a6c50d725b1218ecb12566d473528dfaa13a97ef4afffd83fb34c5513b9ece3a

Analysis

user interaction
yes
max time kernel
137s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ArtRage Vitae.exe
Size 133.4MB
Sample260804-a2df1sac34
SHA256 a6c50d725b1218ecb12566d473528dfaa13a97ef4afffd83fb34c5513b9ece3a
MD5 23a72e703ce07778b04d83957682692e
SHA1 e28da601df52581a9a17c31e55fcb20804702d9d
SHA512 da17dbc740b7dcd9e5966af7ffaa16982109cc722855d31fbf2a9f43620de6045f58e973515b21fa002291bc7c90c3d01fde42c31685ac4a9937f3e5d9d20142
SSDEEP 3145728:sdwcGPpn6Kajp87wGQ9jc3U0sQMVYlwS21C:zV1au7z4o3U0+VYZ
TLSH
T1D9683330729BC93BD07A05B16A6E9BEE41547E750B3240C3F3D85EAE69F54D21232E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2208	ArtRage64.exe

Loads dropped DLL 9 IoCs

pid	Process
6008	MsiExec.exe
2556	MsiExec.exe
2556	MsiExec.exe
2556	MsiExec.exe
2556	MsiExec.exe
2556	MsiExec.exe
3876	MsiExec.exe
3876	MsiExec.exe
3876	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	ArtRage Vitae.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	ArtRage Vitae.exe
File opened (read-only)	\??\L:	ArtRage Vitae.exe
File opened (read-only)	\??\T:	ArtRage Vitae.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	ArtRage Vitae.exe
File opened (read-only)	\??\X:	ArtRage Vitae.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	ArtRage Vitae.exe
File opened (read-only)	\??\U:	ArtRage Vitae.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	ArtRage Vitae.exe
File opened (read-only)	\??\Z:	ArtRage Vitae.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\B:	ArtRage Vitae.exe
File opened (read-only)	\??\Y:	ArtRage Vitae.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	ArtRage Vitae.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	ArtRage Vitae.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	ArtRage Vitae.exe
File opened (read-only)	\??\K:	ArtRage Vitae.exe
File opened (read-only)	\??\O:	ArtRage Vitae.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\D:	ArtRage Vitae.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	ArtRage Vitae.exe
File opened (read-only)	\??\Q:	ArtRage Vitae.exe
File opened (read-only)	\??\S:	ArtRage Vitae.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Custom Brush\Fun\Rainbow Drips.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Grains\Decorative\Gold Glitter Deco.png	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stickers\Brush Heads\Sparse Dot 2.stk	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Sticker Spray\Flower Children Multicolor.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Canvases\Art Papers\Diagonal Grain.cpr	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Custom Brush\Nature\Cloud Smoky 1.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Roller\Speckled Line.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Sticker Spray\Wrapped Candy.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Gradients\Fun\Neon Blowout.argrad	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Patterns\Decorative\Brick Brown.png	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stickers\Brush Heads\Soft Puff.stk	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Warp Brush\Easy Bulge.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Gradients\Sky Gradients\blue sky1.argrad	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stickers\Brush Heads\Texture Brush.stk	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Tube\Hard Squeeze.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Samples\Landscape\Autumn Mountains.col	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stencils\Shapes\Set One.png	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\MFC140ESN.dll	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Samples\Landscape\Green Forest.col	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Custom Brush\Blenders\Bristles Blender.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Gradients\Fun\Glass.argrad	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Grains\Papers\Coarse Paper 2.png	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stickers\Hair + Fur\Fur Curly Seq.stk	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stickers\Stamps\Flower Brush.stk	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Custom Brush\Textures\Curly Bush.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Glitter\Broken Hole-Punch.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Sticker Spray\Art Brushes\Smudge.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Sticker Spray\Art Brushes\Thin Lines.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Artistic\Dotty.png	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Gloop Pen\Pseudo-Water Blob.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Shapes\Triangle Faded.png	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Patterns\Decorative\Concrete Lite.png	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stickers\Stamps\Angled Hair.stk	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Samples\Still Life & Portrait\Hair Tones.col	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stickers\Brush Heads\Brush Stroke.stk	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stickers\Glossy\Jellyoids.stk	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Sticker Spray\Nature Stamps\Cloud Brush.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Custom Brush\Artistic\Hair Strands 2.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Knife\Just Blend Color.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Pencil\Auto Smooth Me.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Selection\Soft Painted Mask.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Sticker Spray\Fun Brushes\Cable 2.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Warp Brush\Easy Spiral.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Gradients\Triadic Complements\pink-yellow-cyan.argrad	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stickers\Hair + Fur\Fur Layering.stk	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Sticker Spray\Fun Brushes\Marching Ants.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\AR3Thumb64.dll	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stencils\Fun\Tendrils.png	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stencils\Grids\Borders.png	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stickers\Character Sets\Glossy Numerals.stk	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Shapes\Square.png	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stickers\Hair + Fur\Fur Curly.stk	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Gradients\Triadic Complements\orange-green-blue.argrad	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Patterns\Decorative\Metal-RustFlecks.png	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Stencils\Grids\Diagonal.png	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Custom Brush\Fun\Flower Jitter 1.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Knife\Small Frost.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Sticker Spray\Art Brushes\Mimosa.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Watercolor\Unclean Brush.prs	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Hatching\Dashes Horizontal.png	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Canvases\Decorative\Red Wood.cpr	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Canvases\Decorative\Shrinkled.cpr	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Custom Sizes\Screen Sizes\1080p (1920 x 1080).spr	msiexec.exe
File created	C:\Program Files\ArtRage Vitae\Resources\Content\Tool Presets\Sticker Spray\Fun Brushes\Glow in the Dark.prs	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5a2404.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5131.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a2404.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI26A4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI29D2.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DB2D6D93-EA3C-4080-9BFC-0CCD597B9341}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD04F95AFCFCD3B57.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{DB2D6D93-EA3C-4080-9BFC-0CCD597B9341}\_.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2741.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA7BB8B95389328BB.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE3425AE0EE0CFA4B.TMP	msiexec.exe
File created	C:\Windows\Installer\{DB2D6D93-EA3C-4080-9BFC-0CCD597B9341}\_.exe	msiexec.exe
File created	C:\Windows\Installer\e5a2406.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8D2BC57EBCC9C1C4.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ArtRage Vitae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000081a973cadba16b310000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380181a973ca0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410181a973ca000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e381a973ca00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e681a973ca00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\39D6D2BDC3AE0804B9CFC0DC95B73914	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\PackageCode = "2085018E90B0D7A4CA07BF6D57498416"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A5B13A3FBD9AC024FAAA4E97F8F12A63\39D6D2BDC3AE0804B9CFC0DC95B73914	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Ambient Design\\ArtRage Vitae 7.1.8\\install\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\ProductIcon = "C:\\Windows\\Installer\\{DB2D6D93-EA3C-4080-9BFC-0CCD597B9341}\\_.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A5B13A3FBD9AC024FAAA4E97F8F12A63	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\SourceList\PackageName = "ArtRage Vitae.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\SourceList\Media\1 = "Disk1;Disk1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\39D6D2BDC3AE0804B9CFC0DC95B73914\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\ProductName = "ArtRage Vitae"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\Version = "117506056"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D6D2BDC3AE0804B9CFC0DC95B73914\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Ambient Design\\ArtRage Vitae 7.1.8\\install\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4884	msiexec.exe
4884	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4884	msiexec.exe
Token: SeCreateTokenPrivilege	4712	ArtRage Vitae.exe
Token: SeAssignPrimaryTokenPrivilege	4712	ArtRage Vitae.exe
Token: SeLockMemoryPrivilege	4712	ArtRage Vitae.exe
Token: SeIncreaseQuotaPrivilege	4712	ArtRage Vitae.exe
Token: SeMachineAccountPrivilege	4712	ArtRage Vitae.exe
Token: SeTcbPrivilege	4712	ArtRage Vitae.exe
Token: SeSecurityPrivilege	4712	ArtRage Vitae.exe
Token: SeTakeOwnershipPrivilege	4712	ArtRage Vitae.exe
Token: SeLoadDriverPrivilege	4712	ArtRage Vitae.exe
Token: SeSystemProfilePrivilege	4712	ArtRage Vitae.exe
Token: SeSystemtimePrivilege	4712	ArtRage Vitae.exe
Token: SeProfSingleProcessPrivilege	4712	ArtRage Vitae.exe
Token: SeIncBasePriorityPrivilege	4712	ArtRage Vitae.exe
Token: SeCreatePagefilePrivilege	4712	ArtRage Vitae.exe
Token: SeCreatePermanentPrivilege	4712	ArtRage Vitae.exe
Token: SeBackupPrivilege	4712	ArtRage Vitae.exe
Token: SeRestorePrivilege	4712	ArtRage Vitae.exe
Token: SeShutdownPrivilege	4712	ArtRage Vitae.exe
Token: SeDebugPrivilege	4712	ArtRage Vitae.exe
Token: SeAuditPrivilege	4712	ArtRage Vitae.exe
Token: SeSystemEnvironmentPrivilege	4712	ArtRage Vitae.exe
Token: SeChangeNotifyPrivilege	4712	ArtRage Vitae.exe
Token: SeRemoteShutdownPrivilege	4712	ArtRage Vitae.exe
Token: SeUndockPrivilege	4712	ArtRage Vitae.exe
Token: SeSyncAgentPrivilege	4712	ArtRage Vitae.exe
Token: SeEnableDelegationPrivilege	4712	ArtRage Vitae.exe
Token: SeManageVolumePrivilege	4712	ArtRage Vitae.exe
Token: SeImpersonatePrivilege	4712	ArtRage Vitae.exe
Token: SeCreateGlobalPrivilege	4712	ArtRage Vitae.exe
Token: SeCreateTokenPrivilege	4712	ArtRage Vitae.exe
Token: SeAssignPrimaryTokenPrivilege	4712	ArtRage Vitae.exe
Token: SeLockMemoryPrivilege	4712	ArtRage Vitae.exe
Token: SeIncreaseQuotaPrivilege	4712	ArtRage Vitae.exe
Token: SeMachineAccountPrivilege	4712	ArtRage Vitae.exe
Token: SeTcbPrivilege	4712	ArtRage Vitae.exe
Token: SeSecurityPrivilege	4712	ArtRage Vitae.exe
Token: SeTakeOwnershipPrivilege	4712	ArtRage Vitae.exe
Token: SeLoadDriverPrivilege	4712	ArtRage Vitae.exe
Token: SeSystemProfilePrivilege	4712	ArtRage Vitae.exe
Token: SeSystemtimePrivilege	4712	ArtRage Vitae.exe
Token: SeProfSingleProcessPrivilege	4712	ArtRage Vitae.exe
Token: SeIncBasePriorityPrivilege	4712	ArtRage Vitae.exe
Token: SeCreatePagefilePrivilege	4712	ArtRage Vitae.exe
Token: SeCreatePermanentPrivilege	4712	ArtRage Vitae.exe
Token: SeBackupPrivilege	4712	ArtRage Vitae.exe
Token: SeRestorePrivilege	4712	ArtRage Vitae.exe
Token: SeShutdownPrivilege	4712	ArtRage Vitae.exe
Token: SeDebugPrivilege	4712	ArtRage Vitae.exe
Token: SeAuditPrivilege	4712	ArtRage Vitae.exe
Token: SeSystemEnvironmentPrivilege	4712	ArtRage Vitae.exe
Token: SeChangeNotifyPrivilege	4712	ArtRage Vitae.exe
Token: SeRemoteShutdownPrivilege	4712	ArtRage Vitae.exe
Token: SeUndockPrivilege	4712	ArtRage Vitae.exe
Token: SeSyncAgentPrivilege	4712	ArtRage Vitae.exe
Token: SeEnableDelegationPrivilege	4712	ArtRage Vitae.exe
Token: SeManageVolumePrivilege	4712	ArtRage Vitae.exe
Token: SeImpersonatePrivilege	4712	ArtRage Vitae.exe
Token: SeCreateGlobalPrivilege	4712	ArtRage Vitae.exe
Token: SeCreateTokenPrivilege	4712	ArtRage Vitae.exe
Token: SeAssignPrimaryTokenPrivilege	4712	ArtRage Vitae.exe
Token: SeLockMemoryPrivilege	4712	ArtRage Vitae.exe
Token: SeIncreaseQuotaPrivilege	4712	ArtRage Vitae.exe
Token: SeMachineAccountPrivilege	4712	ArtRage Vitae.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4712	ArtRage Vitae.exe
4948	msiexec.exe
4948	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4884	msiexec.exe
6008	MsiExec.exe
4948	msiexec.exe
2556	MsiExec.exe
3876	MsiExec.exe
2208	ArtRage64.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 6008	4884	msiexec.exe	89
PID 4712 wrote to memory of 4948	4712	ArtRage Vitae.exe	90
PID 4884 wrote to memory of 2556	4884	msiexec.exe	91
PID 4884 wrote to memory of 4100	4884	msiexec.exe	97
PID 4884 wrote to memory of 3876	4884	msiexec.exe	99

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ArtRage Vitae.exe
"C:\Users\Admin\AppData\Local\Temp\ArtRage Vitae.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Ambient Design\ArtRage Vitae 7.1.8\install\ArtRage Vitae.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\ArtRage Vitae.exe" SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1785563443 "
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4948

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3B2C9F63BD61E83AF93AEDFAD6471D8B C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6008
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2776D865C5119E86598368D301576A38 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2556
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4100
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CE82A2F342479C5753E860C1A2C5612D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3876

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1284

C:\Program Files\ArtRage Vitae\ArtRage64.exe
"C:\Program Files\ArtRage Vitae\ArtRage64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a2405.rbs

Path C:\Config.Msi\e5a2405.rbs
Size 121KB
SHA256 b0f52c401c1b5f00b9ce91197b388c5cf58ceeca1e0f3d16ba7e379342a6dcbd
MD5 ee393ebab8200682c700d57942c8a11e
SHA1 b573dfb9c2ae0cf680c22daf088bde9b2a1f24fc
SHA512 602785262b96c13b6ff901d680ecf075745e580d6ab4fb03fbb9bd6a90393e49c946301173281688b1ce27e362ceaeba69f2e510a56510b68f924586441078ed
SSDEEP 1536:loGVeFYFMjNHZgialwIE8V1mSxCnVR1ms+EpfP+HaeArW6KtdjZjV3gBBBZy6nr3:WVR3Q1HW4W
TLSH
T1A4C39B534808C3F17F76D46A3B56BDD825204C04EB18725ABBDC9A1FF7ECB9401BA4A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArtRage64.exe

Path C:\Program Files\ArtRage Vitae\ArtRage64.exe
Size 12.7MB
SHA256 4b3e60687bafa8a24b365dc7b40e910a4b879692b7a491a53703167fe78bd2e0
MD5 fd00a95df7e8a254885d8a58b21460b3
SHA1 08911fbf0feb1de66dbaf36502cad165cf2038f1
SHA512 56d5153402ee292bd591c2c5dce2f8ad64a5272cfd3f832e6517eda794f6c005f50c184de921c6746272361eb1625fdbc3d4bb198044d388673df469821ba731
SSDEEP 196608:jSNqSRS+l2fZEqQp8kJnMaCol/Col+Col:jSNqKS+vTn
TLSH
T1F2D63BB1B144C68AF86714B29C2FDA212C96A95E80A5811E357A7B19D5F334F10EFF0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dotty.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Artistic\Dotty.png
Size 26KB
SHA256 14cad6958c5e0215cc810865113c60c3ba88c8c540a4dfd14d2c67d5d3ff01f2
MD5 a129c29f9c82a448e0974f6bcd25706b
SHA1 f54a32c0a256f0e235468722514630ff2f09c24c
SHA512 e4bcba93db94d9bfb33a2c1bc856ae69d8113639a017e884a85fc7143d8f533f77038e24ee9e07af257e148969b0b31afafdf936ebfed3a73896153fc7c3f2ac
SSDEEP 192:CSGTikXRFez7BNbhDb9eVlkKLpoaMZCrMM/n2V2i3w8+AsgOMpEJO5wF7prXGYsl:dGThX27LeVPpMZCrGVBlsgJ8OOx92Dl
TLSH
T1CAC29F18ECF2B1A48D47DA312DC41A814C7F2643EA412CC676DECD619F14FC98E4B1AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Drips.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Artistic\Drips.png
Size 37KB
SHA256 373e8170d011efe870a995995cd9b9e575c388298f02365d19fd7b956068f96b
MD5 4a053bd3eae6aa5804e32b9900f8a3f1
SHA1 252abc77298e4342637f966698b93d9dfc13a294
SHA512 0e50891d0ad7e0cae255c3e5c816c56590f6c7eece8f5d6b1146bc659f5d3520c9e80a8b439b301c19154d8f74e8578f18ef8107cb7527223b829f842f694ea7
SSDEEP 768:D6IW5b/LoO5lAJoIWEwr3XiYp+FNYGCtDBk:D6FHoOVIWEwLveCtDBk
TLSH
T10603C038F972B47D744DA032588BA8841CA39983C9823CAA76CE8559BF5DF844CF6649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Droplets.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Artistic\Droplets.png
Size 5KB
SHA256 a6f7c8b3f876388ff590cd2748e5f9359d269639e0dfd0ba12031e1f947b3ce6
MD5 007b606f3b7346222d1bd2c57ae4e302
SHA1 5bbf1d51e357a4c7293f70be6862238df22d4ecb
SHA512 86b8119580e7f42e9afbeb485b23bf81ed81c2b64dbbbde126183b3dbe0094951f14ab0fc170d316979c99ac013d5cba6132d2f1f3241ead43bf7dae3447d411
SSDEEP 96:zaSHRMtBR1ddWTpgmFLQsIMEUufcg6B+gymxaIqM8RY0TxS8geHml4D1KKNlwuX:eSGTZdTSZEUufcg6B+gzaIadTxS8gIwI
TLSH
T18FB18CF47D90C8F63E0967E7002248B059BA27B50B3F5660BF3FE65C8655D1E22A4C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Paint Splat.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Artistic\Paint Splat.png
Size 26KB
SHA256 611978181cd993e8a737f42090c48da263efe59ac83489a9bf4ec9bde058c3d9
MD5 8152988a17b5e8bd8828f49db6a86360
SHA1 fac078679ea90a40530f03572d21ec3fd03e95db
SHA512 2375835a9a2fbec8a16572fc4b96198505b3ab89bb3b99a7bc1e70b5222ecfff3e664b059030730104da9fe66ee8deb45fa0a0750603ca94563714d5c93c833b
SSDEEP 384:zGTA1C+7pV9WDPxfXSoyHS5L4xe+84ArRA04:AA1njWDwjS5c0J4Z04
TLSH
T15CC2C0A8DDF079504998C6B01DD02643BCB716439B23ED9A7E5C0A1A0F15B919E4F3B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ragged Drip.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Artistic\Ragged Drip.png
Size 2KB
SHA256 aaa74b8a8dd77835684e9bb6e92382d2918851ac38e37ee4a0a565447c15f5f7
MD5 b7c716ea765dbaf135ee0c1eed8bacca
SHA1 d7ce1ce4311a7f089ee9ced89f585b5737b4f471
SHA512 e6444d7c9420d636bb78ce8d4e80f43eb8f2e5cd3873405575d9df91a35901b175ec406db7f507d4726edf006104db7c3cae303096d4bed989fd58900226ee95
TLSH
T114515CAFB04740284E2E9A8380943423ADF4D7604A7FA8C2047FA61E4D5D659D9752DF
MD5 SHA1 SHA512 TLSH

Submit Download

Round Oily.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Artistic\Round Oily.png
Size 20KB
SHA256 defa87064979b1bf9d25bb84aa824e5cea7bb9dd0e0625f82cba7c7d85ce4aaf
MD5 ff679e41e9073dcee4460d26fa2b83bf
SHA1 c2812ca0a9115da18632a19520b8289b5a946153
SHA512 6b73486a37cfff669d3f2eecd9d8043409abad98925317b6edbc3315c7fda97f8f53c57d20cdb0b7aa5c1acb47cf4203f07784f5b9e2b066f03b4281c9c6f265
SSDEEP 384:UGTgI6dzh0znRxyfqXvywHOcYFT5eS5VpV6dRx8Su0DdfL3i3niFfcMpI:hrGORwfiy4TYFT5eSX6dRxAQdO3ipcwI
TLSH
T1BFA2D14E9601C5450B3CF744359C432E69D8D7109AA3AED127B610F8336E7B6D66C8AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RoundHead.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Artistic\RoundHead.png
Size 5KB
SHA256 acca6f20b6efffab37ffe4b109915de6e8c3463fdaaadd3e5f6148eb910a7f27
MD5 9d1b96c293166260a7f54b38bd7c7751
SHA1 c2df9d2986f80757b6ff5bd98026f7ac9e6e76f2
SHA512 dd1619cd795539d77cd44c274813621718232d3d0e137a36573fe80b9326e4b35f9e6e7b7df73ec4f2a84b883875fd3de93aa7370a1bffed41279da90c4030a1
SSDEEP 96:HSHRMtBbDot/mt1qkERt2qAp6jvPHFjNhwqKE4LbfmiYpQk8aMGZMCmIAeYfJlGZ:HSGTbDJkTAcjvPBNhwzEKfmiYqnCmIDZ
TLSH
T127C19EC69E848D532C40F5F2B239253597BD63B8421E0D4D863AA32E49AC0C776254E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Watercolor.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Artistic\Watercolor.png
Size 14KB
SHA256 f32b6e13cb5ed8689593551bf26d9b7236ba325fd71f3fdd5430b8dd9fe0cdc8
MD5 b4a45764adb3d37ecdc8c90964198bf1
SHA1 98b6199ace553cbca5db037f8bd8f36e861c2ab2
SHA512 7eb3cd79aef0456df48cbca96afef6b64f99b6f51b579a5a4af40c83ce4f272d3a8bb9cfc7e7e5645fea2a9706c3f26d3407841115af5a90afb7a47df29241f7
SSDEEP 384:+GTzVU6sdc5JaBi41VYg2Vuq+9qf3XMyiWwuZ3hcqpgC2T63A:XMdc5IFUXVTEqfHMyN5h/g9l
TLSH
T1F362D1DDC4475799DB00A2C0987F8078FFA66BC597164F6B4DA121F8200A9EE35BF8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Basic_Circle.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Basic_Circle.png
Size 16KB
SHA256 da5eca774ed3797eb1561a39c9935d80ee1085d2a9af8282478f7641f3e5749c
MD5 7627ffed594be9d5201b5f1021dc74d7
SHA1 59fd6591a9a105c661bd0bc343d1a433bbacafd9
SHA512 83e4ced6c4d52d4bb97d338b6622d0ae86e2b50a80d2264dad46719ca58caa34d60bb70f7d73dde2dba3ffec3ffdcb7f51ec09b5af0a5bc4c93ad21c47079159
SSDEEP 96:JSHRMtBXk7WmnfNFrNnNJcyD6Ve+57E24sAIZSWp:JSGTXkXf7ceAgenSI
TLSH
T189720726BDF171B8C498D5332CD124082DB716C3CA429C45BAED4D2A6F04BFCAD5F046
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Circle - Fuzzy.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Circle - Fuzzy.png
Size 19KB
SHA256 5e15b376710887fae4317941fd74b3773ccfaa16e7415a624ab49393b4f67d28
MD5 025c52247ea3f9b8e4f4b54022bedb5a
SHA1 fa6028d5eabfedc013b15fea8734c4b6246e8f7d
SHA512 16be8f82a27d05f79913c146ec0768c1240324137139621b3f8a8ce8b248f38d711b157f59c6b610298755a0c2370c99c5a4fd3b4665c979615afce3b127bb21
SSDEEP 96:6V7SHRMtBDk7WmuSNFrNnNsc5XUnNXoAvYMbpca51EuQFT0+usPI55I9Vrp8eBNI:+7SGTDkXH7i37EuQFT9BA5K7rqe3xO
TLSH
T1A0928D669DF13CA2D4258936AC913419BCB71A839BD14CC775FC4A7D2F187BA0C2F892
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Circle - SemiSoft.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Circle - SemiSoft.png
Size 21KB
SHA256 6e5c41f5a6e6ee16b5ddd7aebe430937a6b13e59cbed249e95d365a423a19e58
MD5 464f79c81e7ea22eb39f66821e7f15a9
SHA1 24e42c599238ec48052343af8bad256da25235a1
SHA512 c9f78124c5016992ac9759c23068cab4fb6c03866f8644485f6e8d119f27030b51703494f387f79049d3dedfb18ae7c97205b30007b585f27df642a01cfda09e
SSDEEP 192:lSGTDkX57ZwL+v16/lxRgHqVIDbqss4rp4U0UJTjTfLhHi:EGToX57ZwL+vDH/KsPrpvdJfTfNC
TLSH
T1A9A29D28ADB074F4E9D9E3711AD5210D1D771A83A2A65C09BE9E8F673F00BD68D5F00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Circle - Soft.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Circle - Soft.png
Size 25KB
SHA256 41083c02023e2966cf2fcd293ef60e8580836f5e74cf43fedf0cdf0305c0528e
MD5 adf82c40a5ca67df73403528e4a29e9c
SHA1 d69a4b223bbb34a478ad8bde7771dfbdc24a5605
SHA512 128f9f475882f0b72f6e78fc240b6f7cab6619fe3008fbc158279df2654c6e61dbd41a4c8da464818a066c63e69de8c3de792e0641cb772282e26639d6cf45d7
SSDEEP 384:UGToX17F7oGu2K/MxVQYEsUfLSt1bGYnQH8m:hoXrDRKkxh6et1bm
TLSH
T129B2AE621CF33C2AC698C4755C9230952FA84A83C4999EE23FAD09E53F197D5DD8F0CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Circle_RimMask.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Circle_RimMask.png
Size 16KB
SHA256 59979261a2b1e0f72e95c0036d067f7cd3fdc6247f28485a337f2a2f722c570e
MD5 7a11dbdb6ba4fe064afd6007c5fe4245
SHA1 3095c2cac0d596a93552b41d9934f4c47d51a7de
SHA512 583e2a9365e39cc92b718391ffa831aa1cc2fb27e295ec848c151911ab109eff989c452b71298149005e8a59074f047d3742197880d89e28a40c3a9649041a54
SSDEEP 96:JSHRMtBDk7WmVyghzNNFrNnNJcyDFsg0LaCSVLkflv:JSGTDkXJ7eIt6Z
TLSH
T1A7721A36FCB270A195ECD03118D128417C6616878F92DC49BAAD4C2BAF19BE98C4F183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crosshatch Dense.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Hatching\Crosshatch Dense.png
Size 3KB
SHA256 5f92d898fd16b82f7bf5271c75e70db2d904749626f65efa46e27684ea609e75
MD5 f73b0ad37f3ea9700e30ee8a4864243a
SHA1 d367a500cd447855fb4bae377a5d0238d283c1fc
SHA512 6198b0f9a11b2f48ce528c8f9b4de22d6a9b1a8b5977222a4914b35f8b2d78ebf171cb45b5a8601c5b3a4d1d146cb57a34c6aa1ca377181e2b6e4ba2be48c001
TLSH
T1FF614DCD79814489DC2D07F280D21432779BAE7CDADF4482113EFE944D6E8275605F71
MD5 SHA1 SHA512 TLSH

Submit Download

Crosshatch Sparse.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Hatching\Crosshatch Sparse.png
Size 4KB
SHA256 e4b713581734d570428bb6906613c4873296f4d81487cb72a0dc7e13d69e7057
MD5 a3359714f1465ba1d0afbac11330c87a
SHA1 3914b1ddacc7452a8d1eea0ae06e3d5f049a3c00
SHA512 ed14dcba69634386d4528d47eb33167784c6d19fe0ad2f7b8e497d7c855a63b83d6a04767c9b6c2bcc115fde3e64f42e1215de5b5e297e1dd9435761c5c1e605
SSDEEP 96:vSHRMtBsGhtmtOCxHzF/9f2MCaGpge6fmdwHa7:vSGTbAzHzF/9+/76eddwHm
TLSH
T191917EFA98C3003C6EAF7194C2250AD42C4A16E10FBF4093153913A8FA1D97DEEA8766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dashes Horizontal.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Hatching\Dashes Horizontal.png
Size 1KB
SHA256 f5f53b7d7844a65defb5c09e117288f8e7a5b7d75049f77f448a580e7a24ba68
MD5 9fdf249a985a9f3ead1529db72f8a5f2
SHA1 67c5228ae68b09ceae4c01d18950f1201669f3b3
SHA512 f1a80a09fb239853aa04c6cb7b06122a639dc6c7c2244d614473664ba56a985cfaaac6fe745ddfa9244b4181c8841782ddcd190d4f35fe72a12e6cdd7a0ae103
TLSH
T1D111A89D504084789D1DC69380A743206EDD7AB40B3FD8811C7DD778E80D65DD65A4FF
MD5 SHA1 SHA512 TLSH

Submit Download

Dashes Vertical.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Hatching\Dashes Vertical.png
Size 1003B
SHA256 5dc90f03553c6cf2ef9d4c6565255ddc471d80130453852a72698f0d5422ee5a
MD5 b48721341402a6c19c6b3baaacaa1541
SHA1 e3e4d4dd6741048857b0c9c33f417095ed46ee48
SHA512 5970e29a8760fe14cd43673535e48884820e4ff4a32baca5ec28ca148e809eacf04aaab67f75dca3711c9107e98e0cd1fe8f3c7e6612686bf7e8f12a17e2205f
TLSH
T1C311B25DC08089789D88C6E3812302302FDE39640B2F20C2047D56685C0927DE66B4AF
MD5 SHA1 SHA512 TLSH

Submit Download

Diagonal Cross.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Hatching\Diagonal Cross.png
Size 6KB
SHA256 277c73447f7fbefada2f5ed8d2b8a809d6ff1fd7a0f23cbcddac251c4e14ad5e
MD5 25d514b87a6911a7b34e9d11f70f01d0
SHA1 d41b67265e04eb559750265b42d2659d171da76e
SHA512 fc10667953880e933fccb171f4d6c4241fd549e50038531d8ffceef20534921ca9ce8d582463ef28a574e1261dcb751dc1b7a7c4805cb6c47c593bbb8550161d
SSDEEP 192:vSGTBxNdHhLqH9MeUXRfgIg7ap8o9rRYMPGIPLgSaG7:aGTBxNdHFU9MesRIxE/DYs9IG7
TLSH
T117E18DF889D40E7E1ED8B4FA8A4469347A8A6734D76B744491B00776E3287FB084C0EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Flower Outline.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Nature\Flower Outline.png
Size 26KB
SHA256 0c4d92f706b2b1b3b07aa476b903abd6cc569fa9c2b74243625fe737c876e3e7
MD5 f86fde349d700b329f53ba11f1979e04
SHA1 11ee9f1f2c549ea9c2618cf863bc381ce14e791c
SHA512 401812b8d506b27653d65ad128d2eaac1478a2ca69affbaecb961f6fba6bc8fd97835330207606755323e9b2078454ac3f02f7b20ee39ab91f013aeaf2e2baa0
SSDEEP 768:DEYe4h5058dLN8+1MmaF2afKerccylBHPY4:DEqD0uLJQCtcyXw4
TLSH
T117C2E19834B3406068AF838797B5894DC6B4F950037BB9B9D4B72BEB8788838E1D1475
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Leaf.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Nature\Leaf.png
Size 22KB
SHA256 6cdd02df0dd70b065a18fe685f95898b8c49747e1aa945658ff2dba5e1a1d9f9
MD5 245f72d79445e33a19a8a37f705deb3b
SHA1 c0633e7e6a57eb378450712c47f718fa1ecd6cb4
SHA512 ea90bdb7138e87cd3a92fed85733649119619a060b0443d20cbaf523194c62dfa042c1aaae803f8be096a8eaa744d33a1255cbda759ad41a405adfb36c50a667
SSDEEP 384:FGTu8tjkvl+21cSR3ZJeNgDWC6+XGTQKpmC9oeovMXmtrY4cc/YR/k2l/Y0pIF:m3jkN3qQ3ZcNEWCRGTQamFeovMUrHczI
TLSH
T114A2E1D4A460DA1B0B4CF975EC3006A07BB9BCE00FCB59451A6A0B099949A2577C0FCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RoundFlower Outline.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Nature\RoundFlower Outline.png
Size 17KB
SHA256 8b69227834ca40ef25935919bed88dabbee3006b0386bde0588773a31fa5957f
MD5 666360548d4cd8c03287df444fd82271
SHA1 096c0a5e007a6cad06c31e2f5508eb11f4cfae11
SHA512 6cc0934178181a13d1a364fd22de1eb5ec4046b3c4a59f65ae392baa822516adc6646d26f82d0ce7205f9106cb25cbed6e047adac33e49c3ea241d028433e79e
SSDEEP 384:vGT6wPAu1mjLFD4iWHX7WcLT9W3WpWhPL5q3KUBs:c/1m9DIrHLT9W3WpWhdq6UBs
TLSH
T16D72D062C0B0C52BB7E9CCCBB750162D8E3953909AE98ED58F30A353DA5B67834115F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimpleFlower Outline.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Nature\SimpleFlower Outline.png
Size 15KB
SHA256 41376cca0a4166e86d1f5f99a5a9f86ee7a0d292db45889483f86a9616215a20
MD5 3803dc2559e7839f398210d1602681e2
SHA1 045ccc2c89baf3f944cfa1fca61a892ea0122d57
SHA512 d790d37dee7310c135ea63fca754ec2ec33f474888c4087d3f2a21677eed1c43074ed2fa235257a22dfe6334815210c3f0a65a7557007c1c23b3f77371d72b04
SSDEEP 384:vGTHTk/cGd3EBn/Vu59V7KO4PPJw4FYrPefCBY:czALdaO45w4xCS
TLSH
T1AD62D00E60A506F1224090BF5E8ECC3EADD5F47BBB870B4B277CA295916E2D6C94181F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimpleFlower.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Nature\SimpleFlower.png
Size 15KB
SHA256 fd515c73aa0c6e89d9b5cd1a447898c2f4ba4cbc3ce8298e8219cc7b0c8bb1de
MD5 22c7a14cb02ab5a4a4061b03e01ff738
SHA1 dc735bb607feadd920776d64bb7ac61bb4dd7207
SHA512 88ab08fb65e534d6eda823a30ec400aa2d871cf6a594f1d492c9b987f4ac7f83833f37f7b2fdf19c2546223cf19f7e698981f1f0657639b5f5a8e7b783822e55
SSDEEP 384:+GTUl7O4k0i7uNNHTxl3RCgJmK5noGZq9sA2ZltsTFKZb/V:Xg7On0LDPRCgJmmor9sRlueb/V
TLSH
T15B62D1748A72B0520EA5C311D7C2DB6C2FE66522BC5FC94ECAE3DFB29734704C156968
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ring.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Ring.png
Size 2KB
SHA256 3b8c3b45c78466fe6cdb1bfbed38783c5a796fd7742a3b295f7d9364bb1432f1
MD5 9d93c0a8209b59614d4e4e874ecbacfe
SHA1 5e5245161c9b93a22daf2e034e1a886205a74b86
SHA512 8612471e7a56dbb5bf3d35cfad3dae51e4bb42a6791d9be3c2e694dd646a0c3500ac1916cb059f03b60dfd8c3cdcd912199fb9d160fdf2ab235021dfd3ea8c11
TLSH
T1D8414B99A1234169988DDBA7C026215011CEF9F42F2F908B4EFA53996C06A30A729A82
MD5 SHA1 SHA512 TLSH

Submit Download

Bolas - Hollow.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Shapes\Bolas - Hollow.png
Size 5KB
SHA256 c04ef60c246f094dd544c4fc9ecea133d3ed0f99608dab175ec7464c3a3e99d5
MD5 e4908b14751dccbf7d14bf3728596487
SHA1 7600d303a1c0462670ff316bfe1b4b1e43f5dba0
SHA512 aeb6adf38686fe599cf1ec16635e3d4e60d4b32ec518243da86985bf49db3b7c63b6e2bcdf31c0358d28877099c6880772ce1c51b284a4c521c5477cb588afa1
SSDEEP 96:o2S6yGzZLHtofIE33xJnoNONrqVAH7rzqZtGtKFrIj3OP1Q8CffKm9sWHG:o2S65RtIxK7VSrzTtK27OPy8Cffej
TLSH
T16CB18E17AAD6EB586A5431E881480C4130FD04D362D4D01F2FD093AB5169EFB7F41D5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bolas - Solid.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Shapes\Bolas - Solid.png
Size 2KB
SHA256 2723aac37bd949eacc0784dd9d57117164365a5bafb34c3beb81798adeba381d
MD5 cb79e9347e0f0ddf1edfc2eda652d3bb
SHA1 61591ab327da70f85a9ad2bda007216aed6d24e5
SHA512 dea95e43fc0a63959ece68a41d90106eef47e84da00fc8d9a7047a6c2f7e065b12870c8c1cb7795fc3f487781deeb60ef5c3beb91dc7cd0b3c3e6392fe26d572
TLSH
T12F517C1823C4CE773D490BB2D3620A306FF512794B2F22CB0D7D92576A4A3118E2C4E7
MD5 SHA1 SHA512 TLSH

Submit Download

Bubble.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Shapes\Bubble.png
Size 133KB
SHA256 343eeb7de600b9efe850daf4bf722bb0d77b889e0ed64771f4ea39fd5aededa5
MD5 2912126edaf862604722983a9e3668cf
SHA1 6d8f1d8b00c557f2759eb682ea99283281a94a36
SHA512 6c18c966eee550a27d961f879b9b0ed21244170f3ea7ebdd52e7253810eb30d0587fb70ddda66f8290361f252d34797ae2b858e8e6422a1ee246080d0c89f145
SSDEEP 3072:bfBETxr++PO3WqEOrM4lOlgDjHZZ0bjqzhCCmVQpej+lxrA:LBETxy3xnOijHIb2hCCmGp6Y8
TLSH
T1E2D3122036F33020E6AD4C3212C819E8D41AA5C7EA12565E7C9DD6BD9F7A3F44C7B227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Checkers.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Shapes\Checkers.png
Size 26KB
SHA256 c65e5495b49c41c24728fe20a7f497bc8e205bc6bdde69d40b2e92eff88135de
MD5 c88d2b663f762e234eb863218e68249f
SHA1 491438bbf1a17d9487eaa88bdeb6a201efbfaa21
SHA512 ccc5c3ba293c69e84f4f35c321a132ec0bf924b1831083a7e34d5a4bf1801f5d7005919861f0b83f91ac8ed7270b56c2f9906aa86410b0ed100eec5ce9766521
SSDEEP 384:UGTEI27ju5EjwBLr4/skPkeIG8kItssjWjm4qI:hEI6uzE3DZ0jI
TLSH
T12DC2AF78EDF070B80998A6B394A619068C731583D984ECC6B6DE99D17F80FD48C4F5A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Horizontal Line.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Shapes\Horizontal Line.png
Size 1KB
SHA256 a1832ba80eb99d777fd7c29bd1ee99fa5e6556d8ad7ee2698df4b328912b13ce
MD5 e0786c6faf883e874de9896135a10954
SHA1 d978d7b82f84f1b60a3c3b6a0161c726ac4c7bee
SHA512 a13f0182a0857813b1f79a6a84f7557900972974469784b65ae376bd625bcc0d3fb201bb380ac00d41396b50cf010642b37fc898e9855599b0932dc996e8c111
TLSH
T17D210A5D808184BC5D0E86B38063C2206FDEB9A43F3F14C1443DD659740A7B6C91F4A7
MD5 SHA1 SHA512 TLSH

Submit Download

Sparkle.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Shapes\Sparkle.png
Size 4KB
SHA256 9b27728b6f9c29a3a36f3cc16e126d04a0f10af8e0329bf972e6d518070852da
MD5 2ad2bd1ed587d6dc8bee3992daa85b2c
SHA1 69f65879ca9eb67f89fe5dc296ff79efdfb21acf
SHA512 5da1f54f4dc254dd0b43e7e516b5461956b3d58aeef88f6f28dccdebfc77328a1aafcc420fdf8e4d73c1d8da0a72c9824d8d912cb7768c31fd376aa0ac2b2016
SSDEEP 96:hSHRMtBIcosRV6X9VIwqZirL37yHTzUuj575k32pWGI+nz:hSGTIco+QvvLyzz/575km4GI+z
TLSH
T1B1A1AEB809A0451AFF2C8E92808532066E989C6B4723D7CB427C633D801C7A287E40F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spiral Rose.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Shapes\Spiral Rose.png
Size 3KB
SHA256 56d699509198d6166110e7f7cfe9f91cd08c45ae5da79b1b2b712a31119076b4
MD5 1cb76f539133548066af2a0e2916d39f
SHA1 584beae8d676e48836cc7b660aca67142999c55c
SHA512 dfe2c30112b684cf6b87d2e12ec457f9544fe60f9c4accc98ef7d73cf3aa8b0f2ec30c99d49bb9ae25ed645df0c1ee9f0978ad5a03cb4ec82db9be83ff3c8394
TLSH
T1B1813E405200A6EECCC25DD102F307B354EF5EE15D3FAB1B69E6752998B28D1A1F14B5
MD5 SHA1 SHA512 TLSH

Submit Download

Square - Soft.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Square - Soft.png
Size 23KB
SHA256 3801380ab41ab56d7eb8cf6bfb48b73812ea7af780193a7a8d348362846b9707
MD5 92467a879511363e18238bd1dd296533
SHA1 186a505a935821ec67f0a4d08e135a176be6a24c
SHA512 0fc6eab0fcf00210f02188a56f5a9562e53ee756ae318bb41dc54be677ca0e66becc51e4e9c3ca11e7e4aafd9c335944a1058c16ab1362fe740e28c05805bae8
SSDEEP 192:pSGTDkXWPs7XLuQ2Kd/CCwlBLif81VCDK0LNN7jd8SpxXRN+dPxroQZP:QGToXV7AyaCwPLk81EK0LNFjvDRcVF
TLSH
T17CB29E69BCF1B061ED5C42327CA074807DA70A43D8865C81BFAD4C5A7F0E7E98D0F082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Square.png

Path C:\Program Files\ArtRage Vitae\Resources\Content\Brush Bitmaps\Square.png
Size 1KB
SHA256 a877a8aff987f0bf25adb91c5a6788178acd6c0442826946f5b5dc62e6dbed6e
MD5 d49d70060c4ea1aa4fef5ba29bba08cb
SHA1 7c404fff1281d0e019b01a78e2316a503ac7e810
SHA512 015e5577026d06f3b59ad570a77ff49760c8e927501fa7ac126b9a0a9fa9458935d5d25ddad59b71cae061900f825310e172830892d068dae2a55b51ed01883a
TLSH
T1EF21656D9040C8789C0DD7A3806702207B997A645F3F648208BE576CD8196A5D9AA4BB
MD5 SHA1 SHA512 TLSH

Submit Download

system.gsf

Path C:\Program Files\ArtRage Vitae\Resources\Languages\EN\system.gsf
Size 153KB
SHA256 889ceb1210bc6d1c7e70c19e4b6344f3e1aa933709cb13e6c3a3cb13a0501289
MD5 8d845ae424b1232ac8bf3873cfe4e876
SHA1 d4ca183e189e2dec05153c3356c139a8e9c086fa
SHA512 b677701780c0d1ff024d4fe050456b206900ece2b16fb8278b2ce8fd727a9b7990352365118a245757c4c642eb2cfd508e200a0fe5bd39fe54e5ff44402cf043
SSDEEP 3072:OMmrYd883/dorudsBL4BWtofQ+wTW1m5yBQI3fipE746/i+xVW/YziJXi4Rb+3C3:U2Oi4RSyysiwzfyc
TLSH
T14CF3985363F95208F6F77B606FB55570CB3ABDAAA93DC61E1190420F09F1E819860BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImmutableStrings.gsf

Path C:\Program Files\ArtRage Vitae\Resources\Languages\ImmutableStrings.gsf
Size 8KB
SHA256 5f60c053beae36a7e056c27a8305ca46107dc7303f352bbcc06262af19e6aed0
MD5 05c070f66b7be3f1cf7a61fd3d5051db
SHA1 f60aa75783b8889d90b52c6e48b1ae791c640a7d
SHA512 d057a8cc88c3bc83bb130375dcb98d29ea6429168bfb62ca5f0e7ab60870d87018442f5cc026279096ee4ec4d10b03272fe49249c1c1a53d7a6c0b43b66c0422
SSDEEP 192:QBB5JPytOlky98icpjdx/yYSWL6R/wfGd0rJwFkbCZ4PG4AckoDS0:8ezy98rpCYVL6R/wfGd0rJwFkbCZ4PGw
TLSH
T15A02811317F60514F6B64A70AAF94130EB3AB8EF5D2CD91F40C5028F06E1E82D9617E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

images_x1.gimf

Path C:\Program Files\ArtRage Vitae\Resources\images_x1.gimf
Size 4.2MB
SHA256 dea4471a0135f6543c6b88d7c7ea7eaa174484ba47fde053e4ae1ff78a2fd32c
MD5 5eb4df6a4beef09a350a28301fad49e2
SHA1 393c40018a3a432f210f9a5c6ccfa256c45ab6f2
SHA512 2ddaf7387b86a282fb526171a341c16fc422609623594034710977c7217753119f5be07d64bb96292234da50c2df9133b85fb390b43e79e4bec49314d007d33d
SSDEEP 98304:F/XAYqRazS0g4RbDFWa7ohyit61L5JxWsRBr7YlyUhvF5rG935c84ZmYotfYtHMD:FYYK0gKfFW5y51TeG
TLSH
T18E16E08568C08865A81EB699D0FE9400DBF72ED40E3B044E4FF9DDA90E45EDC8DE49DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

images_x2.gimf

Path C:\Program Files\ArtRage Vitae\Resources\images_x2.gimf
Size 10.3MB
SHA256 b7f90d2b23932ab1f5f2ff90f7a3490bb7e62ac4cebf452f22a524a879599434
MD5 4087ec90af0ae17977f81a01cfac4549
SHA1 cdd2007bab49aaa5c2122bce29040e512cd5114a
SHA512 2a5e4669841e367c327acae15ab4536edb87fe2737b458bd7ca9dcbd0e851d892ef42f60c83510621e7f34fd28c0c0abdd597c3b30815268f96f8ba5fc66e08b
SSDEEP 196608:GYY4pcmhU41lKxdiXBDyZd/TUK8eCnCYFN5XGhtMIhSrxR3gujH/TDGeLt1RQPp:GY7pcmde7imN/CnCU5XcMe4UujHmvB
TLSH
T15DB62289BAD4AC56A85EB568E0FC8440DBF72ED50C32041E9FE9CC991E52ECC0DE49D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.grf

Path C:\Program Files\ArtRage Vitae\Resources\system.grf
Size 665KB
SHA256 8dd45dcfe81588074377c35b55d618e6061550b18417fcf9e5975aadb9e38aca
MD5 88ee1a41b99843dcf3f5c4dc42d7bc60
SHA1 2963b4ced68a412dd58f069f90dbc4abf954a310
SHA512 a8852fbc21b5c2ec89e8fa9b6f2ec6c5b259b42ec367f9e7f378f510cc20b351bc95dc4b3d5cee816c7efe3e90031308b46c4a938c87ef156773f416ab7455cb
SSDEEP 6144:TgxB/ZCRFgEl15lgAbvErK4wrKO72v3bqxlSADc1R62FZ//oFyFk0juuNiKr:TBdl1P343mTSl6coo7CuNJ
TLSH
T103E4C85273F50418F1A76F756EF1C9609B35BDEA9E09F01E5084632F1EB9AC24E2072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.gsf

Path C:\Program Files\ArtRage Vitae\Resources\version.gsf
Size 318B
SHA256 16c4b2f8db2228e1b3b1076d7eef21ff461808a7b1920ec2178631eb829e663e
MD5 85631b19dcbe7b7c3f5d65c98a43b8d7
SHA1 d9610ce25026acc607eec7695c661644f730cac9
SHA512 bf05c68d32f9a764cd1b2407996ab7ebdb02a9a51e73cc181438f6daff749f407fe7913028a1984818fd82e07021129392627923d5ad60be96bec1c2da77a929
TLSH
T116E0EC0223ED0519F1B30A6CA8B91561E7B57DA5FC18D51D51E8214905F5A01D9A0BA7
MD5 SHA1 SHA512 TLSH

Submit Download

MSIBFAD.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIBFAD.tmp
Size 391KB
SHA256 fcf24b9b574ed026d3f68b7b70aa6533806ba7fc566c476ccb62e6493ac28f04
MD5 a32decee57c661563b038d4f324e2b42
SHA1 3f381a7e31f450a40c8c2cf2c40c36a61fb7a4c2
SHA512 e17c125adad4702c9a30639858e22a2f0dc4f2926fca89758d544c62fe1fb95360dabd5bd2de2f62a607158bd9ef108c60d8cb5ce709c634668ee509988214f9
SSDEEP 6144:h95gAQAF0Zbd6hyEosZKE+JFiCnXxAO+VK7Gzds:hnQm0OAEosZr+KIoVLzds
TLSH
T1EF848C20B2D6C83BD17E45B03A6DD99F41297EA54BB2C4EBD3D81D2E05729C29235F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArtRage Vitae.msi

Path C:\Users\Admin\AppData\Roaming\Ambient Design\ArtRage Vitae 7.1.8\install\ArtRage Vitae.msi
Size 1.4MB
SHA256 f80adec661e8aa4d23d2c1e336cd06ba1a8c9d64609504566a64c75ba053e062
MD5 3f9d8c5371b594a19da65d294e5da39f
SHA1 49b0379cf34b2017f15f01db1d8be7f14f388641
SHA512 ac004e7219460a0d272e94214a1d24efeada2b6328accdbe486f3dacd03d1199ca8a6998634ccfd85e3ebbd392a541f534e3fa823c234371f7a7d5cdfe3f52ee
SSDEEP 24576:W1dxfZ3YG0OH9KsVfdsPA0xMtw+Hvu/bOJTUVPyqPH7fo/:W1RYyH9jVfdsPA0xMGovoOJTUVqqPH7w
TLSH
T139659D20769AC437D4AD01B0262DCBAB59697EB14B7280D7A3D8AA3F1DF18D14331F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Baubles.stk

Path C:\Users\Admin\AppData\Roaming\Ambient Design\ArtRage\Content\Stickers\Baubles.stk
Size 887KB
SHA256 b27ab364cecb30e8ffed93209f6e8ebac24ea374b4acdd33c79b0f10b1616433
MD5 a12b6543602437241c984af1f485d59d
SHA1 99f1562fe8a7b674333c337009c75961db501ad6
SHA512 ae3db0aacade772685b703782fc5a130acfbc3427482903ca2f6cb3ab0ca1315d541cc365034ba7e2b8bb2b641be3d0e2fe86bc4b8f1a3ddc1c68648bc0fe230
SSDEEP 24576:sRLFuGDl4PlcO6Em89EpfNESiCLmMX7QWyNGsy:kLlytHV94NEjCqMrLt
TLSH
T1EF1522F1E3ADD4A79CFA463D15F15EA2CC52684E18731E8FB3372C645118B887DE8622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI29D2.tmp

Path C:\Windows\Installer\MSI29D2.tmp
Size 569KB
SHA256 41abe8eb54a1910e6fc97fcea4de37a67058b7527badae8f39fba3788c46de14
MD5 0be7cdee6c5103c740539d18a94acbd0
SHA1 a364c342ff150f69b471b922c0d065630a0989bb
SHA512 f96ef5458fdc985501e0dca9cac3c912b3f2308be29eb8e6a305a3b02a3c61b129c4db2c98980b32fd01779566fa5173b2d841755d3cb30885e2f130e4ad6e2c
SSDEEP 12288:ExMVLwCHV6PNm0lA2QH3/ORiY/u1IOTyQtx7N6SfinDlVPJ81EPH7f:ExMtw+Hvu/bOJTUVPyqPH7f
TLSH
T105C44B20325AC43AE47D45B02A6CDB6E61697FB20B7A54DBA3C85A7F15F08C24731F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 075feeb9311276fdd976b2056e2aa1763e0898d2734b0d8737d686070e8a8443
MD5 5fcaa2fddb862a5dac7a9b7bf39ea517
SHA1 5cb2f8a97420570fcd368b5351d8ecccc76f3adf
SHA512 a33b109fdc5b2503fa9e296eb307d876779b5b5117eef1c47986a45b6e121768d3cba85f9c8177f8285de739c3445d4504b0f8cfc0c29e16ac54af5fbd9be8ea
SSDEEP 24576:4Fo3DMP6doO/vvTL/CwF1yFQPrOfebSmUYjHdIrtDQrKJykVM4RWVsfURed:fHw
TLSH
T12257162436F92110E7F39E3DA8F46A234D397D579C16DE8C05425B8D0922FB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{fb362731-668e-4b4e-8003-f3242fa7027c}_OnDiskSnapshotProp

Path \??\Volume{ca73a981-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{fb362731-668e-4b4e-8003-f3242fa7027c}_OnDiskSnapshotProp
Size 6KB
SHA256 975292cf3ee238bfaf273a30a3c6bed51e33ab89ccd7bf2ac71feab255932fc3
MD5 703dcf2910b2e7fba8a43714dee23437
SHA1 978e608c156ab613038c3765c6ea12ed6d74d8b4
SHA512 29c4da6cac6d235536b930d7b4def50ff06b971509598a6e13d43f5ec5ff296aa67bdd5d3eb49a8676cd77ad18a0cabe99c5fc56e8ad33abcaee049931eb12a9
SSDEEP 96:FDDfEhUvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:hf5b++uVmN
TLSH
T11CD198180AF54711E2B3AB3228F58557A877B911EF33CB8E0198638E2631910F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2208-1080-0x0000000140000000-0x0000000141614000-memory.dmp

Download