{
  "type": "Domain",
  "indicator": "deaval.com.ar",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/deaval.com.ar",
    "alexa": "http://www.alexa.com/siteinfo/deaval.com.ar",
    "indicator": "deaval.com.ar",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2961827747,
      "indicator": "deaval.com.ar",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "6888a85aa32aab22f638d0e6",
          "name": "Autodesk issue in CrowdStrike prior to outage | [by scoreblue]",
          "description": "",
          "modified": "2025-07-29T10:54:18.501000",
          "created": "2025-07-29T10:54:18.501000",
          "tags": [
            "healthy check",
            "ssl bypass",
            "domain tracker",
            "privacy badger",
            "startpage",
            "w11 pc",
            "pass",
            "iocs",
            "all scoreblue",
            "pdf report",
            "pcap",
            "stix",
            "avast avg",
            "no expiration",
            "status",
            "name servers",
            "moved",
            "h1 center",
            "next",
            "sec ch",
            "ch ua",
            "ua platform",
            "emails",
            "certificate",
            "passive dns",
            "urls",
            "encrypt",
            "body",
            "pe32 executable",
            "ms windows",
            "intel",
            "windows control",
            "panel item",
            "dos borland",
            "executable",
            "algorithm",
            "thumbprint",
            "serial number",
            "signing ca",
            "symantec time",
            "stamping",
            "g2 name",
            "g2 issuer",
            "class",
            "code",
            "kb pe",
            "csc corporate",
            "porkbun llc",
            "gandi sas",
            "request",
            "path",
            "get https",
            "get http",
            "response",
            "cachecontrol",
            "pragma",
            "connection",
            "gmt connection",
            "accept",
            "slug",
            "as29789",
            "united",
            "unknown",
            "ransom",
            "heur",
            "server",
            "registrar abuse",
            "san rafael",
            "autodesk",
            "contact phone",
            "registrar url",
            "process32nextw",
            "create c",
            "read c",
            "writeconsolew",
            "delete",
            "write",
            "show",
            "malware",
            "write c",
            "regsetvalueexa",
            "delete c",
            "search",
            "regdword",
            "whitelisted",
            "panda banker",
            "ursnif",
            "win32",
            "persistence",
            "execution",
            "banker",
            "local",
            "domain",
            "servers",
            "pulse pulses",
            "files",
            "ip address",
            "creation date",
            "united kingdom",
            "as9009 m247",
            "ipv4",
            "pulse submit",
            "url analysis",
            "twitter",
            "as16552 tiggee",
            "as397241",
            "as397240",
            "entries",
            "cname",
            "nxdomain",
            "a nxdomain",
            "worm",
            "file samples",
            "files matching",
            "alf features",
            "denver co",
            "wewatta",
            "scan endpoints",
            "related pulses",
            "date hash",
            "showing",
            "as62597 nsone",
            "date",
            "trojanspy",
            "cookie",
            "hostmaster",
            "expiration date",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tls handshake",
            "et info",
            "getdc0x2a",
            "failure",
            "post http",
            "copy",
            "crash",
            "ascii text",
            "ascii",
            "jpeg image",
            "artemis",
            "trojan",
            "virustotal",
            "mike",
            "vipre",
            "panda",
            "win32mediadrug",
            "win324shared",
            "win32spigot",
            "hstr",
            "lowfi",
            "yara detections",
            "contacted",
            "report spam",
            "mozilla",
            "trojanclicker",
            "url http",
            "url https",
            "role title",
            "added active",
            "type indicator",
            "source domain",
            "akamai rank",
            "hostname",
            "ver2",
            "msclkidn",
            "vids0",
            "global outage",
            "cobalt strike",
            "fancy bear",
            "communications",
            "android device",
            "cnc beacon",
            "suspicious ua",
            "youtube",
            "sakula rat",
            "mivast",
            "sakula",
            "windows",
            "samuel tulach",
            "light dark",
            "samuel",
            "tulach",
            "hyperv",
            "detecting",
            "writing gui",
            "bootkits",
            "world",
            "information",
            "discovery",
            "t1027",
            "t1057",
            "t1071",
            "protocol",
            "t1105",
            "tool transfer",
            "t1129",
            "capture",
            "service",
            "t1119"
          ],
          "references": [
            "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
            "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
            "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
            "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
            "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
            "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
            "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
            "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
            "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
            "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
            "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
            "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
            "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
            "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com",
            "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
            "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
            "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
            "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
            "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
            "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
            "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
            "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
            "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
            "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
            "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
            "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
            "Above links in search results direct out with and arrow pointing out.",
            "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
            "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
            "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
            "boot.net.anydesk.com removed from my Pulse below",
            "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "Win32:Mystic",
              "display_name": "Win32:Mystic",
              "target": null
            },
            {
              "id": "Win.Trojan.Xblocker-236",
              "display_name": "Win.Trojan.Xblocker-236",
              "target": null
            },
            {
              "id": "Ransom:Win32/Genasom",
              "display_name": "Ransom:Win32/Genasom",
              "target": "/malware/Ransom:Win32/Genasom"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "ALF:JASYP:Backdoor:Win32/Cycbot",
              "display_name": "ALF:JASYP:Backdoor:Win32/Cycbot",
              "target": null
            },
            {
              "id": "#LowFiEnableDTContinueAfterUnpacking",
              "display_name": "#LowFiEnableDTContinueAfterUnpacking",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Usteal",
              "display_name": "TrojanSpy:Win32/Usteal",
              "target": "/malware/TrojanSpy:Win32/Usteal"
            },
            {
              "id": "Win.Trojan.PoetRat-7669676-0",
              "display_name": "Win.Trojan.PoetRat-7669676-0",
              "target": null
            },
            {
              "id": "Mivast",
              "display_name": "Mivast",
              "target": null
            },
            {
              "id": "Sakula",
              "display_name": "Sakula",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1021",
              "name": "Remote Services",
              "display_name": "T1021 - Remote Services"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "66d89c45ddc0c7db084b75b7",
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1417,
            "FileHash-SHA1": 1165,
            "FileHash-SHA256": 6536,
            "URL": 6112,
            "domain": 1340,
            "hostname": 2654,
            "email": 15,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 19248,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "307 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d89c45ddc0c7db084b75b7",
          "name": "Autodesk weakens CS | Unauthorized AlienVault API | Stolen pulsed",
          "description": "Critical issues within AlienVault , VT & my devices. Plugins auto installed after I opened  message from AV user. Sudden redirects to 0/ http/s.   Heavy modifications, removal of IoC's  on AV & VT  & Virus Total. Autodesk.com was under CrowdStrike  until last night. Links where vulnerabilities were originating from completely disappeared from graph I kindly kept private. Continuous mods for  months to Crowdstrike and other  pulses. [https://otx.alienvault.com/api appears in search] A page opens with Tag: \"esta caliente\" | All linked pulses Gone. Only person who frequently contacted me appears where they didn't before & These dishonest billion $ companies cover up though they are at fault for allowing ALL threat actor to be protected with  non adversarial businesses.  Besides other compromises, surprisingly Brashears porn found in Crowdstrike/Autodesk  others. Disappointing.",
          "modified": "2024-10-04T17:02:07.067000",
          "created": "2024-09-04T17:43:33.123000",
          "tags": [
            "healthy check",
            "ssl bypass",
            "domain tracker",
            "privacy badger",
            "startpage",
            "w11 pc",
            "pass",
            "iocs",
            "all scoreblue",
            "pdf report",
            "pcap",
            "stix",
            "avast avg",
            "no expiration",
            "status",
            "name servers",
            "moved",
            "h1 center",
            "next",
            "sec ch",
            "ch ua",
            "ua platform",
            "emails",
            "certificate",
            "passive dns",
            "urls",
            "encrypt",
            "body",
            "pe32 executable",
            "ms windows",
            "intel",
            "windows control",
            "panel item",
            "dos borland",
            "executable",
            "algorithm",
            "thumbprint",
            "serial number",
            "signing ca",
            "symantec time",
            "stamping",
            "g2 name",
            "g2 issuer",
            "class",
            "code",
            "kb pe",
            "csc corporate",
            "porkbun llc",
            "gandi sas",
            "request",
            "path",
            "get https",
            "get http",
            "response",
            "cachecontrol",
            "pragma",
            "connection",
            "gmt connection",
            "accept",
            "slug",
            "as29789",
            "united",
            "unknown",
            "ransom",
            "heur",
            "server",
            "registrar abuse",
            "san rafael",
            "autodesk",
            "contact phone",
            "registrar url",
            "process32nextw",
            "create c",
            "read c",
            "writeconsolew",
            "delete",
            "write",
            "show",
            "malware",
            "write c",
            "regsetvalueexa",
            "delete c",
            "search",
            "regdword",
            "whitelisted",
            "panda banker",
            "ursnif",
            "win32",
            "persistence",
            "execution",
            "banker",
            "local",
            "domain",
            "servers",
            "pulse pulses",
            "files",
            "ip address",
            "creation date",
            "united kingdom",
            "as9009 m247",
            "ipv4",
            "pulse submit",
            "url analysis",
            "twitter",
            "as16552 tiggee",
            "as397241",
            "as397240",
            "entries",
            "cname",
            "nxdomain",
            "a nxdomain",
            "worm",
            "file samples",
            "files matching",
            "alf features",
            "denver co",
            "wewatta",
            "scan endpoints",
            "related pulses",
            "date hash",
            "showing",
            "as62597 nsone",
            "date",
            "trojanspy",
            "cookie",
            "hostmaster",
            "expiration date",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tls handshake",
            "et info",
            "getdc0x2a",
            "failure",
            "post http",
            "copy",
            "crash",
            "ascii text",
            "ascii",
            "jpeg image",
            "artemis",
            "trojan",
            "virustotal",
            "mike",
            "vipre",
            "panda",
            "win32mediadrug",
            "win324shared",
            "win32spigot",
            "hstr",
            "lowfi",
            "yara detections",
            "contacted",
            "report spam",
            "mozilla",
            "trojanclicker",
            "url http",
            "url https",
            "role title",
            "added active",
            "type indicator",
            "source domain",
            "akamai rank",
            "hostname",
            "ver2",
            "msclkidn",
            "vids0",
            "global outage",
            "cobalt strike",
            "fancy bear",
            "communications",
            "android device",
            "cnc beacon",
            "suspicious ua",
            "youtube",
            "sakula rat",
            "mivast",
            "sakula",
            "windows",
            "samuel tulach",
            "light dark",
            "samuel",
            "tulach",
            "hyperv",
            "detecting",
            "writing gui",
            "bootkits",
            "world",
            "information",
            "discovery",
            "t1027",
            "t1057",
            "t1071",
            "protocol",
            "t1105",
            "tool transfer",
            "t1129",
            "capture",
            "service",
            "t1119"
          ],
          "references": [
            "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
            "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
            "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
            "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
            "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
            "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
            "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
            "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
            "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
            "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
            "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
            "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
            "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
            "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com",
            "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
            "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
            "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
            "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
            "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
            "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
            "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
            "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
            "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
            "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
            "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
            "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
            "Above links in search results direct out with and arrow pointing out.",
            "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
            "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
            "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
            "boot.net.anydesk.com removed from my Pulse below",
            "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "Win32:Mystic",
              "display_name": "Win32:Mystic",
              "target": null
            },
            {
              "id": "Win.Trojan.Xblocker-236",
              "display_name": "Win.Trojan.Xblocker-236",
              "target": null
            },
            {
              "id": "Ransom:Win32/Genasom",
              "display_name": "Ransom:Win32/Genasom",
              "target": "/malware/Ransom:Win32/Genasom"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "ALF:JASYP:Backdoor:Win32/Cycbot",
              "display_name": "ALF:JASYP:Backdoor:Win32/Cycbot",
              "target": null
            },
            {
              "id": "#LowFiEnableDTContinueAfterUnpacking",
              "display_name": "#LowFiEnableDTContinueAfterUnpacking",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Usteal",
              "display_name": "TrojanSpy:Win32/Usteal",
              "target": "/malware/TrojanSpy:Win32/Usteal"
            },
            {
              "id": "Win.Trojan.PoetRat-7669676-0",
              "display_name": "Win.Trojan.PoetRat-7669676-0",
              "target": null
            },
            {
              "id": "Mivast",
              "display_name": "Mivast",
              "target": null
            },
            {
              "id": "Sakula",
              "display_name": "Sakula",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1021",
              "name": "Remote Services",
              "display_name": "T1021 - Remote Services"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 38,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1417,
            "FileHash-SHA1": 1165,
            "FileHash-SHA256": 6536,
            "URL": 6112,
            "domain": 1340,
            "hostname": 2654,
            "email": 15,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 19248,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "605 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570819e75a6b853df509785",
          "name": "http://projectorworld.ru/blog/770.htm",
          "description": "",
          "modified": "2023-12-06T14:13:50.518000",
          "created": "2023-12-06T14:13:50.518000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 447,
            "domain": 151,
            "URL": 991,
            "hostname": 334,
            "FileHash-MD5": 61,
            "FileHash-SHA1": 50,
            "email": 2,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 2038,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "908 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6546cf78627adef6562a97aa",
          "name": "Browser Malware Attack",
          "description": "Attacking my browser to identify.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
          "modified": "2023-12-04T22:00:43.514000",
          "created": "2023-11-04T23:10:48.676000",
          "tags": [
            "united",
            "facebook",
            "phishtank",
            "detection list",
            "ip address",
            "blacklist",
            "paypal",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "million",
            "malicious url",
            "malware site",
            "malicious site",
            "malware",
            "name verdict",
            "falcon sandbox",
            "reports no",
            "speci",
            "efr1",
            "pattern match",
            "file",
            "web open",
            "font format",
            "truetype",
            "indicator",
            "windows nt",
            "et tor",
            "known tor",
            "relayrouter",
            "date",
            "unknown",
            "general",
            "hybrid",
            "local",
            "stream",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "self",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "phishing site",
            "heur",
            "cyber threat",
            "unsafe",
            "riskware",
            "phishing",
            "bank",
            "service",
            "artemis",
            "team",
            "xtrat",
            "agent",
            "xrat",
            "filetour",
            "exploit",
            "conduit",
            "opencandy",
            "fusioncore",
            "orkut",
            "steam",
            "genkryptik",
            "runescape",
            "presenoker",
            "ramnit",
            "msil",
            "crack",
            "tofsee",
            "suppobox",
            "malicious",
            "simda",
            "vawtrak",
            "hotmail",
            "generic",
            "webtoolbar",
            "hsbc",
            "maltiverse",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "count blacklist",
            "tag count",
            "downldr",
            "cleaner",
            "iframe",
            "wacatac",
            "alexa",
            "win64",
            "swrort",
            "installcore",
            "azorult",
            "download",
            "blacknet rat",
            "stealer",
            "softcnapp",
            "nircmd",
            "unruy",
            "patcher",
            "adload",
            "dropper",
            "installpack",
            "tiggre",
            "gamehack",
            "trojanspy",
            "germany http",
            "attacker",
            "static engine",
            "internet storm",
            "center",
            "passive dns",
            "urls",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "url http",
            "pulse pulses",
            "http",
            "related nids"
          ],
          "references": [
            "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
            "object.prototype.hasownproperty.call",
            "hasownproperty.call",
            "a.default.meta.applestore.id",
            "applestore.id",
            "http://decafsmob.this.id",
            "id.google.com",
            "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
            "http://git.io/yBU2rg",
            "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
            "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
            "http://tracking.3061331.corn10wuk.club",
            "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
            "apps.apple.com/us/app/id$",
            "t.name",
            "http://e.id?e.id:e.id.getAttribute",
            "location.search",
            "https://dnsorangetel.dn2.n-helix.com",
            "1080p-torrent.ml",
            "states.app",
            "dev-2.ernestatech.com",
            "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
            "209.85.145.113 [malware]",
            "cdn.fuckporntube.com",
            "www.search.app.goo.gl",
            "apps.apple.com",
            "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
            "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
            "globalworker1.sol.us",
            "worker-m-tlcus1.sol.us"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Ireland",
            "Singapore"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "HSBC",
              "display_name": "HSBC",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1015,
            "hostname": 1309,
            "FileHash-MD5": 466,
            "FileHash-SHA1": 255,
            "FileHash-SHA256": 3783,
            "URL": 4001,
            "CVE": 9,
            "email": 3
          },
          "indicator_count": 10841,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "909 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6546d0120a7e479fecffe2b1",
          "name": "Browser Malware Attack",
          "description": "Attacking  browser to identify researcher.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
          "modified": "2023-12-04T22:00:43.514000",
          "created": "2023-11-04T23:13:21.883000",
          "tags": [
            "united",
            "facebook",
            "phishtank",
            "detection list",
            "ip address",
            "blacklist",
            "paypal",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "million",
            "malicious url",
            "malware site",
            "malicious site",
            "malware",
            "name verdict",
            "falcon sandbox",
            "reports no",
            "speci",
            "efr1",
            "pattern match",
            "file",
            "web open",
            "font format",
            "truetype",
            "indicator",
            "windows nt",
            "et tor",
            "known tor",
            "relayrouter",
            "date",
            "unknown",
            "general",
            "hybrid",
            "local",
            "stream",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "self",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "phishing site",
            "heur",
            "cyber threat",
            "unsafe",
            "riskware",
            "phishing",
            "bank",
            "service",
            "artemis",
            "team",
            "xtrat",
            "agent",
            "xrat",
            "filetour",
            "exploit",
            "conduit",
            "opencandy",
            "fusioncore",
            "orkut",
            "steam",
            "genkryptik",
            "runescape",
            "presenoker",
            "ramnit",
            "msil",
            "crack",
            "tofsee",
            "suppobox",
            "malicious",
            "simda",
            "vawtrak",
            "hotmail",
            "generic",
            "webtoolbar",
            "hsbc",
            "maltiverse",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "count blacklist",
            "tag count",
            "downldr",
            "cleaner",
            "iframe",
            "wacatac",
            "alexa",
            "win64",
            "swrort",
            "installcore",
            "azorult",
            "download",
            "blacknet rat",
            "stealer",
            "softcnapp",
            "nircmd",
            "unruy",
            "patcher",
            "adload",
            "dropper",
            "installpack",
            "tiggre",
            "gamehack",
            "trojanspy",
            "germany http",
            "attacker",
            "static engine",
            "internet storm",
            "center",
            "passive dns",
            "urls",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "url http",
            "pulse pulses",
            "http",
            "related nids"
          ],
          "references": [
            "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
            "object.prototype.hasownproperty.call",
            "hasownproperty.call",
            "a.default.meta.applestore.id",
            "applestore.id",
            "http://decafsmob.this.id",
            "id.google.com",
            "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
            "http://git.io/yBU2rg",
            "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
            "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
            "http://tracking.3061331.corn10wuk.club",
            "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
            "apps.apple.com/us/app/id$",
            "t.name",
            "http://e.id?e.id:e.id.getAttribute",
            "location.search",
            "https://dnsorangetel.dn2.n-helix.com",
            "1080p-torrent.ml",
            "states.app",
            "dev-2.ernestatech.com",
            "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
            "209.85.145.113 [malware]",
            "cdn.fuckporntube.com",
            "www.search.app.goo.gl",
            "apps.apple.com",
            "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
            "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
            "globalworker1.sol.us",
            "worker-m-tlcus1.sol.us"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Ireland",
            "Singapore"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "HSBC",
              "display_name": "HSBC",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 33,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1015,
            "hostname": 1309,
            "FileHash-MD5": 466,
            "FileHash-SHA1": 255,
            "FileHash-SHA256": 3783,
            "URL": 4001,
            "CVE": 9,
            "email": 3
          },
          "indicator_count": 10841,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 232,
          "modified_text": "909 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "622d3e8baa0e3f18af673346",
          "name": "update9.cta.99.com/spzf/spco_8353.exe",
          "description": "",
          "modified": "2022-04-12T00:02:34.248000",
          "created": "2022-03-13T00:44:59.229000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "ansi",
            "threat level",
            "sha256",
            "size",
            "date",
            "path",
            "runtime data",
            "pcap",
            "unicode",
            "pcap processing",
            "accept",
            "suspicious",
            "malicious",
            "hybrid",
            "close",
            "click",
            "hosts",
            "general",
            "local",
            "strings"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/c9746684dc0ee5b297eb5df746a4c591d40188a4417f032f0781b73c67acaad5/622d305ca1ef335ee50f6db2"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 14,
            "URL": 26,
            "domain": 7,
            "FileHash-SHA256": 76,
            "FileHash-MD5": 44,
            "FileHash-SHA1": 41
          },
          "indicator_count": 208,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 394,
          "modified_text": "1511 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "622d0de8dc376a8b02b4e32c",
          "name": "http://projectorworld.ru/blog/770.htm",
          "description": "",
          "modified": "2022-04-11T00:04:29.819000",
          "created": "2022-03-12T21:17:28.098000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "ansi",
            "data",
            "decrypted ssl",
            "windows nt",
            "threat level",
            "date",
            "sha256",
            "pcap",
            "pcap processing",
            "reference",
            "path",
            "accept",
            "suspicious",
            "malicious",
            "kcor",
            "nenet",
            "mumo",
            "hybrid",
            "close",
            "click",
            "hosts",
            "general",
            "local",
            "factory",
            "strings",
            "format"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/09e8201ad88a17ad98b0b47f25e9e60b54a15830420811927f1125463a5efab5?environmentId=100"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 334,
            "URL": 991,
            "FileHash-SHA256": 447,
            "domain": 151,
            "email": 2,
            "FileHash-MD5": 61,
            "FileHash-SHA1": 50,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 2038,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 394,
          "modified_text": "1512 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
        "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
        "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
        "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
        "applestore.id",
        "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
        "https://dnsorangetel.dn2.n-helix.com",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
        "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
        "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
        "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
        "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d",
        "http://tracking.3061331.corn10wuk.club",
        "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
        "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
        "http://git.io/yBU2rg",
        "cdn.fuckporntube.com",
        "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
        "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
        "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
        "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
        "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
        "1080p-torrent.ml",
        "https://hybrid-analysis.com/sample/c9746684dc0ee5b297eb5df746a4c591d40188a4417f032f0781b73c67acaad5/622d305ca1ef335ee50f6db2",
        "worker-m-tlcus1.sol.us",
        "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
        "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
        "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
        "hasownproperty.call",
        "apps.apple.com/us/app/id$",
        "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
        "http://decafsmob.this.id",
        "object.prototype.hasownproperty.call",
        "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
        "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
        "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
        "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
        "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
        "apps.apple.com",
        "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
        "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
        "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
        "id.google.com",
        "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
        "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
        "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
        "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
        "http://e.id?e.id:e.id.getAttribute",
        "globalworker1.sol.us",
        "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
        "209.85.145.113 [malware]",
        "https://hybrid-analysis.com/sample/09e8201ad88a17ad98b0b47f25e9e60b54a15830420811927f1125463a5efab5?environmentId=100",
        "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
        "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
        "www.search.app.goo.gl",
        "boot.net.anydesk.com removed from my Pulse below",
        "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
        "dev-2.ernestatech.com",
        "states.app",
        "location.search",
        "a.default.meta.applestore.id",
        "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
        "Above links in search results direct out with and arrow pointing out.",
        "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com",
        "t.name"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Alf:jasyp:backdoor:win32/cycbot",
            "Webtoolbar",
            "Win.trojan.xblocker-236",
            "Sakula",
            "Gamehack",
            "Worm:win32/autorun",
            "Hsbc",
            "Maltiverse",
            "Ransom:win32/genasom",
            "Trojanspy",
            "Win.trojan.poetrat-7669676-0",
            "Mivast",
            "Win32:mystic",
            "#lowfienabledtcontinueafterunpacking",
            "Trojanspy:win32/usteal"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "6888a85aa32aab22f638d0e6",
      "name": "Autodesk issue in CrowdStrike prior to outage | [by scoreblue]",
      "description": "",
      "modified": "2025-07-29T10:54:18.501000",
      "created": "2025-07-29T10:54:18.501000",
      "tags": [
        "healthy check",
        "ssl bypass",
        "domain tracker",
        "privacy badger",
        "startpage",
        "w11 pc",
        "pass",
        "iocs",
        "all scoreblue",
        "pdf report",
        "pcap",
        "stix",
        "avast avg",
        "no expiration",
        "status",
        "name servers",
        "moved",
        "h1 center",
        "next",
        "sec ch",
        "ch ua",
        "ua platform",
        "emails",
        "certificate",
        "passive dns",
        "urls",
        "encrypt",
        "body",
        "pe32 executable",
        "ms windows",
        "intel",
        "windows control",
        "panel item",
        "dos borland",
        "executable",
        "algorithm",
        "thumbprint",
        "serial number",
        "signing ca",
        "symantec time",
        "stamping",
        "g2 name",
        "g2 issuer",
        "class",
        "code",
        "kb pe",
        "csc corporate",
        "porkbun llc",
        "gandi sas",
        "request",
        "path",
        "get https",
        "get http",
        "response",
        "cachecontrol",
        "pragma",
        "connection",
        "gmt connection",
        "accept",
        "slug",
        "as29789",
        "united",
        "unknown",
        "ransom",
        "heur",
        "server",
        "registrar abuse",
        "san rafael",
        "autodesk",
        "contact phone",
        "registrar url",
        "process32nextw",
        "create c",
        "read c",
        "writeconsolew",
        "delete",
        "write",
        "show",
        "malware",
        "write c",
        "regsetvalueexa",
        "delete c",
        "search",
        "regdword",
        "whitelisted",
        "panda banker",
        "ursnif",
        "win32",
        "persistence",
        "execution",
        "banker",
        "local",
        "domain",
        "servers",
        "pulse pulses",
        "files",
        "ip address",
        "creation date",
        "united kingdom",
        "as9009 m247",
        "ipv4",
        "pulse submit",
        "url analysis",
        "twitter",
        "as16552 tiggee",
        "as397241",
        "as397240",
        "entries",
        "cname",
        "nxdomain",
        "a nxdomain",
        "worm",
        "file samples",
        "files matching",
        "alf features",
        "denver co",
        "wewatta",
        "scan endpoints",
        "related pulses",
        "date hash",
        "showing",
        "as62597 nsone",
        "date",
        "trojanspy",
        "cookie",
        "hostmaster",
        "expiration date",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tls handshake",
        "et info",
        "getdc0x2a",
        "failure",
        "post http",
        "copy",
        "crash",
        "ascii text",
        "ascii",
        "jpeg image",
        "artemis",
        "trojan",
        "virustotal",
        "mike",
        "vipre",
        "panda",
        "win32mediadrug",
        "win324shared",
        "win32spigot",
        "hstr",
        "lowfi",
        "yara detections",
        "contacted",
        "report spam",
        "mozilla",
        "trojanclicker",
        "url http",
        "url https",
        "role title",
        "added active",
        "type indicator",
        "source domain",
        "akamai rank",
        "hostname",
        "ver2",
        "msclkidn",
        "vids0",
        "global outage",
        "cobalt strike",
        "fancy bear",
        "communications",
        "android device",
        "cnc beacon",
        "suspicious ua",
        "youtube",
        "sakula rat",
        "mivast",
        "sakula",
        "windows",
        "samuel tulach",
        "light dark",
        "samuel",
        "tulach",
        "hyperv",
        "detecting",
        "writing gui",
        "bootkits",
        "world",
        "information",
        "discovery",
        "t1027",
        "t1057",
        "t1071",
        "protocol",
        "t1105",
        "tool transfer",
        "t1129",
        "capture",
        "service",
        "t1119"
      ],
      "references": [
        "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
        "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
        "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
        "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
        "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
        "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
        "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
        "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
        "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
        "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
        "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
        "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
        "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com",
        "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
        "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
        "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
        "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
        "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
        "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
        "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
        "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
        "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
        "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
        "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
        "Above links in search results direct out with and arrow pointing out.",
        "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
        "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
        "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
        "boot.net.anydesk.com removed from my Pulse below",
        "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "Win32:Mystic",
          "display_name": "Win32:Mystic",
          "target": null
        },
        {
          "id": "Win.Trojan.Xblocker-236",
          "display_name": "Win.Trojan.Xblocker-236",
          "target": null
        },
        {
          "id": "Ransom:Win32/Genasom",
          "display_name": "Ransom:Win32/Genasom",
          "target": "/malware/Ransom:Win32/Genasom"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "ALF:JASYP:Backdoor:Win32/Cycbot",
          "display_name": "ALF:JASYP:Backdoor:Win32/Cycbot",
          "target": null
        },
        {
          "id": "#LowFiEnableDTContinueAfterUnpacking",
          "display_name": "#LowFiEnableDTContinueAfterUnpacking",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Usteal",
          "display_name": "TrojanSpy:Win32/Usteal",
          "target": "/malware/TrojanSpy:Win32/Usteal"
        },
        {
          "id": "Win.Trojan.PoetRat-7669676-0",
          "display_name": "Win.Trojan.PoetRat-7669676-0",
          "target": null
        },
        {
          "id": "Mivast",
          "display_name": "Mivast",
          "target": null
        },
        {
          "id": "Sakula",
          "display_name": "Sakula",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1021",
          "name": "Remote Services",
          "display_name": "T1021 - Remote Services"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1498",
          "name": "Network Denial of Service",
          "display_name": "T1498 - Network Denial of Service"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "66d89c45ddc0c7db084b75b7",
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1417,
        "FileHash-SHA1": 1165,
        "FileHash-SHA256": 6536,
        "URL": 6112,
        "domain": 1340,
        "hostname": 2654,
        "email": 15,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 19248,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "307 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66d89c45ddc0c7db084b75b7",
      "name": "Autodesk weakens CS | Unauthorized AlienVault API | Stolen pulsed",
      "description": "Critical issues within AlienVault , VT & my devices. Plugins auto installed after I opened  message from AV user. Sudden redirects to 0/ http/s.   Heavy modifications, removal of IoC's  on AV & VT  & Virus Total. Autodesk.com was under CrowdStrike  until last night. Links where vulnerabilities were originating from completely disappeared from graph I kindly kept private. Continuous mods for  months to Crowdstrike and other  pulses. [https://otx.alienvault.com/api appears in search] A page opens with Tag: \"esta caliente\" | All linked pulses Gone. Only person who frequently contacted me appears where they didn't before & These dishonest billion $ companies cover up though they are at fault for allowing ALL threat actor to be protected with  non adversarial businesses.  Besides other compromises, surprisingly Brashears porn found in Crowdstrike/Autodesk  others. Disappointing.",
      "modified": "2024-10-04T17:02:07.067000",
      "created": "2024-09-04T17:43:33.123000",
      "tags": [
        "healthy check",
        "ssl bypass",
        "domain tracker",
        "privacy badger",
        "startpage",
        "w11 pc",
        "pass",
        "iocs",
        "all scoreblue",
        "pdf report",
        "pcap",
        "stix",
        "avast avg",
        "no expiration",
        "status",
        "name servers",
        "moved",
        "h1 center",
        "next",
        "sec ch",
        "ch ua",
        "ua platform",
        "emails",
        "certificate",
        "passive dns",
        "urls",
        "encrypt",
        "body",
        "pe32 executable",
        "ms windows",
        "intel",
        "windows control",
        "panel item",
        "dos borland",
        "executable",
        "algorithm",
        "thumbprint",
        "serial number",
        "signing ca",
        "symantec time",
        "stamping",
        "g2 name",
        "g2 issuer",
        "class",
        "code",
        "kb pe",
        "csc corporate",
        "porkbun llc",
        "gandi sas",
        "request",
        "path",
        "get https",
        "get http",
        "response",
        "cachecontrol",
        "pragma",
        "connection",
        "gmt connection",
        "accept",
        "slug",
        "as29789",
        "united",
        "unknown",
        "ransom",
        "heur",
        "server",
        "registrar abuse",
        "san rafael",
        "autodesk",
        "contact phone",
        "registrar url",
        "process32nextw",
        "create c",
        "read c",
        "writeconsolew",
        "delete",
        "write",
        "show",
        "malware",
        "write c",
        "regsetvalueexa",
        "delete c",
        "search",
        "regdword",
        "whitelisted",
        "panda banker",
        "ursnif",
        "win32",
        "persistence",
        "execution",
        "banker",
        "local",
        "domain",
        "servers",
        "pulse pulses",
        "files",
        "ip address",
        "creation date",
        "united kingdom",
        "as9009 m247",
        "ipv4",
        "pulse submit",
        "url analysis",
        "twitter",
        "as16552 tiggee",
        "as397241",
        "as397240",
        "entries",
        "cname",
        "nxdomain",
        "a nxdomain",
        "worm",
        "file samples",
        "files matching",
        "alf features",
        "denver co",
        "wewatta",
        "scan endpoints",
        "related pulses",
        "date hash",
        "showing",
        "as62597 nsone",
        "date",
        "trojanspy",
        "cookie",
        "hostmaster",
        "expiration date",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tls handshake",
        "et info",
        "getdc0x2a",
        "failure",
        "post http",
        "copy",
        "crash",
        "ascii text",
        "ascii",
        "jpeg image",
        "artemis",
        "trojan",
        "virustotal",
        "mike",
        "vipre",
        "panda",
        "win32mediadrug",
        "win324shared",
        "win32spigot",
        "hstr",
        "lowfi",
        "yara detections",
        "contacted",
        "report spam",
        "mozilla",
        "trojanclicker",
        "url http",
        "url https",
        "role title",
        "added active",
        "type indicator",
        "source domain",
        "akamai rank",
        "hostname",
        "ver2",
        "msclkidn",
        "vids0",
        "global outage",
        "cobalt strike",
        "fancy bear",
        "communications",
        "android device",
        "cnc beacon",
        "suspicious ua",
        "youtube",
        "sakula rat",
        "mivast",
        "sakula",
        "windows",
        "samuel tulach",
        "light dark",
        "samuel",
        "tulach",
        "hyperv",
        "detecting",
        "writing gui",
        "bootkits",
        "world",
        "information",
        "discovery",
        "t1027",
        "t1057",
        "t1071",
        "protocol",
        "t1105",
        "tool transfer",
        "t1129",
        "capture",
        "service",
        "t1119"
      ],
      "references": [
        "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
        "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
        "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
        "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
        "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
        "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
        "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
        "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
        "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
        "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
        "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
        "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
        "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com",
        "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
        "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
        "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
        "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
        "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
        "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
        "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
        "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
        "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
        "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
        "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
        "Above links in search results direct out with and arrow pointing out.",
        "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
        "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
        "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
        "boot.net.anydesk.com removed from my Pulse below",
        "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "Win32:Mystic",
          "display_name": "Win32:Mystic",
          "target": null
        },
        {
          "id": "Win.Trojan.Xblocker-236",
          "display_name": "Win.Trojan.Xblocker-236",
          "target": null
        },
        {
          "id": "Ransom:Win32/Genasom",
          "display_name": "Ransom:Win32/Genasom",
          "target": "/malware/Ransom:Win32/Genasom"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "ALF:JASYP:Backdoor:Win32/Cycbot",
          "display_name": "ALF:JASYP:Backdoor:Win32/Cycbot",
          "target": null
        },
        {
          "id": "#LowFiEnableDTContinueAfterUnpacking",
          "display_name": "#LowFiEnableDTContinueAfterUnpacking",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Usteal",
          "display_name": "TrojanSpy:Win32/Usteal",
          "target": "/malware/TrojanSpy:Win32/Usteal"
        },
        {
          "id": "Win.Trojan.PoetRat-7669676-0",
          "display_name": "Win.Trojan.PoetRat-7669676-0",
          "target": null
        },
        {
          "id": "Mivast",
          "display_name": "Mivast",
          "target": null
        },
        {
          "id": "Sakula",
          "display_name": "Sakula",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1021",
          "name": "Remote Services",
          "display_name": "T1021 - Remote Services"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1498",
          "name": "Network Denial of Service",
          "display_name": "T1498 - Network Denial of Service"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 38,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1417,
        "FileHash-SHA1": 1165,
        "FileHash-SHA256": 6536,
        "URL": 6112,
        "domain": 1340,
        "hostname": 2654,
        "email": 15,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 19248,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "605 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570819e75a6b853df509785",
      "name": "http://projectorworld.ru/blog/770.htm",
      "description": "",
      "modified": "2023-12-06T14:13:50.518000",
      "created": "2023-12-06T14:13:50.518000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 447,
        "domain": 151,
        "URL": 991,
        "hostname": 334,
        "FileHash-MD5": 61,
        "FileHash-SHA1": 50,
        "email": 2,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 2038,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "908 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6546cf78627adef6562a97aa",
      "name": "Browser Malware Attack",
      "description": "Attacking my browser to identify.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
      "modified": "2023-12-04T22:00:43.514000",
      "created": "2023-11-04T23:10:48.676000",
      "tags": [
        "united",
        "facebook",
        "phishtank",
        "detection list",
        "ip address",
        "blacklist",
        "paypal",
        "cisco umbrella",
        "site",
        "alexa top",
        "safe site",
        "million",
        "malicious url",
        "malware site",
        "malicious site",
        "malware",
        "name verdict",
        "falcon sandbox",
        "reports no",
        "speci",
        "efr1",
        "pattern match",
        "file",
        "web open",
        "font format",
        "truetype",
        "indicator",
        "windows nt",
        "et tor",
        "known tor",
        "relayrouter",
        "date",
        "unknown",
        "general",
        "hybrid",
        "local",
        "stream",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "self",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "phishing site",
        "heur",
        "cyber threat",
        "unsafe",
        "riskware",
        "phishing",
        "bank",
        "service",
        "artemis",
        "team",
        "xtrat",
        "agent",
        "xrat",
        "filetour",
        "exploit",
        "conduit",
        "opencandy",
        "fusioncore",
        "orkut",
        "steam",
        "genkryptik",
        "runescape",
        "presenoker",
        "ramnit",
        "msil",
        "crack",
        "tofsee",
        "suppobox",
        "malicious",
        "simda",
        "vawtrak",
        "hotmail",
        "generic",
        "webtoolbar",
        "hsbc",
        "maltiverse",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "count blacklist",
        "tag count",
        "downldr",
        "cleaner",
        "iframe",
        "wacatac",
        "alexa",
        "win64",
        "swrort",
        "installcore",
        "azorult",
        "download",
        "blacknet rat",
        "stealer",
        "softcnapp",
        "nircmd",
        "unruy",
        "patcher",
        "adload",
        "dropper",
        "installpack",
        "tiggre",
        "gamehack",
        "trojanspy",
        "germany http",
        "attacker",
        "static engine",
        "internet storm",
        "center",
        "passive dns",
        "urls",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "url http",
        "pulse pulses",
        "http",
        "related nids"
      ],
      "references": [
        "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
        "object.prototype.hasownproperty.call",
        "hasownproperty.call",
        "a.default.meta.applestore.id",
        "applestore.id",
        "http://decafsmob.this.id",
        "id.google.com",
        "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
        "http://git.io/yBU2rg",
        "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
        "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
        "http://tracking.3061331.corn10wuk.club",
        "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
        "apps.apple.com/us/app/id$",
        "t.name",
        "http://e.id?e.id:e.id.getAttribute",
        "location.search",
        "https://dnsorangetel.dn2.n-helix.com",
        "1080p-torrent.ml",
        "states.app",
        "dev-2.ernestatech.com",
        "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
        "209.85.145.113 [malware]",
        "cdn.fuckporntube.com",
        "www.search.app.goo.gl",
        "apps.apple.com",
        "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
        "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
        "globalworker1.sol.us",
        "worker-m-tlcus1.sol.us"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Ireland",
        "Singapore"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "HSBC",
          "display_name": "HSBC",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "GameHack",
          "display_name": "GameHack",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1015,
        "hostname": 1309,
        "FileHash-MD5": 466,
        "FileHash-SHA1": 255,
        "FileHash-SHA256": 3783,
        "URL": 4001,
        "CVE": 9,
        "email": 3
      },
      "indicator_count": 10841,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "909 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6546d0120a7e479fecffe2b1",
      "name": "Browser Malware Attack",
      "description": "Attacking  browser to identify researcher.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
      "modified": "2023-12-04T22:00:43.514000",
      "created": "2023-11-04T23:13:21.883000",
      "tags": [
        "united",
        "facebook",
        "phishtank",
        "detection list",
        "ip address",
        "blacklist",
        "paypal",
        "cisco umbrella",
        "site",
        "alexa top",
        "safe site",
        "million",
        "malicious url",
        "malware site",
        "malicious site",
        "malware",
        "name verdict",
        "falcon sandbox",
        "reports no",
        "speci",
        "efr1",
        "pattern match",
        "file",
        "web open",
        "font format",
        "truetype",
        "indicator",
        "windows nt",
        "et tor",
        "known tor",
        "relayrouter",
        "date",
        "unknown",
        "general",
        "hybrid",
        "local",
        "stream",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "self",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "phishing site",
        "heur",
        "cyber threat",
        "unsafe",
        "riskware",
        "phishing",
        "bank",
        "service",
        "artemis",
        "team",
        "xtrat",
        "agent",
        "xrat",
        "filetour",
        "exploit",
        "conduit",
        "opencandy",
        "fusioncore",
        "orkut",
        "steam",
        "genkryptik",
        "runescape",
        "presenoker",
        "ramnit",
        "msil",
        "crack",
        "tofsee",
        "suppobox",
        "malicious",
        "simda",
        "vawtrak",
        "hotmail",
        "generic",
        "webtoolbar",
        "hsbc",
        "maltiverse",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "count blacklist",
        "tag count",
        "downldr",
        "cleaner",
        "iframe",
        "wacatac",
        "alexa",
        "win64",
        "swrort",
        "installcore",
        "azorult",
        "download",
        "blacknet rat",
        "stealer",
        "softcnapp",
        "nircmd",
        "unruy",
        "patcher",
        "adload",
        "dropper",
        "installpack",
        "tiggre",
        "gamehack",
        "trojanspy",
        "germany http",
        "attacker",
        "static engine",
        "internet storm",
        "center",
        "passive dns",
        "urls",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "url http",
        "pulse pulses",
        "http",
        "related nids"
      ],
      "references": [
        "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
        "object.prototype.hasownproperty.call",
        "hasownproperty.call",
        "a.default.meta.applestore.id",
        "applestore.id",
        "http://decafsmob.this.id",
        "id.google.com",
        "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
        "http://git.io/yBU2rg",
        "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
        "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
        "http://tracking.3061331.corn10wuk.club",
        "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
        "apps.apple.com/us/app/id$",
        "t.name",
        "http://e.id?e.id:e.id.getAttribute",
        "location.search",
        "https://dnsorangetel.dn2.n-helix.com",
        "1080p-torrent.ml",
        "states.app",
        "dev-2.ernestatech.com",
        "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
        "209.85.145.113 [malware]",
        "cdn.fuckporntube.com",
        "www.search.app.goo.gl",
        "apps.apple.com",
        "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
        "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
        "globalworker1.sol.us",
        "worker-m-tlcus1.sol.us"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Ireland",
        "Singapore"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "HSBC",
          "display_name": "HSBC",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "GameHack",
          "display_name": "GameHack",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 33,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1015,
        "hostname": 1309,
        "FileHash-MD5": 466,
        "FileHash-SHA1": 255,
        "FileHash-SHA256": 3783,
        "URL": 4001,
        "CVE": 9,
        "email": 3
      },
      "indicator_count": 10841,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 232,
      "modified_text": "909 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "622d3e8baa0e3f18af673346",
      "name": "update9.cta.99.com/spzf/spco_8353.exe",
      "description": "",
      "modified": "2022-04-12T00:02:34.248000",
      "created": "2022-03-13T00:44:59.229000",
      "tags": [
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "ansi",
        "threat level",
        "sha256",
        "size",
        "date",
        "path",
        "runtime data",
        "pcap",
        "unicode",
        "pcap processing",
        "accept",
        "suspicious",
        "malicious",
        "hybrid",
        "close",
        "click",
        "hosts",
        "general",
        "local",
        "strings"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/c9746684dc0ee5b297eb5df746a4c591d40188a4417f032f0781b73c67acaad5/622d305ca1ef335ee50f6db2"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 14,
        "URL": 26,
        "domain": 7,
        "FileHash-SHA256": 76,
        "FileHash-MD5": 44,
        "FileHash-SHA1": 41
      },
      "indicator_count": 208,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 394,
      "modified_text": "1511 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "622d0de8dc376a8b02b4e32c",
      "name": "http://projectorworld.ru/blog/770.htm",
      "description": "",
      "modified": "2022-04-11T00:04:29.819000",
      "created": "2022-03-12T21:17:28.098000",
      "tags": [
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "ansi",
        "data",
        "decrypted ssl",
        "windows nt",
        "threat level",
        "date",
        "sha256",
        "pcap",
        "pcap processing",
        "reference",
        "path",
        "accept",
        "suspicious",
        "malicious",
        "kcor",
        "nenet",
        "mumo",
        "hybrid",
        "close",
        "click",
        "hosts",
        "general",
        "local",
        "factory",
        "strings",
        "format"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/09e8201ad88a17ad98b0b47f25e9e60b54a15830420811927f1125463a5efab5?environmentId=100"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 334,
        "URL": 991,
        "FileHash-SHA256": 447,
        "domain": 151,
        "email": 2,
        "FileHash-MD5": 61,
        "FileHash-SHA1": 50,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 2038,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 394,
      "modified_text": "1512 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "deaval.com.ar",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "deaval.com.ar",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780346742.7262206
}