{
  "type": "Domain",
  "indicator": "dhtcrypt.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/dhtcrypt.com",
    "alexa": "http://www.alexa.com/siteinfo/dhtcrypt.com",
    "indicator": "dhtcrypt.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3658669894,
      "indicator": "dhtcrypt.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "642eac06b2963a871b0fdd45",
          "name": "just a bunch of tv's - Oh maybe these tv channels are all neural \ud83e\udd37\u200d\u2640\ufe0f world tv stream infection",
          "description": "The Falcon Sandbox malware analysis service is available to download, download and use any of the Falcon MalQuery tools or information you may have seen on the website. \u00c2\u00a31.5m",
          "modified": "2023-05-06T10:00:48.707000",
          "created": "2023-04-06T11:24:54.313000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "ansi",
            "dropped file",
            "runtime data",
            "chromeua",
            "span",
            "optout",
            "pcap processing",
            "pattern match",
            "script",
            "click",
            "date",
            "middle",
            "null",
            "april",
            "twitter",
            "body",
            "error",
            "jackson",
            "desktop",
            "service",
            "bill",
            "heat",
            "webview",
            "cruise",
            "blank",
            "meta",
            "night",
            "false",
            "contact",
            "suspicious",
            "facebook",
            "close",
            "cannon",
            "mayberry",
            "santana",
            "comment",
            "flex",
            "karma",
            "nightmare",
            "find",
            "spacer",
            "kitty",
            "mike",
            "local",
            "already",
            "soldier",
            "wallpaper",
            "story",
            "generic",
            "tiny",
            "trident",
            "android",
            "hybrid",
            "general",
            "hosts",
            "favorite",
            "homepage",
            "music",
            "code",
            "push",
            "strings",
            "malicious",
            "qakbot",
            "25px",
            "60px",
            "24px",
            "100px",
            "1439px",
            "segoe ui",
            "roboto",
            "path",
            "chat",
            "form",
            "embed",
            "unknown",
            "live",
            "network",
            "unicode",
            "feed",
            "5000",
            "next",
            "fullscreen",
            "iframe",
            "latv",
            "latino voices",
            "localappdata",
            "latino",
            "noscript",
            "pragma",
            "this",
            "hybrid analysis",
            "programfiles",
            "input",
            "wilstaging02",
            "potential ip"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb",
            "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd",
            "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36",
            "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9",
            "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1291,
            "email": 13,
            "domain": 591,
            "URL": 3931,
            "FileHash-SHA256": 431,
            "FileHash-MD5": 92,
            "FileHash-SHA1": 89
          },
          "indicator_count": 6438,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 93,
          "modified_text": "1123 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "64405bb59eb4323cde717b83",
          "name": "ttps://accounts.flybe.com/o3r-app-server/flybe/login - from wallet.bundle.js that i see has not published \ud83d\ude21",
          "description": "",
          "modified": "2023-04-19T21:23:01.734000",
          "created": "2023-04-19T21:23:01.734000",
          "tags": [
            "url https",
            "chromeua",
            "runtime data",
            "optout",
            "ansi",
            "unicode",
            "temp",
            "dropped file",
            "localappdata",
            "drmedgeua",
            "optin",
            "hosts",
            "qakbot"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/62c8b9e6618f124d6103d9cc8bf0b29309e32e250b15f2cf5bdbab7c718c1970/643fc8790148eb4a120d88de"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1087",
              "name": "Account Discovery",
              "display_name": "T1087 - Account Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 150,
            "URL": 1741,
            "hostname": 519,
            "FileHash-SHA256": 73,
            "FileHash-MD5": 69,
            "FileHash-SHA1": 69,
            "IPv4": 2,
            "email": 4
          },
          "indicator_count": 2627,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 90,
          "modified_text": "1140 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "64405bb46b8e08b76da24b14",
          "name": "ttps://accounts.flybe.com/o3r-app-server/flybe/login - from wallet.bundle.js that i see has not published \ud83d\ude21",
          "description": "",
          "modified": "2023-04-19T21:23:00.215000",
          "created": "2023-04-19T21:23:00.215000",
          "tags": [
            "url https",
            "chromeua",
            "runtime data",
            "optout",
            "ansi",
            "unicode",
            "temp",
            "dropped file",
            "localappdata",
            "drmedgeua",
            "optin",
            "hosts",
            "qakbot"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/62c8b9e6618f124d6103d9cc8bf0b29309e32e250b15f2cf5bdbab7c718c1970/643fc8790148eb4a120d88de"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1087",
              "name": "Account Discovery",
              "display_name": "T1087 - Account Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 150,
            "URL": 1741,
            "hostname": 519,
            "FileHash-SHA256": 73,
            "FileHash-MD5": 69,
            "FileHash-SHA1": 69,
            "IPv4": 2,
            "email": 4
          },
          "indicator_count": 2627,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 90,
          "modified_text": "1140 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0",
        "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd",
        "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb",
        "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36",
        "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9",
        "https://hybrid-analysis.com/sample/62c8b9e6618f124d6103d9cc8bf0b29309e32e250b15f2cf5bdbab7c718c1970/643fc8790148eb4a120d88de"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "642eac06b2963a871b0fdd45",
      "name": "just a bunch of tv's - Oh maybe these tv channels are all neural \ud83e\udd37\u200d\u2640\ufe0f world tv stream infection",
      "description": "The Falcon Sandbox malware analysis service is available to download, download and use any of the Falcon MalQuery tools or information you may have seen on the website. \u00c2\u00a31.5m",
      "modified": "2023-05-06T10:00:48.707000",
      "created": "2023-04-06T11:24:54.313000",
      "tags": [
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "ansi",
        "dropped file",
        "runtime data",
        "chromeua",
        "span",
        "optout",
        "pcap processing",
        "pattern match",
        "script",
        "click",
        "date",
        "middle",
        "null",
        "april",
        "twitter",
        "body",
        "error",
        "jackson",
        "desktop",
        "service",
        "bill",
        "heat",
        "webview",
        "cruise",
        "blank",
        "meta",
        "night",
        "false",
        "contact",
        "suspicious",
        "facebook",
        "close",
        "cannon",
        "mayberry",
        "santana",
        "comment",
        "flex",
        "karma",
        "nightmare",
        "find",
        "spacer",
        "kitty",
        "mike",
        "local",
        "already",
        "soldier",
        "wallpaper",
        "story",
        "generic",
        "tiny",
        "trident",
        "android",
        "hybrid",
        "general",
        "hosts",
        "favorite",
        "homepage",
        "music",
        "code",
        "push",
        "strings",
        "malicious",
        "qakbot",
        "25px",
        "60px",
        "24px",
        "100px",
        "1439px",
        "segoe ui",
        "roboto",
        "path",
        "chat",
        "form",
        "embed",
        "unknown",
        "live",
        "network",
        "unicode",
        "feed",
        "5000",
        "next",
        "fullscreen",
        "iframe",
        "latv",
        "latino voices",
        "localappdata",
        "latino",
        "noscript",
        "pragma",
        "this",
        "hybrid analysis",
        "programfiles",
        "input",
        "wilstaging02",
        "potential ip"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb",
        "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd",
        "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36",
        "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9",
        "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1291,
        "email": 13,
        "domain": 591,
        "URL": 3931,
        "FileHash-SHA256": 431,
        "FileHash-MD5": 92,
        "FileHash-SHA1": 89
      },
      "indicator_count": 6438,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 93,
      "modified_text": "1123 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "64405bb59eb4323cde717b83",
      "name": "ttps://accounts.flybe.com/o3r-app-server/flybe/login - from wallet.bundle.js that i see has not published \ud83d\ude21",
      "description": "",
      "modified": "2023-04-19T21:23:01.734000",
      "created": "2023-04-19T21:23:01.734000",
      "tags": [
        "url https",
        "chromeua",
        "runtime data",
        "optout",
        "ansi",
        "unicode",
        "temp",
        "dropped file",
        "localappdata",
        "drmedgeua",
        "optin",
        "hosts",
        "qakbot"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/62c8b9e6618f124d6103d9cc8bf0b29309e32e250b15f2cf5bdbab7c718c1970/643fc8790148eb4a120d88de"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1087",
          "name": "Account Discovery",
          "display_name": "T1087 - Account Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 150,
        "URL": 1741,
        "hostname": 519,
        "FileHash-SHA256": 73,
        "FileHash-MD5": 69,
        "FileHash-SHA1": 69,
        "IPv4": 2,
        "email": 4
      },
      "indicator_count": 2627,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 90,
      "modified_text": "1140 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "64405bb46b8e08b76da24b14",
      "name": "ttps://accounts.flybe.com/o3r-app-server/flybe/login - from wallet.bundle.js that i see has not published \ud83d\ude21",
      "description": "",
      "modified": "2023-04-19T21:23:00.215000",
      "created": "2023-04-19T21:23:00.215000",
      "tags": [
        "url https",
        "chromeua",
        "runtime data",
        "optout",
        "ansi",
        "unicode",
        "temp",
        "dropped file",
        "localappdata",
        "drmedgeua",
        "optin",
        "hosts",
        "qakbot"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/62c8b9e6618f124d6103d9cc8bf0b29309e32e250b15f2cf5bdbab7c718c1970/643fc8790148eb4a120d88de"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1087",
          "name": "Account Discovery",
          "display_name": "T1087 - Account Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 150,
        "URL": 1741,
        "hostname": 519,
        "FileHash-SHA256": 73,
        "FileHash-MD5": 69,
        "FileHash-SHA1": 69,
        "IPv4": 2,
        "email": 4
      },
      "indicator_count": 2627,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 90,
      "modified_text": "1140 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "dhtcrypt.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "dhtcrypt.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780440982.2597225
}