flstudio_10.0.9.exe

The application flstudio_10.0.9.exe has been detected as a potentially unwanted program by 2 anti-malware scanners. This is a setup program which is used to install the application. This file is typically installed with the program The Elder Scrolls Online by Zenimax Online Studios. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts. While running, it connects to the Internet address 66.07.24ae.ip4.static.sl-reverse.com on port 80 using the HTTP protocol.
MD5:
70251311cba205836a2e0362cfca85f8

SHA-1:
aa6608ec87572c4ef52751b415eef1caeeb19210

SHA-256:
8ea5b11cbe16648006808a3b3e2b66b0677da5a6aaf330459e41c0be0e574783

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
4/18/2024 10:36:44 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
7.8509

Reason Heuristics
PUP.OpenCandy.Installer (L)
16.11.28.22

File size:
223.5 MB (234,368,802 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\flstudio_10.0.9.exe

File PE Metadata
Compilation timestamp:
12/5/2009 4:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6291456:X8A8vAQiBOk33h1A6ZWU2LixLz4d1/Atcp1LoIPqO7nA:X8/vAjZ3R1A60U2WeDbJyO7nA

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
8.0000  (probably packed)

Code size:
23 KB (23,552 bytes)

The file flstudio_10.0.9.exe has been discovered within the following program.

The Elder Scrolls Online  by Zenimax Online Studios
www.zenimaxonline.com
About 3% of users remove it
 
Powered by Should I Remove It?

The file flstudio_10.0.9.exe has been seen being distributed by the following 50 URLs.

https://dw.uptodown.com/dwn/dBKOHSyeshpq1MvxHh9wqrpvg5afWCbPE_EfTUnpHDYQSRkzk5aDmx6kF54DEyTWJyhydoaqFxeabQP-h_TzzawHnH6FHMiwv2TzOhyKYETXf1eDY8fU3QjcKC5BEpcH/_c08wT-OsypFsGclAWgvVSKBhQAv5sAg83uh7bpgUZFT6ZSVPaKTxG1EWqxNJo1Zzt8qgjjooC0-Ukgzagcj7-SkHzSE66H9WGtmKf9aEvhssxZDwtdb24mm4wuQENbM/_I-VcjyA3yUoRkKiVu2I75EKvHQvb9oQZyKL-EaEdOuBsF5ZgviEw8VU0UOegPp8pHcHCryGiPBR3J2Sp81Hsw2UEWhEDIFzog_JzgVC0W0u0PpQ6Iij1eT5a6vqzH9u/.../

http://download1573.mediafire.com/kwti2cppt7ag/.../flstudio_10.0.9.exe

https://dw.uptodown.com/dwn/CQ9zNlSrM9Jzpgkj9XziSASilI1wB5uinQpIJ09rNwyRc4eZFR7EuI6-kgWchdNjLw15qa_Ls8P2KFAsdcQeArNdUSFgY9sRhLbCq6SMIxxjkvmew-67ZJYMGEuHy7ue/-uN40Vl2b7uxNrM28W_mD6Zh2D5hlPA0MapCMBf3aDjAwuUoABhL_gSTW1UhoMVuH9amGycu1JZOvqfxBD8QvNBlB2H7GUYe9jm5-DCpz4QB_pHFfnPrVi2L-Mk4jdaG/HzVycDXpI_an7dJFEON3Yb9AS6tCkQIHOuhlgaLpkWivf0NqKIzZirBlTOtuwQEITWoXhDwZvMdngATlwwB6De_Fhj6cuL_bHcTfIeineMgMy1KatommkjDcDYBvh4Zg/.../

https://dw.uptodown.com/dwn/DlxR-VEFHLhD94AfT8ioDTz_GsFptaI6g9kBrkJvEZLezlYHAoTOQIVVBEWapDer4u5bEPbA1uAo5hwmPEY6PI5UlNa4JqRVqUfKyEvL99BDlvtFU7lnlbhagR7YKBgH/lOAy0yKwJKBIL-Xgn5ZjRr4wKeebQQVZNgJcpTa7e_iGRc2CPDAsMoxmHvqrWTVouXlJmzSYPIebykiuexsaHGSLO9P9dWY5bJZmZHV09Y4ScbxGyR12rqzYc4TRKRtG/cEOvHiH71Hffh9wZwMAy7YgBTrQahVnxW-etNKaXyU12Kf6UWQ7gdq_0psTbksm1GHz9HHl2J9VCuZUZS9z-VqPzVERV-8PysYppgVa_In64TvKzVpqOMC3Vtj9tvPAP/.../

http://download1372.mediafire.com/7kwbj9stm0ag/.../flstudio_10.0.9.exe

https://dw.uptodown.com/dwn/BVXKF8SZHPR_wOyb-OSCMlRcYNcPxz-7qAHh7YpZifs4iDrDLlYUfQTWfFHL50ie-cEhkogSd2g4rdYYn1E2yPhjC3FxBZCUsCPctle96AG-JA0WUBzxdJ3KtpNbDfDK/uScx1FLkYqLFv96z0kremM6oBDT1W4KdrK5YPbqVnvbpjLDiDEaibKgIbKq_yDQMWNl9tZaI33us1C92U-2idgtcu55no9icYHQ-mqICZW_TzN0hf2PxAUC5VBHo0UMu/N-YiK73bQ4HZQuD90O8xuw1U10ruhLPaBqEqEjmvZYykMegMA8ld1UDihCADRE-XU6C5i4ls1QWziGoQJe-u0uiEswBflTJ3P-fBXD2xAkuHlA7BnigmWJWRMezTsOde/.../

https://dw.uptodown.com/dwn/OvT9JkDDJEE3M6wWxt04ZlH_pdOWHVwEtGo7lUTd07ym454qoKUpiglZvWdeE2RHR5j0EqWNE3vPQxu8V1o2faR-jVDj7CYVwqotHs4wU3A18W39tHLEg9-7GqnB05G1/2t0hvfThhjOMKqwncbjlTG881HjLUSlvXTvF7iXYpIcqFkjCmW1wnhxZMbn4RLHQMqK4HEL4YWYiPZ7NeKaNfXVS1nalUZZeQ9e1sEtk9ZbrEeb62M6BAHlCRPMztxRt/lbiVJX9-pyVA_oN617nv516rSVfacBPK-NT0c1225SJi1ypRg21l_SHqHULR4DZ2VN7cBOCTtBc5SfJzhvBJj9_JQ5CN3ie1_p_5HqeUti39t4JBtQZt8ExX_CtbVJAM/.../

http://dw.uptodown.com/dwn/8tshxhI1zgwVljU8jLvtduDZGmlR-j90VBAaNU8NO6NwzLVmsub2bdxkyomUSGJXmIUpAWechbtsxd3VwYg9NNM4volnvkA-vpdbZPE1GaTC9iYNbVLoUfO9b6wYNeAV/_yfZRRIxkZL0ji9KfJ_pfSuIGvMWy5t8Ky11qpPeAKVJUqi6zDu-5I5UoSLCjvHrYVdTFWrNh12pxjta_nKUoSJrGaPafYxcywb8zz0UlELfxq5hk-QxPz48QvgapPux/zHW3plr1c16xajBuw47Kdy-r9Y5qc7gvV8OwoNV-gbCWUPlXETS6g40oo-wBVRoqRmWIoWO76wTrZNRW8tRlPNdrCsbDcteH_nfiS9XmSp4tG2rqEoKtzr06Z6bEMlXL/.../

https://dw.uptodown.com/dwn/_RfQGvPNGlFsMrXCv-fb_IyefRQchVWRVdi1jDOPLr7X-BIsg0Nt-eFAOms8w2R-_SUu-umktVWRqgC8CMV--L47chGl2r_B_QqNHWwE9NicwRQdyAe2wgOlPI0ebXwJ/tiuwlVXDnce6nTnaeVFWwEwZQgNgEwZGMN9UBgwansjMn5r57vjtACKb4G6w3J0zfcs95VX3OAngWt7CH3q2ZVNtfAPpGZUR6ryfHY06rkyfnENMeZWpmveETGv_3K1s/Vb5ut3duwZEdo7uwoY9H9-hfp0kcBaIELJRw02HN6RhUSadfGJAXiyLLvO0kRnR_JQlCAMqMYkUsSfFhPipNS_L5KWN_0lSoSXJSm7itZjnTtNV3C4j-cpmbjKOmLcMl/.../

https://dw.uptodown.com/dwn/W7FfqJDKbFuhhnmE_mGDvYUwN3IOmmphbj09RfKDiVkZBETQRIlH1AjgYvllmqgBuZ3GQ1N8NjbNYju6UdcwX2yIs7_QbSkkE4oLijy0IgaSlMkMIZek7YKZmzdfkAAi/sh-Xqo9lx00NPsblr6XtV2QJnhG3X3R7HjgqEzXOgUSx66uu2PhHofHn7SQ2A0Nt82iHNXTwVXnxL165PoWCImNhZtekib0T0GIzO6PvoWMQI8Hw-YrKmj1wjTqsz2C4/jMR9HoMjZL9k81cAaZ4nWg2qJlIWgQRzYgAbPfKpafCpCP299_ATDtSlZMbpLmH33beKEB6v-LqZ4lpkzwg6e_o0ZLe1jo-5rqwIHUins10GPQNrZ_4gjgaErkatO-Zt/.../

https://dw.uptodown.com/dwn/EBouQAkb_472eUdvop-u_xPu9xd43eTdiVllpiv3FeHAhHiX-1d-HRS4kQrzDVP4ctDSRoczXzuQHe3IdcHvpCygO9mxE8TERdp3B7_7RY1vw-cJlFhx1an28TFoQqCB/YL84oWivxJDgrkxUkylqKNdsyXaqB_wa3ICV4YC0YWIXiUe31zOciv1Q_l7nAJOfZyCzIlS52dHuMnjHuC409A5AOfCMCdk-jhOlqaVjtBxDhn6ZDYGlluagiJAENHFF/GhKF43fYN9jBRN5OvVa8aBWzwmbTo_u8NTugHnpRAWBwA0TZyMcgzpVBjntckuyC7Un-9O6gHrTdKjAKCvI6g05RgPAQCFSgYC9gL24hYk5esRRCZZZZ5keHO1LGFvtR/.../

https://dw.uptodown.com/dwn/_8Z6lqGzZVfvwsOfJcJEHTwjYw9qShQ5fuFiUE5ndTP106ExYde8bMxTPJyDPEcWrAbraIEx0RtrhRbsArXWN46lkF4Z21T1o0-kozPnfPxIkZqEl5MTcTkyKAeD9apL/tlFwn2ngCrimHEEcXXnqUQezaifpVWekxjRBLNVG-Z2IQMSwVfAfvQiJby_wjfvdp_ecfqofmdvYYZB3ktqpXwYLM2dynFBOPTqhxs1pabdfNJz5Vn2D4ROCDex8hRVV/-NiInVAADez-VsBO29H7G2BMzuhNIqY9faWlKRPUYFBkIol6r6nuKZ_1L3U3_Ns7h3KymVNByEuBfAyY-Y5dnB7juYfUx1doyNmkfIcXDtKKBZ-ONYYS3GEy_a5f6a8O/.../

https://dw.uptodown.com/dwn/yYp8h5kp0SRiUxa4LuBMvpXdhqGiXSthizQFi2Ws3w8Jet-A1_QAm28K74J1_iAOYtCv9hVQM1uC7j_3NteCEiAhDzt1_Wa6unMG4lHGYYJc8WTaqZ5ZmoOmNlsheuDY/X22X2zHIVkW80UbPNxkD7fCWM5cCdSziYhb2DNfRRwnFvnhmcBtHHYVKZrScUW-UQtPBhj40z1x7SqwNldiiqFvM_HciAOWP3gUU208_hYXr9bA3TAT-1O4LGKGfJNT_/PQZZzMBAhnJ5Hv8oZHLTmn44LvSk7nxBqbewxMaAiHtWPYkFcOxXEJ9TVnmSLsWxrm04VFoEKgEykh0MvInUci5QkCw05My5vM31xhrx0A5-GZOCfceIOVINeynpJEkx/.../

https://download51.files.attachmail.ru/A524244725BC4259A2278B791FF7E4F2/.../flstudio_10.0.9.exe

http://www.tamindir.com/indir/MjAxNi0xMC0xNSAxNjo0NTo0Ng==/fl-studio/windows/.../

https://dw.uptodown.com/dwn/nbHvqufLJcRf5rgXm4FbCHC4tJeSt8nhAKYaQPiwhAcu0h959fdyFZyVXalebErr36n6UyAm0-7Y6Q3om72JjTShmKeQqxUGWizK502amTa33Vvuf7ufrnJkgFm7n9-_/EtY3r1KNe3b4sc3o4LUmf_ovMX5AQPLVRXFOiHRx67z-w5lPzmECPGkmfn3G5EA-m-ljDMr0xH3OyHEfYC3CNXY2iIUXDNXJH94ry33tU0MDtXUBciOwbLB2WnM0E5wf/UIHKKhoAGO2pmvFs8QsFgDe_SgLV47JcUj-ltHV0z7bAtHpzsGQDVJGXUb3k49MEpuLigOMHSX6Je_QRfr2FPsxxAcS2WfaHIvM5xDPSUusOt86A0Xwq5Z36fPITIqiQ/.../

https://dw.uptodown.com/dwn/TZ7gRpgjtAwYwpjb3E7aw4jV8DQkqF4dNwiEPsIFp1oeEBXzfQLFCZhWBnSLSnHz96337m5wv4gsk1xEORGbuR20hDAx-Ehq247Fxg2bIuhLS6_WciW4H1BekKjGvbEh/MIw68T7NGrQBF_kG9L7CdF0DhgW7hlCFOIKHQBIzcGhARwG_1kN-FeJ8t-yYP1kxk6VJPHChmnkzrNK2JeYb1lfRx9Ws_NgryFfXUNRQjNhrFLBqw3H8V0F7B8RxP8K4/.../

https://dw.uptodown.com/dwn/LZjWpCN9TplSQJ4HsGTPGK6GWeIB_ckfKl5bx-Bwjtd9867E-OxkUw4suRF-0v8LffI4RGGyk4KK6hlrVyYwDVir_3Ohkv2BWgNO8eAS6_6RPTm_GEme4egtvkbJQqoe/N9OPLUwN28fQLn2_dpRApr0d2quzxDyajivAEIIEGZMKtddJN9q8HoWyIIp_iMXYuQk1yU3y_Jik9xJy7PDbCakr-61cXKWs6azvDVW84I0CBXvevq5hZzT5L7fhrP-w/uAzbw_Tay9jVPeZIMzJ7S9dastlTbO58fKHsgf0cdjWCRqFUEscc67ke6rGi27e3BzcHhDP3HKzz5iivr0KZvvVMYQ0vfPTZFjpCDNBz5-c9QtLvnEoAY3O_YhhBV0Uu/.../

https://drive.google.com/uc?export=download&confirm=q4OQ&id=0BzWyT5ZXbcw1WHJlTXJYS05qSkE

http://download1979.mediafire.com/vfz5i275atsg/.../flstudio_10.0.9.exe

https://dw.uptodown.com/dwn/GdUIL2OUOzVlhDokGucgyMBH-s_XjgpStp_cIEBayo-ZBP5bO5s1M2ZU2Q6MbXKovJyTpgczQUp8o33zcyz87ERGmpwwrE5dD4Sow1bxRfJ9ckfRH8cYc-AQouvZAUb3/J15wZWJv2znJ1aACc55LAUmeyfKTT-afOsqPYKWvIXPd-o_F5PIQyBiW1bFowwM4okfbFnFO7ghYKgrx7Ba2SR3-8H1WMHt_hv2KN-Qppk2F_9-G_pcwqkdkzJLTxFNc/db0ZA6BcpdaR6Q0ytB4WmRvXb6IumuHEYFEKKeoYAI4E-rrcdeUl1CyTwSVuE4GjygKLXm6y2ZKdlh_30lHylkEkJcR_96UCjJ3qu8pzM6YlgnIkIZjnVJMSts0rqFYn/.../

https://dw.uptodown.com/dwn/hfDWVbOyAS6sFVtlxEsYzaGaveL_JUmZYFdRI0GIa2XJuFhGErBQLIIgOFNKeOO9u2SvGxqQco2cf7dGqExowZ9JKzMjCr-qLtj-qtpDA13DB3mmUAg3q_PKwVDlP_aP/UTT2SC8tC83Fp5XoE0M3kuxd2IQtUTl1ZYh1BvJOUGEsXggW4Bi6OiflJX2MOmC_qwEtXJLejYktZKUDRYfL08Y8uXcpGV-Spt2xqsKD5gyAtebho0u1ROtbwzstvCP6/Of9AHmPkx2lCH0Q5WoE9gcdqgmrQVzY0IUMXz3JL_Cc3uEKxFaDMUVoWiWGKhRvnYSwSYgBgPgGhR5FpWWf6Sw_ITL-oPQ5tBJJQ2qYDupySLIromGBhW-ZQuuILdeYM/.../

https://dw.uptodown.com/dwn/hwvnLDJvqk1CUoKzjD0oJ9qFLru7NkSdqUHYNT5SAgvzqfu0DmZt9_eyT73_6grzcQBM0Bs5zwkfU8GKOO74qDorCF-5cDCDe7OMIJmtrEyn6Z7_a4a4K60xGGs-UWSw/fLXAwe2_oj4i78D39-mcALuq4rmR3R7FpyiUbSlvq8haZaPDEogdXiQZ8rrdyZY_bFh8-ltHep-Oy331wAtVq1Hsc-qZwmALJN9Es6E4VXPTmoD9i3itPPUIYOHtZGDb/dP7idXiHc6xUlBZT_HXIlc7XcwstlNb6OVyL7l_lk58tsgRevD5dvIr4ZA13exlQMwGaILELHh-gn97Puz9uaFUIrrfPEoU4ivZcYmdBxVDNj7_pjKcZWV6Q49d0r1c2/.../

http://download982.mediafire.com/88ebn27zaj7g/.../flstudio_10.0.9.exe

https://dw.uptodown.com/dwn/Jf4yObh7y1YG90dbTsINFmIKxsii0SqsvMl2Vr_lpaz9UPisTGmOU2Lalu5znimvdRx6-b1lQWe0JlLbP3O6GIaHGyhyC2cLayojeXFrG7VKUtUDSXjix5dFZYqsFA5k/2ejGn4dLlgilflANDzT_Nio3AnK6khyDNYLjiJUNlzAg7WlG1Q9aN1ZIh6JlZTCba0v5aZQans9zCfF1YAzxRmCFDkJhb7WnzlSoZV00rX_pAfDHlXPwIwjxU9S7raEV/XxdRLloR19wEAOojxGykze7AyySFdGzwAwllSx27mFq83eQ5rUb5jl6bGJdI_ln9M-0rfurhYQt8yAyY6BGkz-X2B4TFxUYnHQsVgFKfqrS7Eqvw0tRSmpcVRpQhEHa4/.../

http://download2206.mediafire.com/2gdh1jgybi2g/.../flstudio_10.0.9.exe

https://dw.uptodown.com/dwn/LZumL8sm_VnMrtp0hcVPAPPRrITWvF-X0uMti3qFJpYLm6I61IE9yzlKxFjwxQSMRjb-TSMvj_P8OsxAf6F5r1L4aU0d4p72j1wG_oH3Sl9qRl-WYN_2cgCAFpvMqocx/AbNMsjOE0XrLTZpC2kGjrcOWuuTAke6C0QJR91452_2EdpEtbebw6zH8BxgP-7r3XxUFGdLzOoJ0ka1AqyQ3PIgQqhaJjQrsRJgh0lZP_tzWLda1y7PmLOKIXMp20Yz2/_fD9zgAqlakS0LUOjODG3CI6nItTf0w2u4YenbVFMCKQFkgtdk04uftoIuI1IOhxG080nIcNCXF3LTnt3wiPinqh0NPITgfLttjE_iqxiZiz8K3t8Ztfcs206e-YdotQ/.../

https://dw.uptodown.com/dwn/PZkENyC_YzvtHyx0zCgqArXjV6iVQjQxK16LsIa149blYj-MjWEHa8cCV58aj9_bJoHz0hFLmFAQTrnWHLIB9LnBD0szwb8-oKDc5AbMDRZcUzHWDhT6aL7b6A4ok-SU/Ceo8poqSqTIuNk0mQ55SXaOKtdro_wYACRCbOEQrv2AsoaATXspiLp8YXVpgejccswkq2pm50oQN66AwkgppEyut-9GbFVod186zMHryWdc2Zwp7b2TOTJTTITAoCa2t/ZrjP6r6eDVpCtaYrWqyHL8y_oQwVgwsuWeAeKjBinLLfAOr8WD0RKjJcFV5WGLp6HzmreCNJWM93lAwPci0To56KNw6L5B6uM-RdXggguX6aX7_Gl5jhEbD1HBADLflC/.../

https://dw.uptodown.com/dwn/pi1EyvpsBQWOjkKB6KH6FaRzu6FZAvHtnSkUyy4i5Bdc2O8qbUc6aZq0G7n_jezcjEHDhDZy0rwzm8eH8kJ2nGGJGTTIgn-sRbAV3qRgJ34nGtcUmABS9FVzUSlML7Rr/ozHQGbUNH4jVHwEMxKoOXrxTJ9GIVLM6na2Y2sm3blZwT_sPsULJTiUa_4xx6EQeLhxGS-ki0p0AJ1eISA8AMrUU8xKl2mwkDeWu7JZuHj3B6SN17gX9InZpinJVkWdh/z4anEeDc-vyCDKkYj76zOBG0ptm9EwJeLuGAy5kwy9dy37uuF0tWabPRzprlnv9r5FqMsMjcG9P1G9iyH5NP7zDGcA3AVMCFTS9MpNWAGhJUtKP0ge543KbFTw6HLGC8/.../

https://dw.uptodown.com/dwn/y2dgXVzMyrIdECYYiLArWJPCecMItqJgUtEiaL9YowDbTG-99N6dotZhwVkZZ0h5og9Tg-UUFpAdW5q5HuLwO4wJLwXiSaiXVAxwv-a_-JxOh9gvAXw-QCcOOooglgra/C2vAa1jB19xPuNuK_-yQfuvPxchBGvXDufUYr4jT4H3aEnMGDtlA0DTtcqYzkEo6sS4i3x04hm87ykBD2ZK5BBcvhmPcIlPgyYr6SxG0zJvHWOe2xxHVZBdJ52i7sI0_/IWGV7dLn2jW9L8Rtlcf4Q-7UQdqAkMDzgChNXDGSnnR_NIJTd5l_GQ_-AFQScgnESQmGdb5W24slynFDHKr1lyAn4UTegTgbQRJVit7ZgpMNBZHbrA9i4T5P5MfTeZCX/.../

Latest 30 of 128 download URLs

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to 66.07.24ae.ip4.static.sl-reverse.com  (174.36.7.102:80)

Remove flstudio_10.0.9.exe - Powered by Reason Core Security