52c997e78942ea2d370382755817714a0066520229378d2bda6e99a760ba0e1b

Resubmissions

24/10/2026, 01:35

261024-bzr23ae13s6

24/10/2026, 01:31

24/10/2026, 01:29

24/10/2026, 01:27

24/10/2026, 01:04

Analysis

user interaction
yes
max time kernel
227s
max time network
132s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
artcraft-launcher-0.5.1-windows-x64.msi
Size 8.9MB
Sample261024-bfebvsgz6k
SHA256 52c997e78942ea2d370382755817714a0066520229378d2bda6e99a760ba0e1b
MD5 5c1c4f3298e7bd54c0abc21a34b81932
SHA1 f6bb4f2cc5179588845f164306ac8ac6abd97d6e
SHA512 1d380ecdafa9d60b9ac7f510c33d8d9d20220983ec3dd60883fbbae1c0b1af829bd1148f0c401d7e212de42965d55f751a244a92ae3171a47524e1abcc025e11
SSDEEP 196608:GF7RzXu6YzCWfEHGsvszC+LIfep4GkrXGw2BDnOZ8namYp+bxF:cRz+EdszC+LIfDh2tOZ8nAc
TLSH
T18F96235DB79835AAD4BB427CC4A35615EA30BC083720D24B0364B66B6E3A763F47B74C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2712	powershell.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	720	msiexec.exe
3	720	msiexec.exe
4	720	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\FilmCraft\filmcraft-cli.exe	msiexec.exe
File created	C:\Program Files\FilmCraft\filmcraft.exe	msiexec.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF42D9DDE5CC25E53B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAFF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF7CBCF30C9057F92.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\{F79A882E-479A-4253-81EE-2CC272EB7924}\FilmcraftIcon.ico	msiexec.exe
File created	C:\Windows\Installer\e59c869.msi	msiexec.exe
File created	C:\Windows\Installer\e59c85a.msi	msiexec.exe
File created	C:\Windows\Installer\e59c864.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{F79A882E-479A-4253-81EE-2CC272EB7924}\FilmcraftIcon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCCF18260EFCD3C69.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI10BC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c865.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD64B891BBF81F10F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC6572F2A1556D69C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFED22B9F2BCF26D1D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9AC63A2992F7F6A2.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3B71170E-5AD7-4F74-80F1-07A213177EF0}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F79A882E-479A-4253-81EE-2CC272EB7924}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F5A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF97BE906DCFDABFCA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDE9820B4E320FF8D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF25950643ED27161D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c85a.msi	msiexec.exe
File created	C:\Windows\Installer\e59c857.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c857.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EB405404-028D-4751-8466-A9A41C0EBFBD}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF59A0758232CC3EE.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9AF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBC8900DF37FAF551.TMP	msiexec.exe
File created	C:\Windows\Installer\e59c865.msi	msiexec.exe
File created	C:\Windows\Installer\e59c859.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF38B45FC127067169.TMP	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
1372	artcraft-launcher.exe
3256	artcraft-launcher.exe
5024	filmcraft.exe

Loads dropped DLL 2 IoCs

pid	Process
5936	MsiExec.exe
5936	MsiExec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
720	msiexec.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	artcraft-launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	artcraft-launcher.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	artcraft-launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	artcraft-launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	artcraft-launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	artcraft-launcher.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000460a485937509c200000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000460a48590000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900460a4859000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a460a4859000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d460a4859000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E288A97FA974352418EEC22C27BE9742\Main	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\ProductName = "FilmCraft"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\Version = "786432"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\ProductIcon = "C:\\Windows\\Installer\\{F79A882E-479A-4253-81EE-2CC272EB7924}\\FilmcraftIcon.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41BF6E13CBD9DD142BB4627BF13BB126\E288A97FA974352418EEC22C27BE9742	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41BF6E13CBD9DD142BB4627BF13BB126	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\ArtCraft Launcher\\downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E288A97FA974352418EEC22C27BE9742	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\PackageCode = "8EE2F13DBBBA7C94488E5BA523C85601"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\SourceList\PackageName = "filmcraft-0.12.0-windows-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\ArtCraft Launcher\\downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E288A97FA974352418EEC22C27BE9742\SourceList	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	artcraft-launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df0040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	artcraft-launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c000000010000000400000080010000040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf15761419000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	artcraft-launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	artcraft-launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	artcraft-launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	artcraft-launcher.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4232	msiexec.exe
4232	msiexec.exe
2712	powershell.exe
2712	powershell.exe
2712	powershell.exe
2712	powershell.exe
4232	msiexec.exe
4232	msiexec.exe
4232	msiexec.exe
4232	msiexec.exe
4232	msiexec.exe
4232	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	720	msiexec.exe
Token: SeIncreaseQuotaPrivilege	720	msiexec.exe
Token: SeSecurityPrivilege	4232	msiexec.exe
Token: SeCreateTokenPrivilege	720	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	720	msiexec.exe
Token: SeLockMemoryPrivilege	720	msiexec.exe
Token: SeIncreaseQuotaPrivilege	720	msiexec.exe
Token: SeMachineAccountPrivilege	720	msiexec.exe
Token: SeTcbPrivilege	720	msiexec.exe
Token: SeSecurityPrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeLoadDriverPrivilege	720	msiexec.exe
Token: SeSystemProfilePrivilege	720	msiexec.exe
Token: SeSystemtimePrivilege	720	msiexec.exe
Token: SeProfSingleProcessPrivilege	720	msiexec.exe
Token: SeIncBasePriorityPrivilege	720	msiexec.exe
Token: SeCreatePagefilePrivilege	720	msiexec.exe
Token: SeCreatePermanentPrivilege	720	msiexec.exe
Token: SeBackupPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeShutdownPrivilege	720	msiexec.exe
Token: SeDebugPrivilege	720	msiexec.exe
Token: SeAuditPrivilege	720	msiexec.exe
Token: SeSystemEnvironmentPrivilege	720	msiexec.exe
Token: SeChangeNotifyPrivilege	720	msiexec.exe
Token: SeRemoteShutdownPrivilege	720	msiexec.exe
Token: SeUndockPrivilege	720	msiexec.exe
Token: SeSyncAgentPrivilege	720	msiexec.exe
Token: SeEnableDelegationPrivilege	720	msiexec.exe
Token: SeManageVolumePrivilege	720	msiexec.exe
Token: SeImpersonatePrivilege	720	msiexec.exe
Token: SeCreateGlobalPrivilege	720	msiexec.exe
Token: SeCreateTokenPrivilege	720	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	720	msiexec.exe
Token: SeLockMemoryPrivilege	720	msiexec.exe
Token: SeIncreaseQuotaPrivilege	720	msiexec.exe
Token: SeMachineAccountPrivilege	720	msiexec.exe
Token: SeTcbPrivilege	720	msiexec.exe
Token: SeSecurityPrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeLoadDriverPrivilege	720	msiexec.exe
Token: SeSystemProfilePrivilege	720	msiexec.exe
Token: SeSystemtimePrivilege	720	msiexec.exe
Token: SeProfSingleProcessPrivilege	720	msiexec.exe
Token: SeIncBasePriorityPrivilege	720	msiexec.exe
Token: SeCreatePagefilePrivilege	720	msiexec.exe
Token: SeCreatePermanentPrivilege	720	msiexec.exe
Token: SeBackupPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeShutdownPrivilege	720	msiexec.exe
Token: SeDebugPrivilege	720	msiexec.exe
Token: SeAuditPrivilege	720	msiexec.exe
Token: SeSystemEnvironmentPrivilege	720	msiexec.exe
Token: SeChangeNotifyPrivilege	720	msiexec.exe
Token: SeRemoteShutdownPrivilege	720	msiexec.exe
Token: SeUndockPrivilege	720	msiexec.exe
Token: SeSyncAgentPrivilege	720	msiexec.exe
Token: SeEnableDelegationPrivilege	720	msiexec.exe
Token: SeManageVolumePrivilege	720	msiexec.exe
Token: SeImpersonatePrivilege	720	msiexec.exe
Token: SeCreateGlobalPrivilege	720	msiexec.exe
Token: SeCreateTokenPrivilege	720	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	720	msiexec.exe
Token: SeLockMemoryPrivilege	720	msiexec.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
720	msiexec.exe
720	msiexec.exe
1372	artcraft-launcher.exe
1372	artcraft-launcher.exe
1372	artcraft-launcher.exe
1372	artcraft-launcher.exe
5460	msiexec.exe
5460	msiexec.exe
3256	artcraft-launcher.exe
3256	artcraft-launcher.exe
3256	artcraft-launcher.exe
3736	msiexec.exe
3736	msiexec.exe
5024	filmcraft.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1372	artcraft-launcher.exe
1372	artcraft-launcher.exe
1372	artcraft-launcher.exe
3256	artcraft-launcher.exe
3256	artcraft-launcher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5024	filmcraft.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 5936	4232	msiexec.exe	83
PID 4232 wrote to memory of 2336	4232	msiexec.exe	87
PID 5936 wrote to memory of 1372	5936	MsiExec.exe	90
PID 1372 wrote to memory of 2712	1372	artcraft-launcher.exe	91
PID 2712 wrote to memory of 5460	2712	powershell.exe	93
PID 2712 wrote to memory of 3256	2712	powershell.exe	95
PID 3256 wrote to memory of 3736	3256	artcraft-launcher.exe	96
PID 3256 wrote to memory of 5024	3256	artcraft-launcher.exe	98

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\artcraft-launcher-0.5.1-windows-x64.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:720

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 38250C923BA400C218EFBD1C650B6EA7 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Users\Admin\AppData\Local\Programs\ArtCraft Launcher\artcraft-launcher.exe
    "C:\Users\Admin\AppData\Local\Programs\ArtCraft Launcher\artcraft-launcher.exe"
    3⤵
    - Executes dropped EXE
    - Modifies trusted root certificate store through registry
    - Reads the TCP/IP host and domain name from the registry
    - Modifies system certificate store
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Wait-Process -Id 1372 -Timeout 60 -ErrorAction SilentlyContinue; Start-Process -FilePath (Join-Path $env:SystemRoot 'System32\msiexec.exe') -ArgumentList '/i','\"C:\Users\Admin\AppData\Local\ArtCraft Launcher\downloads\artcraft-launcher-0.7.0-windows-x64.msi\"','/passive','/norestart' -Wait; Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\ArtCraft Launcher\downloads\artcraft-launcher-0.7.0-windows-x64.msi' -ErrorAction SilentlyContinue; Start-Process -FilePath '\\?\C:\Users\Admin\AppData\Local\Programs\ArtCraft Launcher\artcraft-launcher.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\ArtCraft Launcher\downloads\artcraft-launcher-0.7.0-windows-x64.msi" /passive /norestart
        5⤵
        Suspicious use of FindShellTrayWindow
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Programs\ArtCraft Launcher\artcraft-launcher.exe
        
        "C:\Users\Admin\AppData\Local\Programs\ArtCraft Launcher\artcraft-launcher.exe"
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3256
      - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\ArtCraft Launcher\downloads\filmcraft-0.12.0-windows-x64.msi" /passive /norestart /l*v "C:\Users\Admin\AppData\Local\ArtCraft Launcher\downloads\filmcraft-0.12.0-windows-x64.log"
        6⤵
        Suspicious use of FindShellTrayWindow
        
        PID:3736
      - C:\Program Files\FilmCraft\filmcraft.exe
        
        "C:\Program Files\FilmCraft\filmcraft.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:5024
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2336

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:496

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C4
1⤵
PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59c858.rbs

Path C:\Config.Msi\e59c858.rbs
Size 9KB
SHA256 575ebb75843778d57192cdc059b0eb5622f089fa878c9c23c617905f9437705f
MD5 f68e499ab488ade703e0cb57c199be3a
SHA1 1ace600cc0464946601cce17050b26bd56d182b6
SHA512 366fd60ef235f33cca08591066150d8f5cba4f6f081885b3d9faf80958ee905f46d14af9d642481de76398224fc13eb4ac48d1ce3b39f3d0b37b52e8cd25517e
SSDEEP 192:yyE3PvUat5CCPLdONZqIsdONZqPCwFepHa:yyCPcat5BdON4dON51a
TLSH
T1ED124501B601C1E3E4651BB5C74B1F20B7F6E69BC225271B1D9E42180F9B799DB17A83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59c85f.rbs

Path C:\Config.Msi\e59c85f.rbs
Size 10KB
SHA256 61a6a6cc6128ac94d43df9594fb6f3e42dd3cba6097104f598b3732d5ee4d96a
MD5 c0043a342320dda1bc640af0e0c10a90
SHA1 4cf33d6c9b169c2c98d45b01d5701a216bd0b2a0
SHA512 0f8d4174d2d0324c64bcea9b1c179152a4075b2130db31f5ed955410d1b2305d243b7c403a7ed92738e34bbea525841974f0b9b7660fe49e5823f3e5fb6ca99d
SSDEEP 192:5y/RBOx9GER9Ox9GduRGwT0JugXAr+qAn:5y/RBOx1R9OxUELAAr+qAn
TLSH
T18C326302B205C2E3E8A11B71CB272B30BBF3DA9B8329471B119E46581FDF7959B57583
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59c863.rbs

Path C:\Config.Msi\e59c863.rbs
Size 9KB
SHA256 fc695737ded46be5ab36b99136ef8b98240f2d0a1b6aab9c1738e3bf2f999943
MD5 a9a2d76358ec6d19e02e53e58eee778d
SHA1 5842dbbda6ef1a708e711d4152562441bab4a28d
SHA512 7b1f7be5a137b131b637f289e8a8aa4634e25c019cb0a7a081937326ec2b15d51b2ebf90e5aef959be76ececec770c3196eb43591517aaa9cf822d02981ed4a2
SSDEEP 192:52ybzvMaQG5CCrQKODmITKODmvumihpXn:52Az0ad5CKOD9KODPBn
TLSH
T1A71254427282D1E3E0AA1734C70A1B307777D3E68226674F05CD82589F9F6986F1F197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59c868.rbs

Path C:\Config.Msi\e59c868.rbs
Size 8KB
SHA256 1c09dbf7a00912edeb825939dfb775b3782a4b9dfa53e3c0103fc76f96f1cf01
MD5 07abbd9784462571f206e0664e0bd0a6
SHA1 0239e513019ab10eb9212a8562d820bb57a4853e
SHA512 64936151f01cbb1507e5d6570e56d7dfc4b4c8f3277138f811e0718b2bedf2a334d58083a64220cd95389cdb854b5f3a4483fe1835d1cdf9a7e00a949538eb1c
SSDEEP 96:dcm0jYAhvxR28sCnx2YUXnw5zZ+CsTloUXnw5zZ+C6jpT9xTlrNjv5+QWBQBcAAI:TUY+xHsCc3ANZ9I1ANZ9SP9OcYpQ
TLSH
T1D5025142F30291D3F89A5B34C74707663BA6EAD89308130B158E86249F9F7485FE81AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1F4E5DEECE6C3828271EEAA915CE0365

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F4E5DEECE6C3828271EEAA915CE0365
Size 309B
SHA256 d6b065201560957ee0d219d3bfcc830df21cce066297e645d87af227e12ec1a4
MD5 a59e840fdb316aed6cce55dedd400913
SHA1 e3a14bddef589646311225d1429df672b9df056d
SHA512 ee698d062d0727dfdb88d209f2b17c9cd866082c480e2d401900a24d837aed0a74554e5d2879bdca8be79d0e7bc8e847058f824c0cbe0bbdfb6ed45e9d9dc396
TLSH
T137E07D91927D3AC502F1EA50D9E4C4B32C7CC0C5069B70550540C39064C368A9B802CE
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 279B
SHA256 afc5ee13d6ed025c84384a46139bdeb43bf8b0fd9dd2aab6ba9c52c0e92cc634
MD5 a6985e3348ab22d00ccc4d46882e9f58
SHA1 3bb3e490a5446b0ac2a73739535f9ff357703c5c
SHA512 a7598eb8170596e1e3b4a3bde5bc58a24d329c3a6af9f5a488efc3dd2095157e2bce814b5849da1056dd4488787fdefa9e8197690f63a0441d2a840d5d7fb8b1
TLSH
T121D02B7246FEF4053E2BEFB1E9D4E7D47800273216F5A44374C8C2540A48DAA6D4A221
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 188KB
SHA256 bef85c98e8ba95d249e5111089211ce79639324e9ce3bc49a1f337f2b817441a
MD5 8316661c20c201eff825b477fbab76ec
SHA1 b80271f6343b280bdeceb5891cab6486657a20cb
SHA512 0b6a1798ccd50155a6621d4f87371cd004e506950b4f41e1fcf77b9b3a4ad12a388198b80f165437de6ffd0684019e27e38bc34f5d3934ddede017462143eba0
SSDEEP 3072:VwXzqv9YzQGujJU/v+NpO7ZMmwRnqaDyf8ZHaHzGDM:seOEGujJUeNpFnDW9SA
TLSH
T124142F286DBBB1619F4ACDA14C9AAA5E03F571DF1312331B4EB76ED01D43A9B8E0744C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 1KB
SHA256 c1657ce4cc8a4df2cf5f9b4b55462f054eda037760e056fe1552a0cbd09dba7f
MD5 2b9812083eba71f116cab1c47a9ceb66
SHA1 1b8aabaf54674ae1fdd90a80a459e219dcc87fea
SHA512 81c0342d1434d23edf5bd744490adae703f28a6e1308414154c4339dc4418ac532e8506d02bca8f47e6f0894da17961b01b074b39e1c929d9e7b0a5629bfbb82
TLSH
T18E31E9CA4C6578813E4B648617C0CFB63DB49D931C584299386F93BB0FD67B2278574D
MD5 SHA1 SHA512 TLSH

Submit Download

A9FA314C8877B1FA1F912B4C18662AEE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A9FA314C8877B1FA1F912B4C18662AEE
Size 279B
SHA256 a19f267e6071afb5b76bc0bdfe9d631251d55f096b5bb32e04933c81b8eb95f4
MD5 0c33fe184afb2bc29e9e3641df21fa6f
SHA1 c828669340e2e94a1b06db502c2177d463d45139
SHA512 0704b11c65f8f0a5511dbd3ce13914b86d7d2a625beea5d13a59d3e6256f439bb0448192efe1bdf09a5ee288fc5629c21f295e92e91b051fb5ae087e5d1f1cc4
TLSH
T16FD02B67497998467D1DF560A4E4939072496035539B6645340482991914B7B1D0A199
MD5 SHA1 SHA512 TLSH

Submit Download

C8D02B4227BDBA17232BCBB5B61BEFB6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8D02B4227BDBA17232BCBB5B61BEFB6
Size 21KB
SHA256 982609d826c83fa8f6defe429618fe2f8382829b4a50ebb00b39215237e2d4b2
MD5 962a7f4cf2b8bc829fa6ed7ee04c7fed
SHA1 fb7ad2bcccb8acd4501d5bece8134f74468762f8
SHA512 b1f5b9f1fecc3f7b2f4f3156e6adea86767a70ba2d6049606ec8401d2c79ab113b14c4a3b6879233576163b2420b58ce22fe2b0e8694b09d5f4d357e3414cd9e
SSDEEP 384:j+3aXwYEwMsYEg4QfKnaZo7CNBXo+/gxX5ew:3wYEL3e7CDL0X5ew
TLSH
T1F5A2E9BCAA4CA69751C66A71CACB9FD3C8F651B53BD2E10F41651E880424FC3CE97382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 9e153cc9331fb887cacd6f08cfa3dc5aac7b9b26b4b9cfa75d2ac57288e9142a
MD5 13c624bbd9ad9ff627a68b5ced19b228
SHA1 ff158247f5c6bf41d5fed9f3d756b82f735a24f6
SHA512 62251f6fd12706cc3b90b738523a3a32c34b104ed967b0f42da80596fe0a3b03a27dbbbab144afff619c4a910558b2f8f6f6f223f4cc65bb288f7516bfdb7068
TLSH
T14A017561A8BCF3844DA11BD603F4ADA559B407F6294CB2672437A1560562B53EF28129
MD5 SHA1 SHA512 TLSH

Submit Download

1F4E5DEECE6C3828271EEAA915CE0365

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F4E5DEECE6C3828271EEAA915CE0365
Size 192B
SHA256 1b755fda177575a85d175e360f1b64c93a1c8725d8df874fa71d30d7db0fd3ac
MD5 c2bb8f5964112ac68f13e12d63078eb2
SHA1 4b432058f2cc727aecb9943ac78ae7c5413232ee
SHA512 950a308ab330c85c3bfda4788665e366ce1fe549db95c249148f9e02325c200b9235b89fcea0fdfa2dbc29867f7f24685550ca67d167c34c59d59e9f7e8e7d1e
TLSH
T129C08C0276324200E128027E0CD166210BFCF214E06383148BF8431D229DA951C71E06
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 1cb4a3baa1ba1a22de640fa52f40ef43a6cbe94176ccbebcfafc270a546c8bc9
MD5 6640c4884771cdb82f98775d0d6e1100
SHA1 560e39f85ad70c66aa5ca3ae9e9f8df46e647a1e
SHA512 d6f8239bcfde6552cc84aec35238d08b42192ceb2d9ab1ed94fadd1b93a3c2968234bdba92b259caf48e365399064d8e45f1e76ce9598299761753334d07cbfe
TLSH
T195F0AB20257C463DF0B3E839C1D632FBEA39E21764099BBB06EB130A5711E400D9263F
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 5e89da5f702329204fb5edffe31613dff667dbdd00fbe2a53130024100de208d
MD5 8cdbc80ea1b8e729df6ae9c9c84125fb
SHA1 f3fef8bc3a6db1aa666bc7519644d62ed36f3834
SHA512 ee51f1286439a735ceb4ae4d582aa74c208cb227dd813f832d6c65f44cbe15ad8d1690637d9ba78dcac4ad205ff7d5599495ec817a42e6b5cc14bd33684e85b8
TLSH
T16AD0222C0BA50728F121773A1AE002826B90A81AB189CBBA0F7A011CA1ADDD29C60C1E
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 422B
SHA256 a435e163bc2e92806434bbbdbcde394c1811fe15a68dd37e6be7a0946f3e5e73
MD5 0889f1785c99585b2b98a15ac3bbc9fd
SHA1 1f8c4793c88fb60a14f49c391d19aed5e228ea13
SHA512 0904cf161a03db9ae90b625972ac235596f1061dbbbbe94af68aa5637a2aba8351f03b7db055de609fe4b32f22009abc0eb8254874157ebb3717e34454554505
TLSH
T138E0681418FEC10BE372AD3D079AA53F4A3BF3730C086AA6E2600134680AD108D31F23
MD5 SHA1 SHA512 TLSH

Submit Download

A9FA314C8877B1FA1F912B4C18662AEE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A9FA314C8877B1FA1F912B4C18662AEE
Size 484B
SHA256 5e5dbd6ae07b1a80ab9186e4899864a1821d5b0810ae441b8acc0de305a0d940
MD5 60b8d7286bb722fe27d3731d60eec4db
SHA1 160e8302883cc7cda46b2a1f8e30046bb9c4fdbe
SHA512 e007b1a7a9228550940996756a54ab23edb878277c2b43c355a255a76f256b73632508179a2588a59ffc87bf19cb345f47cb70d5f19df0139f8c607d6e13c5d4
TLSH
T108F0A33954FD0016F0B5D57D52D972B2F922F225340AA3FE06E352085F51C402CC213E
MD5 SHA1 SHA512 TLSH

Submit Download

C8D02B4227BDBA17232BCBB5B61BEFB6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8D02B4227BDBA17232BCBB5B61BEFB6
Size 290B
SHA256 bdb0b7a36a5f8325fa1b67f817945a05c7ff5ea29b08e8437b16450acb9b0aaf
MD5 2adeb04e9bd57dc95d813167a7d88b04
SHA1 5b79bb94764b793f94c65aa09f555b9280d6e47e
SHA512 cfeddf7dde2d186424c9575da234b47cb8862a2a89b9cdb7fe9b49ce8310a87fe852d99880c1f829adf1152314b2c7b36fdf8c34b3f336e1b23119182955a3fc
TLSH
T1A8D05E2993F50212F080C53F95D01A53A936BA35960093842BF0C31874A8EA1FE31743
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 b4abdb2bc9f280920bfc3c4d44b7802b1e126441dbf44838e7483f9074f85ae2
MD5 2044d2be990c54834c160718a99cd7ac
SHA1 87753bfc4af3a0b89fb138ca175ae4aa02527a78
SHA512 d01d9119e9ace38cde118aaa46f5d1eae45dde5b89026b093bf35c24a31355956068dd0e7b1ab74dda17ad8342b1a8675fadc2c5a9eeb86ea9724bb734fd97c3
TLSH
T148E05E0CA3FA0723F4D0C93D25E025137A35AE548A04C3490FF08719787CD81F920753
MD5 SHA1 SHA512 TLSH

Submit Download

artcraft-launcher-0.7.0-windows-x64.msi

Path C:\Users\Admin\AppData\Local\ArtCraft Launcher\downloads\artcraft-launcher-0.7.0-windows-x64.msi
Size 9.1MB
SHA256 a03aed4aec4bebee922227a9c2dce465c33de62ee0a6b463b9706a6706f346b9
MD5 15028dcedef3092b7051c5cbd1a9001b
SHA1 035fa0d56e6c36bfb70618a2933c7fafa1ebc412
SHA512 aaef40064c3a0cc41607996b3d15d90dadd5c3f1f9b454fb871a3af05c7127c4e07ff019da87415fbd4b28ef9189671016c15aa926f99153d8eade8a9af70880
SSDEEP 196608:9Fhg3iX7AZkH+X/sVT/Xex69xVXlJiqFUD8dXVo8kxlg6rI+ZPlh1d8boVciM:WSrikH/T/uI9xdXraD8dXvP6jrdpVc
TLSH
T168A6234E739434A9D8A7427D84675616FA30BC087710D29F07A8B65F2F3A353B1B6B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filmcraft-0.12.0-windows-x64.log

Path C:\Users\Admin\AppData\Local\ArtCraft Launcher\downloads\filmcraft-0.12.0-windows-x64.log
Size 2KB
SHA256 c3c7959d22d66154e210b614152cf5f0050725cedc48e8d62f5dd5c7d655062c
MD5 03ad94ac1f47357dcdcff108fe97aa13
SHA1 ce1e524f385ced55abb8e576b7a8c7c38d805fb4
SHA512 886840ec9fa6fd21b2dc5f9c225b584eaafdaa77ac376f8e69a4396755ff2733f48461ad727a392bf9de01414cec80c94ea89fa86e0002c36ee2ddd6c3f68162
TLSH
T19641C1281FE9090AB1B29B47EEF381535A73FD926838C70C2248D31A856BD05DD7D3B6
MD5 SHA1 SHA512 TLSH

Submit Download

feed.json

Path C:\Users\Admin\AppData\Local\ArtCraft Launcher\feed.json
Size 211KB
SHA256 c83b694a7a62186ef2de108e04b7f4994a3a16c23230d05d05cf7f68ebd52000
MD5 fc391bbaf4b9d5b1588dd1d1980dd8ef
SHA1 373ef9ab16aff1ee76e8c2e757dc8b7f5af5b7cc
SHA512 4713dd058ae737a33196949158ed3793dd5439a1b5cb69b0b717084d9615b43e364d66c69459e6956cba0a3c6ddfd6839321569687cb7a190d3f43764e11e7c3
SSDEEP 1536:r5LYk2FSxFAvYkoSCphd8TuEpd4YwB/lWW87xP2ouzLigBrujkHRJFXXl/cjJVG:rNYzFWAvMrd8lpd49/lM7JuXl/cVVG
TLSH
T1862453E7E326E6AD0F807FC086AE240CF7236177EDD5ACDCA1E2905897A355A0377446
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

artcraft-launcher.log

Path C:\Users\Admin\AppData\Local\ArtCraft Launcher\logs\artcraft-launcher.log
Size 570B
SHA256 b5e26286465705fc394975c78df748b7dda243d8405655cfb520824181a8b65c
MD5 65e283afd5263d0a25f859e8926aeb07
SHA1 7b2950c01ff7052c0015c3141dc7b9e75faeb97e
SHA512 9b45569b51f0dd81361bf610af3be641b5ca47c9fab45dd24e064503aca0751bb14be1e917dede17bb67977b377e97c9a637db91461572aa088c66fe05c30d28
TLSH
T1BDF0EB06B18F9A32982387A193286323DF2EDBD2105D64F83770CB1822CE4789D6E620
MD5 SHA1 SHA512 TLSH

Submit Download

releases.json

Path C:\Users\Admin\AppData\Local\ArtCraft Launcher\releases.json
Size 8KB
SHA256 478a0b89f750dedb1ba66961d4de417d5e7b6b105e6c23e4f552259671b9d9a4
MD5 32048a5b96435c8eda69fd27217c9358
SHA1 0611126f7b7cef2dd871fc30792e5a2562e8a698
SHA512 415ebb66e1a4d84961a19f84d10f132e10c253a2d458964630c105410cecf42ef4ad4d3b38626bf5bcd22caa7f11100877ed8d2420b15088a5d01675049853cc
SSDEEP 192:tEsGL1H88eV7hbWcrsMHvprOtyQoC+d4KG6ZDv49nz:qsGL1H8Ac4QvprOttoC+GP6ZDwd
TLSH
T19D02F0B3E37769991F90BFD0C75B6118EA133136BEC4ED58E1E3994C9A93B5602760C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

self-update.txt

Path C:\Users\Admin\AppData\Local\ArtCraft Launcher\self-update.txt
Size 18B
SHA256 c4993ea7d9d146e72730b4cfa2334632c14dc00e5c27b5284b60592f1c6ec036
MD5 94231f3f0e0460ab54ed18c7f9139d2d
SHA1 6d06913cb3c7d5e217e42fdeff9caa8f79abde7d
SHA512 07f033ae933733dab687427ec61cce152ac02e8e6fbc8d0e29e1cb1bb8ee627683f75cd0b4c3e740711b73f5f809f0029640d3cda63ae396f01c0b38427efc8d
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\107c941c7d7cf7f3\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 ed46fd55fcac7b7fc786bf5f9feb1c7952d91ad871e43feb2412e3f392acc582
MD5 da44e950c25392b6584d42ce359cc14a
SHA1 b2741f36c9fd13f70b087f502136eba8c30be3f1
SHA512 a7284fb10b864a1bda0442fbe209426233b6c4a7f0ef65d46572f287acff387a1738c5a5e7d30d744f089ab2432df1c47bb7e9e670b811512e08ab7a3bb7e9da
SSDEEP 3:dFlGlll/l/lXp9ZjDzExPBYyqETuTHPl/lBl/lrJl/vhtqeWlG1xR9jG5GgxFl/l:dF0RExPBYyq1XltrJlfie9jG5GWV
TLSH
T141538C10A3139617C41A233089D51BE23872895D0A032FB2E78A8EA168B9312193BA88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\107c941c7d7cf7f3\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\107c941c7d7cf7f3\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 11KB
SHA256 0022b7d08fd5c9856e3a6992c4c6d9281ae87450061b6df340ce1df8fdd9d922
MD5 7b10e15d62c894e55469f0ffd434e63d
SHA1 918e49603da1db70a0c4a721383b178ad059952f
SHA512 318d2a7d32706b2271d33829b4751d6e1160df5d02e6cfccc8158c5433df78bb84e409a7c8774b906099faee4c61324406ea9ba8f70fe0dd5317d593c03bc12f
SSDEEP 192:Y+NlUKt9yOPTApi6PKt9iyp1CQkJC2Kt9kqdU81ImiGoKt9Qz3bGoLBkl:Y+NlymApUiyqBJ8JdU93GPQz3bGoo
TLSH
T15E324E46E1812EDCE074B3BE85FC42E7B356901977B7AEEC93F5E369851352724035A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

artcraft-launcher.exe

Path C:\Users\Admin\AppData\Local\Programs\ArtCraft Launcher\artcraft-launcher.exe
Size 21.9MB
SHA256 ae89d6316cb18ca136c6332a43ace5340651cc66b32846842d180ac3f65bb3e6
MD5 3c93158786fa0ab6f26ad9216d0e9487
SHA1 eab3b36ebdaf3224f22b016c2b4349ea11e1e30b
SHA512 5f44a2015cef6e8e6a2881d50eca9e6a57e3f600c4c77ba2279f38f46340f6e7f8755e7f39e911185d37ef6b3ba323ca7544d001c912b0d68c9b29f3e26a91fb
SSDEEP 98304:YAvJJCs8Um506eEaIuVKHGbVhtq9BW7p6Ljr1dfyXZHLwEmPx6ZrMYStl/QoazK+:bJ2J4IsAYePaSUn6mnKipt+Rq7BQ+l
TLSH
T152377C02B65B99ADE16AC87083068A736A2134DB0B36B9FF45C451383F7EBE05B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

artcraft-launcher.exe

Path C:\Users\Admin\AppData\Local\Programs\ArtCraft Launcher\artcraft-launcher.exe
Size 22.7MB
SHA256 c516539e0bb7cdf92161d2b7b9ff8550e9b023edeca49e28bc73d04a94a2ee24
MD5 1879daded81c48ac0e248efe66328440
SHA1 a2ca6db260da5ae372e632df20c30bf42bf79623
SHA512 6c8a9a82789fe48813aaf2c8dff7aff54dbf3c2cd373c7400f0f724e7e531463ea426b0daf915417ca606f6294afaa1719759de70743eeefcb51b8ba294dd327
SSDEEP 196608:nnw8bMVcJRe/7q445XriuVpipt+RzOAW11:nnw8Qv/Rpt+DW7
TLSH
T18B377C02B65B99ADD16AC87083468A736E2134DB0B26B9FF45C452383F7EBE01B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8CE4.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8CE4.tmp
Size 175KB
SHA256 9d6745913a51d4c6749a4119f87da410cb226c45a72d6dbc3231efe5b928f491
MD5 543072c649a87e1880784b7f0effaeeb
SHA1 c0f986dbb344aab2efe92bffbc8e683f11558f80
SHA512 b7a16edd32a517245ba3c70d83175009486e840f9a0820b8d787b3e39b8594687617f67c50db253bce213786609975bb969325150b99ccdcb4e4b858e539ef2d
SSDEEP 3072:nColDBwKxdtOToLEzKqflmw9N+rDoluP2:nl+Kx/XL4KIT5
TLSH
T188046C5673B400BAE8B78235C4934A16EB76B8511720DBDF07A4433A9F2F3D1A93E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID6DF.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSID6DF.tmp
Size 390KB
SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
MD5 e8dc682f2c486075c6aba658971a62cc
SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
TLSH
T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mmu2n1rq.anl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mmu2n1rq.anl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

graphics-start.json

Path C:\Users\Admin\AppData\Roaming\FilmCraft\graphics-start.json
Size 31B
SHA256 5a901b950e990d525cab0225239e8bacd839bbb7d85d80c99110b09ba26d2d1b
MD5 72fb56a3c4ebd4857af37d4c0756bf21
SHA1 1a24bbb0062eb1ac35d8650dc189dfef83eac2bc
SHA512 b5c0e842b963f47f0a00268cef1b598cc0318da63450b35b9e2cdd336fd6542edb9a4fc122896ec993034726a682b665cc1a4b24e3130c937f1fe0bd1046a01d
MD5 SHA1 SHA512

Submit Download

ArtCraftLauncherIcon.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{3B71170E-5AD7-4F74-80F1-07A213177EF0}\ArtCraftLauncherIcon.exe
Size 11KB
SHA256 5cfb23780d306e7abe92e4dccb10b9bb5f638625c5de719b2c977ab0b5821ea8
MD5 7addf9bf3518fde492a6064ef3849f89
SHA1 210888beadf9c7ac5bb7b77e18ad306e8f1b6ded
SHA512 40a5538459f0e1e7dbc2cdf9495cb731963a54b4b0217bae37ae081a5d43c37443fda5f86c0c058fc9656f9093e82b4aff51cd32fa7aa377a9465f94f089d066
SSDEEP 192:LUQjqUirct2hIu4KpmzQBu4DX4dewOuGa6+eAWR5myKdbN9B77sdtxDJJL9JsJ:Ln7irc+ozQY4swba6TJ5mtB7Shc
TLSH
T10732AED397E9BC74F2BCB17BC0112557AC79836C41B7408F608D8A2AB63B62458D92C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArtCraft Launcher.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ArtCraft Launcher.lnk
Size 2KB
SHA256 748e110f8f55cc04837a5a56aefa67f3e4c2b60e02186b60fe33594d8283e2fc
MD5 07bac957af950efaa9ce7475330ddf7d
SHA1 29a977b81fe84a6e36446908335f303ef7217c35
SHA512 8623a7143ce98e0044acc7e60263fc0626ab1a5c3ac2094012ef710e13104ebd27529f0b468d00e5b3bdfdacb3d112c6f8cf9cb52e2777a8cf85c357b1b973f7
TLSH
T1D8510F10A7E91625F3BB5BB50FB95A22EB66FC159728CE1D0044E38E0536F039C95F2D
MD5 SHA1 SHA512 TLSH

Submit Download

ArtCraft Launcher.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ArtCraft Launcher.lnk
Size 2KB
SHA256 8f0651fbb92eef6a6ff5273f7b80159ec926fd537bbce0738fbdd9c304c3ccf7
MD5 0fbbb713304dc53c3130cce60420f1cd
SHA1 4aa1382387ea3630b7a30639f7b2fc8d0ce6c62c
SHA512 14bd77dfd37a2085d88a7bf9ad329fd0690a90ef40dd14149a9d723b1aea5395d066189118c148407e381e1661796cd2a94ea1e93bbc8ecef2444fe99d4d0dd0
TLSH
T1B751DF1067D91536F3775BB54FFA6522E766FC559714CE1D0140E38E0636A03C819F2E
MD5 SHA1 SHA512 TLSH

Submit Download

ArtCraft Launcher.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ArtCraft Launcher.lnk
Size 2KB
SHA256 b36f89d3aedf2760186b0d9217badf9f077e559395df5a24a842eee31221c174
MD5 1b148ae05b4cd3d44b86b456e30d20f2
SHA1 c20708bad8cc029639b9b21de8ebe7bbe904092e
SHA512 9a127fe9d182dc1de879ddd125cb2fc1099303aceb0ddfd732b3dbd1f5f33a5dc4088d404b121d593113beed49e72975cc303c2c14eb374d437774b5c2ba83d7
TLSH
T10F51E21067D9163AF37747B54FF96522DB66FC559714CE1D0140E38D0A36A03D818F2D
MD5 SHA1 SHA512 TLSH

Submit Download

~rtCraft Launcher.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\~rtCraft Launcher.tmp
Size 2KB
SHA256 86101ffa971f9942173b6f791b240d1febbc3c863770b70ecd9dfc8389a4919b
MD5 df02f85d47b0bd11f06933d960dafde2
SHA1 373b819d7838db7a7065b182efe262f50261e099
SHA512 e95ea2af649d0a131291b3534566e2dd1f9d0f82b93fecc8e32f8cbb220a46d48322e0be6965a0bcbd2f3b9a275a2ba189f0ce5caf1e89bb0c1b713ed53dd600
TLSH
T1D0510010A7E91625F3BB5BB51FB95A22DB66FC159728CE1D0044E38E0536F039CA8F2D
MD5 SHA1 SHA512 TLSH

Submit Download

app.ron

Path C:\Users\Admin\AppData\Roaming\ai.storyteller.artcraft-launcher\data\app.ron
Size 3KB
SHA256 c9c827bdce57f9cccba8acf285fa36ef93fa938fcd1f0eea74941df31338778d
MD5 91ce822d697e153ba3b98a415ee52bed
SHA1 1f4b768a6d70050b6ecb7aa972ecf51fa8d4c28b
SHA512 1db820f578415d9801216a0f238b8419d0478b52e641ab0a280923aed713065bc831ca74e7e43efe5f62891903e1bf2f195a2c9ee8cc7decb7438a5c13dda04e
TLSH
T18061C82404C67AEFF1D3D99581803E199F32B2B6F656BC96D58C831728832939763A44
MD5 SHA1 SHA512 TLSH

Submit Download

ArtCraft Launcher.lnk

Path C:\Users\Admin\Desktop\ArtCraft Launcher.lnk
Size 2KB
SHA256 b8a0b4fba106b0d6a684033398549d0d28e676870be16d5cc42c44654bdeebd8
MD5 e96177a878b4c993d6136181e11e3ed8
SHA1 fcd41c1ae06e06909cd3a4ae0ef83a6ea2522571
SHA512 2cde1980cfb582570221483186d5764b095fbc0e415849faf9101dc17b6bb9492489ca4621b75eeff13b1780c8a12cdcddbfb04568fe705b93ea9f0de2e37c85
TLSH
T1DD514410A7D91125F3BB5BB50FFA1A12EB6AFC154718CD1D0040E38E0532F039C95B2D
MD5 SHA1 SHA512 TLSH

Submit Download

ArtCraft Launcher.lnk

Path C:\Users\Admin\Desktop\ArtCraft Launcher.lnk
Size 2KB
SHA256 cc71027e94d76942bc4fed08f9d6125969629a2e512506e3e9264545654e89cc
MD5 195bd96d0d3d25d3e4368312ad6a0caf
SHA1 fff762ff335e9aa56e7497428636d5e6a657d5ef
SHA512 c6ef3a18cb0ff6ee28a8290aaa526758aedd48e4e75b1424b394adee8204b1108b849c64a7aa79a61ca1139bdcc8e7c3809ec3a5798eab9d7f002ce74fed1fe2
TLSH
T1F3514510A7D91225F3BB5BB61FB95912DB66FC265718CE1D0044E38E0536F039CA9B2D
MD5 SHA1 SHA512 TLSH

Submit Download

ArtCraft Launcher.lnk

Path C:\Users\Admin\Desktop\ArtCraft Launcher.lnk
Size 2KB
SHA256 3269ef51e5a1c7626e7f673dde4bdaec2f8edd713f5dbd01ce902ce988c7b19f
MD5 c398ba0c127d2427a68b4d9befb81abb
SHA1 be13859f7399076d10527e7b8c09dd53ff5c4511
SHA512 468d8789b108c9c2f3de2b307183384ae2c8abf707be04a751b139de9d457e6f37f0fcde001fbe9458ef8bb383b3582c0a552a3da7cda86c336746b82aaea1b6
TLSH
T17D51FD1067D91436F37B1BB54BFA6522EB6AF8119714CE1C0140E34E0A33A13C829B2E
MD5 SHA1 SHA512 TLSH

Submit Download

~rtCraft Launcher.tmp

Path C:\Users\Admin\Desktop\~rtCraft Launcher.tmp
Size 2KB
SHA256 b4af38d0e1226eb6e9dd27a65493178ee76df3ad20047919135a87cc6faacb9d
MD5 f7776941d0cda238118f9b6baff42da0
SHA1 dd850bf848f27c0e69473c7211a3d7293b9c5620
SHA512 9a8492e7c7befc2206d12bd30bf56b5dd9dab7c65465558ff4edb4f8adb927edf344b7a83bd0a5295ec948d367422a5f2d8eb6725d49bcc1e0947e498e376e3a
TLSH
T16B510E0067D9153AF3BB4BB54FFA6522AB66F8219714CE1D0100E34E0A32A03D828B2E
MD5 SHA1 SHA512 TLSH

Submit Download

e59c859.msi

Path C:\Windows\Installer\e59c859.msi
Size 8.9MB
SHA256 52c997e78942ea2d370382755817714a0066520229378d2bda6e99a760ba0e1b
MD5 5c1c4f3298e7bd54c0abc21a34b81932
SHA1 f6bb4f2cc5179588845f164306ac8ac6abd97d6e
SHA512 1d380ecdafa9d60b9ac7f510c33d8d9d20220983ec3dd60883fbbae1c0b1af829bd1148f0c401d7e212de42965d55f751a244a92ae3171a47524e1abcc025e11
SSDEEP 196608:GF7RzXu6YzCWfEHGsvszC+LIfep4GkrXGw2BDnOZ8namYp+bxF:cRz+EdszC+LIfDh2tOZ8nAc
TLSH
T18F96235DB79835AAD4BB427CC4A35615EA30BC083720D24B0364B66B6E3A763F47B74C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 f8ac6f754847cc4610a95130f28a7a35f8288f10222d1788954983b0e0cfb938
MD5 12f7096116407e4ebba4f603c7f31be9
SHA1 e324a213d0d9306025d87b1808e863f102f0c02d
SHA512 69022a0e02c5d2720f85f828e477913654647bbed6afb3cc9e17d2881be9b814c64f13036b238abc9d746dd8a8b4fa848312b93b29d1075725954b18b6ea8795
SSDEEP 24576:q2gmSp1kdoO/vvTL2mdeR036/6p2wY5H22eNXJkdkma4Ex5oIGcK7Q3aR:b
TLSH
T14347052436F92210E7F79E3CA8F4AA23893D7D579C15DE8C45411B8D0921BB1E8B2F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{94d8b2f3-a9ba-42de-b6fa-f350260d5789}_OnDiskSnapshotProp

Path \??\Volume{59480a46-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{94d8b2f3-a9ba-42de-b6fa-f350260d5789}_OnDiskSnapshotProp
Size 6KB
SHA256 0360a571b4f5f0dd3b6cd13ee27ef46d46420353bb6b6b1a24344c9b1cf8ffdd
MD5 29ca7ce57b97663604ccb023836a5200
SHA1 882edcefe4cf9462f7ad1e6de6e23003b8ea9744
SHA512 45232307cb3fe9e5984566801ed96cc4a84af0910bad4ab7f2a3a9b7c58d100be7e200f834f98a2658d55c89accda6e05d4dec61edb6402017c6abf9b8ad6192
SSDEEP 96:FZHh0dvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:jwb++ZVmN
TLSH
T1CFD199185AF54711E2B3AB7128F18557A877B811EF33CB8E0298638E2670A10F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1372-76-0x0000020EC0E50000-0x0000020EC0E51000-memory.dmp

Download

memory/1372-115-0x0000020EC0E50000-0x0000020EC0E51000-memory.dmp

Download

memory/1372-75-0x0000020EC0E50000-0x0000020EC0E51000-memory.dmp

Download

memory/1372-74-0x0000020EC0E50000-0x0000020EC0E51000-memory.dmp

Download

memory/1372-112-0x0000020EC0E50000-0x0000020EC0E51000-memory.dmp

Download

memory/1372-113-0x0000020EC0E50000-0x0000020EC0E51000-memory.dmp

Download

memory/1372-114-0x0000020EC0E50000-0x0000020EC0E51000-memory.dmp

Download

memory/1372-118-0x0000020EC0E50000-0x0000020EC0E51000-memory.dmp

Download

memory/1372-116-0x0000020EC0E50000-0x0000020EC0E51000-memory.dmp

Download

memory/1372-117-0x0000020EC0E50000-0x0000020EC0E51000-memory.dmp

Download

memory/2712-125-0x000002A262270000-0x000002A262292000-memory.dmp

Download

memory/3256-243-0x000001FE079F0000-0x000001FE079F1000-memory.dmp

Download

memory/3256-244-0x000001FE079F0000-0x000001FE079F1000-memory.dmp

Download

memory/3256-242-0x000001FE079F0000-0x000001FE079F1000-memory.dmp

Download