26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Windows_Hacktool_SystemInformer Sample 7a57a1e7d2c4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7a57a1e7d2c4…. Malware family: Windows_Hacktool_SystemInformer. Threat score 100/100. 12/25 AV engines flagged this file. 2 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7a57a1e7d2c423150a496bd46c0eea65c434204d5a3e1e84baec764188e698f7","keywords":["Malicious","Windows_Hacktool_SystemInformer","malware analysis","sandbox report","threat intelligence","7a57a1e7d2c423150a496bd46c0eea65c434204d5a3e1e84baec764188e698f7"],"about":{"@type":"SoftwareApplication","name":"SystemInformer.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"7a57a1e7d2c423150a496bd46c0eea65c434204d5a3e1e84baec764188e698f7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Windows_Hacktool_SystemInformer","antivirusDetections":{"malicious":12,"total":25},"behavioralIndicators":{"malicious":2,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4b0,Found reference to API (Indicator: "NtWriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "NtWaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegReplaceKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegRestoreKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetKeySecurity"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegFlushKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegSaveKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKey"; Source: "sample.bin"), Found reference to API (Indicator: "NtReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "RegLoadKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKey"; Source: "sample.bin"), Found reference to API (Indicator: "NtWaitForMultipleObjects"; Source: "sample.bin")28:T48d,"Software\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: sample.bin, "System\CurrentControlSet\Enum\" in Source: sample.bin, "Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: sample.bin, "System\CurrentControlSet\Control\Session Manager\Environment" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" in Source: sample.bin, "Software\Microsoft\Wbem\Scripting" in Source: sample.bin, "Software\Microsoft\Windows Kits\Installed Roots" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Applets\Regedit" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\SilentProcessExit" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\HostComputeService\VolatileStore\ComputeSystem" in Source: sample.bin, "System\CurrentControlSet\Services\Tcpip\Parameters" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin29:T44c,"Thanks to: wj32 - Wen Jia Liu dmex - Steven G jxy-s - Johnny Shaw ionescu007 - Alex Ionescu yardenshafir - Yarden Shafir Contributors - thank you for your additions! Donors - thank you for your support! System Informer uses the following components: PresentMon by Intel Corporation Mini-XML by Michael Sweet PCRE2 by Philip Hazel json-c by Michael Clark MD5 code by Jouni Malinen SHA1 code by Filip Navara, based on code by Steve Reid " (Indicator: "github.com"), " (