Windows Analysis Report
zDcNyG6Csn.exe

AI detected suspicious sample

Source: Yara match	File source: 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3030223169.0000000007259000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2702181142.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2683044684.0000000005F6A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2682373684.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2691547817.00000000059C2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2696959590.00000000059CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2696465564.000000000651B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VinylStudio.exe PID: 6540, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 83.2% probability

Source: zDcNyG6Csn.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: zDcNyG6Csn.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: G:\source\VinylStudio\V15_00\Release\VinylStudio.pdb source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2638736749.00000000009E5000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: c:\starburn\Bin\Dynamic\Release\i386\StarBurn.pdb source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\PDR14_AutoBuild\LayerTemplate_9\Generic\Trunk\bin\Win32\Release\CES_Picture.pdb source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.00000000041CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\starburn\Bin\Dynamic\Release\i386\StarBurn.pdb(_ source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\PDR14_AutoBuild\LayerTemplate_9\Generic\Trunk\bin\Win32\Release\CES_Picture.pdb* source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.00000000041CC000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49947 -> 89.116.191.177:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49946 -> 77.221.149.84:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49949 -> 193.188.22.40:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49948 -> 213.210.13.4:443

Source: global traffic

TCP traffic: 192.168.2.5:49956 -> 8.8.8.8:53

Source: Joe Sandbox View	ASN Name: LRTC-ASLT LRTC-ASLT
Source: Joe Sandbox View	ASN Name: INFOBOX-ASInfoboxruAutonomousSystemRU INFOBOX-ASInfoboxruAutonomousSystemRU
Source: Joe Sandbox View	ASN Name: EDGEtaGCIComGB EDGEtaGCIComGB

Source: unknown	TCP traffic detected without corresponding DNS query: 77.221.149.84
Source: unknown	TCP traffic detected without corresponding DNS query: 77.221.149.84
Source: unknown	TCP traffic detected without corresponding DNS query: 77.221.149.84
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 77.221.149.84
Source: unknown	TCP traffic detected without corresponding DNS query: 77.221.149.84
Source: unknown	TCP traffic detected without corresponding DNS query: 77.221.149.84
Source: unknown	TCP traffic detected without corresponding DNS query: 77.221.149.84
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 77.221.149.84
Source: unknown	TCP traffic detected without corresponding DNS query: 77.221.149.84
Source: unknown	TCP traffic detected without corresponding DNS query: 77.221.149.84
Source: unknown	TCP traffic detected without corresponding DNS query: 77.221.149.84
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40

Source: VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: <l><h>https://www.facebook.com/alpinesoft\|</h>www.facebook.com/alpinesoft</l>.Cannot recycle file: equals www.facebook.com (Facebook)
Source: VinylStudio.exe, 00000004.00000000.2640778975.0000000000B30000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: And you will find us on Facebook here: <l><h>https://www.facebook.com/alpinesoft\|</h>www.facebook.com/alpinesoft</l> equals www.facebook.com (Facebook)

Source: VinylStudio.exe, 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2683044684.0000000005F6A000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2702181142.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2691547817.00000000059C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: VinylStudio.exe, 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2683044684.0000000005F6A000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2702181142.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2691547817.00000000059C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2638736749.00000000009E5000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://api.discogs.com/releases/%sCollection
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.duplexsecure.com/entity.crl0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.grsign.com/root.crl0Q
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.grsign.com/rootca.crl0Q
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: VinylStudio.exe, 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2683044684.0000000005F6A000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2702181142.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2691547817.00000000059C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2638736749.00000000009E5000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.alpinesoft.co.uk%s/%d.%d.%d
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: VinylStudio.exe, 00000004.00000003.2686047930.000000000397C000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2685827682.000000000397B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gimp.org/xmp/
Source: VinylStudio.exe, 00000004.00000003.3030745195.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: VinylStudio.exe, 00000004.00000003.3030745195.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2638736749.00000000009E5000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2638736749.00000000009E5000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://%s/VinylStudio/register.aspx?platform=%s&partner=%s&email=%srecording_options_dialogrecordin
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2638736749.00000000009E5000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://%s/VinylStudio/register_partner.aspx?platform=%s&partner=%s&email=%s%s
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://beebom.com/how-to-use-light-theme-with-dark-menu-bar-and-dock-in-macos-mojave/
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.00000000043B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inivation.gitlab.io/dv/dv-docs/docs/update-firmware/
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.alpinesoft.co.uk/VinylStudio/VinylStudio_premium.aspx
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.alpinesoft.co.uk/VinylStudio/VinylStudio_pro.aspx
Source: VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.alpinesoft.co.uk/VinylStudio/download.aspx
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.alpinesoft.co.uk/VinylStudio/download_mac.aspx
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.alpinesoft.co.uk/VinylStudio/request_license_key.aspx
Source: VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000B30000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.alpinesoft.co.uk/contact_us.aspx
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000B30000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.alpinesoft.co.uk/forum
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.alpinesoft.co.uk/forum/index.php?topic=18.0
Source: zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.alpinesoft.co.uk/forum/index.php?topic=2567.0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000B30000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.alpinesoft.co.uk/forum/index.php?topic=725.0
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.apple.com/itunes/download/win64
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2638736749.00000000009E5000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.discogs.com/release/%s%s
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

E-Banking Fraud

PE file has a writeable .text section

Source: Yara match	File source: 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3030223169.0000000007259000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2702181142.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2683044684.0000000005F6A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2682373684.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2691547817.00000000059C2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2696959590.00000000059CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2696465564.000000000651B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VinylStudio.exe PID: 6540, type: MEMORYSTR

System Summary

Source: CES_Picture.dll.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: VinylStudio.exe.0.dr	Static PE information: Resource name: RT_STRING type: 370 sysV executable not stripped
Source: VinylStudio.exe.0.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: VinylStudio.exe.0.dr	Static PE information: Resource name: RT_STRING type: basic-16 executable not stripped

Source: zDcNyG6Csn.exe, 00000000.00000002.2644237794.0000000001A97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVinylStudio.exe8 vs zDcNyG6Csn.exe
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVinylStudio.exe8 vs zDcNyG6Csn.exe
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.00000000041CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCES_Picture.dllh$ vs zDcNyG6Csn.exe
Source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStarBurn vs zDcNyG6Csn.exe

Source: zDcNyG6Csn.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@3/19@0/5

Source: C:\Users\user\Desktop\zDcNyG6Csn.exe

Code function: 0_2_00937B50 ?openRtApi@RtAudio@@IAEXW4Api@1@@Z,??0RtApi@@QAE@XZ,CoInitialize,CoCreateInstance,

0_2_00937B50

Source: C:\Users\user\Desktop\zDcNyG6Csn.exe

File created: C:\Users\user\AppData\Local\Programs

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe

Mutant created: \Sessions\1\BaseNamedObjects\59474285

Source: C:\Users\user\Desktop\zDcNyG6Csn.exe

File created: C:\Users\user\AppData\Local\Temp\TMP1A28.tmp

Source: zDcNyG6Csn.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\zDcNyG6Csn.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\zDcNyG6Csn.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: VinylStudio.exe, 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: VinylStudio.exe, 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: VinylStudio.exe, 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: VinylStudio.exe, 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: zDcNyG6Csn.exe

ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\zDcNyG6Csn.exe "C:\Users\user\Desktop\zDcNyG6Csn.exe"
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Process created: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe "C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe"
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Process created: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe "C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe"	Jump to behavior

Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: starburn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: imodel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: winusb.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: libusbk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: hid.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: winusb.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: libusbk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: hid.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: libjack.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: fpres12-x64-0419.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: ces_picture.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: wshunix.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\zDcNyG6Csn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

May use the Tor software to hide its network traffic

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: zDcNyG6Csn.exe

Static PE information: More than 140 > 100 exports found

Source: zDcNyG6Csn.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: zDcNyG6Csn.exe

Static file information: File size 14840744 > 1048576

Source: zDcNyG6Csn.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x267a00
Source: zDcNyG6Csn.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xae1600

Source: zDcNyG6Csn.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: G:\source\VinylStudio\V15_00\Release\VinylStudio.pdb source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2638736749.00000000009E5000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: c:\starburn\Bin\Dynamic\Release\i386\StarBurn.pdb source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\PDR14_AutoBuild\LayerTemplate_9\Generic\Trunk\bin\Win32\Release\CES_Picture.pdb source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.00000000041CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\starburn\Bin\Dynamic\Release\i386\StarBurn.pdb(_ source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\PDR14_AutoBuild\LayerTemplate_9\Generic\Trunk\bin\Win32\Release\CES_Picture.pdb* source: zDcNyG6Csn.exe, 00000000.00000003.2631071020.00000000041CC000.00000004.00000020.00020000.00000000.sdmp

Source: zDcNyG6Csn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: zDcNyG6Csn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: zDcNyG6Csn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: zDcNyG6Csn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: zDcNyG6Csn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: fpres12-x64-0419.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x17a95e
Source: CES_Picture.dll.0.dr	Static PE information: real checksum: 0xdbf2e should be: 0xe3f2e
Source: StarBurn.dll.0.dr	Static PE information: real checksum: 0x98075 should be: 0x9033d

Source: CES_Picture.dll.0.dr	Static PE information: section name: .text1
Source: CES_Picture.dll.0.dr	Static PE information: section name: .data1
Source: CES_Picture.dll.0.dr	Static PE information: section name: .trace
Source: CES_Picture.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\zDcNyG6Csn.exe

Code function: 0_2_00965A6C push ecx; ret

0_2_00965A7F

Source: StarBurn.dll.0.dr

Static PE information: section name: .text entropy: 6.997353967963893

Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	File created: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\StarBurn.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	File created: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Jump to dropped file
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	File created: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\imodel.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	File created: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\fpres12-x64-0419.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	File created: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\CES_Picture.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: VinylStudio.exe, 00000004.00000003.3030223169.0000000007259000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: torConnect

Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Window / User API: threadDelayed 364			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Window / User API: threadDelayed 726			Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe TID: 1524	Thread sleep time: -75075s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe TID: 6020	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe TID: 6716	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Thread delayed: delay time: 75075			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: VinylStudio.exe, 00000004.00000003.2644908742.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: VinylStudio.exe, 00000004.00000003.2644524988.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: zDcNyG6Csn.exe, 00000000.00000002.2644237794.0000000001A97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y2U
Source: VinylStudio.exe, 00000004.00000003.2641897899.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}7
Source: VinylStudio.exe, 00000004.00000003.2644524988.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: zDcNyG6Csn.exe, 00000000.00000002.2644237794.0000000001A97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y7V>T
Source: VinylStudio.exe, 00000004.00000003.2642486880.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: zDcNyG6Csn.exe, 00000000.00000002.2644237794.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: VinylStudio.exe, 00000004.00000003.2644524988.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\zDcNyG6Csn.exe

Process created: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe "C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe"

Source: VinylStudio.exe, 00000004.00000000.2638736749.000000000087E000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: Fg:\source\hpslib\v15_00\psutils.cpphBrushProgmanShell_TrayWndSideBar_AppBarBulletSideBar_HTMLHostWindow4
Source: VinylStudio.exe, 00000004.00000003.3030223169.0000000007259000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSysPagerToolbarWindow32U
Source: VinylStudio.exe, 00000004.00000003.3030223169.0000000007259000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: explorer.exeShell_TrayWnd

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId			Jump to behavior

Source: C:\Users\user\Desktop\zDcNyG6Csn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\TMP1A28.tmp VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\zDcNyG6Csn.exe

Code function: 0_2_00965D85 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00965D85

Source: C:\Users\user\Desktop\zDcNyG6Csn.exe

Code function: 0_2_00937AF0 ?getVersion@RtAudio@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ,

0_2_00937AF0

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3030223169.0000000007259000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2702181142.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2683044684.0000000005F6A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2682373684.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2691547817.00000000059C2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2696959590.00000000059CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2696465564.000000000651B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VinylStudio.exe PID: 6540, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe

File opened: C:\Users\user\AppData\Roaming\Miranda\

Source: Yara match	File source: 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3030223169.0000000007259000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2702181142.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2683044684.0000000005F6A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2682373684.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2691547817.00000000059C2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2696959590.00000000059CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2696465564.000000000651B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VinylStudio.exe PID: 6540, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3030223169.0000000007259000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2702181142.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2683044684.0000000005F6A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2682373684.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2691547817.00000000059C2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2696959590.00000000059CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2696465564.000000000651B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VinylStudio.exe PID: 6540, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	1 Credentials in Registry	211 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Multi-hop Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	1 Credentials In Files	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	1 Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	55 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
zDcNyG6Csn.exe	42%	ReversingLabs	Win32.Trojan.Leonem
zDcNyG6Csn.exe	100%	Avira	TR/Dldr.Rugmi.zaxam

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\imodel.dll	100%	Avira	TR/Dldr.Rugmi.rxflt
C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\CES_Picture.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\StarBurn.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\fpres12-x64-0419.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\imodel.dll	50%	ReversingLabs	Win32.Trojan.Dacic

Source	Detection	Scanner	Label
https://www.alpinesoft.co.uk/forum	0%	Avira URL Cloud	safe
https://www.alpinesoft.co.uk/VinylStudio/request_license_key.aspx	0%	Avira URL Cloud	safe
http://crl.duplexsecure.com/entity.crl0	0%	Avira URL Cloud	safe
https://www.alpinesoft.co.uk/VinylStudio/VinylStudio_pro.aspx	0%	Avira URL Cloud	safe
http://crl.grsign.com/rootca.crl0Q	0%	Avira URL Cloud	safe
https://%s/VinylStudio/register_partner.aspx?platform=%s&partner=%s&email=%s%s	0%	Avira URL Cloud	safe
https://%s/VinylStudio/register.aspx?platform=%s&partner=%s&email=%srecording_options_dialogrecordin	0%	Avira URL Cloud	safe
https://www.alpinesoft.co.uk/forum/index.php?topic=2567.0	0%	Avira URL Cloud	safe
https://www.alpinesoft.co.uk/VinylStudio/download.aspx	0%	Avira URL Cloud	safe
https://www.alpinesoft.co.uk/forum/index.php?topic=725.0	0%	Avira URL Cloud	safe
http://www.alpinesoft.co.uk%s/%d.%d.%d	0%	Avira URL Cloud	safe
https://www.alpinesoft.co.uk/contact_us.aspx	0%	Avira URL Cloud	safe
https://www.alpinesoft.co.uk/VinylStudio/VinylStudio_premium.aspx	0%	Avira URL Cloud	safe
https://www.alpinesoft.co.uk/VinylStudio/download_mac.aspx	0%	Avira URL Cloud	safe
http://crl.grsign.com/root.crl0Q	0%	Avira URL Cloud	safe
https://inivation.gitlab.io/dv/dv-docs/docs/update-firmware/	0%	Avira URL Cloud	safe
https://www.alpinesoft.co.uk/forum/index.php?topic=18.0	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	VinylStudio.exe, 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2683044684.0000000005F6A000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2702181142.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2691547817.00000000059C2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.alpinesoft.co.uk/forum	zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000B30000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://www.gimp.org/xmp/	VinylStudio.exe, 00000004.00000003.2686047930.000000000397C000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2685827682.000000000397B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.grsign.com/rootca.crl0Q	zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.alpinesoft.co.uk/VinylStudio/request_license_key.aspx	zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://%s/VinylStudio/register.aspx?platform=%s&partner=%s&email=%srecording_options_dialogrecordin	zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2638736749.00000000009E5000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.discogs.com/release/%s%s	zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2638736749.00000000009E5000.00000002.00000001.01000000.00000005.sdmp	false		high
https://beebom.com/how-to-use-light-theme-with-dark-menu-bar-and-dock-in-macos-mojave/	zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.alpinesoft.co.uk/VinylStudio/VinylStudio_pro.aspx	zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://%s/VinylStudio/register_partner.aspx?platform=%s&partner=%s&email=%s%s	zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2638736749.00000000009E5000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://.css	VinylStudio.exe, 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2683044684.0000000005F6A000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2702181142.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2691547817.00000000059C2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.duplexsecure.com/entity.crl0	zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	VinylStudio.exe, 00000004.00000003.3030745195.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.alpinesoft.co.uk/forum/index.php?topic=2567.0	zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.alpinesoft.co.uk/forum/index.php?topic=725.0	zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000B30000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.htmlRAND	VinylStudio.exe, 00000004.00000003.3030745195.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.alpinesoft.co.uk/VinylStudio/download.aspx	VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://api.discogs.com/releases/%sCollection	zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2638736749.00000000009E5000.00000002.00000001.01000000.00000005.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.alpinesoft.co.uk%s/%d.%d.%d	zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2638736749.00000000009E5000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://www.alpinesoft.co.uk/contact_us.aspx	VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000B30000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://www.alpinesoft.co.uk/VinylStudio/VinylStudio_premium.aspx	VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://www.alpinesoft.co.uk/forum/index.php?topic=18.0	zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2638736749.00000000009E5000.00000002.00000001.01000000.00000005.sdmp	false		high
https://www.alpinesoft.co.uk/VinylStudio/download_mac.aspx	zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000000.2640778975.0000000000C4C000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://.jpg	VinylStudio.exe, 00000004.00000003.2698406593.0000000006510000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2694856415.0000000006511000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2688539770.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690829104.0000000006ABC000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2684285072.0000000005427000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2687682405.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.3029578609.0000000006514000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2690264096.0000000006517000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2689455592.00000000059C6000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2695780673.00000000059C4000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2683044684.0000000005F6A000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2702181142.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, VinylStudio.exe, 00000004.00000003.2691547817.00000000059C2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://inivation.gitlab.io/dv/dv-docs/docs/update-firmware/	zDcNyG6Csn.exe, 00000000.00000003.2631071020.00000000043B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.grsign.com/root.crl0Q	zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004532000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	zDcNyG6Csn.exe, 00000000.00000003.2630805664.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2631071020.0000000004DB0000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2630949044.0000000001AAF000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635111445.0000000001A85000.00000004.00000020.00020000.00000000.sdmp, zDcNyG6Csn.exe, 00000000.00000003.2635292554.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
89.116.191.177	unknown	Lithuania	15419	LRTC-ASLT	true
77.221.149.84	unknown	Russian Federation	30968	INFOBOX-ASInfoboxruAutonomousSystemRU	true
213.210.13.4	unknown	United Kingdom	8851	EDGEtaGCIComGB	true
193.188.22.40	unknown	Russian Federation	49558	LIVECOMM-ASRespublikanskayastr3k6RU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573182
Start date and time:	2024-12-11 16:16:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zDcNyG6Csn.exe renamed because original name is a hash value
Original Sample Name:	ea9c85e8d44bc5d7b98a5f6f15c0929841ebdabf62e412247b112ca21de55287.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@3/19@0/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.109.210.53
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: zDcNyG6Csn.exe

Simulations

Behavior and APIs

Time	Type	Description
10:18:42	API Interceptor	98x Sleep call for process: VinylStudio.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INFOBOX-ASInfoboxruAutonomousSystemRU	file.exe	Get hash	malicious	PureCrypter	Browse	109.120.137.89
	file.exe	Get hash	malicious	PureCrypter	Browse	109.120.137.89
	USD470900_COPY_800BLHSBC882001_NOV202024.PDF.exe	Get hash	malicious	Remcos, DBatLoader	Browse	77.221.149.38
	USD470900_COPY_800BLHSBC882001.PDF.bat	Get hash	malicious	Remcos, DBatLoader	Browse	77.221.149.38
	YDW0S5K7hi.exe	Get hash	malicious	SilverRat	Browse	109.120.138.54
	cDRgXaadjD.exe	Get hash	malicious	SilverRat	Browse	109.120.138.220
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	92.243.83.22
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	77.221.151.63
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	77.221.151.63
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	77.221.151.63
LRTC-ASLT	jew.arm7.elf	Get hash	malicious	Mirai	Browse	89.117.100.57
	ET5.exe	Get hash	malicious	Unknown	Browse	89.117.55.228
	b1.exe	Get hash	malicious	PureCrypter, MicroClip	Browse	89.117.79.31
	b1.exe	Get hash	malicious	PureCrypter, MicroClip	Browse	89.117.79.31
	mipsel.elf	Get hash	malicious	Unknown	Browse	84.46.252.91
	aeI0ukq9TD.exe	Get hash	malicious	Unknown	Browse	89.117.72.231
	0ylPF4c3eF.exe	Get hash	malicious	Unknown	Browse	89.117.72.231
	0ylPF4c3eF.exe	Get hash	malicious	Unknown	Browse	89.117.72.231
	aeI0ukq9TD.exe	Get hash	malicious	Unknown	Browse	89.117.72.231
	apep.m68k.elf	Get hash	malicious	Unknown	Browse	89.116.194.115
EDGEtaGCIComGB	Support.Client (1).exe	Get hash	malicious	ScreenConnect Tool	Browse	185.49.126.73
	Support.Client (1).exe	Get hash	malicious	ScreenConnect Tool	Browse	185.49.126.73
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	213.210.9.89
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	77.107.70.202
	fvIqrxcfuL.exe	Get hash	malicious	Quasar	Browse	89.213.56.109
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	89.213.146.12
	arm7.elf	Get hash	malicious	Unknown	Browse	77.107.120.22
	JnC2t6WhUf.elf	Get hash	malicious	Mirai	Browse	213.130.144.69
	mhmdm9Hb6i.elf	Get hash	malicious	Mirai	Browse	213.130.144.69
	https://t.ly/nFp5i	Get hash	malicious	Unknown	Browse	213.130.145.203

Process:	C:\Users\user\Desktop\zDcNyG6Csn.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	889640
Entropy (8bit):	6.364493902810947
Encrypted:	false
SSDEEP:	24576:uY4VVLzRyDWTDeZTN2iBtbIVil8BjV5myDcOoxjpr9hVMl0d6O:uY4vzRyDWTDeZTN2iBtbIVJV5myDSvrv
MD5:	83714D9AB875B4CDEA81CB3D1A426DDA
SHA1:	C6CA0E5ED7F6ADC2506D266E3DC698F323996924
SHA-256:	076D930CB42C204899DC3B36496A27E5F75C60AD78720BB4F37338DA4EE81A6E
SHA-512:	5CF6690A9A529247EA05923B6969B757D35C3EAA3645EC4D9161EC9FF8C60FA1D177380ED341816706F75819000C237FF74334F700E335E6DBBD1D15AC106E49
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U\|.SU\|.SU\|.SK.#SW\|.S..{SG\|.S..ySn\|.S..xS.\|.S\.5ST\|.S\.%SZ\|.SU\|.S.\|.SU\|.Sr\|.S..\|ST\|.S...ST\|.S..zST\|.SRichU\|.S........PE..L....!.T...........!.....6...&...............P............................................@.............................f...(........@...............`..(3...P...T..`R..8........................... ...@............P...............................text............................... ....text1.......0...................... ..`.rdata..&p...P...r...:..............@..@.data...lA......."..................@....data1....... ......................@....trace..............................@..@_RDATA..@....0......................@..@.rsrc........@......................@..@.reloc..2w...P...x..................@..B................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\ColorProfiles\Reservation.wav

Process:	C:\Users\user\Desktop\zDcNyG6Csn.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	3294764
Entropy (8bit):	7.554270122814332
Encrypted:	false
SSDEEP:	98304:WSmV5gbunBDUmu80z3a70OeCSowz8y++L:WSrKndUb80WAAkzB+6
MD5:	01D177688E395C53B82A379B7B908F8C
SHA1:	807239BDFD727C5EF7B469B8EE16151F11F40EB3
SHA-256:	7F2733EB690EAF13DD3F9D27AFE6DB6B2EFD125B513A233492F7A06B8C38BECD
SHA-512:	73C86E835EC54886C78BD33340A1ACB8F7D1BEC910CFE44FF981BAD61637BD77156D8BF7326B5B397A7451EA6F94C0DCA1960D5493FE5366EB9A430FC6C25BDF
Malicious:	false
Reputation:	low
Preview:	RIFF$F2.WAVEfmt ........D...........data.F2.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\Patches\Remote.db

Process:	C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe
File Type:	data
Category:	modified
Size (bytes):	5855574
Entropy (8bit):	7.999545017237168
Encrypted:	true
SSDEEP:	98304:pZRqC6MUBblcj6877bC+MnlbSyttNAlbcXRtB0nxXSc8tBFDIQFxVO5m4f0Nkuzp:pD7URlw777mRlOyVFBZtBjg5lTo
MD5:	ACF212D8FEB30FB873FAED8BB7A09DD4
SHA1:	B8B02BC50D8C17E76B7F27A1C4C515A2C10182C0
SHA-256:	DE9C9A93D5497F079FA0B84C57B5CE0194E665B0999B01120CCB0698656CD866
SHA-512:	5EB064E035E77AD072B12E8CA21519CDEAF013BF24506038D963A163C8E9A1195F79E2F86F787878BDDE6AADFA412953C4DD6721EF035A85F42CFB6D76D3BCC0
Malicious:	false
Reputation:	low
Preview:	.......}x....r......................................1012546698.?=<>/! #rDPDNL[wxHA@Z4~70VTWVXX[Z.Y_^@HCBEprrxx~x.HONqqsru.rvyysz}\|JGUWWP]Qbfihjjml.k...............s.......................^........................".......................!................................................................:>?8?;..>2546698.?=<>6! #KKPBTGIG$-,//QPS.PTWWQX[ZimihrupvJDGFHHKJ.IONpxsru........l.~aacbe.bfiocjmlSn..............k..................................................................g................W......................e.r.0.K.l.h.r.q.d.w.Y.t.h.}.h...10&254.0989.=<?.!P#P%K'A)Z+K-A/JQ1S&U5WsY.[/]/_1A.C'E0G.I<K+M?O%qhsrutwvy.~z}\|.~a`zbed.fih.omlnd..............................................9.............................................l.........................#}t!%z#n`r.ooljode;{`3u.........4033.476.@.[...\|@.G....@..M.......c`fg`f8.n.mk..tw]BED_FIH.OMLNlqps&9&..>...0=8.;+/.+!_._.!3.YZ..................................................................D...........

C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\Specification.dat

Process:	C:\Users\user\Desktop\zDcNyG6Csn.exe
File Type:	data
Category:	dropped
Size (bytes):	5855352
Entropy (8bit):	7.999545005212404
Encrypted:	true
SSDEEP:	98304:qZRqC6MUBblcj6877bC+MnlbSyttNAlbcXRtB0nxXSc8tBFDIQFxVO5m4f0Nkuzj:qD7URlw777mRlOyVFBZtBjg5lTu
MD5:	AAD52F56E5B022A2BE90B2940CC0857A
SHA1:	EF95A63359B01BB5696539E3D5C8A8DD454AF935
SHA-256:	DE676F1EC756C6827648D867CDAF491DE155A81859EEC3253D2E68355D67DDD6
SHA-512:	ED592F123A7C52569C0FB6715EE94CDABB921877A6C3F31FBF2BA979D7237160DE4D59B406E68CD51A8F6A6DAB5D563B52557F0AC250A54CD8B49E45EC22D95D
Malicious:	false
Reputation:	low
Preview:	......d'.=5.\.....[.................................1012546698.?=<>/! #rDPDNL[wxHA@Z4~70VTWVXX[Z.Y_^@HCBEprrxx~x.HONqqsru.rvyysz}\|JGUWWP]Qbfihjjml.k...............s.......................^........................".......................!................................................................:>?8?;..>2546698.?=<>6! #KKPBTGIG$-,//QPS.PTWWQX[ZimihrupvJDGFHHKJ.IONpxsru........l.~aacbe.bfiocjmlSn..............k..................................................................g................W......................e.r.0.K.l.h.r.q.d.w.Y.t.h.}.h...10&254.0989.=<?.!P#P%K'A)Z+K-A/JQ1S&U5WsY.[/]/_1A.C'E0G.I<K+M?O%qhsrutwvy.~z}\|.~a`zbed.fih.omlnd..............................................9.............................................l.........................#}t!%z#n`r.ooljode;{`3u.........4033.476.@.[...\|@.G....@..M.......c`fg`f8.n.mk..tw]BED_FIH.OMLNlqps&9&..>...0=8.;+/.+!_._.!3.YZ..................................................................D...........

C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\StarBurn.dll

Process:	C:\Users\user\Desktop\zDcNyG6Csn.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	588200
Entropy (8bit):	7.049548838106319
Encrypted:	false
SSDEEP:	6144:XO/y/giMzI+IOyLwjiwjD2S+HGN6TWjSp8Kl9xjp4cfSuHwQBGp88MRUssCR9CDl:j/gzbn+GgTWjg8S4cfSn8GpsCD0FdS
MD5:	669198EEB088EE32BBE71045858DD0D1
SHA1:	D970D2E7ECF511996A30D34E80689A4520CCF931
SHA-256:	3887A0042F6C2E43734359C9AD27B64CEDA8DDC3BD8B0CF8C97405C947F917D2
SHA-512:	D4EB8A50A6A753E31F437E78B13275FA09B91531E3CFFFC571DF6040F54479D02D14F8C67E0DB206E99FB84085DDE152CC9AD20EE326093F97243D15C98A036B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PV..>...>...>...>...>...-...>..eC...>...?.b.>..eE...>..eS..>..eP...>..e@...>..eD...>..eB...>..eF...>.Rich..>.........PE..L...../I...........!.....4...........[.......P....@.......................... ......u...............................0..../......x...............................X>.. ...................................@...............(............................text....3.......4.................. ..`.data....K...P...<...8..............@....idata.. ............t..............@....rsrc...............................@..@.reloc...Z.......Z..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe

Process:	C:\Users\user\Desktop\zDcNyG6Csn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9112184
Entropy (8bit):	5.809706821513065
Encrypted:	false
SSDEEP:	196608:Bk1o1JZLTAPe+jpJm1H25okMKZeVVZ5ib8:aKnZLTAPeOJKH2akZZSVZ5iw
MD5:	73979A5C684010903C2B85D78AACADED
SHA1:	1826CD3575125DB232F07C1AC25C7E8483E82BC9
SHA-256:	85AFAB823ADF585D8559D561C51EBB7E6BC53CF2D54CCA7898A6CB24E01355E9
SHA-512:	8A3C37F41297577F5007A8E1879B2AF35BBFC9CE26C2D9705EDBC0A27EEB6DEA0DD2ECCE2338FB4CEA839DA327B4B18C4A4EB921DBFD9E3D54C1D140AE4FBAB2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.......J.!..sO..sO..sO...)sO....sO...)sO.....sO.\.K..sO.\.L..sO.\.J. sO.....sO......sO..sO.drO.).2..sO...K..pO.....sO.....sO..sN..qO.).4..sO...K..sO...J.MsO...F.krO......sO..s..sO...M..sO.Rich.sO.........................PE..L......f..................G...C......'B.......G...@..................................e.......................................vq.T.....s..t.............x.............m.p...................p.m.......g.@.............G.\....tq.`....................text...k.G.......G................. ..`.rdata....)...G...)...G.............@..@.data...D8....q.......q.............@....rsrc....t....s..v...fr.............@..@................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\fpres12-x64-0419.dll

Process:	C:\Users\user\Desktop\zDcNyG6Csn.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1526784
Entropy (8bit):	4.95663034685677
Encrypted:	false
SSDEEP:	12288:c2RsPax5+phlBW9jw75hiOtOYb+bxarHmAqbCWgCgaKavYu:zTohlw9jw75wsavR
MD5:	1DA0AC0C020F668D9F851D6EA2185128
SHA1:	06B82F54D0725E965019CE6E255665DBCEF07FCB
SHA-256:	62A0BBAA2E745F9C03A125F496ECD61922900053739826CEB5AF3CEF00FD73CB
SHA-512:	62ACC5B9AB7684DC9BB378F3AECB9E81FC1AE2082C2366BBD329CA0E9FEE08FA772F62D66534BC1FCFD49F7F8203DC5B1D4979531D6962F7C47F689B909907F0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......iK..-..-..-..fR..!..fR.....fR..8...\./....:....=..........'..;........./..fR..<..-.....;...,..;...,..;.^.,..;...,..Rich-..................PE..L......f...........!...(.....b.......?....................................................@..........................`..`....a...............................P..p<..8H..8....................H......xG..@............................................text............................... ..`.rdata...o.......p..................@..@.data....@...p......Z..............@....rsrc...............................@..@.reloc..p<...P...>..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\images.dat

Process:	C:\Users\user\Desktop\zDcNyG6Csn.exe
File Type:	data
Category:	dropped
Size (bytes):	141461
Entropy (8bit):	7.796575011484894
Encrypted:	false
SSDEEP:	3072:JJO3/tC/8IK3VRvXv9UQ/iksTPAgRL6jlkrrlxqMO++xqKR:JXKlRHpikWASLelkflxqMr+xqo
MD5:	E6B1DE7D75D62346148FFD27107C4CED
SHA1:	FB22F21237CF9D746A03A49D32ED400F170BEEA9
SHA-256:	9820524D2950183143E275FEE011CAE37336AA21382D21C2017A32B990841C72
SHA-512:	DDD5BCD78E7BB87D47C882D59AA578A387243DCB63A818861240C10D8F77AD1F1AF9B0A8F78046911B59EB55017B1512EB1FEDC643A8B470E43A648C34CC2A53
Malicious:	false
Reputation:	low
Preview:	about.jpg..,.....<..........JFIF.....d.d......Ducky..............Adobe.d...............................................#%'%#.//33//@@@@@@@@@@@@@@@......................&.....&0#....#0+.'''.+550055@@?@@@@@@@@@@@@..........."..........u..................................................................!.1QA.aq2..."..BR..b3.....................!1QAa.q............?...................@.....ApYE@.@........................D.Q.TP.i...V..\.u.J...t.J..".......a&)Sq...............................k..,."....y.@HL...q..................(..k(......................(.............(,".._.1yD~O....t..2.y.a.-b..#...z..>.J..X.V?.%sf]'......5=Y..G.5.A..............................._..?..................P..........................T..@...........P..5...........&}..&Yq.$..V..).X.0...o.~.qX...v.1..e...NV...k.....q..;dZ.Q.y.G...x..CH.6.h.QYL#S5.4.YtD..:..N.....*......SRj ........@...............................P@..@..................................P.TUHj......?.!...?...b.B.....Q-.i..Y...p...5...pN

C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\imodel.dll

Process:	C:\Users\user\Desktop\zDcNyG6Csn.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1594624
Entropy (8bit):	5.078022258074917
Encrypted:	false
SSDEEP:	12288:Nh+c7O+K/lAqmqYR6D75wvaAtOYb+bxarHmAqbCWgCgaKavYNAK:T+c9uAqmz6D7u9avxK
MD5:	7A2E86AAA761548DEB67202BA3BE141F
SHA1:	AF0FEB19075C0C600286DA95FB4DB24A2D84895B
SHA-256:	BEE2971C242A67D8F57D26CBEFEEEC020B2F9071F857AA7626C51FB87ED660A6
SHA-512:	03480C448DA2C7881316F7FEFA09CE30243E78EE3300AE75E64256C44BB35F7335604D3771C97BAC63D1B8A32CEAD15460C349E6A25C21884FF6866264C84D18
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......7L..s-..s-..s-..8U.a-..8U..-..8U.k-.....d-.....c-.....U-..`..r-..e..}-.....q-..8U..t-..s-...-..e...-..e...r-..e.?.r-..e..r-..Richs-..................PE..L......f...........!...(.....@...............................................p............@......................... `..4...Ti..P.......`y...........&.../...0...>...H..8....................I.......H..@............................................text............................... ..`.rdata...t.......v..................@..@.data...x ...........\..............@....rsrc...`y.......z...l..............@..@.reloc...>...0...@..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Aqpeawwtprthq

Process:	C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe
File Type:	data
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	EF2E0D18474B2151EF5876B1E89C2F1D
SHA1:	AEF9802FCF76C67D695BC77322BAE5400D3BBE82
SHA-256:	3381DE4CA9F3A477F25989DFC8B744E7916046B7AA369F61A9A2F7DC0963EC9E
SHA-512:	E81185705A3BD73645BF2B190BBF3AEE060C1C72F98FA39665F254A755B0A5723CE8296422874EB50C7B5E8D6BCD90175B0BA28061221039172A3F50E8902CC8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ewsaydee

Process:	C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe
File Type:	data
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	AB893875D697A3145AF5EED5309BEE26
SHA1:	C90116149196CBF74FFB453ECB3B12945372EBFA
SHA-256:	02B1C2234680617802901A77EAE606AD02E4DDB4282CCBC60061EAC5B2D90BBA
SHA-512:	6B65C0A1956CE18DF2D271205F53274D2905C803D059A0801BF8331CCAA28A1D4842D3585DD9C2B01502A4BE6664BDE2E965B15FCFEC981E85EED37C595CD6BC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Eyasddqi

Process:	C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe
File Type:	data
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	DAA100DF6E6711906B61C9AB5AA16032
SHA1:	963FF6C2D517D188014D2EF3682C4797888E6D26
SHA-256:	CC61635DA46B2C9974335EA37E0B5FD660A5C8A42A89B271FA7EC2AC4B8B26F6
SHA-512:	548FAEE346D6C5700BB37D3D44B593E3C343CA7DC6B564F6D3DC7BD5463FBB925765D9C6EA3065BF19F3CCF7B2E1CB5C34C908057C60B62BE866D2566C0B9393
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Fftsse

Process:	C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	E6FF930C3FB6DE61F664581C1A85F60C
SHA1:	F447CB15945D8630CC88ED3B7BEE049B6F5E4C7D
SHA-256:	CAA961E702D561D3245D06BF54FB5FE35BF75037032D764EC11FCB5AC1D41C1C
SHA-512:	60CA902E544D9535BC0F596EE8D262CAA73C885750875623DE20B42FAD52189C0CF41225312FC50DDB0C4D52580094A79F69CC8C674DC3200A42A935190DFFF8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Hyaodds

Process:	C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	E6FF930C3FB6DE61F664581C1A85F60C
SHA1:	F447CB15945D8630CC88ED3B7BEE049B6F5E4C7D
SHA-256:	CAA961E702D561D3245D06BF54FB5FE35BF75037032D764EC11FCB5AC1D41C1C
SHA-512:	60CA902E544D9535BC0F596EE8D262CAA73C885750875623DE20B42FAD52189C0CF41225312FC50DDB0C4D52580094A79F69CC8C674DC3200A42A935190DFFF8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Iafttdpwyfe

Process:	C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe
File Type:	data
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	DAA100DF6E6711906B61C9AB5AA16032
SHA1:	963FF6C2D517D188014D2EF3682C4797888E6D26
SHA-256:	CC61635DA46B2C9974335EA37E0B5FD660A5C8A42A89B271FA7EC2AC4B8B26F6
SHA-512:	548FAEE346D6C5700BB37D3D44B593E3C343CA7DC6B564F6D3DC7BD5463FBB925765D9C6EA3065BF19F3CCF7B2E1CB5C34C908057C60B62BE866D2566C0B9393
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Psueteyufy

Process:	C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF235F22DF3E004EDE21041978C24F2E
SHA1:	7188972F71AEE4C62669330FF7776E48094B4D9D
SHA-256:	16FA66A7DC98D93F2A4C5D20BAF5177F59C4C37FC62FACE65690C11C15FE6FF9
SHA-512:	E76D7CBBAA2B3110D38425F7B579C6F94C29A162D3B4A3B9A4FEACEDE7CEC5EA5E30E455F9417A2C230390C78AB2FBC54C7B98C8F8F68955FE071C37C59D4046
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Seyhaarq

Process:	C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0A9156C4E3C48EF827980639C4D1E263
SHA1:	9F13A523321C66208E90D45F87FA0CD9B370E111
SHA-256:	3A3ED164E42500A1C5B2D0093F0A813D27DC50D038F330CC100A7E70ECE2E6E4
SHA-512:	8A46C1B44C0EA338AFF0D2E2D07C34430B67B68B6D27E1ADB8CF216B0F0994172CED106A90283F2F0469B5CAA40ACEDF101D45729B823E5179EA55AC507E04AD
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Seyhaarq-shm

Process:	C:\Users\user\AppData\Local\Programs\Advanced Vynil Studio\VinylStudio.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TMP1A28.tmp