24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 40:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample dedd0a1960e9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample dedd0a1960e9…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 1/25 AV engines flagged this file. 0 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/dedd0a1960e9f1c9a0614a4213c4a27bb33577b400eafd9fdd80632ac906215b","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","dedd0a1960e9f1c9a0614a4213c4a27bb33577b400eafd9fdd80632ac906215b"],"about":{"@type":"SoftwareApplication","name":"MiPony.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"dedd0a1960e9f1c9a0614a4213c4a27bb33577b400eafd9fdd80632ac906215b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":1,"total":25},"behavioralIndicators":{"malicious":0,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T86c,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SystemDefaultCharSize" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAuto" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "Mipony.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Mipony.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "Mipony.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteByte" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalUni" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetExceptionForHR" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "DestroyStructure" in "Mipony.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt64" in "Mipony.exe"26:T49e,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform AES encryption (Dotnet String) Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform AES cryptographic operations (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: Contains ability to perform asymmetric crypto operations27:T2f14,Found XOR loop in file "sample.bin" at offset 1682374; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1809093; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1849675; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1881782; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4046855; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4157858; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4162497; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4168178; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4204882; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4229504; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4286302; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4363730; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4467569; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4537516; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5104087; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5238732; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5450270; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5503748; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5619854; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5905609; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5953136; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6216418; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6257660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6340356; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6500161; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6591788; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6675089; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6682578; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6792163; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6797811; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7199604; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7352991; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7354377; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7354467; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7355889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7356861; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7357563; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 291504; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 804176; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 893494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1720153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1834374; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1902448; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4007780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4035408; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4045948; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4075204; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4191507; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4193899; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4249440; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4344509; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4440190; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4460735; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4742383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4753873; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5020438; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5083180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5138877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5270794; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5437474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5731136; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5744508; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5943701; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6045618; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6051920; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6166655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6508688; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6521514; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6535372; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6597373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6604413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6717812; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6729930; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 32615; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229297; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 449485; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 874654; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1666894; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1745563; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1843570; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1877905; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1993418; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2111281; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2251189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2391281; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2531189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2671097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2826661; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2966569; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3109237; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3249329; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3389440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4019493; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4087837; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4108384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4164069; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4165185; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4170062; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188726; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189598; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4296762; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4303344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4332982; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4445163; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4472208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4473439; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4515455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4542350; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4547913; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4612324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4716280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4741036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4757763; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4763847; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4861162; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5048990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5142010; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5142442; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5146084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5237277; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5306278; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5349747; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5448694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5622543; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5681422; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5727917; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6018140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6048147; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6101878; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6161247; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6249804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6319990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6320753; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6322149; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6337564; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6426089; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6428345; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6431335; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6431388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6469336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6484677; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6506326; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6519127; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6554362; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6584570; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6703480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6720460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6745020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6813451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7078283; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7079833; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7081323; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7085733; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7098683; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7100783; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7104033; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7106823; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7268158; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7354772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7541672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7579446; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7582638; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8543734; code bytes = 803028:T466,Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "add_DownloadDataCompleted" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadDataAsync" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "remove_DownloadDataCompleted" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "add_DownloadStringCompleted" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadStringAsync" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "remove_DownloadStringCompleted" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "add_DownloadFileCompleted" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFileAsync" in "Mipony.exe"29:T5fc,"SOFTWARE\Wow6432Node\VideoLAN\VLC" in Source: Mipony.exe "SOFTWARE\VideoLAN\VLC" in Source: Mipony.exe "Software\Classes" in Source: Mipony.exe "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: Mipony.exe "SOFTWARE\Microsoft\Internet Explorer\MenuExt\" in Source: Mipony.exe "SOFTWARE\\Wow6432Node\\VideoLAN\\VLC" in Source: 60018ab-EmitterDecryptor~CompileConnectedDefinition "SOFTWARE\\VideoLAN\\VLC" in Source: 60018ab-EmitterDecryptor~CompileConnectedDefinition "SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_BROWSER_EMULATION" in Source: 60018ad-EmitterDecryptor~CombineMapper "SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl" in Source: 60018ad-EmitterDecryptor~CombineMapper "Software\\Classes" in Source: 60026ca-TransactionConfigurationExecutor~ProcessPortableField "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.torrent" in Source: 60026cb-TransactionConfigurationExecutor~ManageOrderedAnnotation "Software\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 60026d4-TransactionConfigurationExecutor~SolveStruct "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\." in Source: 60026d9-TransactionConfigurationExecutor~ProcessLogicalPool "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" in Source: 6002a96-RemoteDecryptorEmitter~EmitDividedTag "SOFTWARE\\Microsoft\\Internet Explorer\\MenuExt\\" in Source: 6003032-DictionaryServer~MapIntegratedConsumer2a:T43b,Observed unmanaged function "SendMessage" in "Mipony.exe" Observed unmanaged function "FindWindowEx" in "Mipony.exe" Observed unmanaged function "SetWindowText" in "Mipony.exe" Observed unmanaged function "SHBrowseForFolder" in "Mipony.exe" Observed unmanaged function "SHGetMalloc" in "Mipony.exe" Observed unmanaged function "SHGetPathFromIDList" in "Mipony.exe" Observed unmanaged function "SHGetSpecialFolderLocation" in "Mipony.exe" Observed unmanaged function "DeleteObject" in "Mipony.exe" Observed unmanaged function "StrongNameSignatureVerificationEx" in "Mipony.exe" Observed unmanaged function "RAROpenArchive" in "Mipony.exe" Observed unmanaged function "RAROpenArchiveEx" in "Mipony.exe" Observed unmanaged function "RARCloseArchive" in "Mipony.exe" Observed unmanaged function "RARReadHeader" in "Mipony.exe" Observed unmanaged function "RARReadHeaderEx" in "Mipony.exe" Observed unmanaged function "RARProcessFile" in "Mipony.exe" Observed unmanaged function "RARSetCallback" in "Mipony.exe" Observed unmanaged function "RARSetPassword" in "Mipony.exe"2b:T708,Found string "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0" (Indicator: "mozilla/5.0 ("; File: "Mipony.exe") Found string "Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6" (Indicator: "mozilla/5.0 ("; File: "Mipony.exe") Found string "{"U":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Safari/605.1.15","L":"en-US","Z":"GMT-05:00","V":"1.1","F":""}" (Indicator: "mozilla/5.0 ("; File: "Mipony.exe") Found string "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0" (Indicator: "mozilla/5.0 ("; File: "Mipony.exe") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36" (Indicator: "mozilla/5.0 ("; File: "Mipony.exe") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36" (Indicator: "mozilla/5.0 ("; File: "Mipony.exe") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36 Edg/84.0.522.59" (Indicator: "mozilla/5.0 ("; File: "Mipony.exe") Found string "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Safari/605.1.15" (Indicator: "mozilla/5.0 ("; File: "Mipony.exe") Found string "{\"U\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Safari/605.1.15\",\"L\":\"en-US\",\"Z\":\"GMT-05:00\",\"V\":\"1.1\",\"F\":\"\"}" (Indicator: "mozilla/5.0 ("; File: "Mipony.exe") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)" (Indicator: "mozilla/5.0 ("; File: "Mipony.exe")2c:T487,"Mipony.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2d:T547,"Mipony.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Mipony.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Mipony.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Mipony.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Mipony.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Mipony.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Mipony.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Mipony.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "Mipony.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "Mipony.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "Mipony.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "Mipony.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "")2e:T944,"Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "MIPONY"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "Mipony.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "")2f:T927,"Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "Mipony.exe" trying to access non-existent file "C:\GALASOFT.MVVMLIGHT.DLL" "Mipony.exe" trying to access non-existent file "C:\GalaSoft.MvvmLight.dll" "Mipony.exe" trying to access non-existent file "C:\GALASOFT.MVVMLIGHT.EXE" "Mipony.exe" trying to access non-existent file "C:\GalaSoft.MvvmLight.exe" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\MSCORRC.DLL" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\MSCORRC.DLL.DLL" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll.DLL" "Mipony.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Mipony.exe" trying to access non-existent file "C:\CRYPTSP.dll" "Mipony.exe" trying to access non-existent file "C:\BCRYPT.DLL" "Mipony.exe" trying to access non-existent file "C:\bcrypt.dll"30:T471,"Mipony.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "Mipony.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "Mipony.exe" trying to access non-existent file "C:\MIPONY.EXE.CONFIG" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "Mipony.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "Mipony.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MIPONY.EXE.LOG" "Mipony.exe" trying to access non-existent file "C:\Mipony.exe.config" "Mipony.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\MIPONY" "Mipony.exe" trying to access non-existent file "C:\MIPONY.INI" "Mipony.exe" trying to access non-existent file "C:\Mipony.INI" "Mipony.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "Mipony.exe" trying to access non-existent file "C:\MIPONY.PDB" "Mipony.exe" trying to access non-existent file "C:\Mipony.PDB"31:T999,Observed Namespace "System.Net.Sockets.TcpListener" and MemberReference ".ctor" in "Mipony.exe" Observed Namespace "System.Net.Sockets.TcpListener" and MemberReference "Start" in "Mipony.exe" Observed Namespace "System.Net.Sockets.TcpListener" and MemberReference "BeginAcceptTcpClient" in "Mipony.exe" Observed Namespace "System.Net.Sockets.TcpListener" and MemberReference "EndAcceptTcpClient" in "Mipony.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "Close" in "Mipony.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_RemoteEndPoint" in "Mipony.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "GetStream" in "Mipony.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Connected" in "Mipony.exe" Observed Namespace "System.Net.Sockets.TcpListener" and MemberReference "Stop" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Available" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Poll" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_LocalEndPoint" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Receive" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "SetSocketOption" in "Mipony.exe" Observed Namespace "System.Net.Sockets.NetworkStream" and MemberReference ".ctor" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Bind" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Listen" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Accept" in "Mipony.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginAccept" in "Mipony.exe"32:T823,Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "get_Headers" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "set_Encoding" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "UploadString" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "Mipony.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_KeepAlive" in "Mipony.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ReadWriteTimeout" in "Mipony.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AllowWriteStreamBuffering" in "Mipony.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "set_Credentials" in "Mipony.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_Accept" in "Mipony.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_SendChunked" in "Mipony.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_CookieContainer" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "GetWebRequest" in "Mipony.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "get_ServicePoint" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "get_ResponseHeaders" in "Mipony.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AllowAutoRedirect" in "Mipony.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "get_CookieContainer" in "Mipony.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_Expect" in "Mipony.exe" Observed Namespace "System.Net.WebClient" and MemberReference "UploadData" in "Mipony.exe"33:T621,Observed Namespace "System.Net.Mail.MailMessage" and MemberReference ".ctor" in "Mipony.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference ".ctor" in "Mipony.exe" Observed Namespace "System.Net.Mail.MailAddress" and MemberReference ".ctor" in "Mipony.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_From" in "Mipony.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "get_To" in "Mipony.exe" Observed Namespace "System.Net.Mail.MailAddressCollection" and MemberReference "Add" in "Mipony.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_Subject" in "Mipony.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_IsBodyHtml" in "Mipony.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_Body" in "Mipony.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_Port" in "Mipony.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_Credentials" in "Mipony.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_EnableSsl" in "Mipony.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "Send" in "Mipony.exe" Observed Namespace "System.Net.Mail.Attachment" and MemberReference ".ctor" in "Mipony.exe" Observed Namespace "System.Net.Mail.AttachmentBase" and MemberReference "set_ContentType" in "Mipony.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "get_Attachments" in "Mipony.exe"34:T785,Observed Namespace "System.Net.HttpListener" and MemberReference ".ctor" in "Mipony.exe" Observed Namespace "System.Net.HttpListener" and MemberReference "get_Prefixes" in "Mipony.exe" Observed Namespace "System.Net.HttpListenerPrefixCollection" and MemberReference "Add" in "Mipony.exe" Observed Namespace "System.Net.HttpListener" and MemberReference "Start" in "Mipony.exe" Observed Namespace "System.Net.HttpListener" and MemberReference "BeginGetContext" in "Mipony.exe" Observed Namespace "System.Net.HttpListener" and MemberReference "get_IsListening" in "Mipony.exe" Observed Namespace "System.Net.HttpListener" and MemberReference "EndGetContext" in "Mipony.exe" Observed Namespace "System.Net.HttpListenerContext" and MemberReference "get_Request" in "Mipony.exe" Observed Namespace "System.Net.HttpListenerRequest" and MemberReference "get_Url" in "Mipony.exe" Observed Namespace "System.Net.HttpListenerRequest" and MemberReference "get_Headers" in "Mipony.exe" Observed Namespace "System.Net.HttpListenerContext" and MemberReference "get_Response" in "Mipony.exe" Observed Namespace "System.Net.HttpListenerResponse" and MemberReference "get_OutputStream" in "Mipony.exe" Observed Namespace "System.Net.HttpListenerResponse" and MemberReference "set_ProtocolVersion" in "Mipony.exe" Observed Namespace "System.Net.HttpListenerResponse" and MemberReference "set_StatusCode" in "Mipony.exe" Observed Namespace "System.Net.HttpListenerResponse" and MemberReference "set_ContentLength64" in "Mipony.exe" Observed Namespace "System.Net.HttpListenerResponse" and MemberReference "get_Headers" in "Mipony.exe" Observed Namespace "System.Net.HttpListenerResponse" and MemberReference "set_ContentType" in "Mipony.exe" Observed Namespace "System.Net.HttpListenerResponse" and MemberReference "Close" in "Mipony.exe" Observed Namespace "System.Net.HttpListener" and MemberReference "Stop" in "Mipony.exe"35:T8fa,Found string "api.pcloud.com" (Indicator: "api.pcloud.com"; File: "Mipony.exe") Found string "https://www.googleapis.com/drive/v2/files/" (Indicator: ".googleapis.com"; File: "Mipony.exe") Found string "https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile" (Indicator: ".googleapis.com"; File: "Mipony.exe") Found string "https://www.googleapis.com/drive/v" (Indicator: ".googleapis.com"; File: "Mipony.exe") Found string "https://www.googleapis.com/upload/drive/v2/files?uploadType=resumable&supportsAllDrives=true" (Indicator: ".googleapis.com"; File: "Mipony.exe") Found string "https://www.googleapis.com/upload/drive/v2/files/" (Indicator: ".googleapis.com"; File: "Mipony.exe") Found string "https://oauth2.googleapis.com/token" (Indicator: ".googleapis.com"; File: "Mipony.exe") Found string "https://www.googleapis.com/auth/drive" (Indicator: ".googleapis.com"; File: "Mipony.exe") Found string "https://content.dropboxapi.com/2/files/upload_session/append_v2" (Indicator: "content.dropboxapi.com"; File: "Mipony.exe") Found string "https://content.dropboxapi.com/2/files/upload_session/finish" (Indicator: "content.dropboxapi.com"; File: "Mipony.exe") Found string "https://content.dropboxapi.com/2/files/upload" (Indicator: "content.dropboxapi.com"; File: "Mipony.exe") Found string "https://www.googleapis.comhttps:" (Indicator: ".googleapis.com"; File: "Mipony.exe") Found string "https://www.googleapis.com" (Indicator: ".googleapis.com"; File: "Mipony.exe") Found string "https://content.dropboxapi.com/2/files/download" (Indicator: "content.dropboxapi.com"; File: "Mipony.exe") Found string "https://content.dropboxapi.com/2/files/export" (Indicator: "content.dropboxapi.com"; File: "Mipony.exe") Found string "https://content.dropboxapi.com/2/files/get_thumbnail" (Indicator: "content.dropboxapi.com"; File: "Mipony.exe") Found string "https://api.dropboxapi.com/oauth2/token" (Indicator: "api.dropboxapi.com"; File: "Mipony.exe") Found string "https://api.dropboxapi.com/2/users/get_space_usage" (Indicator: "api.dropboxapi.com"; File: "Mipony.exe") Found string "https://content.dropboxapi.com/2/files/upload_session/start" (Indicator: "content.dropboxapi.com"; File: "Mipony.exe")36:T73a,Observed email domain:"https://cloud.mail.ru" [Source: Mipony.exe] Observed email domain:"https://cloud.mail.ru/public/" [Source: Mipony.exe] Observed email domain:"https://cloud.mail.ru/home" [Source: Mipony.exe] Observed email domain:"cloud.mail.ru" [Source: Mipony.exe] Observed email domain:"web control panel. select 'full access to mail, cloud, calendar (all protocols)'. you can generate the password in this url https://id.mail.ru/security" [Source: Mipony.exe] Observed email domain:"https://o2.mail.ru/token" [Source: Mipony.exe] Observed email domain:"https://dispatcher.cloud.mail.ru/u" [Source: Mipony.exe] Observed email domain:"https://storage-file-us.mail.com" [Source: 600013c-ctor] Observed email domain:".ase.art.bmp.blp.cd5.cit.cpt.cr2.cut.dds.dib.djvu.egt.exif.gif.gpl.grf.icns.ico.iff.jng.jpeg.jpg.jfif.jp2.jps.lbm.max.miff.mng.msp.nitf.ota.pbm.pc1.pc2.pc3.pcf.pcx.pdn.pgm.pi1.pi2.pi3.pict.pct.pnm.pns.ppm.psb.psd.pdd.psp.px.pxm.pxr.qfx.raw.rle.sct.sgi.rgb.int.bw.tga.tiff.tif.vtf.xbm.xcf.xpm.3dv.amf.ai.awg.cgm.cdr.cmx.dxf.e2d.egt.eps.fs.gbr.odg.svg.stl.vrml.x3d.sxd.v2d.vnd.wmf.emf.art.xar.png.webp.jxr.hdp.wdp.cur.ecw.iff.lbm.liff.nrrd.pam.pcx.pgf.sgi.rgb.rgba.bw.int.inta.sid.ras.sun.tga." [Source: 60002d6-DividedDictionary~FindEfficientThread] Observed email domain:".ase.art.bmp.blp.cd5.cit.cpt.cr2.cut.dds.dib.djvu.egt.exif.gif.gpl.grf.icns.ico.iff.jng.jpeg.jpg.jfif.jp2.jps.lbm.max.miff.mng.msp.nitf.ota.pbm.pc1.pc2.pc3.pcf.pcx.pdn.pgm.pi1.pi2.pi3.pict.pct.pnm.pns.ppm.psb.psd.pdd.psp.px.pxm.pxr.qfx.raw.rle.sct.sgi.rgb.int.bw.tga.tiff.tif.vtf.xbm.xcf.xpm.3dv.amf.ai.awg.cgm.cdr.cmx.dxf.e2d.egt.eps.fs.gbr.odg.svg.stl.vrml.x3d.sxd.v2d.vnd.wmf.emf.art.xar.png.webp.jxr.hdp.wdp.cur.ecw.iff.lbm.liff.nrrd.pam.pcx.pgf.sgi.rgb.rgba.bw.int.inta.sid.ras.sun.tga" [Source: 60020c1-FilterAttribute~EmitSequentialModule]37:T51fc,Pattern match: "www.inkscape.org" Pattern match: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=8c83506a-e72d-4ca4-bfde-bb7de1e08463&scope=" Pattern match: "http://127.0.0.1:3321" Pattern match: "https://login.microsoftonline.com/common/oauth2/v2.0/token" Pattern match: "https://graph.microsoft.com/v1.0/me/sendmail" Pattern match: "https://oauth.yandex.com/token" Pattern match: "https://oauth.yandex.com/authorize?scope=" Pattern match: "https://cloud-api.yandex.net/v1/disk/" Pattern match: "https://cloud-api.yandex.net/v1" Pattern match: "http://127.0.0.1:3021" Pattern match: "http://webdav.org/cadaver/custom-properties/" Pattern match: "http://nextcloud.org/ns" Pattern match: "http://owncloud.org/ns" Pattern match: "remote.php/dav/files/" Pattern match: "remote.php/dav/trashbin/" Heuristic match: ".terabox.com" Pattern match: "https://www.terabox.com/" Pattern match: "https://user.mypikpak.com" Pattern match: "https://api-drive.mypikpak.com" Heuristic match: "mypikpak.com" Heuristic match: "api.pcloud.com" Pattern match: "https://my.pcloud.com/oauth2/authorize?client_id=" Pattern match: "https://login.live.com/oauth20_token.srf" Pattern match: "https://api.onedrive.com/v1.0" Pattern match: "https://graph.microsoft.com/v1.0/me" Pattern match: "http://www.airexplorer.net/thanks/" Pattern match: "https://login.microsoftonline.com/common/oauth2/nativeclient" Pattern match: "http://localhost:4699/" Pattern match: "https://graph.microsoft.com/v1.0" Pattern match: "https://api.office.com/discovery/v2.0/me/services" Pattern match: "https://api.office.com/discovery/" Pattern match: "https://login.chinacloudapi.cn" Pattern match: "https://microsoftgraph.chinacloudapi.cn" Pattern match: "https://files.cloud.naver.com/getregisteruserinfo.ndrive?userid=" Pattern match: "http://ndrive2.naver.com" Heuristic match: "cloud.naver.com" Heuristic match: "thumb1.photo.cloud.naver.com" Pattern match: "https://thumb1.photo.cloud.naver.com/" Pattern match: "https://cloud.naver.com/" Pattern match: "http://mega.nz/" Pattern match: "https://mega.nz/file/" Pattern match: "https://mega.nz/folder/" Pattern match: "https://g.api.mega.co.nz/cs?id=" Pattern match: "https://www.mediafire.com/api/1.2/user/get_session_token.php?email=" Pattern match: "https://www.mediafire.com/api/user/get_info.php" Pattern match: "http://www.mediafire.com/api/1.1/folder/search.php" Pattern match: "https://www.mediafire.com/api/1.1/upload/instant.php" Pattern match: "https://www.mediafire.com/api/1.1/upload/poll_upload.php" Pattern match: "https://www.mediafire.com/api/1.5/upload/check.php" Pattern match: "http://www.mediafire.com/api/1.5/file/create.php" Pattern match: "https://www.mediafire.com/api/1.5/upload/poll_upload.php" Pattern match: "https://cloud.mail.ru" Pattern match: "https://cloud.mail.ru/public/" Pattern match: "https://cloud.mail.ru/home" Heuristic match: "cloud.mail.ru" Heuristic match: "@mail.ru" Heuristic match: "mail.ru" Pattern match: "https://id.mail.ru/security" Pattern match: "https://o2.mail.ru/token" Pattern match: "https://dispatcher.cloud.mail.ru/u" Pattern match: "http://127.0.0.1" Pattern match: "https://app.koofr.net" Pattern match: "https://api.infomaniak.com" Pattern match: "https://api.infomaniak.com/2/drive/" Pattern match: "https://kdrive.infomaniak.com/app/drive/" Pattern match: "https://id.jottacloud.com/auth/realms/jottacloud/protocol/openid-connect/token" Pattern match: "https://jfs.jottacloud.com/jfs/" Pattern match: "https://up.jottacloud.com/jfs" Pattern match: "https://cloud.onlime.dk/web/secure" Pattern match: "https://cloud.onlime.dk" Pattern match: "https://www.icloud.com/" Pattern match: "https://setup.icloud.com/setup/ws/1/storageusageinfo" Pattern match: "https://idmsa.apple.com/appleauth/auth/federate?isremembermeenabled=true" Pattern match: "https://idmsa.apple.com/appleauth/auth/signin/init" Pattern match: "https://idmsa.apple.com/appleauth/auth/verify/trusteddevice/securitycode" Pattern match: "https://idmsa.apple.com/appleauth/auth" Pattern match: "https://idmsa.apple.com/appleauth/auth/verify/phone" Pattern match: "https://driveapis.cloud.huawei.com.cn" Pattern match: "https://oauth-login.cloud.huawei.com/oauth2/v3/token" Pattern match: "https://oauth-login.cloud.huawei.com/oauth2/v3/authorize?client_id=" Pattern match: "https://api.hidrive.strato.com/2.1/file?pid=" Pattern match: "https://api.hidrive.strato.com/2.1/file?dir_id=" Pattern match: "https://api.hidrive.strato.com/2.1/file/?pid=" Pattern match: "https://api.hidrive.strato.com/2.1/file/thumbnail?width=300&height=300&pid=" Pattern match: "https://api.hidrive.strato.com/2.1/file/url?pid=" Pattern match: "https://api.hidrive.strato.com/2.1/sharelink" Pattern match: "https://api.hidrive.strato.com/2.1/sharelink?id=" Pattern match: "https://www.hidrive.strato.com/oauth2/authorize?scope=admin,rw&client_id=" Pattern match: "https://www.googleapis.com/drive/v2/files/" Pattern match: "https://www.googleapis.com/auth/drive" Pattern match: "https://accounts.google.com/o/oauth2/token" Pattern match: "https://accounts.google.com/o/oauth2/auth?client_id=" Pattern match: "https://www.googleapis.com/drive/v" Pattern match: "https://www.googleapis.com/upload/drive/v2/files?uploadtype=resumable&supportsalldrives=true" Pattern match: "https://www.googleapis.com/upload/drive/v2/files/" Pattern match: "https://oauth2.googleapis.com/token" Pattern match: "https://api.dropbox.com/2/" Pattern match: "https://content.dropboxapi.com/2/files/upload_session/append_v2" Pattern match: "https://content.dropboxapi.com/2/files/upload_session/finish" Pattern match: "https://content.dropboxapi.com/2/files/upload" Pattern match: "https://app.drime.cloud/account-settings#developers" Pattern match: "https://api.directcloud.jp/openapi/" Pattern match: "https://api.directcloud.jp/openapp/" Pattern match: "https://app.digiboxx.com/share/" Pattern match: "https://degoo.com/me/login" Pattern match: "https://production-appsync.degoo.com/graphql" Pattern match: "https://rest-api.degoo.com/access-token/v2" Pattern match: "https://api.box.com/2.0/files/" Pattern match: "https://api.box.com/oauth2/token" Pattern match: "https://api.box.com/2.0/metadata_templates/enterprise?limit=1000" Pattern match: "https://api.box.com/2.0/groups?limit=1000&filter_term=" Pattern match: "https://api.box.com/2.0/users/" Pattern match: "https://api.box.com/2.0/collaborations" Pattern match: "https://api.box.com/2.0/collaborations/" Pattern match: "http://127.0.0.1:30831/" Pattern match: "https://pcs.baidu.com/rest/2.0/pcs/file?method=download&path=" Pattern match: "https://pcs.baidu.com/rest/2.0/pcs/file" Pattern match: "https://pcs.baidu.com/rest/2.0/pcs/file?method=meta&access_token=" Pattern match: "https://pcs.baidu.com/rest/2.0/pcs/quota?method=info&access_token=" Heuristic match: "oss-cn-hangzhou.aliyuncs.com" Heuristic match: "oss-cn-shanghai.aliyuncs.com" Heuristic match: "oss-cn-nanjing.aliyuncs.com" Heuristic match: "oss-cn-qingdao.aliyuncs.com" Heuristic match: "oss-cn-beijing.aliyuncs.com" Heuristic match: "oss-cn-zhangjiakou.aliyuncs.com" Heuristic match: "oss-cn-huhehaote.aliyuncs.com" Heuristic match: "oss-cn-wulanchabu.aliyuncs.com" Heuristic match: "oss-cn-shenzhen.aliyuncs.com" Heuristic match: "oss-cn-heyuan.aliyuncs.com" Heuristic match: "oss-cn-guangzhou.aliyuncs.com" Heuristic match: "oss-cn-chengdu.aliyuncs.com" Heuristic match: "oss-cn-hongkong.aliyuncs.com" Heuristic match: "oss-us-west-1.aliyuncs.com" Heuristic match: "oss-us-east-1.aliyuncs.com" Heuristic match: "oss-ap-northeast-1.aliyuncs.com" Heuristic match: "oss-ap-northeast-2.aliyuncs.com" Heuristic match: "oss-ap-southeast-1.aliyuncs.com" Heuristic match: "oss-ap-southeast-2.aliyuncs.com" Heuristic match: "oss-ap-southeast-3.aliyuncs.com" Heuristic match: "oss-ap-southeast-5.aliyuncs.com" Heuristic match: "oss-ap-southeast-6.aliyuncs.com" Heuristic match: "oss-ap-southeast-7.aliyuncs.com" Heuristic match: "oss-ap-south-1.aliyuncs.com" Heuristic match: "oss-eu-central-1.aliyuncs.com" Heuristic match: "oss-eu-west-1.aliyuncs.com" Heuristic match: "oss-me-east-1.aliyuncs.com" Heuristic match: ".aliyuncs.com" Heuristic match: "digitaloceanspaces.com" Heuristic match: ".r2.cloudflarestorage.com" Heuristic match: "s3.synologyc2.net" Heuristic match: ".c2.synology.com" Heuristic match: "s3.us-east-1.wasabisys.com" Heuristic match: "s3.us-east-2.wasabisys.com" Heuristic match: "s3.eu-central-1.wasabisys.com" Heuristic match: "s3.us-central-1.wasabisys.com" Heuristic match: "s3.ca-central-1.wasabisys.com" Heuristic match: "s3.eu-central-2.wasabisys.com" Heuristic match: "s3.us-west-1.wasabisys.com" Heuristic match: "s3.eu-west-1.wasabisys.com" Heuristic match: "s3.eu-west-2.wasabisys.com" Heuristic match: "s3.ap-northeast-1.wasabisys.com" Heuristic match: "s3.ap-northeast-2.wasabisys.com" Heuristic match: "s3.ap-southeast-1.wasabisys.com" Heuristic match: "s3.ap-southeast-2.wasabisys.com" Pattern match: "https://www.aliyundrive.com/" Pattern match: "https://www.aliyundrive.com/sign/in" Pattern match: "https://aliyundrive.com" Pattern match: "https://aliyundrive.com/" Pattern match: "http://127.0.0.1:9666" Pattern match: "http://www" Heuristic match: "userstorage.mega.co.nz" Heuristic match: "filenium.com" Pattern match: "https://www.mipony.net/checkversion5/?v=" Pattern match: "https://www.mipony.net/storewin/activate.php" Pattern match: "https://www.mipony.net/storewin/checklic.php" Pattern match: "https://www.mipony.net/bugreport/sendbug.php" Pattern match: "https://www.airexplorer.net/checkversion/getmorespace.php?cloud=" Heuristic match: "degoo.com" Pattern match: "http://static.dfiles.eu/images/favicon.ico" Heuristic match: "shareflare.net" Heuristic match: "filesmonster.com" Pattern match: "https://www.mipony.net/banners-version3/getbanner.php?zona=zona728x90" Heuristic match: "activation code is invalid, please check it or contact contact@mipony.net" Pattern match: "http://www.mipony.net/manualcaptcha.php" Pattern match: "https://www.google.com/recaptcha/api.js" Pattern match: "https://hcaptcha.com/1/api.js" Pattern match: "https://example.com/a.mkv" Pattern match: "https://example.com/folder" Pattern match: "www.mipony.net" Pattern match: "https://www.adrive.com/webdav.php" Heuristic match: ".dattodrive.com" Pattern match: "dattodrive.com/remote.php/webdav" Pattern match: "https://magentacloud.de/remote.php/webdav" Pattern match: "https://magentacloud.de/settings/user/security" Heuristic match: "mail.com" Pattern match: "https://storage-file-us.mail.com" Heuristic match: ".stackstorage.com" Pattern match: "stackstorage.com/remote.php/webdav" Pattern match: "http://webdav.org/cadaver/custom-properties/\" Pattern match: "https://api.teracloud.jp/v2/api/ba/user" Pattern match: "v2.php/apps/files_sharing/api/v1/shares" Pattern match: "index.php/core/preview.png?file=" Pattern match: "https://dav.jianguoyun.com/dav" Pattern match: "https://www.jianguoyun.com/d/account#safe" Pattern match: "http://nextcloud.org/ns\" Pattern match: "remote.php/dav/trash-bin/" Pattern match: "http://owncloud.org/ns\" Pattern match: "https://www.terabox.com/main" Heuristic match: "c-jp.terabox.com" Pattern match: "data.terabox.com/rest/2.0/pcs/file?method=locateupload" Pattern match: "http://127.0.0.1:35890/" Pattern match: "list.json/oauth/" Pattern match: "https://dev.opendrive.com/api/v1" Pattern match: "https://dev.opendrive.com/api/v1/oauth2/grant.json" Pattern match: "info.json/oauth" Pattern match: "file.json/oauth/" Pattern match: "trash.json/oauth" Pattern match: "trashlist.json/oauth" Pattern match: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=" Pattern match: "https://login.microsoftonline.com" Pattern match: "https://graph.microsoft.com" Pattern match: "https://files.cloud.naver.com/" Pattern match: "https://nid.naver.com/nidlogin.login" Heuristic match: "files.cloud.naver.com" Pattern match: "https://www.mediafire.com/api/1.1/file/update.php" Pattern match: "https://www.mediafire.com/api/1.1/file/delete.php" Pattern match: "https://www.mediafire.com/api/1.1/file/move.php" Pattern match: "https://www.mediafire.com/api/1.1/file/copy.php" Pattern match: "https://www.mediafire.com/api/1.1/file/get_info.php" Pattern match: "https://www.mediafire.com/" Pattern match: "https://www.mediafire.com/api/1.1/file/get_links.php" Pattern match: "https://www.mediafire.com/api/1.1/folder/get_info.php" Pattern match: "https://www.mediafire.com/api/1.1/folder/get_content.php" Pattern match: "https://www.mediafire.com/api/1.1/folder/update.php" Pattern match: "https://www.mediafire.com/api/1.1/folder/move.php" Pattern match: "https://www.mediafire.com/api/1.1/folder/create.php" Pattern match: "https://www.mediafire.com/api/1.1/folder/delete.php" Pattern match: "https://www.mediafire.com/api/1.1/folder/copy.php" Pattern match: "https://manager.infomaniak.com/v3/ng/accounts/token/list" Pattern match: "https://api.infomaniak.com/3/drive/" Pattern match: "https://api.jottacloud.com/" Pattern match: "https://www.jottacloud.com/web/secure" Pattern match: "https://www.jottacloud.com" Pattern match: "https://www.icloud.com" Pattern match: "https://idmsa.apple.com" Pattern match: "https://idmsa.apple.com/appleauth/auth/authorize/signin?frame_id=" Pattern match: "https://idmsa.apple.com/appleauth/auth/signin/complete?isremembermeenabled=true" Pattern match: "https://idmsa.apple.com/appleauth/auth/repair/complete" Pattern match: "https://idmsa.apple.com/appleauth/auth/verify/phone/securitycode" Pattern match: "https://idmsa.apple.com/appleauth/auth/2sv/trust" Pattern match: "https://setup.icloud.com/setup/ws/1/accountlogin" Pattern match: "https://setup.icloud.com/setup/ws/1/validate" Pattern match: "https://setup.icloud.com/setup/ws/1/requestpcs" Pattern match: "http://127.0.0.1:2134" Pattern match: "https://www.huawei.com/auth/drive" Pattern match: "https://api.hidrive.strato.com/2.1/meta?fields=ctime,has_dirs,mtime,readable,size,type,writable,image.exif&pid=" Pattern match: "https://api.hidrive.strato.com/2.1/file/rename" Pattern match: "https://api.hidrive.strato.com/2.1/meta" Pattern match: "https://api.hidrive.strato.com/2.1/file" Pattern match: "https://api.hidrive.strato.com/2.1/file/move" Pattern match: "https://api.hidrive.strato.com/2.1/file/copy" Pattern match: "https://api.hidrive.strato.com/2.1/dir" Pattern match: "https://api.hidrive.strato.com/2.1/dir/rename" Pattern match: "https://api.hidrive.strato.com/2.1/dir/move" Pattern match: "https://api.hidrive.strato.com/2.1/dir/copy" Pattern match: "https://api.hidrive.strato.com/2.1/share?id=" Pattern match: "https://api.hidrive.strato.com/2.1/share" Pattern match: "https://www.hidrive.strato.com/oauth2/token" Pattern match: "https://api.hidrive.strato.com/2.1/user/me?fields=account,alias,home,home_id" Pattern match: "https://api.hidrive.strato.com/2.1/zone" Pattern match: "http://localhost:5454" Pattern match: "https://www.googleapis.comhttps" Pattern match: "https://www.googleapis.com" Heuristic match: "928557045466-4nu7dv2ujlhr3ibaekqaujn3200fih92.apps.googleusercontent.com" Pattern match: "https://www.airexplorer.net/link/gdriveinfo.php" Pattern match: "https://www.mipony.net/links/gdrivecustomid" Pattern match: "https://content.dropboxapi.com/2/files/download" Pattern match: "https://content.dropboxapi.com/2/files/export" Pattern match: "https://content.dropboxapi.com/2/files/get_thumbnail" Pattern match: "https://api.dropboxapi.com/oauth2/token" Pattern match: "https://www.dropbox.com/oauth2/authorize?client_id=" Pattern match: "https://api.dropbox.com/2/users/get_current_account" Pattern match: "https://api.dropboxapi.com/2/users/get_space_usage" Pattern match: "http://127.0.0.1:35855/" Pattern match: "https://content.dropboxapi.com/2/files/upload_session/start" Pattern match: "https://app.drime.cloud" Pattern match: "https://app.drime.cloud/api/v1/auth/login" Pattern match: "https://app.drime.cloud/api/v1/user/space-usage" Pattern match: "https://app.drime.cloud/api/v1" Pattern match: "https://app.drime.cloud/drive/shares/" Pattern match: "https://app.drime.cloud/api/v1/uploads" Pattern match: "https://account-d.docusign.com" Pattern match: "https://publicapi.digiboxx.com/" Pattern match: "https://app.box.com/file/" Pattern match: "https://api.box.com/2.0/folders/" Pattern match: "https://api.box.com/2.0/folders" Pattern match: "https://app.box.com/folder/" Pattern match: "https://api.box.com/2.0/folder_locks?folder_id=" Pattern match: "https://api.box.com/2.0/folder_locks" Pattern match: "https://api.box.com/2.0/folder_locks/" Pattern match: "https://api.box.com/2.0/" Pattern match: "https://api.box.com/2.0/files/content" Pattern match: "https://upload.box.com/api/2.0/files/upload_sessions" Pattern match: "https://upload.box.com/api/2.0/files/" Pattern match: "https://upload.box.com/api/2.0/files/upload_sessions/" Pattern match: "https://account.box.com/api/oauth2/authorize?client_id=" Pattern match: "https://api.box.com/2.0/users/me" Pattern match: "https://api.box.com/2.0/search?query=" Pattern match: "https://upload.box.com/api/2.0/files/content" Pattern match: "https://pcs.baidu.com/rest/2.0/pcs/thumbnail?method=generate&quality=100&width=200&height=200&path=" Pattern match: "http://pan.baidu.com/disk/home#path=" Pattern match: "https://openapi.baidu.com/oauth/2.0/token?grant_type=refresh_token&refresh_token=" Pattern match: "https://openapi.baidu.com/oauth/2.0/authorize?client_id=" Pattern match: "https://openapi.baidu.com/rest/2.0/passport/users/getloggedinuser?access_token=" Pattern match: "https://pcs.baidu.com/rest/2.0/pcs/file?method=search&access_token=" Pattern match: "https://openapi.baidu.com/oauth/2.0/token" Pattern match: "https://c.pcs.baidu.com/rest/2.0/pcs/file" Heuristic match: "s3.us-west-000.backblazeb2.com" Pattern match: "https://www.airexplorer.net/helpbackblaze/" Heuristic match: "oss.eu-west-0.prod-cloud-ocb.orange-business.com" Heuristic match: "oss.eu-west-1.prod-cloud-ocb.orange-business.com" Pattern match: "https://api.aliyundrive.com" Pattern match: "https://auth.aliyundrive.com/v2/account/token" Pattern match: "https://upload.4shared.com/v1_2/upload" Pattern match: "https://upload.4shared.com/v1_2/upload/" Pattern match: "https://api.4shared.com/v1_2/files/" Pattern match: "https://api.4shared.com/v1_2/folders/" Pattern match: "https://api.4shared.com/v1_2/folders" Pattern match: "https://api.4shared.com/v1_2/oauth/initiate" Pattern match: "https://api.4shared.com/v1_2/oauth/authorize?oauth_token=" Pattern match: "https://api.4shared.com/v1_2/user" Pattern match: "https://api.4shared.com/v1_2/user/files?limit=100&query=" Pattern match: "https://api.4shared.com/v1_2/oauth/token" Pattern match: "https://upload.4shared.com/v1_2/files?folderid=" Pattern match: "https://upload.4shared.com/v1_2/files/" Pattern match: "https://passportapi.115.com/open/authdevicecode" Pattern match: "https://qrcodeapi.115.com/get/status/" Pattern match: "https://passportapi.115.com/open/devicecodetotoken" Pattern match: "https://passportapi.115.com/open/refreshtoken" Pattern match: "https://proapi.115.com" Pattern match: "https://www.airexplorer.net/link/115login.html?url=" Pattern match: "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd\" Pattern match: "http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd" Pattern match: "http://127.0.0.1:5151/" Pattern match: "https://developer.microsoft.com/en-us/microsoft-edge/webview2/#download-section" Pattern match: "https://www.mipony.net/" Pattern match: "http://www.mipony.net/manual/" Pattern match: "http://www.mipony.net/start/" Pattern match: "http://www.totald.org/images/favicon" Pattern match: "https://www.mipony.net/get-premium-account/" Pattern match: "https://www.mipony.net/banners-version3/getbanner.php?zona=zona300x250" Pattern match: "http://www.mipony.net/get-premium-account/info/" Pattern match: "http://www.mipony.net/proversionwin.php" Pattern match: "http://www.mipony.net/contactform/" Pattern match: "http://www.mipony.net/websites/" Heuristic match: "internal error (code 5) while activating the license, contact contact@mipony.net" Pattern match: "https://www.google.com/recaptcha/api.js\" Pattern match: "https://developer.microsoft.com/es-es/microsoft-edge/webview2/#download-section" Pattern match: "https://filejoker.net/xcaptcha/api.js" Pattern match: "https://developer.microsoft.com/" Pattern match: "https://filejoker.net/js/jquery-latest.min.js" Pattern match: "https://example.com/file.zip\" Pattern match: "https://example.com/a.mkv\" Pattern match: "https://example.com/folder\"38:T44c,Found HTTPS url "https://login.microsoftonline.com" Found HTTPS url "https://graph.microsoft.com" Found HTTPS url "https://oauth.yandex.com" Found HTTPS url "https://cloud" Found HTTPS url "https://www.terabox.com" Found HTTPS url "https://user.mypikpak.com" Found HTTPS url "https://api" Found HTTPS url "https://my.pcloud.com" Found HTTPS url "https://login.live.com" Found HTTPS url "https://api.onedrive.com" Found HTTPS url "https://api.office.com" Found HTTPS url "https://login.chinacloudapi.cn" Found HTTPS url "https://microsoftgraph.chinacloudapi.cn" Found HTTPS url "https://files.cloud.naver.com" Found HTTPS url "https://thumb1.photo.cloud.naver.com" Found HTTPS url "https://cloud.naver.com" Found HTTPS url "https://mega.nz" Found HTTPS url "https://g.api.mega.co.nz" Found HTTPS url "https://www.mediafire.com" Found HTTPS url "https://cloud.mail.ru" Found HTTPS url "https://id.mail.ru" Found HTTPS url "https://o2.mail.ru" Found HTTPS url "https://dispatcher.cloud.mail.ru" Found HTTPS url "https://app.koofr.net" Found HTTPS url "https://api.infomaniak.com"39:Tbb3,Found string "&client_secret=" (Indicator: "secret"; File: "Mipony.exe") Found string "" "client_secret":"" (Indicator: "secret"; File: "Mipony.exe") Found string "" "password":"" (Indicator: "password"; File: "Mipony.exe") Found string "access_key_secret" (Indicator: "secret"; File: "Mipony.exe") Found string "Invalid user or password" (Indicator: "password"; File: "Mipony.exe") Found string "web control panel. Select 'Full access to Mail, Cloud, Calendar (All Protocols)'. You can generate the password in this url https://id.mail.ru/security" (Indicator: "password"; File: "Mipony.exe") Found string "Application password" (Indicator: "password"; File: "Mipony.exe") Found string "client_id=cloud-win&grant_type=password&username=" (Indicator: "password"; File: "Mipony.exe") Found string "&grant_type=password&scope=offline_access%20openid&username=" (Indicator: "password"; File: "Mipony.exe") Found string "No - Enter your Apple ID and password here." (Indicator: "password"; File: "Mipony.exe") Found string "&grant_type=refresh_token&client_secret=" (Indicator: "secret"; File: "Mipony.exe") Found string "Enter your Drime email and password. If your account uses two-factor authentication (2FA), leave the email empty and paste an API access token in the password field instead. You can create the token at:" (Indicator: "password"; File: "Mipony.exe") Found string "Aliyundrive Refresh Token is not defined, requesting user and password" (Indicator: "password"; File: "Mipony.exe") Found string "Bad password error." (Indicator: "password"; File: "Mipony.exe") Found string "Missing password error." (Indicator: "password"; File: "Mipony.exe") Found string "Sorry, password protected files are not currently supported" (Indicator: "password"; File: "Mipony.exe") Found string "Encryption password not specified, the file can not be decrypted. Please save the encryption password in the account with the user interface" (Indicator: "password"; File: "Mipony.exe") Found string "Encryption password not specified, the file can not be encrypted. Please save the encryption password in the account with the user interface or include the encryption password in the command line" (Indicator: "password"; File: "Mipony.exe") Found string "Encrypt all uploads to your account in this session with the following password:" (Indicator: "password"; File: "Mipony.exe") Found string "Use user and password" (Indicator: "password"; File: "Mipony.exe") Found string "How to create a client Id and a client secret" (Indicator: "secret"; File: "Mipony.exe") Found string "If you lost this password you won't be able to unzip the files" (Indicator: "password"; File: "Mipony.exe") Found string "Encrypt the zip files with the following password:" (Indicator: "password"; File: "Mipony.exe") Found string "Generate a WebDAV session password" (Indicator: "password"; File: "Mipony.exe") Found string "Create an application password" (Indicator: "password"; File: "Mipony.exe")3a:Td47,Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000140-SingletonSpec~RecommendGlobalClient Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000145-ArgumentEmitter~Rename Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000146-ArgumentEmitter~InstantiateCache Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000147-ArgumentEmitter~Delete Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000148-ArgumentEmitter~IncludeConnection Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000149-ArgumentEmitter~Copy Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-600014d-ArgumentEmitter~RecommendHiddenBridge Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000156-ConvertibleRecommender~Refresh Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000158-ConvertibleRecommender~Rename Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000159-ConvertibleRecommender~IncludeConnection Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-600015a-ConvertibleRecommender~PushField Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-600015b-ConvertibleRecommender~Delete Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-600015c-ConvertibleRecommender~Copy Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000162-EmitterService~GenerateConfigurableSubscriber Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000163-EmitterService~PlayCommand Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000173-RecommenderTracer~FindEfficientThread Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000184-EmitterHandler~DeclineCommonDecider Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000195-ConfigurableToken~RecommendJoinedCommand Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-60001a0-DetachedTransaction~Restore Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-60001a1-DetachedTransaction~Delete Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-60001a7-ReadableToken~GenerateVisualDecorator Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-60001a9-ReadableToken~Delete Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-60001af-ObserverChain~ScanTag Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-60001b0-ObserverChain~Refresh Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-60001bd-AdapterAuthenticator~Refresh3b:Td63,System.Type::GetProperty(System.String,System.Reflection.BindingFlags) at 64449320844f8abc32a3a7a1cf47bfdb-60000c0-LiteralTransaction~DoubleBuffered Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000140-SingletonSpec~RecommendGlobalClient Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000145-ArgumentEmitter~Rename Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000146-ArgumentEmitter~InstantiateCache Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000147-ArgumentEmitter~Delete Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000148-ArgumentEmitter~IncludeConnection Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000149-ArgumentEmitter~Copy Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-600014d-ArgumentEmitter~RecommendHiddenBridge Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000156-ConvertibleRecommender~Refresh Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000158-ConvertibleRecommender~Rename Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000159-ConvertibleRecommender~IncludeConnection Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-600015a-ConvertibleRecommender~PushField Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-600015b-ConvertibleRecommender~Delete Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-600015c-ConvertibleRecommender~Copy Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000162-EmitterService~GenerateConfigurableSubscriber Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000163-EmitterService~PlayCommand Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000173-RecommenderTracer~FindEfficientThread Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000184-EmitterHandler~DeclineCommonDecider Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-6000195-ConfigurableToken~RecommendJoinedCommand System.Windows.Forms.Control::set_TabIndex(System.Int32) at 64449320844f8abc32a3a7a1cf47bfdb-600019b-FormLoginWebDav~ProcessAuthenticator Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-60001a0-DetachedTransaction~Restore Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-60001a1-DetachedTransaction~Delete Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-60001a7-ReadableToken~GenerateVisualDecorator Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-60001a9-ReadableToken~Delete Mipony.Chains.EmitterHandler::DisconnectStatelessListener() at 64449320844f8abc32a3a7a1cf47bfdb-60001af-ObserverChain~ScanTag3c:T7fb,Found string "webdav32x32" (Indicator: "webdav"; File: "Mipony.exe") Found string " " (Indicator: "webdav"; File: "Mipony.exe") Found string " " (Indicator: "http://webdav."; File: "Mipony.exe") Found string "FormLoginWebDav" (Indicator: "webdav"; File: "Mipony.exe") Found string "WebDav login" (Indicator: "webdav"; File: "Mipony.exe") Found string "CloudClient.Clouds.CloudWebDav.Properties.Resources" (Indicator: "webdav"; File: "Mipony.exe") Found string "favicon_48_webdav" (Indicator: "webdav"; File: "Mipony.exe") Found string "webdav16x16" (Indicator: "webdav"; File: "Mipony.exe") Found string "https://www.adrive.com/webDAV.php" (Indicator: "webdav"; File: "Mipony.exe") Found string ".dattodrive.com/remote.php/webdav" (Indicator: "webdav"; File: "Mipony.exe") Found string "https://magentacloud.de/remote.php/webdav" (Indicator: "webdav"; File: "Mipony.exe") Found string "Generate a WebDAV session password" (Indicator: "webdav"; File: "Mipony.exe") Found string ".stackstorage.com/remote.php/webdav" (Indicator: "webdav"; File: "Mipony.exe") Found string "\r\n \r\n \r\n " (Indicator: "webdav"; File: "Mipony.exe") Found string "\r\n \r\n \r\n " (Indicator: "http://webdav."; File: "Mipony.exe") Found string "Error refreshing Webdav folder" (Indicator: "webdav"; File: "Mipony.exe") Found string "webdav_url" (Indicator: "webdav"; File: "Mipony.exe") Found string "WebDav" (Indicator: "webdav"; File: "Mipony.exe") Found string "Error refreshing Webdav thrash folder" (Indicator: "webdav"; File: "Mipony.exe")3d:T529,Mipony.VirtualMouse::mouse_event(System.Int32,System.Int32,System.Int32,System.Int32,System.Int32) at 64449320844f8abc32a3a7a1cf47bfdb-600291d-VirtualMouse~Move Mipony.VirtualMouse::mouse_event(System.Int32,System.Int32,System.Int32,System.Int32,System.Int32) at 64449320844f8abc32a3a7a1cf47bfdb-600291e-VirtualMouse~MoveTo Mipony.VirtualMouse::mouse_event(System.Int32,System.Int32,System.Int32,System.Int32,System.Int32) at 64449320844f8abc32a3a7a1cf47bfdb-600291f-VirtualMouse~LeftClick Mipony.VirtualMouse::mouse_event(System.Int32,System.Int32,System.Int32,System.Int32,System.Int32) at 64449320844f8abc32a3a7a1cf47bfdb-6002920-VirtualMouse~LeftDown Mipony.VirtualMouse::mouse_event(System.Int32,System.Int32,System.Int32,System.Int32,System.Int32) at 64449320844f8abc32a3a7a1cf47bfdb-6002921-VirtualMouse~LeftUp Mipony.VirtualMouse::mouse_event(System.Int32,System.Int32,System.Int32,System.Int32,System.Int32) at 64449320844f8abc32a3a7a1cf47bfdb-6002922-VirtualMouse~RightClick Mipony.VirtualMouse::mouse_event(System.Int32,System.Int32,System.Int32,System.Int32,System.Int32) at 64449320844f8abc32a3a7a1cf47bfdb-6002923-VirtualMouse~RightDown Mipony.VirtualMouse::mouse_event(System.Int32,System.Int32,System.Int32,System.Int32,System.Int32) at 64449320844f8abc32a3a7a1cf47bfdb-6002924-VirtualMouse~RightUp3e:T400,AAABAAEAICAQBwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAHiIhwAAAAAAAAAAAAAAAReP//8AAAAAAAAAAAAAAXERj///cAAAAAAAAAAAAAdxEX///4AAAAAAAAAAAAADgRkf///wAAAAAAAAAAAAAIGRH///hwAAAAAAAAAAAAD3GRj/+IgAAAAAAAAAAAAAiBEX/4j/cAAAAAAAAAAAAIgRkXj//3cAAAAAAAAAAAB4ERF///+IAAAAAAAAAAAAeHEZH///iHAAAAAAAAAAAA9xERj///j3AAAAAAAAAAAIgRGX///4+HcAAAAAAAAAB/EREY//+PiIcAAAAAAAAAfxkREXiPiIh3AAAAAAAAAA95ERF3D/iId3AAAAAAAAAIMREReH/4iHdwAAAAAAAAAXERER///3d3cAAAAAAAAACHkREX/4d3h3AAAAAAAAAAhxERkYeP93cQAAAAAAAAABcRERF///h3cQAAAAAAAAAIcRERGP//h3AAAAAAAAAAB3ERERf///dwAAAAAAAAAACBERERf//4AAAAAAAAAAAAdxERERj4cAAAAAAAAAAAAAcRERERcAAAAAAAAAAAAAAAAQMAEAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/AP//+AB///AAP//wAD//8AA///AAP//wAB//8AAf//AAD//wAAf/8AAH//AAA//wAAH/+AAAf/gAAH/4AAA/+AAAH/wAAB/8AAAf/AAAH/4AAB/+AAAf/gAAP/8AAD//AAA//4AAf/+AAD//wAAf/+AHn//4D////B////5//w==3f:T400,AAABAAEAICAQBwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAHiIhwAAAAAAAAAAAAAAAReP//8AAAAAAAAAAAAAAXERj///cAAAAAAAAAAAAAdxEX///4AAAAAAAAAAAAADgRkf///wAAAAAAAAAAAAAIGRH///hwAAAAAAAAAAAAD3GRj/+IgAAAAAAAAAAAAAiBEX/4j/cAAAAAAAAAAAAIgRkXj//3cAAAAAAAAAAAB4ERF///+IAAAAAAAAAAAAeHEZH///iHAAAAAAAAAAAA9xERj///j3AAAAAAAAAAAIgRGX///4+HcAAAAAAAAAB/EREY//+PiIcAAAAAAAAAfxkREXiPiIh3AAAAAAAAAA95ERF3D/iId3AAAAAAAAAIMREReH/4iHdwAAAAAAAAAXERER///3d3cAAAAAAAAACHkREX/4d3h3AAAAAAAAAAhxERkYeP93cQAAAAAAAAABcRERF///h3cQAAAAAAAAAIcRERGP//h3AAAAAAAAAAB3ERERf///dwAAAAAAAAAACBERERf//4AAAAAAAAAAAAdxERERj4cAAAAAAAAAAAAAcRERERcAAAAAAAAAAAAAAAAQMAEAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/AP//+AB///AAP//wAD//8AA///AAP//wAB//8AAf//AAD//wAAf/8AAH//AAA//wAAH/+AAAf/gAAH/4AAA/+AAAH/wAAB/8AAAf/AAAH/4AAB/+AAAf/gAAP/8AAD//AAA//4AAf/+AAD//wAAf/+AHn//4D////B////5//w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"dedd0a1960e9f1c9a0614a4213c4a27bb33577b400eafd9fdd80632ac906215b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791693409445,"unified_at":"2026-10-11T04:36:49.445Z","metadata":{"hashes":{"sha256":"dedd0a1960e9f1c9a0614a4213c4a27bb33577b400eafd9fdd80632ac906215b","sha1":"e0c84499db50ee455e3d0338f9ac03b000f2a6ba","md5":"64449320844f8abc32a3a7a1cf47bfdb","sha512":"135f291a63d6210db62546e34ace5b6e7814a2ebb8799b90313e12fa03c38abde7cb0768d09269c02ace64f99408c071706ac8ab64b4de7059451d685c777d1b","ssdeep":"196608:Ar0uUQnAXPXXoX/PYRl0hH2yb0bJ5G++6Orfq3AoS0LFE:3DTHNOWw3eF","ssdeep_chunks":["196608:Ar0uUQn","196608:r0uUQnA","196608:0uUQnAX","196608:uUQnAXP","196608:UQnAXPX","196608:QnAXPXX","196608:nAXPXXo","196608:AXPXXoX","196608:XPXXoX/","196608:PXXoX/P","196608:XXoX/PY","196608:XoX/PYR","196608:oX/PYRl","196608:X/PYRl0","196608:/PYRl0h","196608:PYRl0hH","196608:YRl0hH2","196608:Rl0hH2y","196608:l0hH2yb","196608:0hH2yb0","196608:hH2yb0b","196608:H2yb0bJ","196608:2yb0bJ5","196608:yb0bJ5G","196608:b0bJ5G+","196608:0bJ5G++","196608:bJ5G++6","196608:J5G++6O","196608:5G++6Or","196608:G++6Orf","196608:++6Orfq","196608:+6Orfq3","196608:6Orfq3A","196608:Orfq3Ao","196608:rfq3AoS","196608:fq3AoS0","196608:q3AoS0L","196608:3AoS0LF","196608:AoS0LFE","393216:Ar0uUQn","393216:r0uUQnA","393216:0uUQnAX","393216:uUQnAXP","393216:UQnAXPX","393216:QnAXPXX","393216:nAXPXXo","393216:AXPXXoX","393216:XPXXoX/","393216:PXXoX/P","393216:XXoX/PY","393216:XoX/PYR","393216:oX/PYRl","393216:X/PYRl0","393216:/PYRl0h","393216:PYRl0hH","393216:YRl0hH2","393216:Rl0hH2y","393216:l0hH2yb","393216:0hH2yb0","393216:hH2yb0b","393216:H2yb0bJ","393216:2yb0bJ5","393216:yb0bJ5G","393216:b0bJ5G+","393216:0bJ5G++","393216:bJ5G++6","393216:J5G++6O","393216:5G++6Or","393216:G++6Orf","393216:++6Orfq","393216:+6Orfq3","393216:6Orfq3A","393216:Orfq3Ao","393216:rfq3AoS","393216:fq3AoS0","393216:q3AoS0L","393216:3AoS0LF","393216:AoS0LFE","196608:3DTHNOW","196608:DTHNOWw","196608:THNOWw3","196608:HNOWw3e","196608:NOWw3eF"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"29837eb777ae24a2336467cb6010639101e5fd2d"},"file_info":{"file_name":"MiPony.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":8635904,"entropy":6.56,"compile_timestamp":"2026-10-01T17:23:22","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791555907000,"last_seen":1791693250000,"last_multi_scan":1791693250000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":8490116,"raw_size":8490496},{"name":".rsrc","virtual_address":"0x81c000","virtual_size":144254,"raw_size":144384},{"name":".reloc","virtual_address":"0x840000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":63},"sandbox_signatures":{"informative_count":119,"suspicious_count":14,"malicious_count":0,"total":133},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_60%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Able to execute application (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"suspicious","value":"Able to start/interact with device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Credential Access","technique":"Steal Application Access Token","attack_id":"T1528","attack_id_wiki":"https://attack.mitre.org/techniques/T1528","identifiers":[{"type":"informative","value":"Able to access AWS credential file"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","identifiers":[{"type":"suspicious","value":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"suspicious","value":"Contains ability to simulate user keyboard/mouse input"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":".NET code is able to query registry"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Able to access Cisco VPN profile file"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to retrieve geographical location"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve security identifier details"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Contains ability to upload data with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contains ability to use Webdav for network"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"informative","value":"Dotnet code contains ability to establish a HTTP listener"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"},{"type":"informative","value":"Contains ability to perform email related activity (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Able to download remote files (.NET)"},{"type":"informative","value":"Contains ability to transfer files remotely using SFTP"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform asymmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"suspicious","value":"Able to reboot/shutdown the operating system"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform AES cryptographic operations (Dotnet)"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet code contains ability to generate random numbers"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES encryption (Dotnet String)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"},{"type":"informative","value":"Contains ability to generate intermediate language instructions (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Windows.Forms.Control\" and MemberReference \"Hide\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"$25","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to generate intermediate language instructions (Dotnet)","description":"Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"Mipony.exe\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-171","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"XSHA512 {0}\" (Indicator: \"SHA512\"; File: \"Mipony.exe\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007720-00000BC0-1181100972\")\n Found reference to \"AesManaged\" (Indicator: \"Aes\"; File: \"Mipony.exe\")\n Found reference to \"AesManaged\" (Indicator: \"AesManaged\"; File: \"Mipony.exe\")\n Found reference to \"HMAC-SHA1\" (Indicator: \"HMAC\"; File: \"Mipony.exe\")\n Found reference to \"XSHA512\" (Indicator: \"SHA512\"; File: \"Mipony.exe\")\n Found reference to \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"Aes\"; File: \"Mipony.exe\")\n Found reference to \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"AesCryptoServiceProvider\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.LoadFrom\" in \"Mipony.exe\"\n Observed function \"System.Reflection.LoadFile\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"Mipony.exe\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"Mipony.exe\"\n Observed namespace \"System.Diagnostics\" and MemberReference \"GetMethod\" in \"Mipony.exe\"\n Observed namespace \"System.Reflection\" and MemberReference \"GetGetMethod\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"Mipony.exe has big resource with name: \"AutomatedFinalizer.ExternalFinalizer\" size: \"356300\" and abnormal entropy:\"7.999455251114122\"\n Mipony.exe has big resource with name: \"syncHeader\" size: \"3937001\" and abnormal entropy:\"7.152624393424249\"\n Mipony.exe has big resource with name: \"syncSummary\" size: \"105922\" and abnormal entropy:\"6.508956561793689\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - [\\w\\.]*?(\\w+)\\.\\w+$; Source: \"Mipony.exe\")\n Found string - (.*?)\\.\\d+$; Source: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"Mipony.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"Mipony.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00007372]\n Process \"WerFault.exe\" [UID: 00000000-00007748]\n Process \"WerFault.exe\" [UID: 00000000-00003660]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"ToBase64String\" in \"Mipony.exe\"\n Observed function \"FromBase64String\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.System.Security.Cryptography.AesCryptoServiceProvider.Decrypting\" in Source: 60034d5-FilterInitializer~CreateTransmitter","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES encryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.AesManaged.Encrypt uploads\" in Source: 60034d5-FilterInitializer~CreateTransmitter","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-446","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"EncryptFileNames\" (Indicator: \"EncryptFile\"; File: \"Mipony.exe\")\n Found reference to API \"property/@EncryptFileNames\" (Indicator: \"EncryptFile\"; File: \"Mipony.exe\")\n Found reference to API \"checkBoxEncryptFileNames\" (Indicator: \"EncryptFile\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"set_UseMachineKeyStore\" in \"Mipony.exe\"\n Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \".ctor\" in \"Mipony.exe\"\n Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"VerifyHash\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"Mipony.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"Mipony.exe\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"Mipony.exe\"\n Observed namespace \"System.Security.Cryptography.Rijndael\" and TypeReference \"Create\" in \"Mipony.exe\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"Private key files (*.pem;*.key;id_*)|*.pem;*.key;id_*|All files (*.*)|*.*\" (Indicator: \"private key\"; File: \"Mipony.exe\")\n Found string \"Private Key file\" (Indicator: \"private key\"; File: \"Mipony.exe\")\n Found string \"Private Key password\" (Indicator: \"private key\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"Dotnet code contains ability to generate random numbers","description":"Observed namespace \"System.Security.Cryptography.RNGCryptoServiceProvider\" and TypeReference \".ctor\" in \"Mipony.exe\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"GetBytes\" in \"Mipony.exe\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"Create\" in \"Mipony.exe\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"GetNonZeroBytes\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-150","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$26","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$27","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetDirectories\" in \"Mipony.exe\"\n Observed dotnet function \"GetFiles\" in \"Mipony.exe\"\n Observed dotnet function \"GetFileSystemEntries\" in \"Mipony.exe\"\n Observed dotnet function \"GetLogicalDrives\" in \"Mipony.exe\"\n Observed dotnet function \"GetFileSystemInfos\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Mipony.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007720)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"System.IO.Directory::GetLogicalDrives() at 64449320844f8abc32a3a7a1cf47bfdb-6001c7e-FilterPredicate~ExecuteRunner\n System.Environment::GetLogicalDrives() at 64449320844f8abc32a3a7a1cf47bfdb-6001eef-EmitterMember~EmitScopeProgram","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_OSVersion\" in \"Mipony.exe\"\n Observed function \"get_MachineName\" in \"Mipony.exe\"\n Observed function \"GetLogicalDrives\" in \"Mipony.exe\"\n Observed function \"GetAvailableBrowserVersionString\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"CloudClient.Editors.SeparatedEditor::GetDiskFreeSpaceEx(System.String,System.UInt64&,System.UInt64&,System.UInt64&) at 64449320844f8abc32a3a7a1cf47bfdb-600267f-SeparatedEditor~WriteExternalWriter","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Mipony.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve geographical location","description":"\"accountCountryCode\" (Indicator: \"countrycode\") in Source: 60008af-FilterAnalyzer~FilterLogicalSingleton\n \"{\\\"operationName\\\":\\\"GetUserInfo3\\\",\\\"variables\\\":{\\\"Token\\\":\\\"%TOKEN%\\\"},\\\"query\\\":\\\"query GetUserInfo3($Token: String!) {\\\\n getUserInfo3(Token: $Token) {\\\\n ID\\\\n FirstName\\\\n LastName\\\\n Email\\\\n AvatarURL\\\\n CountryCode\\\\n LanguageCode\\\\n Phone\\\\n AccountType\\\\n UsedQuota\\\\n TotalQuota\\\\n OAuth2Provider\\\\n GPMigrationStatus\\\\n FeatureNoAds\\\\n FeatureTopSecret\\\\n FeatureDownsampling\\\\n FeatureAutomaticVideoUploads\\\\n FileSizeLimit\\\\n }\\\\n }\\\"}\" (Indicator: \"countrycode\") in Source: 6000ccf-CalcFilter~PlayCommand","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-575","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve security identifier details","description":"Observed Namespace \"System.Security.Principal.SecurityIdentifier\" and MemberReference \".ctor\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-156","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"CloudClient.Editors.SeparatedEditor::OpenProcessToken(System.IntPtr,System.Int32,System.IntPtr&) at 64449320844f8abc32a3a7a1cf47bfdb-6002687-SeparatedEditor~UpdateStatelessReporter\n CloudClient.Tagging.SelectorTag::OpenProcessToken(System.IntPtr,System.Int32,System.IntPtr&) at 64449320844f8abc32a3a7a1cf47bfdb-6002915-SelectorTag~IdentifyPassiveStream","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Mipony.exe\" queries volume information of \"C:\\Mipony.exe\" at 00000000-00007720-00000C17-1181104423","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Mipony.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Mipony.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"Mipony.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"OpenProcessToken\" in \"Mipony.exe\"\n Observed API \"LoadLibrary\" in \"Mipony.exe\"\n Observed API \"GetProcAddress\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"Mipony.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory(\\\"{0}\\\", {1}): Create non-existent parent: {2}\" (Indicator: \"CreateDirectory\"; File: \"Mipony.exe\")\n Found reference to API \"CreateDirectory(\\\"{0}\\\", {1})\" (Indicator: \"CreateDirectory\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"$28","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"SeShutdownPrivilege\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"Mipony.exe\")\n Found reference to API \"setMoveFile\":true\" (Indicator: \"MoveFile\"; File: \"Mipony.exe\"), Found reference to API \"{\\\"operationName\\\":\\\"SetMoveFile\\\"\n\\\"variables\\\":{\\\"Token\\\":\\\"%TOKEN%\\\"\n\\\"NewParentID\\\":\\\"\" (Indicator: \"MoveFile\"; File: \"Mipony.exe\")\n Found reference to API \"setMoveFile\\\":true\" (Indicator: \"MoveFile\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"Mipony.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetCreationTime\" in \"Mipony.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetLastWriteTime\" in \"Mipony.exe\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"Mipony.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.get_StartInfo\" in \"Mipony.exe\"\n Observed function \"Process.Start\" in \"Mipony.exe\"\n Observed function \"Process.get_StartTime\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$29","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process Mipony.exe created mutex with name \"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"Mipony.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"Mipony.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"Mipony.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"Mipony.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKey\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Mipony.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"children@odata.nextlink\"\n Pattern match: \"contact@mipony.net\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$2a","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"youtube\" (Indicator: \"youtube\"; File: \"Mipony.exe\")\n Found string \"favicontwitter\" (Indicator: \"twitter\"; File: \"Mipony.exe\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://oauth.yandex.com/token\" (Indicator: \"yandex.com\")\n \"https://oauth.yandex.com/authorize?scope=\" (Indicator: \"yandex.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"Mipony.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at D3A90000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Mipony.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 04850000\n \"Mipony.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 03360000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"Mipony.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at D5090000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Mipony.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 04D20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Mipony.exe\" was detected as \".NET\" and name: \"Library\"\n \"Mipony.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Mipony.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"Mipony.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Mipony.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2c","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x818e00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x818c84\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Baidu\" (Indicator: \"baidu\") in Source: Mipony.exe","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Mipony.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Mipony.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Mipony.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"Found string \"application/json, text/javascript, */*; q=0.01\" (Indicator: \"text/javascript\"; File: \"Mipony.exe\")\n Found string \"text/javascript\" (Indicator: \"text/javascript\"; File: \"Mipony.exe\")\n file/memory contains long string with (Indicator: \"text/javascript\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 6878439)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Mipony.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Mipony.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Mipony.exe\" queries basic process information of the \"C:\\Mipony.exe\" (UID: 7720)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Mipony.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"Mipony.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux\"\n \"Mipony.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll.aux\"\n \"Mipony.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll.aux\"\n \"Mipony.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll.aux\"\n \"Mipony.exe\" reads file \"c:\\mipony.exe\"\n \"Mipony.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\0d59b0e237d7519417de10cd84bda4e7\\system.core.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: The input sample contains the RDTSCP instruction\n Matched sigs: Contains ability to query volume size","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Mipony.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"Mipony.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL\"\n \"Mipony.exe\" trying to touch file \"C:\\Windows\\System32\\MSCOREE.DLL.LOCAL\"\n \"Mipony.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL.local\"\n \"Mipony.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\"\n \"Mipony.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"Mipony.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\kernelbase.dll\"\n \"Mipony.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CLR.DLL\"\n \"Mipony.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll\"\n \"Mipony.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\"\n \"Mipony.exe\" trying to touch file \"\\Device\\CNG\"\n \"Mipony.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"Mipony.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"Mipony.exe\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$31","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$32","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"Mipony.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Receive\" in \"Mipony.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"EndConnect\" in \"Mipony.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"BeginConnect\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Contains ability to perform email related activity (Dotnet)","description":"$33","origin":"Static Parser","mitre_attack_id":"T1071.003","relevance":1,"id":"static-160","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload data with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadString\" in \"Mipony.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadData\" in \"Mipony.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadValues\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1005","relevance":1,"id":"static-142","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Disposition: form-data; name=\\\"{0}\\\"; filename=\\\"{1}\\\"\\r\\nContent-Type: {2}\\r\\n\\r\\n\"; File: \"Mipony.exe\")\n Found string \"Content-Disposition: form-data; name=\\\"{0}\\\"\\r\\n\\r\\n{1}\"; File: \"Mipony.exe\")\n Found string \"\\r\\nContent-Disposition: form-data; name=\\\"\"; File: \"Mipony.exe\"), Found string \"\\r\\nContent-Disposition: form-data; name=\\\"file\\\"; filename=\\\"\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"This account has Advanced Data Protection enabled, connect it again to approve the access from your Apple device\" (Indicator: \" connect \"; File: \"Mipony.exe\")\n Found reference to API \"Timed out waiting for the server to connect to the active data socket.\" (Indicator: \" connect \"; File: \"Mipony.exe\")\n Found reference to API \"The free version allows up to {0} cloud accounts and only one per cloud service. Remove the accounts you do not need or upgrade to Mipony Pro to connect to them.\" (Indicator: \" connect \"; File: \"Mipony.exe\")\n Found reference to API \"Could not connect to Digiboxx\" (Indicator: \" connect \"; File: \"Mipony.exe\")\n Found reference to API \"Timed out trying to read data from the socket stream!\" (Indicator: \" socket \"; File: \"Mipony.exe\")\n Found reference to API \"The underlying socket is null. Have you established a connection?\" (Indicator: \" socket \"; File: \"Mipony.exe\")\n Found reference to API \"Failed to connect to host.\" (Indicator: \" connect \"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Dotnet code contains ability to establish a HTTP listener","description":"$34","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-147","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$36","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1:3321\"\n Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1:3021\"\n Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1:\"\n Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1:30831/\"\n \"127.0.0.1\"\n Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1:9666\"\n \"4.0.1.0\"\n Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1:35890/\"\n Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1:2134\"\n Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1:35855/\"\n Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1:5151/\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$37","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET .*?\\?(?.*?) HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"Mipony.exe\")\n Found string \"POST .*?\\?(?.*?) HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"Mipony.exe\")\n Found string \"GET .*?\\\\?(?.*?) HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"Mipony.exe\")\n Found string \"POST .*?\\\\?(?.*?) HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://127.0.0.1:3321\"Found ip/domain with port number \"http://127.0.0.1:3021\"Found ip/domain with port number \"http://127.0.0.1:30831\"Found ip/domain with port number \"http://127.0.0.1:9666\"Found ip/domain with port number \"http://127.0.0.1:35890\"Found ip/domain with port number \"http://127.0.0.1:2134\"Found ip/domain with port number \"http://127.0.0.1:35855\"Found ip/domain with port number \"http://127.0.0.1:5151\"Found ip/domain with port number \"http://localhost:4699\"Found ip/domain with port number \"http://localhost:5454\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to transfer files remotely using SFTP","description":"Observed string: \"Error refreshing SFTP folder\" (Indicator: \" sftp \") in Source: 6000247-StaticToken~Refresh\n Observed string: \"SFTP connection error:\" (Indicator: \"sftp \") in Source: 600025b-SetEmitter~GenerateAutomatedAuthorizer\n Observed string: \"SFTP Login\" (Indicator: \"sftp \") in Source: 60023ea-FormSFTPLogin~ConcatProxy","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-578","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"Found string \"The specified URI scheme is not supported. Please use ftp:// or ftps://\" (Indicator: \"ftps://\"; File: \"Mipony.exe\")\n Found string \"CloudClient.Clouds.CloudSFTP.Properties.Resources\" (Indicator: \"sftp.\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access Cisco VPN profile file","description":"file/memory contains long string with (Indicator: \".pcf\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-866","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base64\"; File: \"Mipony.exe\")\n Found string \"PolicyBase64\" (Indicator: \"base64\"; File: \"Mipony.exe\")\n Found string \"SHA256WITHECDSA\" (Indicator: \"ecdsa\"; File: \"Mipony.exe\")\n Found string \"AesManaged\" (Indicator: \"aes\"; File: \"Mipony.exe\")\n Found string \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"aes\"; File: \"Mipony.exe\")\n Found string \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"aescryptoserviceprovider\"; File: \"Mipony.exe\")\n Found string \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"System.Security.Cryptography\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"Mipony.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$39","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"bytes (?\\d+)-(?\\d+)/(?\\d+)\" (Indicator: \"\"; File: \"Mipony.exe\")\n Found string \"bytes (?\\\\d+)-(?\\\\d+)/(?\\\\d+)\" (Indicator: \"\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"hostname\" (Indicator: \"hostname\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"System Security","name":"Able to access AWS credential file","description":"Found string \"SECRETACCESSKEY\" (Indicator: \"secretaccesskey\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1528","relevance":1,"id":"string-5076","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"\"}]\n\"IsInRecycleBin\":false\n\"Token\":\"%TOKEN%\"}\n\"query\":\"mutation SetDeleteFile5(\\n $Token: String!\\n $IsInRecycleBin: Boolean!\\n $IDs: [IDType]!\\n ) {\\n setDeleteFile5(Token: $Token, IsInRecycleBin: $IsInRecycleBin, IDs: $IDs)\\n }\"}\" (Indicator: \"DeleteFile\"; File: \"Mipony.exe\"), Found reference to API \"setDeleteFile5\":true\" (Indicator: \"DeleteFile\"; File: \"Mipony.exe\")\n Found reference to API \"{\\\"operationName\\\":\\\"SetDeleteFile5\\\",\\\"variables\\\":{\\\"IDs\\\":[{\\\"FileID\\\":\\\"\" (Indicator: \"DeleteFile\"; File: \"Mipony.exe\"), Found reference to API \"\\\"}],\\\"IsInRecycleBin\\\":false,\\\"Token\\\":\\\"%TOKEN%\\\"},\\\"query\\\":\\\"mutation SetDeleteFile5(\\\\n $Token: String!\\\\n $IsInRecycleBin: Boolean!\\\\n $IDs: [IDType]!\\\\n ) {\\\\n setDeleteFile5(Token: $Token, IsInRecycleBin: $IsInRecycleBin, IDs: $IDs)\\\\n }\\\"}\" (Indicator: \"DeleteFile\"; File: \"Mipony.exe\")\n Found reference to API \"setDeleteFile5\\\":true\" (Indicator: \"DeleteFile\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: Mipony.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Mipony.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"system\" (Source: Mipony.exe, API is part of module: UCRTBASE_CLR0400.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Mipony.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Mipony.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".text\" unusually large (8490116 bytes)\n possible junk padding","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Mipony.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7720)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"Mipony.exe queries ProcessDebugPort (UID: 7720)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"suspicious","category":"General","name":"Able to start/interact with device drivers","description":"Mipony.RecommendationSystems.RecommenderNode::DeviceIoControl(Microsoft.Win32.SafeHandles.SafeFileHandle,System.Int32,System.IntPtr,System.Int32,System.IntPtr,System.Int32,System.Int32&,System.Threading.NativeOverlapped&) at 64449320844f8abc32a3a7a1cf47bfdb-6001cba-RecommenderNode~FindIdentifiableService\n CloudClient.Tagging.SelectorTag::DeviceIoControl(Microsoft.Win32.SafeHandles.SafeFileHandle,System.Int32,System.IntPtr,System.Int32,System.IntPtr,System.Int32,System.Int32&,System.Threading.NativeOverlapped&) at 64449320844f8abc32a3a7a1cf47bfdb-60028f9-SelectorTag~LabelActiveHandler","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":5,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"Mipony.exe\" has resource with unusual entropy \"RT_ICON:7.96979388533956\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"$3a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$3b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to use Webdav for network","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-476","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA\" matched file \"sample.bin\" as \"Detects Windows executables referencing non-Windows User-Agents\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"Found string \"&display=popup&scope=basic,netdisk&force_login=1&response_type=code&redirect_uri=\" (Indicator: \"login=\"; File: \"Mipony.exe\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"CloudClient.Editors.SeparatedEditor::LookupPrivilegeValue(System.String,System.String,System.Int64&) at 64449320844f8abc32a3a7a1cf47bfdb-6002687-SeparatedEditor~UpdateStatelessReporter\n CloudClient.Tagging.SelectorTag::LookupPrivilegeValue(System.String,System.String,System.Int64&) at 64449320844f8abc32a3a7a1cf47bfdb-6002915-SelectorTag~IdentifyPassiveStream","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Able to reboot/shutdown the operating system","description":"CloudClient.Editors.SeparatedEditor::ExitWindowsEx(System.Int32,System.Int32) at 64449320844f8abc32a3a7a1cf47bfdb-6002687-SeparatedEditor~UpdateStatelessReporter\n CloudClient.Tagging.SelectorTag::ExitWindowsEx(System.Int32,System.Int32) at 64449320844f8abc32a3a7a1cf47bfdb-6002915-SelectorTag~IdentifyPassiveStream","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains ability to simulate user keyboard/mouse input","description":"$3d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056","relevance":6,"id":"stream-35","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Contains ability to query information about shared network resources"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":38,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Sample Crashed"],"sandbox_reports":[{"id":"6acb11c153443f4df008f242","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"undetected","threat_score":69,"submit_name":"Mipony.exe","analysis_start_time":"2026-10-11T04:34:11+00:00","indicators_count":{"informative":119,"suspicious":22,"malicious":0},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}],"processes":[{"pid":7720,"ppid":0,"name":"Mipony.exe","command_line":"","sha256":"dedd0a1960e9f1c9a0614a4213c4a27bb33577b400eafd9fdd80632ac906215b","normalized_path":"C:\\Mipony.exe","uid":"00000000-00007720","icon":"$3e"},{"pid":7748,"ppid":7720,"name":"WerFault.exe","command_line":"-u -p 7720 -s 700","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00007720","uid":"00000000-00007748"},{"pid":3660,"ppid":7720,"name":"WerFault.exe","command_line":"-u -p 7720 -s 700","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00007720","uid":"00000000-00003660"},{"pid":7372,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 452 -p 7720 -ip 7720","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007372","icon":"$3f"}],"all_imported_dlls":["cryptsp.dll","rsaenh.dll","bcryptprimitives.dll","win32u.dll","imm32.dll","ole32.dll","uxtheme.dll","advapi32.dll","shlwapi.dll","ucrtbase.dll","kernel.appcore.dll","vcruntime140_clr0400.dll","KernelBase.dll","mscorlib.ni.dll","sechost.dll","combase.dll","gdi32.dll","gdi32full.dll","psapi.dll","System.Drawing.ni.dll","cryptbase.dll","ntdll.dll","msvcrt.dll","clr.dll","System.ni.dll","System.Core.ni.dll","ucrtbase_clr0400.dll","mscoree.dll","mscoreei.dll","version.dll","diasymreader.dll","bcrypt.dll","kernel32.dll","rpcrt4.dll","msvcp_win.dll","user32.dll","clrjit.dll","System.Windows.Forms.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6acb11c153443f4df008f242"}]}]}},"report_ids":{"sandbox_job_ids":["6acb11c153443f4df008f242"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_60% Sample dedd0a1960e9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample dedd0a1960e9…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 1/25 AV engines flagged this file. 0 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/dedd0a1960e9f1c9a0614a4213c4a27bb33577b400eafd9fdd80632ac906215b"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_60% Sample dedd0a1960e9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample dedd0a1960e9…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 1/25 AV engines flagged this file. 0 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/dedd0a1960e9f1c9a0614a4213c4a27bb33577b400eafd9fdd80632ac906215b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_60% Sample dedd0a1960e9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample dedd0a1960e9…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 1/25 AV engines flagged this file. 0 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L40","11",{}]]