23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:T596,"" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\System.dll" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app-64.7z" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\nsis7z.dll" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\locales" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\resources" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\blink_image_resources_200_percent.pak" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\content_resources_200_percent.pak" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\content_shell.pak" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\icudtl.dat" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\LICENSE.electron.txt" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\LICENSES.chromium.html" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\locales\am.pak" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\locales\ar.pak" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\locales\bg.pak"25:Tb8b,Antivirus vendors marked dropped file "api-ms-win-crt-heap-l1-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-runtime-l1-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "nsis7z.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-processthreads-l1-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-file-l2-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-string-l1-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "ffmpeg.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-file-l1-2-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-private-l1-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-processthreads-l1-1-1.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-debug-l1-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "d3dcompiler_47.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-handle-l1-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-util-l1-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-synch-l1-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "vcruntime140.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-synch-l1-2-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-time-l1-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-libraryloader-l1-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-errorhandling-l1-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows")26:T79b,Spawned process "Instagram Checker.exe" (UID: 00011757-00003176) Spawned process "Instagram Checker.exe" with commandline "--type=gpu-process --no-sandbox --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=7,10,18,19,20,23,41,74 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x80ee --gpu-device-id=0xbeef --gpu-driver-vendor="Oracle Corporation" --gpu-driver-version=5.0.40.0 --gpu-driver-date=4-28-2017 --service-request-channel-token=AFB6DF66843BA57C55EC4D6C13F4D52D --mojo-platform-channel-handle=1112 /prefetch:2" (UID: 00015195-00003832) Spawned process "Instagram Checker.exe" with commandline "--type=renderer --no-sandbox --primordial-pipe-token=EF7083DE8B524F7B059CD6C571AC4DE5 --lang=en-US --app-path="C:\Users\HAPUBWS\AppData\Local\Temp\nsj92E0.tmp\app\resources\app.asar" --node-integration=true --webview-tag=true --no-sandbox --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553 --service-request-channel-token=EF7083DE8B524F7B059CD6C571AC4DE5 --renderer-client-id=4 --mojo-platform-channel-handle=1412 /prefetch:1" (UID: 00015342-00003932)27:T7ad,"api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "nsis7z.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-file-l2-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-string-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "ffmpeg.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-crt-private-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "d3dcompiler_47.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-util-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "vcruntime140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"28:T5f0,"" touched file "C:\Windows\SysWOW64\oleaccrc.dll" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db" "" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db" "Instagram Checker.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "Instagram Checker.exe" touched file "C:\Windows\System32\rsaenh.dll" "Instagram Checker.exe" touched file "C:\Windows\System32\drivers\etc\hosts" "Instagram Checker.exe" touched file "C:\Windows\System32\en-US\user32.dll.mui" "Instagram Checker.exe" touched file "C:\Windows\Fonts\segoeui.ttf" "Instagram Checker.exe" touched file "C:\Windows\Fonts\segoeuib.ttf" "Instagram Checker.exe" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "Instagram Checker.exe" touched file "C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm"29:Tc70,Heuristic match: "rHtx.pG" Pattern match: "http://nsis.sf.net/NSIS_Error" Pattern match: "http://dmd.metaservices.microsoft.com/dms/metadata.svc" Pattern match: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1ab01a1c1f29147d HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?16be157157057ca0 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Pattern match: "www.microsoft.com" Heuristic match: "GET /CRL/Omniroot2025.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cdp1.public-trust.com" Heuristic match: "GET /sv.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: sv.symcb.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBuN56dlW1Lzehhu%2FtdSD3U%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: sv.symcd.com" Heuristic match: "GET /pca3-g5.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s1.symcb.com" Pattern match: "http://www.symauth.com/cps0*" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s2.symcb.com" Pattern match: "http://www.symauth.com/cps0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAt%2BEJA8OEkP%2Bi9nmoehp7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /sha2-ha-cs-g1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl3.digicert.com" Pattern match: "www.digicert.com1503" Pattern match: "http://crl3.digicert.com/sha2-ha-cs-g1.crl0" Heuristic match: "GET /sha2-ha-cs-g1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl4.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSLIycRsoI3J6zPns4K1aQgAqaqHgQUZ50PIAkMzIo65YJGcmL88cyQ5UACEAG2Yem3HYLmNssdMr3TCFk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /DigiCertHighAssuranceEVRootCA.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl3.digicert.com" Heuristic match: "GET /DigiCertHighAssuranceEVRootCA.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl4.digicert.com" Pattern match: "www.digicert.com1+0" Heuristic match: "crl3.digicert.com" Heuristic match: "crl4.digicert.com" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings"2a:T6a0,"api-ms-win-crt-heap-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "nsis7z.dll" was detected as "Borland Delphi 3.0 (???)" "api-ms-win-core-processthreads-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-file-l2-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-string-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-file-l1-2-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-private-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-processthreads-l1-1-1.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-debug-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-handle-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-util-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-synch-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-synch-l1-2-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-time-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-libraryloader-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-errorhandling-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-processenvironment-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-sysinfo-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-conio-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"2b:T7ad,"api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "nsis7z.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-file-l2-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-string-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "ffmpeg.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-crt-private-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "d3dcompiler_47.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-util-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "vcruntime140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"2c:T693,"System.dll" claimed CRC 0 while the actual is CRC 39682 "api-ms-win-crt-runtime-l1-1-0.dll" claimed CRC 32776 while the actual is CRC 48938 "api-ms-win-core-processthreads-l1-1-0.dll" claimed CRC 20830 while the actual is CRC 429384 "api-ms-win-core-file-l2-1-0.dll" claimed CRC 77623 while the actual is CRC 20830 "api-ms-win-core-string-l1-1-0.dll" claimed CRC 47967 while the actual is CRC 77623 "api-ms-win-core-file-l1-2-0.dll" claimed CRC 24376 while the actual is CRC 2015127 "api-ms-win-crt-private-l1-1-0.dll" claimed CRC 104772 while the actual is CRC 24376 "api-ms-win-core-processthreads-l1-1-1.dll" claimed CRC 59884 while the actual is CRC 104772 "api-ms-win-core-debug-l1-1-0.dll" claimed CRC 34822 while the actual is CRC 59884 "d3dcompiler_47.dll" claimed CRC 4219283 while the actual is CRC 34822 "api-ms-win-core-handle-l1-1-0.dll" claimed CRC 66050 while the actual is CRC 4219283 "api-ms-win-core-util-l1-1-0.dll" claimed CRC 56187 while the actual is CRC 66050 "api-ms-win-core-synch-l1-1-0.dll" claimed CRC 84327 while the actual is CRC 56187 "vcruntime140.dll" claimed CRC 122157 while the actual is CRC 84327 "api-ms-win-core-synch-l1-2-0.dll" claimed CRC 29340 while the actual is CRC 122157 "api-ms-win-crt-time-l1-1-0.dll" claimed CRC 59261 while the actual is CRC 29340 "api-ms-win-core-libraryloader-l1-1-0.dll" claimed CRC 77632 while the actual is CRC 59261 "api-ms-win-core-errorhandling-l1-1-0.dll" claimed CRC 51506 while the actual is CRC 77632 "api-ms-win-core-processenvironment-l1-1-0.dll" claimed CRC 67859 while the actual is CRC 3466836 "api-ms-win-core-sysinfo-l1-1-0.dll" claimed CRC 55310 while the actual is CRC 678592d:T5ca,"" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\Instagram Checker.exe" (Handle: 340) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\Instagram Checker.exe" (Handle: 340) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\Instagram Checker.exe" (Handle: 340) "" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\Instagram Checker.exe" (Handle: 340) "Instagram Checker.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\Instagram Checker.exe" (Handle: 1120) "Instagram Checker.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\Instagram Checker.exe" (Handle: 1120) "Instagram Checker.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\Instagram Checker.exe" (Handle: 1120) "Instagram Checker.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\Instagram Checker.exe" (Handle: 1420) "Instagram Checker.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\Instagram Checker.exe" (Handle: 1420) "Instagram Checker.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj92E0.tmp\app\Instagram Checker.exe" (Handle: 1420)2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8ADw/////////////////w8A8P////////////////8PAPD/////////////////DwDw/////////////////w8A8P////////////////8PAPD/////////////////DwDw/////////////////w8A8P//+Hj/+IiIiIj///8PAPD///Zmf4iIiIiIj///DwDw///4+Gf//////////w8A8P////+I//////////8PAPD/////////////////DwDw/////////////////w8A8P///3j/+IiIiIj///8PAPD///Zmj4iIiIiIj///DwDw///4+Gf//////////w8A8P////+I//////////8PAPD/////////////////DwDw/////////////////w8A8P///3j/+IiIiIj///8PAPD///dmj4iIiIiIj///DwDw///4+Gf//////////w8A8P////+I//////////8PAPD/////////////////DwDw///////////4iIiIiAgA8P//////////+IiIiICAAPD///////////iIiIgIAADw///////////4iIiAgAAA8P//////////+IiICAAAAPD///////////iIgIAAAADw///////////4iAgAAAAA8P//////////+ICAAAAADwAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAH/AAAD/wAAB/8AAA//AAAf/wAAP/8AAH/w==2f:T4c1,--type=renderer --no-sandbox --primordial-pipe-token=EF7083DE8B524F7B059CD6C571AC4DE5 --lang=en-US --app-path="C:\Users\HAPUBWS\AppData\Local\Temp\nsj92E0.tmp\app\resources\app.asar" --node-integration=true --webview-tag=true --no-sandbox --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553 --service-request-channel-token=EF7083DE8B524F7B059CD6C571AC4DE5 --renderer-client-id=4 --mojo-platform-channel-handle=1412 /prefetch:11b:["$","$L2",null,{"children":[null,["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98","overall_status":"IN_PROGRESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"IN_PROGRESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1792056906133,"unified_at":"2026-10-15T09:35:06.133Z","metadata":{"hashes":{"sha256":"0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98","sha1":"3b78865dea2e6b4d4bc139f66b6f8ad0ef9ae6b2","md5":"f3e46103028c43cdb9efe697a569922b","sha512":"d8540a91f9b1b95193ab78585dc395b819f1819a79b9034152ea3a09ea5e336d5905b9df096498e3ef63f425b2b47e04afa523ddb6423038476c6555fea92061","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"Instagram Checker 1.2.2.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":35927323,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1518083289000,"last_seen":0}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":23,"suspicious_count":14,"malicious_count":6,"total":43},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{}},"rule_matches":{},"attributions":{},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 11691-137-000000018000CCD8\n SetUnhandledExceptionFilter@KERNEL32.dll at 26663-477-000000018038F620\n SetUnhandledExceptionFilter@KERNEL32.dll at 27393-1750-10039F5C\n SetUnhandledExceptionFilter@KERNEL32.dll at 33702-2831-0000000180166BE0\n SetUnhandledExceptionFilter@KERNEL32.dll at 33702-2861-0000000180166034","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 11691-156-000000018000CC2C\n GetSystemTimeAsFileTime@KERNEL32.dll at 26663-628-0000000180390880","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00010532-00002796-44235-8-00406106\n GetVersion@KERNEL32.DLL at 00010532-00002796-44235-1-00403334\n GetVersion@KERNEL32.DLL at 00010532-00002796-51149-8-00406106\n GetVersion@KERNEL32.dll at 26663-468-00000001803954D0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00010532-00002796-44235-1120-00404643\n GetDiskFreeSpaceW@KERNEL32.DLL at 00010532-00002796-48889-1120-00404643\n GetDiskFreeSpaceW@KERNEL32.DLL at 00010532-00002796-51149-1120-00404643","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL (Target: \"0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98.exe\"; Stream UID: \"00010532-00002796-44235-1-00403334\")\n which is directly followed by \"cmp ax, 00000006h\" and \"je 0040337Ah\". See related instructions: \"...+35 call dword ptr [004080B0h] ;SetErrorMode+41 call dword ptr [004080ACh] ;GetVersion+47 cmp ax, 00000006h+51 je 0040337Ah\" ... at 00010532-00002796-44235-1-00403334","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 26663-1064-0000000180326370\n GetProcessHeap@KERNEL32.dll at 26663-1065-00000001801858E0\n GetProcessHeap@KERNEL32.dll at 26663-1060-0000000180339FA0\n GetProcessHeap@KERNEL32.dll at 26663-1330-0000000180158870\n GetProcessHeap@KERNEL32.dll at 26663-1170-000000018033B160\n GetProcessHeap@KERNEL32.dll at 26663-1322-0000000180158940\n GetProcessHeap@KERNEL32.dll at 26663-1319-0000000180147B30\n GetProcessHeap@KERNEL32.dll at 26663-1285-000000018032BF60\n GetProcessHeap@KERNEL32.dll at 26663-1171-000000018033ADC0\n GetProcessHeap@KERNEL32.dll at 26663-1323-0000000180158CB0\n GetProcessHeap@KERNEL32.dll at 26663-1484-0000000180315BB0\n GetProcessHeap@KERNEL32.dll at 27393-3610-10043C9F","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Instagram Checker.exe\" queries volume information of \"%WINDIR%\\Fonts\\segoeui.ttf\" at 00011757-00003176-00000046-66097563\n \"Instagram Checker.exe\" queries volume information of \"%WINDIR%\\Fonts\\segoeui.ttf\" at 00011757-00003176-00000046-66107062\n \"Instagram Checker.exe\" queries volume information of \"%WINDIR%\\Fonts\\segoeuib.ttf\" at 00011757-00003176-00000046-66107548\n \"Instagram Checker.exe\" queries volume information of \"%WINDIR%\\Fonts\\segoeuib.ttf\" at 00011757-00003176-00000046-66109877","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"crl3.digicert.com\"\n \"crl4.digicert.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"66.225.197.197:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"vcruntime140.amd64.pdb\"\n \"api-ms-win-core-file-l1-2-0.pdb\"\n \"api-ms-win-core-util-l1-1-0.pdb\"\n \"api-ms-win-core-synch-l1-2-0.pdb\"\n \"api-ms-win-core-libraryloader-l1-1-0.pdb\"\n \"api-ms-win-crt-runtime-l1-1-0.pdb\"\n \"api-ms-win-core-synch-l1-1-0.pdb\"\n \"api-ms-win-core-processthreads-l1-1-0.pdb\"\n \"api-ms-win-core-debug-l1-1-0.pdb\"\n \"api-ms-win-crt-time-l1-1-0.pdb\"\n \"api-ms-win-core-handle-l1-1-0.pdb\"\n \"api-ms-win-core-string-l1-1-0.pdb\"\n \"api-ms-win-crt-heap-l1-1-0.pdb\"\n \"api-ms-win-core-file-l2-1-0.pdb\"\n \"api-ms-win-core-processthreads-l1-1-1.pdb\"\n \"api-ms-win-crt-private-l1-1-0.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$24","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$25","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /sha2-ha-cs-g1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl3.digicert.com\"\n \"GET /sha2-ha-cs-g1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl4.digicert.com\"\n \"GET /DigiCertHighAssuranceEVRootCA.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl3.digicert.com\"\n \"GET /DigiCertHighAssuranceEVRootCA.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl4.digicert.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Instagram Checker.exe\" (UID: 00011757-00003176) was launched with new environment variables: \"PORTABLE_EXECUTABLE_DIR=\"C:\"\"\n Process \"Instagram Checker.exe\" (UID: 00015195-00003832) was launched with new environment variables: \"GOOGLE_API_KEY=\"AIzaSyAQfxPJiounkhOjODEO5ZieffeBv6yft2Q\"\"\n Process \"Instagram Checker.exe\" (UID: 00015195-00003832) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"Instagram Checker.exe\" (UID: 00015195-00003832) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"#32770\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$26","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$27","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Instagram Checker.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"Instagram Checker.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$2a","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"Instagram Checker.exe\" queried SystemProcessInformation at 00011757-00003176-00000033-65221673","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 27393-143-1003AD4A","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Instagram Checker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Instagram Checker.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$2b","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"suspicious","category":"Network Related","name":"Reads the hosts file","description":"\"Instagram Checker.exe\" read 65536 bytes from file \"%WINDIR%\\System32\\drivers\\etc\\hosts\"\n \"Instagram Checker.exe\" read 61440 bytes from file \"%WINDIR%\\System32\\drivers\\etc\\hosts\"","origin":"API Call","relevance":10,"id":"api-33","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00010532-00002796-44235-1130-00405382","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98.exe\" marked \"%TEMP%\\nse9188.tmp\" for deletion\n \"C:\\0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98.exe\" marked \"%TEMP%\\nsj92E0.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%APPDATA%\\instagram-checker\\D013.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$2c","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryW\n VirtualProtect\n GetProcAddress\n VirtualAlloc\n GetModuleHandleW\n OpenProcessToken\n GetFileAttributesW\n GetTempPathW\n DeviceIoControl\n GetModuleFileNameW\n IsDebuggerPresent\n UnhandledExceptionFilter\n LoadLibraryExW\n GetModuleHandleA\n CreateThread\n ExitThread\n TerminateProcess\n GetModuleHandleExW\n GetVersionExW\n GetTickCount\n GetFileSize\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n FindFirstFileW\n CreateFileW\n GetCommandLineW\n GetCommandLineA\n WriteFile\n FindWindowExW\n SleepConditionVariableCS\n Sleep\n RegCloseKey\n RegOpenKeyExW\n RegOpenKeyExA\n RegEnumKeyExA\n GetModuleFileNameA\n MapViewOfFileEx\n CopyFileExW\n CreateFileMappingW\n GetFileSizeEx\n MapViewOfFile\n OutputDebugStringA\n CreateFileA\n LoadLibraryA\n GetTempPathA\n GetTempFileNameA\n GetModuleHandleExA\n GetWindowThreadProcessId\n ShellExecuteW\n ShellExecuteExW\n OutputDebugStringW\n GetDriveTypeW\n FindFirstFileExA\n FindNextFileW\n FindNextFileA\n FindFirstFileExW\n GetFileAttributesExW\n LoadLibraryExA\n CreateProcessA\n CreateProcessW\n CopyFileW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"5034dd76f854dd7657d1de7686d5df76ea30df762212dd76dd16dd763e18dd766834dd76d016dd76cb48dd762e58dd76fe18dd762618dd76ff42dd76c011dd760000000019f1cf76000000000822a575d1e4a27500000000\" to virtual address \"0x10003000\" (part of module \"SYSTEM.DLL\")\n \"\" wrote bytes \"7111ba007a3bb900ab8b02007f950200fc8c0200729602006cc805001ecdb6007d26b600\" to virtual address \"0x76CD07E4\" (part of module \"USER32.DLL\")\n \"\" wrote bytes \"d055d4756473dd750000000051c1357594983575ee9c357575dc3775273e37750fb33b75000000008548dd766987dd760f77df76d917dd76ead7de76a934dd76f811dd762014dd760c11dd76f516dd765414dd76ff10dd763214dd7600000000\" to virtual address \"0x74251000\" (part of module \"SHFOLDER.DLL\")\n \"\" wrote bytes \"c2000000\" to virtual address \"0x1000405C\" (part of module \"SYSTEM.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"Instagram Checker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/66 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 27393-3268-1000E1F4","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/71 Antivirus vendors marked dropped file \"System.dll\" as malicious (classified as \"Adware.Domage.Neobar.BF\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2d","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00010532-00002796-44235-1-00403334","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00010532-00002796-44235-1109-00401000","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":116,"dropped_files_count":0,"extracted_files_count":59,"files_written_count":52,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5a7bfbee7ca3e17052767e93","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"malware_family":"HW32.Packed","contacted_countries":["EU","USA"],"submit_name":"Instagram Checker 1.2.2.exe","analysis_start_time":"2018-02-08T10:36:02+00:00","indicators_count":{"informative":23,"suspicious":18,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5a7bf8e77ca3e169d86be2d5","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"Instagram Checker 1.2.2.exe","analysis_start_time":"2018-02-08T07:14:47+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":[{"address":"66.225.197.197","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]}],"dns_resolutions":[{"domain":"crl4.digicert.com","address":"66.225.197.197","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"domain":"crl3.digicert.com","address":"93.184.220.29","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]}],"http_requests":[{"host":"crl3.digicert.com","host_ip":"93.184.220.29:80","url":"/sha2-ha-cs-g1.crl","method":"GET","header":"GET /sha2-ha-cs-g1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl3.digicert.com","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"host":"crl3.digicert.com","host_ip":"93.184.220.29:80","url":"/DigiCertHighAssuranceEVRootCA.crl","method":"GET","header":"GET /DigiCertHighAssuranceEVRootCA.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl3.digicert.com","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}],"processes":[{"pid":2796,"ppid":0,"name":"0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98.exe","command_line":"","sha256":"0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98","normalized_path":"C:\\0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98.exe","uid":"00010532-00002796","icon":"$2e"},{"pid":3176,"ppid":2796,"name":"Instagram Checker.exe","command_line":"","sha256":"44dda9dad71109a5e325c69dcbedd8593ec058df1595a1c4e37206856f4a0704","normalized_path":"%TEMP%\\nsj92E0.tmp\\app\\Instagram Checker.exe","parent_uid":"00010532-00002796","uid":"00011757-00003176"},{"pid":3832,"ppid":3176,"name":"Instagram Checker.exe","command_line":"--type=gpu-process --no-sandbox --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=7,10,18,19,20,23,41,74 --disable-gl-extensions=\"GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent\" --gpu-vendor-id=0x80ee --gpu-device-id=0xbeef --gpu-driver-vendor=\"Oracle Corporation\" --gpu-driver-version=5.0.40.0 --gpu-driver-date=4-28-2017 --service-request-channel-token=AFB6DF66843BA57C55EC4D6C13F4D52D --mojo-platform-channel-handle=1112 /prefetch:2","sha256":"44dda9dad71109a5e325c69dcbedd8593ec058df1595a1c4e37206856f4a0704","normalized_path":"%TEMP%\\nsj92E0.tmp\\app\\Instagram Checker.exe","parent_uid":"00011757-00003176","uid":"00015195-00003832"},{"pid":3932,"ppid":3176,"name":"Instagram Checker.exe","command_line":"$2f","sha256":"44dda9dad71109a5e325c69dcbedd8593ec058df1595a1c4e37206856f4a0704","normalized_path":"%TEMP%\\nsj92E0.tmp\\app\\Instagram Checker.exe","parent_uid":"00011757-00003176","uid":"00015342-00003932"}],"all_imported_dlls":["api-ms-win-core-localization-l1-2-0.dll","comdlg32.dll","ncrypt.dll","ucrtbase.dll","wow64win.dll","gdi32.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","netapi32.dll","wtsapi32.dll","msctf.dll","Wldap32.dll","bcrypt.dll","sspicli.dll","wininet.dll","dhcpcsvc.dll","wow64cpu.dll","cfgmgr32.dll","api-ms-win-core-processthreads-l1-1-1.dll","setupapi.dll","StdUtils.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","msimg32.dll","wship6.dll","netutils.dll","wintrust.dll","api-ms-win-crt-stdio-l1-1-0.dll","psapi.dll","rsaenh.dll","propsys.dll","api-ms-win-core-synch-l1-2-0.dll","nlaapi.dll","oleacc.dll","IPHLPAPI.DLL","api-ms-win-downlevel-user32-l1-1-0.dll","iertutil.dll","UIAutomationCore.dll","AudioSes.dll","MMDevAPI.dll","user32.dll","devobj.dll","api-ms-win-crt-convert-l1-1-0.dll","dxgi.dll","crypt32.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-crt-string-l1-1-0.dll","dbghelp.dll","normaliz.dll","apphelp.dll","shfolder.dll","cryptbase.dll","nsis7z.dll","DWrite.dll","cryptsp.dll","dwmapi.dll","version.dll","ws2_32.dll","api-ms-win-core-timezone-l1-1-0.dll","profapi.dll","oleaut32.dll","api-ms-win-crt-multibyte-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","kernel32.dll","shell32.dll","shlwapi.dll","ole32.dll","imm32.dll","ntmarta.dll","api-ms-win-crt-heap-l1-1-0.dll","dhcpcsvc6.dll","winnsi.dll","powrprof.dll","wshqos.dll","winrnr.dll","rpcrt4.dll","uxtheme.dll","userenv.dll","nsi.dll","vcruntime140.dll","api-ms-win-core-file-l1-2-0.dll","ffmpeg.dll","api-ms-win-crt-runtime-l1-1-0.dll","pnrpnsp.dll","comctl32.dll","srvcli.dll","wkscli.dll","NapiNSP.dll","KernelBase.dll","System.dll","wlanapi.dll","oleaccrc.dll","node.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","msasn1.dll","lpk.dll","clbcatq.dll","msvcp140.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-crt-conio-l1-1-0.dll","wow64.dll","advapi32.dll","wlanutil.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","mswsock.dll","WSHTCPIP.DLL","api-ms-win-core-file-l2-1-0.dll","winmm.dll","ntdll.dll","usp10.dll","dnsapi.dll","msvcrt.dll","sechost.dll","winsta.dll","mscms.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"System.dll","sha256":"bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-debug-l1-1-0.dll","sha256":"290030199e8b47d6bcf466f9fc81fee7e6aebc2c16a3f26dd77019f795658956","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-errorhandling-l1-1-0.dll","sha256":"573aed3f3eb436f9b7c24d51be3be2105deb8149ebda9b964660930c957b2410","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-file-l1-2-0.dll","sha256":"d9973270a952b4ce615104520051e847b26e4b1cc330a5a95ba1ae128f0dfdeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-file-l2-1-0.dll","sha256":"144d3a28e43e47fc1cce956255cc80467d4a6fbbb8f612ec6d85f62de030a924","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-handle-l1-1-0.dll","sha256":"d6bc1509fd2d4ea07e661f2f59395b4d71907d16f59942443a5d460df343dbf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-libraryloader-l1-1-0.dll","sha256":"f8e8d85035bcb478ce2ab47a6476a8c756a7c8fa05bad66b9a03ece6a2ced141","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-processenvironment-l1-1-0.dll","sha256":"1cd9cff9f7d24b22993a207cb81f15ce2792fa5f941e77e8280db00db6a273ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-processthreads-l1-1-0.dll","sha256":"2658242ccd090181ed944f682c435e5fb880f3b21d1811d43b93478901d701b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-processthreads-l1-1-1.dll","sha256":"ae574c9b8a2467c3ee0ac3e862255e93a02627bce146ad7b720b99905dc224fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-string-l1-1-0.dll","sha256":"7b5393e2cb79f0396d5d97510e8f0955a2586aacaf60eb8de3676006cb81dc5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-synch-l1-1-0.dll","sha256":"5d1a854a0c5121e2e8866dad26545f7f8c2d2f1b15ed7f1ed0b72654a1fc299b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-synch-l1-2-0.dll","sha256":"9566b81b1c6db1727a4bb3a7a3de12247ff5297f34548593280ec31f2b2e2c65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-sysinfo-l1-1-0.dll","sha256":"1f98f9e044d32e61445c5fab3c80c2f37ca6bab3d5b22cd5611fb5df73db04a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-util-l1-1-0.dll","sha256":"070afbdbe5b3f3b76b6b7ea2dbb9f8deff81c6ec8706eef9080671543e2ae28b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-conio-l1-1-0.dll","sha256":"1d4464fe335470452e58d613028dde2f105edf969d411e90ba7ca9e343c3fc89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-convert-l1-1-0.dll","sha256":"91c5966932287078d0e616d8e0369347991f39765749bbffa1ed3a9df49776d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-filesystem-l1-1-0.dll","sha256":"8f9361d02f68392127fe264655eac4fef4a4a1bf63571f184ce26faa98670702","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-heap-l1-1-0.dll","sha256":"76dad3e04c9ff61b40ae1c9e039837cd1c077d59b6a008643e4fbf2dbdb564dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-locale-l1-1-0.dll","sha256":"ba1458f730ff90009483c763926d1c74383480e529541c0ef5d4de44e7a4f14c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-math-l1-1-0.dll","sha256":"5f2bb085217304006c81c55214c6093ec476e554e31808026e424da82f58aa0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-private-l1-1-0.dll","sha256":"c1e206aa4c8014dcfdad15c16f50fbf4e3ce8e76e9406af923131ebc001dd5ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-process-l1-1-0.dll","sha256":"36589e9738a9358065d5a72f4276505d6c2f78101508bede05bdcceea46a8cd8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-runtime-l1-1-0.dll","sha256":"11aca97acda31203aeee496c9f183b49db1c54d0efa48888a15ab4ea47ee080f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-time-l1-1-0.dll","sha256":"a4b0f75854949980d410c5da90c36ddb94be292431c89fd3e992f9d5f8ee9983","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"d3dcompiler_47.dll","sha256":"e994847e01a6f1e4cbdc5a864616ac262f67ee4f14db194984661a8d927ab7f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"ffmpeg.dll","sha256":"420d87064162f8392ec14a28160ac5d80bf03161548d690c628c09ba6af6efd4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"libEGL.dll","sha256":"a013c8211c4492a2369ea7ec672ce589198850a38b193d22cc3f9e9e42a0ec3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"libGLESv2.dll","sha256":"d7a923280b31f96f94118847b79f071d10f41465004d5eee6dc15e48c2cb4b54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"msvcp140.dll","sha256":"517cd3aac2177a357cca6032f07ad7360ee8ca212a02dd6e1301bf6cfade2094","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"vcruntime140.dll","sha256":"d89c7b863fc1ac3a179d45d5fe1b9fd35fb6fbd45171ca68d0d68ab1c1ad04fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"nsis7z.dll","sha256":"66ac8bd1f273a73e17a3f31d6add739d3cb0330a6417faeda11a9cae00b62d8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"D013.tmp","sha256":"1250e832396512c640d10ce5cfb1d5175d4a84bd1cc6591dddb9df9ff1a205dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"StdUtils.dll","sha256":"72d38ef115e71fc73dc5978987c583fc8c6b50ff12e4a5d30649a4d164a8b6ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"app-64.7z","sha256":"ca456fb1eb7651d53b0ee94192dc8ffd14e6d2293d5d1fd8574d2632c8e705cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"Instagram Checker.exe","sha256":"d557d0354d4618c5974395133ff030cf420e5d6e27822c8e2304b4580d7f1f65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"LICENSE.electron.txt","sha256":"dd29d9a7373462713796224a3c5033b30a5a91f8a5027bdf29ced677e4135b4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"LICENSES.chromium.html","sha256":"002cc048e33fc1498e91f71a2bbfd61f44bb258281155cb629b98fca45824d9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-console-l1-1-0.dll","sha256":"4ceaf28cadfd0929b44e9c686b93432a7151504c8ffe2a6afe516f9b16538131","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-datetime-l1-1-0.dll","sha256":"69b84f7318798a91143e3d273ae9c0bedaabba930e3702447d493e2b8dd70725","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-file-l1-1-0.dll","sha256":"74075b7af84378cee0d035c020b320ee52a120b21f71a4972093c9e23d534830","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-heap-l1-1-0.dll","sha256":"f60267cab87dfc1accf912c212186112aba38742f621549d6bc8d67e217e7234","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-interlocked-l1-1-0.dll","sha256":"f93ddef4ac14ef778790f3f00057ab6cafc0c99dff52cc24f523d63917719970","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-localization-l1-2-0.dll","sha256":"6475f20f46814d28845c2fa73e9c283a8504483fa16d911325588c778cf76c26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-memory-l1-1-0.dll","sha256":"dc41da54e717aef60228ee11d10669c31d3ddd532eee9ecad944c09b71b762dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-namedpipe-l1-1-0.dll","sha256":"b0ae48eb5ff51fa038e1ed23c7c48d266c20c2af3f9907ee6906bb0346df7f9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-profile-l1-1-0.dll","sha256":"cffb2007c31932b092cda3a0a39f1cfcc5766b6a1c05e5eaeabc53660cbbe786","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-rtlsupport-l1-1-0.dll","sha256":"eae3cd8747da3b435846901a1dbe0e430666d3d8d7ba6e54307cff5d6ee0592f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-core-timezone-l1-1-0.dll","sha256":"5909e928d791f67a13e3130033cb0e2178f5167a644c3ab5336322d38356db47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-environment-l1-1-0.dll","sha256":"8d9d3e905d072c4465e4787dd5bd843d3a5dd5ac5ad9d7f232032b25facc82ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-multibyte-l1-1-0.dll","sha256":"0aa2cf2cc029c95fc053374071d7873edddc410ff8858720ee5c29bfee62dddc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-stdio-l1-1-0.dll","sha256":"cf7bbe93ae75a1c46a38204a6acef71bf2f5e3cd34501825601900e07d3d7b15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-string-l1-1-0.dll","sha256":"b516d1772b75714f039440cf5d070b87a187d2f67b7f891c94cf1c60330fbfa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"api-ms-win-crt-utility-l1-1-0.dll","sha256":"d675ee0c418c4cd7ff0c19c2d945331c8e6072a51abbca548e7d9d2f1bf288dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"natives_blob.bin","sha256":"63ca83faf83e5c47f9ea5915961aeb171b740fe4d4d10c18581c867567fc2e99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"node.dll","sha256":"00093888200e880d39f523498a0fa00b0dce7621432242500c80ab38d4714901","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"elevate.exe","sha256":"9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"snapshot_blob.bin","sha256":"b874a3601d7d2422a2a95e4894f079e124c128baee92021ca087016b1977c53d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"name":"ucrtbase.dll","sha256":"4c5b8e529854cedfa8f46cd6906952400cdbbf25efc4cf37dda2c42d8e96ddcb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]}],"files_written":[{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"C:\\0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98.exe","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app-64.7z","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\locales","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\natives_blob.bin","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\resources\\electron.asar","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\resources","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\update.exe","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\resources\\app\\package.json","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\resources\\app\\package.json.js","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\resources\\app\\package.json.json","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\resources\\app\\package.json.node","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\resources\\app.asar","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\content_shell.pak","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\pdf_viewer_resources.pak","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\blink_image_resources_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\content_resources_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\ui_resources_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%TEMP%\\nsj92E0.tmp\\app\\views_resources_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%WINDIR%\\System32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%APPDATA%\\instagram-checker","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%APPDATA%\\instagram-checker\\DevTools Extensions","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%APPDATA%\\instagram-checker\\Preferences","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%APPDATA%\\instagram-checker\\File System\\primary.origin","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"5a7bfbee7ca3e17052767e93"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a7bfbee7ca3e17052767e93"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample 0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98 | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis and detection results for sample 0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98. View antivirus detections, behavioral indicators, and sandbox reports on Hybrid Analysis."}],["$","meta","2",{"name":"robots","content":"noindex, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98"}],["$","meta","4",{"property":"og:title","content":"Sample 0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98 | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis and detection results for sample 0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98. View antivirus detections, behavioral indicators, and sandbox reports on Hybrid Analysis."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98 | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis and detection results for sample 0dd0878185ad74a7485ade23ca940a44e5c19815974fbaa6c6af9fd393b3ad98. View antivirus detections, behavioral indicators, and sandbox reports on Hybrid Analysis."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]