34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3a:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64.Expiro.Generic Sample 6bc863bc92bf… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6bc863bc92bf…. Malware family: Win64.Expiro.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 2 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6bc863bc92bfa5ff0eeec2a903dca80b2673cc4ce3650f85f26038e5e4e3c8b0","keywords":["Malicious","Win64.Expiro.Generic","malware analysis","sandbox report","threat intelligence","6bc863bc92bfa5ff0eeec2a903dca80b2673cc4ce3650f85f26038e5e4e3c8b0"],"about":{"@type":"SoftwareApplication","name":"SystemInformer.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"6bc863bc92bfa5ff0eeec2a903dca80b2673cc4ce3650f85f26038e5e4e3c8b0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64.Expiro.Generic","antivirusDetections":{"malicious":15,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T4b0,Found reference to API (Indicator: "NtWriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "NtWaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegReplaceKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegRestoreKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetKeySecurity"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegFlushKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegSaveKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKey"; Source: "sample.bin"), Found reference to API (Indicator: "NtReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "RegLoadKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKey"; Source: "sample.bin"), Found reference to API (Indicator: "NtWaitForMultipleObjects"; Source: "sample.bin")37:T48d,"Software\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: sample.bin, "System\CurrentControlSet\Enum\" in Source: sample.bin, "Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: sample.bin, "System\CurrentControlSet\Control\Session Manager\Environment" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" in Source: sample.bin, "Software\Microsoft\Wbem\Scripting" in Source: sample.bin, "Software\Microsoft\Windows Kits\Installed Roots" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Applets\Regedit" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\SilentProcessExit" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\HostComputeService\VolatileStore\ComputeSystem" in Source: sample.bin, "System\CurrentControlSet\Services\Tcpip\Parameters" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin38:T44c,"Thanks to: wj32 - Wen Jia Liu dmex - Steven G jxy-s - Johnny Shaw ionescu007 - Alex Ionescu yardenshafir - Yarden Shafir Contributors - thank you for your additions! Donors - thank you for your support! System Informer uses the following components: PresentMon by Intel Corporation Mini-XML by Michael Sweet PCRE2 by Philip Hazel json-c by Michael Clark MD5 code by Jouni Malinen SHA1 code by Filip Navara, based on code by Steve Reid " (Indicator: "github.com"), " (