File scan report
Verdict Safe
Is artmoney821eng64.
Only Skyhigh flagged this executable generically; major antivirus engines, completed sandbox runs, and external intelligence supplied no corroborating malicious evidence.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 71 flagged
- Flagged 1
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 18d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Skyhigh alone flagged the file with a generic dropper-style label, while none of the major antivirus engines did. Four completed sandbox runs produced no malicious verdict, named injection target, persistence, or sample-attributed network contact, so the isolated detection is most consistent with a false positive.
Only 1 of the 71 antivirus engines that checked it flagged the executable, and the detection was Skyhigh's generic behavior label rather than a named malware family. None of the major antivirus engines flagged it, and independent detections did not corroborate the result. Four completed sandbox runs returned no malicious verdict and recorded neither a named injection target nor persistence or sample-attributed network contact. The mapping lacked the target artifact needed to establish process injection and therefore carries no adverse weight. The executable is unsigned and protected with .NET Reactor, which lowers confidence, but no malware-specific intelligence or malicious child supports the lone alert.
What We Detected
Skyhigh was the only engine to flag the executable, using a generic dropper-behavior label. None of the major antivirus engines flagged it, and no engine identified a real malware family. The executable is unsigned and protected with .NET Reactor, which can make automated inspection harder but is not proof of harmful code.
Threat Behavior
Four completed sandbox runs produced no malicious verdict. They recorded no named injection target, persistence indicator, or sample-attributed network contact. No malware-specific community rule, public sample-database listing, or malicious dropped file corroborated Skyhigh's result. A complete host-reputation cross-check was not available.
What To Do Now
If the executable came from the expected publisher channel, it can be used with normal caution while security software remains enabled. If its origin is uncertain, obtain a fresh copy from the official source and compare its SHA-256 before running it.
Where this verdict could be wrong3 caveats
- Skyhigh's generic dropper-style detection is a meaningful warning even though no other engine corroborates it.
- The executable is unsigned and protected with .NET Reactor, which limits static visibility and prevents publisher verification.
- No complete contacted-host reputation result is available, although the sandbox runs recorded no sample-attributed contacts.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the major antivirus engines flagged the file.
- Four completed sandbox runs produced no malicious verdict or corroborated high-risk behavior.
- No sample-attributed network contact or persistence was observed during the test run.
- No malware-specific rule or public malware-sample database matched the hash.
- The inspected dropped file was not identified as malicious or suspicious.
- One antivirus engine reported generic dropper-like behavior.
- The executable has no authenticated publisher signature.
- The code is protected with .NET Reactor, reducing transparency to automated inspection.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 10sandbox rule tags
- 5spawned processes
- 0network contacts
- 17filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1071· Application protocol
- T1082· System recon
- T1129· Loads modules
- T1553
- T1553.002
Observed activity
Processes started
5Programs the file ran, with their command lines.
artmoney821eng64.exe"C:\Users\<USER>\Desktop\artmoney821eng64.exe"artmoney821eng64.tmp"C:\Users\<USER>\AppData\Local\Temp\is-W139KKAPJS.tmp\artmoney821eng64.tmp" /SL5="$1E0026,4263304,837120,C:\Users\<USER>\Desktop\artmoney821eng64.exe"artmoney821eng64.exeC:\Users\<USER>\AppData\Local\Temp\is-LALYM0GSI8.tmp\artmoney821eng64.tmp /SL5=$20172,4263304,837120,C:\Users\<USER>\Downloads\artmoney821eng64.exeartmoney821eng64.exe"C:\Users\user\Desktop\artmoney821eng64.exe"artmoney821eng64.tmp"C:\Users\user\AppData\Local\Temp\is-1GYF4PF1CQ.tmp\artmoney821eng64.tmp" /SL5="$2043E,4263304,837120,C:\Users\user\Desktop\artmoney821eng64.exe"
Files
7Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\is-W139KKAPJS.tmp\artmoney821eng64.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\is-LALYM0GSI8.tmp\artmoney821eng64.tmp - Written
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer - Written
C:\Users\user\AppData\Local\Temp\is-1GYF4PF1CQ.tmp - Written
C:\Users\user\AppData\Local\Temp\is-1GYF4PF1CQ.tmp\artmoney821eng64.tmp - Written
C:\Users\user\AppData\Local\Temp\is-INEHFR7RDH.tmp
Show all 7 entries for files
- Written
C:\Users\user\AppData\Local\Temp\is-INEHFR7RDH.tmp\_isetup
Registry and auto-start
8Settings the file changed, including ways to start again after a restart.
- Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\RestartManager\Session0000\Owner - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\RestartManager\Session0000\Sequence - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\RestartManager\Session0000\SessionHash - Set
Software\Microsoft\RestartManager\Session0000\Owner - Set
Software\Microsoft\RestartManager\Session0000\SessionHash - Set
Software\Microsoft\RestartManager\Session0000\Sequence
Show all 8 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager - Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\Sessions\1\BaseNamedObjects\Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex\Sessions\1\BaseNamedObjects\Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer\Sessions\1\BaseNamedObjects\Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer\Sessions\1\BaseNamedObjects\Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer
Show all 10 entries for mutexes
\Sessions\1\BaseNamedObjects\Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer\Sessions\1\BaseNamedObjects\Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer\Sessions\1\BaseNamedObjects\Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer\Sessions\1\BaseNamedObjects\Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer
Sandbox background — not the file
6The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
lsass.exeC:\Windows\system32\lsass.exe
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- 712362c74d2746f649f0…cfd760Not checkedno saved verdict
Chapter 04
Technical details
1 of the 71 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- SkyhighBehavesLike.Win32.Dropper.tc
File fingerprint
- Last analyzed
- Oct 19, 2026, 4:40 PM UTC
- SHA-256
f293402c2a995996518a9681255b26a8f7f723f02f4d4ff631606b84dcdfd48c- SHA-1
5f3c0e21ae54922a8e2fa497114d6fd18046d922- MD5
62f9a42934af26402f2f377348c30e29
About this file
artmoney821eng64.exe says it is ArtMoney SE v8.21.3 (ArtMoney SE), 5.5 MB.
- Claims to be
- ArtMoney SE v8.21.3 (ArtMoney SE)From the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 5.5 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 7, 2026On VirusTotal.
- Submitted by
- 58 distinct sources
- Packer
- .NET Reactor 2.X-3.X (DetectItEasy protector)Packing hides code; legitimate installers use it too.
- Entropy
- 6.33 of 8
First scanned
Antivirus consensus
1 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines1flagged
- Low-trust17 engines0flagged
View all 75 engine results
- SkyhighMalicious: BehavesLike.Win32.Dropper.tc
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
A known packer signature (UPX / Themida / VMProtect / etc.) matched this file. Packers aren't malicious on their own, but most malware uses them.
Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is artmoney821eng64.exe safe?
What is artmoney821eng64.exe?
How many antivirus engines detected artmoney821eng64.exe?
What is the SHA-256 hash of artmoney821eng64.exe?
Is it safe to run artmoney821eng64.exe?
How up to date is this analysis of artmoney821eng64.exe?
Community
Member reviews and reports for this exact file hash.