHA256 24794e42617b3794ea69fa94d3870a97f91ba879b6b126e98362baa1e77b29e9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              resources.dll
              • Path C:\Program Files (x86)\NewBlueFX 2012\resources.dll
              • Size 501KB
              • SHA256 c13f961ed757efd8c54cc6c42bd43ef8f884a7ed244eb8a0bbf0b7615786ef62
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              unins000.exe
              • Path C:\Program Files (x86)\NewBlueFX 2012\unins000.exe
              • Size 713KB
              • SHA256 16c5a80b026ecb62e5102dfd1e0eaaacdbe7f5f4181db99a6ef3f6e39ac675a4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Adobe After Effects.txt
              • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewBlueFX 2012\Instructions\Adobe After Effects.txt
              • Size 780B
              • SHA256 d4f811420650c1dd60b7aea60ba1d2182da798293d0559e1a5df9e3d93c33cb3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Adobe Premiere.txt
              • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewBlueFX 2012\Instructions\Adobe Premiere.txt
              • Size 909B
              • SHA256 475c9723670d28905f88884bc8e2b853074495a779419ea3ce1aa1b62dba6118
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Corel VideoStudio.txt
              • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewBlueFX 2012\Instructions\Corel VideoStudio.txt
              • Size 910B
              • SHA256 9ad46fa0d1600eb25d24d9e6985d847fd91637fa83e256a93070bb5729e5e37c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Grass Valley Edius.txt
              • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewBlueFX 2012\Instructions\Grass Valley Edius.txt
              • Size 904B
              • SHA256 9570c1bd5a1478e87691d3de69af40ee7274ec152e8dc11c38ae685a93b1573c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Sony Vegas.txt
              • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewBlueFX 2012\Instructions\Sony Vegas.txt
              • Size 912B
              • SHA256 64373ae86d510ad79c6f88670ff1726697424aaf5a7deb0dd5e669587835b834
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              EWS30D5.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\EWS30D5.tmp
              • Size 272KB
              • SHA256 d6fe44396a1f3c867058f5f8502f3cc40d7558df0ce1151182360193130fa23e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NewBlueFX 2012 Beta1.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\is-JMT6V.tmp\NewBlueFX 2012 Beta1.tmp
              • Size 703KB
              • SHA256 55e97488f8dda378ce7167682b124277a911f55dc64ba01ddb11df29b80535b6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/2492-2133-0x0000000003880000-0x0000000004480000-memory.dmp
              Download

              memory/2516-2011-0x00000000030B0000-0x0000000003B40000-memory.dmp
              Download

              memory/3056-2108-0x00000000039B0000-0x00000000039FA000-memory.dmp
              Download

              memory/3056-2105-0x0000000003B10000-0x00000000045BA000-memory.dmp
              Download

              memory/3308-90-0x0000000000400000-0x00000000004C0000-memory.dmp
              Download

              memory/3308-2090-0x0000000000400000-0x00000000004C0000-memory.dmp
              Download

              memory/3308-9-0x0000000000400000-0x00000000004C0000-memory.dmp
              Download

              memory/3308-8-0x0000000000400000-0x00000000004C0000-memory.dmp
              Download

              memory/3308-2031-0x0000000000400000-0x00000000004C0000-memory.dmp
              Download

              memory/3308-15-0x0000000000400000-0x00000000004C0000-memory.dmp
              Download

              memory/3308-2148-0x0000000000400000-0x00000000004C0000-memory.dmp
              Download

              memory/3308-19-0x0000000000400000-0x00000000004C0000-memory.dmp
              Download

              memory/3308-1984-0x0000000000400000-0x00000000004C0000-memory.dmp
              Download

              memory/3308-2177-0x0000000000400000-0x00000000004C0000-memory.dmp
              Download

              memory/3308-532-0x0000000000400000-0x00000000004C0000-memory.dmp
              Download

              memory/3468-2054-0x0000000003600000-0x0000000004095000-memory.dmp
              Download

              memory/4120-2118-0x00000000032C0000-0x0000000003D4A000-memory.dmp
              Download

              memory/4124-2098-0x0000000003330000-0x0000000003DCC000-memory.dmp
              Download

              memory/4128-1965-0x0000000003B90000-0x000000000463E000-memory.dmp
              Download

              memory/4412-2091-0x0000000003300000-0x0000000003DCD000-memory.dmp
              Download

              memory/4500-2075-0x0000000002FD0000-0x0000000003A5F000-memory.dmp
              Download

              memory/4932-2149-0x00000000034C0000-0x0000000003F91000-memory.dmp
              Download

              memory/5040-2140-0x0000000003200000-0x0000000003F75000-memory.dmp
              Download

              memory/5080-2126-0x0000000003B40000-0x00000000045DE000-memory.dmp
              Download

              memory/5100-2034-0x0000000003090000-0x0000000003B1D000-memory.dmp
              Download

              memory/5484-2111-0x0000000003800000-0x000000000481F000-memory.dmp
              Download

              memory/6024-2068-0x0000000002E40000-0x00000000038EE000-memory.dmp
              Download

              memory/6412-1990-0x0000000002EB0000-0x0000000003956000-memory.dmp
              Download

              memory/6544-1-0x0000000000400000-0x0000000000415000-memory.dmp
              Download

              memory/6544-16-0x0000000000400000-0x0000000000415000-memory.dmp
              Download

              memory/6544-0-0x000000000040D000-0x000000000040E000-memory.dmp
              Download

              memory/6544-2178-0x0000000000400000-0x0000000000415000-memory.dmp
              Download

              memory/6664-2061-0x0000000003C20000-0x00000000046E5000-memory.dmp
              Download

              memory/7096-2083-0x0000000003020000-0x0000000003AAA000-memory.dmp
              Download