26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64.Expiro.Generic Sample 51c69f0b7468… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 51c69f0b7468…. Malware family: Win64.Expiro.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 2 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/51c69f0b74683c6806df7e0206e1d293932721a36b200c900e5f1977e5051116","keywords":["Malicious","Win64.Expiro.Generic","malware analysis","sandbox report","threat intelligence","51c69f0b74683c6806df7e0206e1d293932721a36b200c900e5f1977e5051116"],"about":{"@type":"SoftwareApplication","name":"SystemInformer.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"51c69f0b74683c6806df7e0206e1d293932721a36b200c900e5f1977e5051116","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64.Expiro.Generic","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4b0,Found reference to API (Indicator: "NtWriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "NtWaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegReplaceKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegRestoreKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetKeySecurity"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegFlushKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegSaveKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKey"; Source: "sample.bin"), Found reference to API (Indicator: "NtReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "RegLoadKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKey"; Source: "sample.bin"), Found reference to API (Indicator: "NtWaitForMultipleObjects"; Source: "sample.bin")28:T48d,"Software\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: sample.bin, "System\CurrentControlSet\Enum\" in Source: sample.bin, "Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: sample.bin, "System\CurrentControlSet\Control\Session Manager\Environment" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" in Source: sample.bin, "Software\Microsoft\Wbem\Scripting" in Source: sample.bin, "Software\Microsoft\Windows Kits\Installed Roots" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Applets\Regedit" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\SilentProcessExit" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\HostComputeService\VolatileStore\ComputeSystem" in Source: sample.bin, "System\CurrentControlSet\Services\Tcpip\Parameters" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin29:T44c,"Thanks to: wj32 - Wen Jia Liu dmex - Steven G jxy-s - Johnny Shaw ionescu007 - Alex Ionescu yardenshafir - Yarden Shafir Contributors - thank you for your additions! Donors - thank you for your support! System Informer uses the following components: PresentMon by Intel Corporation Mini-XML by Michael Sweet PCRE2 by Philip Hazel json-c by Michael Clark MD5 code by Jouni Malinen SHA1 code by Filip Navara, based on code by Steve Reid " (Indicator: "github.com"), " (