{ "type": "URL", "indicator": "http://usage.vinacf.com/cgi-sys/defaultwebpage.cgi", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "http://usage.vinacf.com/cgi-sys/defaultwebpage.cgi", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 2277340035, "indicator": "http://usage.vinacf.com/cgi-sys/defaultwebpage.cgi", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "69d20ba20b81857c628e1d9e", "name": "VirusTotal Windows Sandbox", "description": "A security alert has been issued by the UK government over the weekend, with the result of a malicious web address being sent to a member of the public via an address address linked tolinkedin.", "modified": "2026-05-05T07:28:14.492000", "created": "2026-04-05T07:13:38.735000", "tags": [ "windows sandbox", "calls process", "time", "request header", "host", "windows nt", "win64", "khtml", "gecko", "acceptencoding", "accept", "response header", "date", "dword", "malware", "file type", "utf8", "crlf line", "unicode text", "yara", "binary", "found", "sample", "mitre attack", "malicious", "window", "next", "detail info", "tickcount", "behaviour", "processid", "threadid", "startaddress", "parameter", "offset", "windows xp", "professional", "write", "info", "shell", "cultureneutral", "count", "default", "subsys11001af4", "rev003", "rev033", "folders api", "skylakeibrs", "daba3ff", "inprocserver32", "first", "virustotal", "enterprise", "service", "close", "win32 exe", "pe32", "ms windows", "win16 ne", "icons library", "os2 executable", "generic windos", "executable", "pe64 library", "cname", "none rticon", "file size", "sha256", "mwdb", "bazaar", "sha3384", "crc32", "shutdown", "error", "back", "lsappdata", "inetfiles", "windowname", "protocol level", "application", "next connection", "address", "http url", "get http", "full path", "path", "filename", "targetprocess", "writeaddress", "size", "targetpid", "findfirstfileex", "class", "find", "open", "imagepath", "cmdline", "ping", "flags" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/000bdbb9556e3474630b36d57190d5dae719886a6cdecf824af6a456243ebf88_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372160&Signature=wARiO6wRTZGhS9vOpI%2BvoWxpe55%2BBlHjfTVS2m1fsb3%2FyiqXoI5x8uRNh6fj6Qp6DpePIZAM2MHvDzi%2B5TT6VWKI4zyyc%2BeVp9gihB0djBnCJr%2BKCB18kdFNBE%2BicOTMmx5aJ1hSjWQcOBYm9PMkZ6%2BhLzxX3gxTMneBKGhh0ckFJRTRfM2gKMfEPrOQ6aVgfkTWJUR9FQYz5g2qKGSDh1CCNlEzXhO33BEPI9fN", "https://vtbehaviour.commondatastorage.googleapis.com/03a5d431bb42e7730a3ae3b3563cee73e7a782079cf56f57bad5fe665d261e54_SecneurX.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372244&Signature=fXjnCgFbGybFp%2BCRO6a%2FQ3LKU2uLiKNtjgwKzprL3LFL%2BTMgup6nbp7%2F9Hxy8bnBzlFtSzO0fcnf%2FpIsNim0UdrINmB63N9mKkBW1cOkjxV88PAy2nsFZA3FjOEYq4N0lgc8gAtS5eRTt%2Bwb7WjEnd3QQ7aPLuoVl2hjed4hC8Cit6efcSD9GbJCITMeX4%2FVHBYSjmDr4Pgip9ANSZ6wvzkRktqPpC23Qwl62gkuXE%2BKp0s%2Bq%", "https://vtbehaviour.commondatastorage.googleapis.com/14116af49a976b71f7ddd760161a1d50328baa280ac2c9a1f9f3a8996a3929b6_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372327&Signature=bhG0zZxkKhoz9temkLENxZsdN9KeMsxW4nt2II1lmaPLEGAhNM4EmX5e7z1UM9LLsnqrvuZBhQs7ZnBuwSpY5T8iiKIu2%2FfZ83pX1Tw8s%2Bn%2BfXlEl3jlhzXWewZ9i8ZlXd6YIeWETsAak1j93aNnJHB2IPoZn7VISupTj400x7E%2FSm0ilDz4zCCDAjz1eTp1N41HvmoviGQGwTSnjTW5oyBHDm8RglOnnNqcEsm6%2BkGBJToFomLsipvuVIz8", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372451&Signature=Dv9FcZuWlVKlY26EcoSmR4Kcb44tKDv4kyBrDOputdJDLMvfDX9%2Fs4Ss4cLURTdCso74wPUHQpcMVcyeGGK%2F3RwYbxXwJjMGGAJSCfCxIDRiL%2BLOQKY3M7zGyXrkpuwr5lQS4CaKp1LFajsxxwnKpd%2F5eXNMLqlyxh%2ByO3dJWTkY8WqNnnwnSjW0lqpwB9%2BBjgEdIeWsnMRqF0t4JQ8dJsmCbbTXmAKIEZ46Rpio044%2BrsqH", "https://vtbehaviour.commondatastorage.googleapis.com/539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372560&Signature=tXBHkUCyFp7E2Um%2FMUvRPbUvaQmYPeBV7KGbi%2Bssa%2FkYQyqgH4u8fy6h0A8bVbsyQMMPf2EEF2JkzkiD6SXcfLADGdVqHYQya%2F6s2Ox5QnOFkJSATlDdXCWVp%2F4wHxZHInIRcrBPZFjjYFQM0u7VYCEMtkMCS0pzld2nGLlcOuOXBFxGTQPy0A03dikBC4Yw4f%2BdiMLMxO0hxZSo9FxPq1ylB4gs57NBBniylVO4Qi%2BLzleU5", "https://vtbehaviour.commondatastorage.googleapis.com/0ab7fad77871a45137c9f2e40e3cbf47e3d71315f71c8eca9c8d62bc24a53184_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372878&Signature=cLNwLw1L9ZCpQXZej7DaLTWH5w887X5wPnSpN1pwH2N4acSu8Llp25uprGRArg6qCuPbVQ2YPyIeCdwLCZvq%2FU0hP8m17ZPontiyR5zKb7jxcW57eEUuVnuSV9%2FnukwtPPJ%2BTY7a0%2B9rwSAU%2FL%2FJQ1yMke6VIX%2B%2F6KSWHgmLV%2F%2FR%2FbOxB0oZ4%2Fe%2Fsb2%2Fw12dZix7IY6c7wOj1OlWGQSkAZZsEoDw", "https://vtbehaviour.commondatastorage.googleapis.com/01f09136cb86f25635f91144946847d58c559228d50d9b84b0c021d4091b840b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373052&Signature=U7haY6XsgyJ83G1vAOPLrLLS%2BaMP9xAKOlnzSb4I9clIBLt9Y8xzP4qjfBxbeUfdF6s%2B6dtg4dXzqTjrAYSC3XOTEEtHZeK4ePz5qfS9n%2FWNrOKQb30VBhfUNL5DYUCd3XSOPjIVlbRz9ylDpwApfVK2AMarGiLLlnKRDv7M0S63SkQx8eWyabXd2afPPy96ZGNZVZfOhw5llZiztL6mYo%2BVivlyFsDcodH9F4XrS%2FPsSLeJRx5d", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373200&Signature=uMO8ESBCpu0oIIRS0CToWTN9KlOHyq4uWjWMjfdcUCGyliW%2FSy8KDIg6OMWLUQ6SBC45Jm0Mr%2FNV6m74hTSnpmGdVf6k6mA3QrTQwUMaMk2QbBLU1IwUG8wvylr6KXEqQYYCkZksYiZEyNm%2B2hKNvWtKFc%2BZlL7M12RBSER84%2FDRQlJnK6qbDW3DYX1tPsXxTynGj5YxQDlUqfWU8CjZtSAfUK%2Bw%2FoybwyMsJc68%2B01HQ", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373283&Signature=KIPnPqQCcifTzuRS43FhFyzCXei0rDK20JuVvXA3UkB%2Bj6R1a4SAH2sn%2BJO1ohLSxLswzbryMf81lr4eGQCMbr3Wwfwo7kHN1yHV4M187cNxRZlbZ4%2BzOZZgfWt3bJNLx2Z4%2B4aqarco7OzqkhcQizlq8frRttJQjcLcNxgWD3oV2QDxZxurniW%2BhRRUS%2Bv9uGXWIRhWYmbEA%2BaoQsvpX0AIeSUCn4qb%2Fh31hJe7JitkCE", "https://vtbehaviour.commondatastorage.googleapis.com/000007781f616194758c52c551ab2f198970675c9218eab9f1e4470f0a696e71_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373373&Signature=mjvxt7z8ajbHZY%2BdL0G02pE7trUx7SkineLNrDSnq8FxmEuCuDdnNDWKdPawPb4w2NnK5HFkV3BAdTJrRNBxBceLP%2FevhdkmR4C%2BiZZ8pz9GBeqwl0l6oJMBga2ZHfKcA%2BxqQgP5r1zzN%2BZPMH0zxPdHYZA2WlzkfzPBDQcTEDdz8aTIaX%2BOP5JUo4gYjqxxxrdBLVGv0i54PedBqgFw5IRrPpdH%2FwlQGTLKQ%2BSjslq2d0", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373454&Signature=oXNg992chHQhOJxpI2XcWdFB%2FxJme1ol4iA4aOgaKWQcqa9WXsYlPcTANPmFkyrHIciosnksXEJrIAfFsjAYeEqG%2F7oPGCQLBILFHUhwZVcoJR9PgFwUsHBu%2FqiWSOifVPER4vpDL0gbsuNlU6gHT5aWRW%2BwoOwbHSIt5jj%2FJ3%2FxGDBAUaZrSuQurOM0Nb3qRhNN1NOTUj7mGTuUBXdtvnzCFLjxl3Kk6dYYFgmwhWI04P3JIB" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 72, "FileHash-MD5": 56, "FileHash-SHA1": 27, "FileHash-SHA256": 113, "domain": 19, "hostname": 89 }, "indicator_count": 376, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "29 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d20ba21b989eb65ac172a8", "name": "VirusTotal Windows Sandbox", "description": "A security alert has been issued by the UK government over the weekend, with the result of a malicious web address being sent to a member of the public via an address address linked tolinkedin.", "modified": "2026-05-05T07:28:14.492000", "created": "2026-04-05T07:13:38.308000", "tags": [ "windows sandbox", "calls process", "time", "request header", "host", "windows nt", "win64", "khtml", "gecko", "acceptencoding", "accept", "response header", "date", "dword", "malware", "file type", "utf8", "crlf line", "unicode text", "yara", "binary", "found", "sample", "mitre attack", "malicious", "window", "next", "detail info", "tickcount", "behaviour", "processid", "threadid", "startaddress", "parameter", "offset", "windows xp", "professional", "write", "info", "shell", "cultureneutral", "count", "default", "subsys11001af4", "rev003", "rev033", "folders api", "skylakeibrs", "daba3ff", "inprocserver32", "first", "virustotal", "enterprise", "service", "close", "win32 exe", "pe32", "ms windows", "win16 ne", "icons library", "os2 executable", "generic windos", "executable", "pe64 library", "cname", "none rticon", "file size", "sha256", "mwdb", "bazaar", "sha3384", "crc32", "shutdown", "error", "back", "lsappdata", "inetfiles", "windowname", "protocol level", "application", "next connection", "address", "http url", "get http", "full path", "path", "filename", "targetprocess", "writeaddress", "size", "targetpid", "findfirstfileex", "class", "find", "open", "imagepath", "cmdline", "ping", "flags" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/000bdbb9556e3474630b36d57190d5dae719886a6cdecf824af6a456243ebf88_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372160&Signature=wARiO6wRTZGhS9vOpI%2BvoWxpe55%2BBlHjfTVS2m1fsb3%2FyiqXoI5x8uRNh6fj6Qp6DpePIZAM2MHvDzi%2B5TT6VWKI4zyyc%2BeVp9gihB0djBnCJr%2BKCB18kdFNBE%2BicOTMmx5aJ1hSjWQcOBYm9PMkZ6%2BhLzxX3gxTMneBKGhh0ckFJRTRfM2gKMfEPrOQ6aVgfkTWJUR9FQYz5g2qKGSDh1CCNlEzXhO33BEPI9fN", "https://vtbehaviour.commondatastorage.googleapis.com/03a5d431bb42e7730a3ae3b3563cee73e7a782079cf56f57bad5fe665d261e54_SecneurX.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372244&Signature=fXjnCgFbGybFp%2BCRO6a%2FQ3LKU2uLiKNtjgwKzprL3LFL%2BTMgup6nbp7%2F9Hxy8bnBzlFtSzO0fcnf%2FpIsNim0UdrINmB63N9mKkBW1cOkjxV88PAy2nsFZA3FjOEYq4N0lgc8gAtS5eRTt%2Bwb7WjEnd3QQ7aPLuoVl2hjed4hC8Cit6efcSD9GbJCITMeX4%2FVHBYSjmDr4Pgip9ANSZ6wvzkRktqPpC23Qwl62gkuXE%2BKp0s%2Bq%", "https://vtbehaviour.commondatastorage.googleapis.com/14116af49a976b71f7ddd760161a1d50328baa280ac2c9a1f9f3a8996a3929b6_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372327&Signature=bhG0zZxkKhoz9temkLENxZsdN9KeMsxW4nt2II1lmaPLEGAhNM4EmX5e7z1UM9LLsnqrvuZBhQs7ZnBuwSpY5T8iiKIu2%2FfZ83pX1Tw8s%2Bn%2BfXlEl3jlhzXWewZ9i8ZlXd6YIeWETsAak1j93aNnJHB2IPoZn7VISupTj400x7E%2FSm0ilDz4zCCDAjz1eTp1N41HvmoviGQGwTSnjTW5oyBHDm8RglOnnNqcEsm6%2BkGBJToFomLsipvuVIz8", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372451&Signature=Dv9FcZuWlVKlY26EcoSmR4Kcb44tKDv4kyBrDOputdJDLMvfDX9%2Fs4Ss4cLURTdCso74wPUHQpcMVcyeGGK%2F3RwYbxXwJjMGGAJSCfCxIDRiL%2BLOQKY3M7zGyXrkpuwr5lQS4CaKp1LFajsxxwnKpd%2F5eXNMLqlyxh%2ByO3dJWTkY8WqNnnwnSjW0lqpwB9%2BBjgEdIeWsnMRqF0t4JQ8dJsmCbbTXmAKIEZ46Rpio044%2BrsqH", "https://vtbehaviour.commondatastorage.googleapis.com/539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372560&Signature=tXBHkUCyFp7E2Um%2FMUvRPbUvaQmYPeBV7KGbi%2Bssa%2FkYQyqgH4u8fy6h0A8bVbsyQMMPf2EEF2JkzkiD6SXcfLADGdVqHYQya%2F6s2Ox5QnOFkJSATlDdXCWVp%2F4wHxZHInIRcrBPZFjjYFQM0u7VYCEMtkMCS0pzld2nGLlcOuOXBFxGTQPy0A03dikBC4Yw4f%2BdiMLMxO0hxZSo9FxPq1ylB4gs57NBBniylVO4Qi%2BLzleU5", "https://vtbehaviour.commondatastorage.googleapis.com/0ab7fad77871a45137c9f2e40e3cbf47e3d71315f71c8eca9c8d62bc24a53184_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372878&Signature=cLNwLw1L9ZCpQXZej7DaLTWH5w887X5wPnSpN1pwH2N4acSu8Llp25uprGRArg6qCuPbVQ2YPyIeCdwLCZvq%2FU0hP8m17ZPontiyR5zKb7jxcW57eEUuVnuSV9%2FnukwtPPJ%2BTY7a0%2B9rwSAU%2FL%2FJQ1yMke6VIX%2B%2F6KSWHgmLV%2F%2FR%2FbOxB0oZ4%2Fe%2Fsb2%2Fw12dZix7IY6c7wOj1OlWGQSkAZZsEoDw", "https://vtbehaviour.commondatastorage.googleapis.com/01f09136cb86f25635f91144946847d58c559228d50d9b84b0c021d4091b840b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373052&Signature=U7haY6XsgyJ83G1vAOPLrLLS%2BaMP9xAKOlnzSb4I9clIBLt9Y8xzP4qjfBxbeUfdF6s%2B6dtg4dXzqTjrAYSC3XOTEEtHZeK4ePz5qfS9n%2FWNrOKQb30VBhfUNL5DYUCd3XSOPjIVlbRz9ylDpwApfVK2AMarGiLLlnKRDv7M0S63SkQx8eWyabXd2afPPy96ZGNZVZfOhw5llZiztL6mYo%2BVivlyFsDcodH9F4XrS%2FPsSLeJRx5d", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373200&Signature=uMO8ESBCpu0oIIRS0CToWTN9KlOHyq4uWjWMjfdcUCGyliW%2FSy8KDIg6OMWLUQ6SBC45Jm0Mr%2FNV6m74hTSnpmGdVf6k6mA3QrTQwUMaMk2QbBLU1IwUG8wvylr6KXEqQYYCkZksYiZEyNm%2B2hKNvWtKFc%2BZlL7M12RBSER84%2FDRQlJnK6qbDW3DYX1tPsXxTynGj5YxQDlUqfWU8CjZtSAfUK%2Bw%2FoybwyMsJc68%2B01HQ", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373283&Signature=KIPnPqQCcifTzuRS43FhFyzCXei0rDK20JuVvXA3UkB%2Bj6R1a4SAH2sn%2BJO1ohLSxLswzbryMf81lr4eGQCMbr3Wwfwo7kHN1yHV4M187cNxRZlbZ4%2BzOZZgfWt3bJNLx2Z4%2B4aqarco7OzqkhcQizlq8frRttJQjcLcNxgWD3oV2QDxZxurniW%2BhRRUS%2Bv9uGXWIRhWYmbEA%2BaoQsvpX0AIeSUCn4qb%2Fh31hJe7JitkCE", "https://vtbehaviour.commondatastorage.googleapis.com/000007781f616194758c52c551ab2f198970675c9218eab9f1e4470f0a696e71_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373373&Signature=mjvxt7z8ajbHZY%2BdL0G02pE7trUx7SkineLNrDSnq8FxmEuCuDdnNDWKdPawPb4w2NnK5HFkV3BAdTJrRNBxBceLP%2FevhdkmR4C%2BiZZ8pz9GBeqwl0l6oJMBga2ZHfKcA%2BxqQgP5r1zzN%2BZPMH0zxPdHYZA2WlzkfzPBDQcTEDdz8aTIaX%2BOP5JUo4gYjqxxxrdBLVGv0i54PedBqgFw5IRrPpdH%2FwlQGTLKQ%2BSjslq2d0", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373454&Signature=oXNg992chHQhOJxpI2XcWdFB%2FxJme1ol4iA4aOgaKWQcqa9WXsYlPcTANPmFkyrHIciosnksXEJrIAfFsjAYeEqG%2F7oPGCQLBILFHUhwZVcoJR9PgFwUsHBu%2FqiWSOifVPER4vpDL0gbsuNlU6gHT5aWRW%2BwoOwbHSIt5jj%2FJ3%2FxGDBAUaZrSuQurOM0Nb3qRhNN1NOTUj7mGTuUBXdtvnzCFLjxl3Kk6dYYFgmwhWI04P3JIB" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 72, "FileHash-MD5": 56, "FileHash-SHA1": 27, "FileHash-SHA256": 113, "domain": 19, "hostname": 89 }, "indicator_count": 376, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "29 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d20ba2a469e45b8dfd8c31", "name": "VirusTotal Windows Sandbox", "description": "A security alert has been issued by the UK government over the weekend, with the result of a malicious web address being sent to a member of the public via an address address linked tolinkedin.", "modified": "2026-05-05T07:28:14.492000", "created": "2026-04-05T07:13:38.063000", "tags": [ "windows sandbox", "calls process", "time", "request header", "host", "windows nt", "win64", "khtml", "gecko", "acceptencoding", "accept", "response header", "date", "dword", "malware", "file type", "utf8", "crlf line", "unicode text", "yara", "binary", "found", "sample", "mitre attack", "malicious", "window", "next", "detail info", "tickcount", "behaviour", "processid", "threadid", "startaddress", "parameter", "offset", "windows xp", "professional", "write", "info", "shell", "cultureneutral", "count", "default", "subsys11001af4", "rev003", "rev033", "folders api", "skylakeibrs", "daba3ff", "inprocserver32", "first", "virustotal", "enterprise", "service", "close", "win32 exe", "pe32", "ms windows", "win16 ne", "icons library", "os2 executable", "generic windos", "executable", "pe64 library", "cname", "none rticon", "file size", "sha256", "mwdb", "bazaar", "sha3384", "crc32", "shutdown", "error", "back", "lsappdata", "inetfiles", "windowname", "protocol level", "application", "next connection", "address", "http url", "get http", "full path", "path", "filename", "targetprocess", "writeaddress", "size", "targetpid", "findfirstfileex", "class", "find", "open", "imagepath", "cmdline", "ping", "flags" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/000bdbb9556e3474630b36d57190d5dae719886a6cdecf824af6a456243ebf88_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372160&Signature=wARiO6wRTZGhS9vOpI%2BvoWxpe55%2BBlHjfTVS2m1fsb3%2FyiqXoI5x8uRNh6fj6Qp6DpePIZAM2MHvDzi%2B5TT6VWKI4zyyc%2BeVp9gihB0djBnCJr%2BKCB18kdFNBE%2BicOTMmx5aJ1hSjWQcOBYm9PMkZ6%2BhLzxX3gxTMneBKGhh0ckFJRTRfM2gKMfEPrOQ6aVgfkTWJUR9FQYz5g2qKGSDh1CCNlEzXhO33BEPI9fN", "https://vtbehaviour.commondatastorage.googleapis.com/03a5d431bb42e7730a3ae3b3563cee73e7a782079cf56f57bad5fe665d261e54_SecneurX.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372244&Signature=fXjnCgFbGybFp%2BCRO6a%2FQ3LKU2uLiKNtjgwKzprL3LFL%2BTMgup6nbp7%2F9Hxy8bnBzlFtSzO0fcnf%2FpIsNim0UdrINmB63N9mKkBW1cOkjxV88PAy2nsFZA3FjOEYq4N0lgc8gAtS5eRTt%2Bwb7WjEnd3QQ7aPLuoVl2hjed4hC8Cit6efcSD9GbJCITMeX4%2FVHBYSjmDr4Pgip9ANSZ6wvzkRktqPpC23Qwl62gkuXE%2BKp0s%2Bq%", "https://vtbehaviour.commondatastorage.googleapis.com/14116af49a976b71f7ddd760161a1d50328baa280ac2c9a1f9f3a8996a3929b6_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372327&Signature=bhG0zZxkKhoz9temkLENxZsdN9KeMsxW4nt2II1lmaPLEGAhNM4EmX5e7z1UM9LLsnqrvuZBhQs7ZnBuwSpY5T8iiKIu2%2FfZ83pX1Tw8s%2Bn%2BfXlEl3jlhzXWewZ9i8ZlXd6YIeWETsAak1j93aNnJHB2IPoZn7VISupTj400x7E%2FSm0ilDz4zCCDAjz1eTp1N41HvmoviGQGwTSnjTW5oyBHDm8RglOnnNqcEsm6%2BkGBJToFomLsipvuVIz8", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372451&Signature=Dv9FcZuWlVKlY26EcoSmR4Kcb44tKDv4kyBrDOputdJDLMvfDX9%2Fs4Ss4cLURTdCso74wPUHQpcMVcyeGGK%2F3RwYbxXwJjMGGAJSCfCxIDRiL%2BLOQKY3M7zGyXrkpuwr5lQS4CaKp1LFajsxxwnKpd%2F5eXNMLqlyxh%2ByO3dJWTkY8WqNnnwnSjW0lqpwB9%2BBjgEdIeWsnMRqF0t4JQ8dJsmCbbTXmAKIEZ46Rpio044%2BrsqH", "https://vtbehaviour.commondatastorage.googleapis.com/539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372560&Signature=tXBHkUCyFp7E2Um%2FMUvRPbUvaQmYPeBV7KGbi%2Bssa%2FkYQyqgH4u8fy6h0A8bVbsyQMMPf2EEF2JkzkiD6SXcfLADGdVqHYQya%2F6s2Ox5QnOFkJSATlDdXCWVp%2F4wHxZHInIRcrBPZFjjYFQM0u7VYCEMtkMCS0pzld2nGLlcOuOXBFxGTQPy0A03dikBC4Yw4f%2BdiMLMxO0hxZSo9FxPq1ylB4gs57NBBniylVO4Qi%2BLzleU5", "https://vtbehaviour.commondatastorage.googleapis.com/0ab7fad77871a45137c9f2e40e3cbf47e3d71315f71c8eca9c8d62bc24a53184_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372878&Signature=cLNwLw1L9ZCpQXZej7DaLTWH5w887X5wPnSpN1pwH2N4acSu8Llp25uprGRArg6qCuPbVQ2YPyIeCdwLCZvq%2FU0hP8m17ZPontiyR5zKb7jxcW57eEUuVnuSV9%2FnukwtPPJ%2BTY7a0%2B9rwSAU%2FL%2FJQ1yMke6VIX%2B%2F6KSWHgmLV%2F%2FR%2FbOxB0oZ4%2Fe%2Fsb2%2Fw12dZix7IY6c7wOj1OlWGQSkAZZsEoDw", "https://vtbehaviour.commondatastorage.googleapis.com/01f09136cb86f25635f91144946847d58c559228d50d9b84b0c021d4091b840b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373052&Signature=U7haY6XsgyJ83G1vAOPLrLLS%2BaMP9xAKOlnzSb4I9clIBLt9Y8xzP4qjfBxbeUfdF6s%2B6dtg4dXzqTjrAYSC3XOTEEtHZeK4ePz5qfS9n%2FWNrOKQb30VBhfUNL5DYUCd3XSOPjIVlbRz9ylDpwApfVK2AMarGiLLlnKRDv7M0S63SkQx8eWyabXd2afPPy96ZGNZVZfOhw5llZiztL6mYo%2BVivlyFsDcodH9F4XrS%2FPsSLeJRx5d", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373200&Signature=uMO8ESBCpu0oIIRS0CToWTN9KlOHyq4uWjWMjfdcUCGyliW%2FSy8KDIg6OMWLUQ6SBC45Jm0Mr%2FNV6m74hTSnpmGdVf6k6mA3QrTQwUMaMk2QbBLU1IwUG8wvylr6KXEqQYYCkZksYiZEyNm%2B2hKNvWtKFc%2BZlL7M12RBSER84%2FDRQlJnK6qbDW3DYX1tPsXxTynGj5YxQDlUqfWU8CjZtSAfUK%2Bw%2FoybwyMsJc68%2B01HQ", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373283&Signature=KIPnPqQCcifTzuRS43FhFyzCXei0rDK20JuVvXA3UkB%2Bj6R1a4SAH2sn%2BJO1ohLSxLswzbryMf81lr4eGQCMbr3Wwfwo7kHN1yHV4M187cNxRZlbZ4%2BzOZZgfWt3bJNLx2Z4%2B4aqarco7OzqkhcQizlq8frRttJQjcLcNxgWD3oV2QDxZxurniW%2BhRRUS%2Bv9uGXWIRhWYmbEA%2BaoQsvpX0AIeSUCn4qb%2Fh31hJe7JitkCE", "https://vtbehaviour.commondatastorage.googleapis.com/000007781f616194758c52c551ab2f198970675c9218eab9f1e4470f0a696e71_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373373&Signature=mjvxt7z8ajbHZY%2BdL0G02pE7trUx7SkineLNrDSnq8FxmEuCuDdnNDWKdPawPb4w2NnK5HFkV3BAdTJrRNBxBceLP%2FevhdkmR4C%2BiZZ8pz9GBeqwl0l6oJMBga2ZHfKcA%2BxqQgP5r1zzN%2BZPMH0zxPdHYZA2WlzkfzPBDQcTEDdz8aTIaX%2BOP5JUo4gYjqxxxrdBLVGv0i54PedBqgFw5IRrPpdH%2FwlQGTLKQ%2BSjslq2d0", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373454&Signature=oXNg992chHQhOJxpI2XcWdFB%2FxJme1ol4iA4aOgaKWQcqa9WXsYlPcTANPmFkyrHIciosnksXEJrIAfFsjAYeEqG%2F7oPGCQLBILFHUhwZVcoJR9PgFwUsHBu%2FqiWSOifVPER4vpDL0gbsuNlU6gHT5aWRW%2BwoOwbHSIt5jj%2FJ3%2FxGDBAUaZrSuQurOM0Nb3qRhNN1NOTUj7mGTuUBXdtvnzCFLjxl3Kk6dYYFgmwhWI04P3JIB" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 72, "FileHash-MD5": 60, "FileHash-SHA1": 31, "FileHash-SHA256": 149, "domain": 19, "hostname": 91 }, "indicator_count": 422, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "29 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d20ba3e768ce672f6faaf0", "name": "VirusTotal Windows Sandbox", "description": "A security alert has been issued by the UK government over the weekend, with the result of a malicious web address being sent to a member of the public via an address address linked tolinkedin.", "modified": "2026-05-05T07:28:14.492000", "created": "2026-04-05T07:13:39.327000", "tags": [ "windows sandbox", "calls process", "time", "request header", "host", "windows nt", "win64", "khtml", "gecko", "acceptencoding", "accept", "response header", "date", "dword", "malware", "file type", "utf8", "crlf line", "unicode text", "yara", "binary", "found", "sample", "mitre attack", "malicious", "window", "next", "detail info", "tickcount", "behaviour", "processid", "threadid", "startaddress", "parameter", "offset", "windows xp", "professional", "write", "info", "shell", "cultureneutral", "count", "default", "subsys11001af4", "rev003", "rev033", "folders api", "skylakeibrs", "daba3ff", "inprocserver32", "first", "virustotal", "enterprise", "service", "close", "win32 exe", "pe32", "ms windows", "win16 ne", "icons library", "os2 executable", "generic windos", "executable", "pe64 library", "cname", "none rticon", "file size", "sha256", "mwdb", "bazaar", "sha3384", "crc32", "shutdown", "error", "back", "lsappdata", "inetfiles", "windowname", "protocol level", "application", "next connection", "address", "http url", "get http", "full path", "path", "filename", "targetprocess", "writeaddress", "size", "targetpid", "findfirstfileex", "class", "find", "open", "imagepath", "cmdline", "ping", "flags" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/000bdbb9556e3474630b36d57190d5dae719886a6cdecf824af6a456243ebf88_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372160&Signature=wARiO6wRTZGhS9vOpI%2BvoWxpe55%2BBlHjfTVS2m1fsb3%2FyiqXoI5x8uRNh6fj6Qp6DpePIZAM2MHvDzi%2B5TT6VWKI4zyyc%2BeVp9gihB0djBnCJr%2BKCB18kdFNBE%2BicOTMmx5aJ1hSjWQcOBYm9PMkZ6%2BhLzxX3gxTMneBKGhh0ckFJRTRfM2gKMfEPrOQ6aVgfkTWJUR9FQYz5g2qKGSDh1CCNlEzXhO33BEPI9fN", "https://vtbehaviour.commondatastorage.googleapis.com/03a5d431bb42e7730a3ae3b3563cee73e7a782079cf56f57bad5fe665d261e54_SecneurX.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372244&Signature=fXjnCgFbGybFp%2BCRO6a%2FQ3LKU2uLiKNtjgwKzprL3LFL%2BTMgup6nbp7%2F9Hxy8bnBzlFtSzO0fcnf%2FpIsNim0UdrINmB63N9mKkBW1cOkjxV88PAy2nsFZA3FjOEYq4N0lgc8gAtS5eRTt%2Bwb7WjEnd3QQ7aPLuoVl2hjed4hC8Cit6efcSD9GbJCITMeX4%2FVHBYSjmDr4Pgip9ANSZ6wvzkRktqPpC23Qwl62gkuXE%2BKp0s%2Bq%", "https://vtbehaviour.commondatastorage.googleapis.com/14116af49a976b71f7ddd760161a1d50328baa280ac2c9a1f9f3a8996a3929b6_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372327&Signature=bhG0zZxkKhoz9temkLENxZsdN9KeMsxW4nt2II1lmaPLEGAhNM4EmX5e7z1UM9LLsnqrvuZBhQs7ZnBuwSpY5T8iiKIu2%2FfZ83pX1Tw8s%2Bn%2BfXlEl3jlhzXWewZ9i8ZlXd6YIeWETsAak1j93aNnJHB2IPoZn7VISupTj400x7E%2FSm0ilDz4zCCDAjz1eTp1N41HvmoviGQGwTSnjTW5oyBHDm8RglOnnNqcEsm6%2BkGBJToFomLsipvuVIz8", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372451&Signature=Dv9FcZuWlVKlY26EcoSmR4Kcb44tKDv4kyBrDOputdJDLMvfDX9%2Fs4Ss4cLURTdCso74wPUHQpcMVcyeGGK%2F3RwYbxXwJjMGGAJSCfCxIDRiL%2BLOQKY3M7zGyXrkpuwr5lQS4CaKp1LFajsxxwnKpd%2F5eXNMLqlyxh%2ByO3dJWTkY8WqNnnwnSjW0lqpwB9%2BBjgEdIeWsnMRqF0t4JQ8dJsmCbbTXmAKIEZ46Rpio044%2BrsqH", "https://vtbehaviour.commondatastorage.googleapis.com/539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372560&Signature=tXBHkUCyFp7E2Um%2FMUvRPbUvaQmYPeBV7KGbi%2Bssa%2FkYQyqgH4u8fy6h0A8bVbsyQMMPf2EEF2JkzkiD6SXcfLADGdVqHYQya%2F6s2Ox5QnOFkJSATlDdXCWVp%2F4wHxZHInIRcrBPZFjjYFQM0u7VYCEMtkMCS0pzld2nGLlcOuOXBFxGTQPy0A03dikBC4Yw4f%2BdiMLMxO0hxZSo9FxPq1ylB4gs57NBBniylVO4Qi%2BLzleU5", "https://vtbehaviour.commondatastorage.googleapis.com/0ab7fad77871a45137c9f2e40e3cbf47e3d71315f71c8eca9c8d62bc24a53184_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372878&Signature=cLNwLw1L9ZCpQXZej7DaLTWH5w887X5wPnSpN1pwH2N4acSu8Llp25uprGRArg6qCuPbVQ2YPyIeCdwLCZvq%2FU0hP8m17ZPontiyR5zKb7jxcW57eEUuVnuSV9%2FnukwtPPJ%2BTY7a0%2B9rwSAU%2FL%2FJQ1yMke6VIX%2B%2F6KSWHgmLV%2F%2FR%2FbOxB0oZ4%2Fe%2Fsb2%2Fw12dZix7IY6c7wOj1OlWGQSkAZZsEoDw", "https://vtbehaviour.commondatastorage.googleapis.com/01f09136cb86f25635f91144946847d58c559228d50d9b84b0c021d4091b840b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373052&Signature=U7haY6XsgyJ83G1vAOPLrLLS%2BaMP9xAKOlnzSb4I9clIBLt9Y8xzP4qjfBxbeUfdF6s%2B6dtg4dXzqTjrAYSC3XOTEEtHZeK4ePz5qfS9n%2FWNrOKQb30VBhfUNL5DYUCd3XSOPjIVlbRz9ylDpwApfVK2AMarGiLLlnKRDv7M0S63SkQx8eWyabXd2afPPy96ZGNZVZfOhw5llZiztL6mYo%2BVivlyFsDcodH9F4XrS%2FPsSLeJRx5d", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373200&Signature=uMO8ESBCpu0oIIRS0CToWTN9KlOHyq4uWjWMjfdcUCGyliW%2FSy8KDIg6OMWLUQ6SBC45Jm0Mr%2FNV6m74hTSnpmGdVf6k6mA3QrTQwUMaMk2QbBLU1IwUG8wvylr6KXEqQYYCkZksYiZEyNm%2B2hKNvWtKFc%2BZlL7M12RBSER84%2FDRQlJnK6qbDW3DYX1tPsXxTynGj5YxQDlUqfWU8CjZtSAfUK%2Bw%2FoybwyMsJc68%2B01HQ", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373283&Signature=KIPnPqQCcifTzuRS43FhFyzCXei0rDK20JuVvXA3UkB%2Bj6R1a4SAH2sn%2BJO1ohLSxLswzbryMf81lr4eGQCMbr3Wwfwo7kHN1yHV4M187cNxRZlbZ4%2BzOZZgfWt3bJNLx2Z4%2B4aqarco7OzqkhcQizlq8frRttJQjcLcNxgWD3oV2QDxZxurniW%2BhRRUS%2Bv9uGXWIRhWYmbEA%2BaoQsvpX0AIeSUCn4qb%2Fh31hJe7JitkCE", "https://vtbehaviour.commondatastorage.googleapis.com/000007781f616194758c52c551ab2f198970675c9218eab9f1e4470f0a696e71_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373373&Signature=mjvxt7z8ajbHZY%2BdL0G02pE7trUx7SkineLNrDSnq8FxmEuCuDdnNDWKdPawPb4w2NnK5HFkV3BAdTJrRNBxBceLP%2FevhdkmR4C%2BiZZ8pz9GBeqwl0l6oJMBga2ZHfKcA%2BxqQgP5r1zzN%2BZPMH0zxPdHYZA2WlzkfzPBDQcTEDdz8aTIaX%2BOP5JUo4gYjqxxxrdBLVGv0i54PedBqgFw5IRrPpdH%2FwlQGTLKQ%2BSjslq2d0", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373454&Signature=oXNg992chHQhOJxpI2XcWdFB%2FxJme1ol4iA4aOgaKWQcqa9WXsYlPcTANPmFkyrHIciosnksXEJrIAfFsjAYeEqG%2F7oPGCQLBILFHUhwZVcoJR9PgFwUsHBu%2FqiWSOifVPER4vpDL0gbsuNlU6gHT5aWRW%2BwoOwbHSIt5jj%2FJ3%2FxGDBAUaZrSuQurOM0Nb3qRhNN1NOTUj7mGTuUBXdtvnzCFLjxl3Kk6dYYFgmwhWI04P3JIB" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 72, "FileHash-MD5": 56, "FileHash-SHA1": 27, "FileHash-SHA256": 113, "domain": 19, "hostname": 89 }, "indicator_count": 376, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "29 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63f106ff111b27f61ceec85e", "name": "23", "description": "", "modified": "2023-02-18T17:12:31.066000", "created": "2023-02-18T17:12:31.066000", "tags": [ "www.lists.mwsys.mine.bz" ], "references": [ "https://www.virustotal.com/graph/ga565cd28cb004dfc90132273ccff8663cc04dfabd88947d49c378c82a31a01c3", "all about the www's" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "63bb5b61ab5d5c9ebc74a954", "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ikkeookniet", "id": "120587", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_120587/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 564, "URL": 875, "FileHash-SHA256": 491, "domain": 204, "FileHash-MD5": 83, "FileHash-SHA1": 83 }, "indicator_count": 2300, "is_author": false, "is_subscribing": null, "subscriber_count": 2, "modified_text": "1200 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63bb5b61ab5d5c9ebc74a954", "name": "evil.in bum.ms - www.lists.mwsys.mine.bz", "description": "", "modified": "2023-02-07T22:01:16.959000", "created": "2023-01-09T00:10:09.776000", "tags": [ "www.lists.mwsys.mine.bz" ], "references": [ "https://www.virustotal.com/graph/ga565cd28cb004dfc90132273ccff8663cc04dfabd88947d49c378c82a31a01c3", "all about the www's" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 564, "URL": 875, "FileHash-SHA256": 491, "domain": 204, "FileHash-MD5": 83, "FileHash-SHA1": 83 }, "indicator_count": 2300, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "1211 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373200&Signature=uMO8ESBCpu0oIIRS0CToWTN9KlOHyq4uWjWMjfdcUCGyliW%2FSy8KDIg6OMWLUQ6SBC45Jm0Mr%2FNV6m74hTSnpmGdVf6k6mA3QrTQwUMaMk2QbBLU1IwUG8wvylr6KXEqQYYCkZksYiZEyNm%2B2hKNvWtKFc%2BZlL7M12RBSER84%2FDRQlJnK6qbDW3DYX1tPsXxTynGj5YxQDlUqfWU8CjZtSAfUK%2Bw%2FoybwyMsJc68%2B01HQ", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373454&Signature=oXNg992chHQhOJxpI2XcWdFB%2FxJme1ol4iA4aOgaKWQcqa9WXsYlPcTANPmFkyrHIciosnksXEJrIAfFsjAYeEqG%2F7oPGCQLBILFHUhwZVcoJR9PgFwUsHBu%2FqiWSOifVPER4vpDL0gbsuNlU6gHT5aWRW%2BwoOwbHSIt5jj%2FJ3%2FxGDBAUaZrSuQurOM0Nb3qRhNN1NOTUj7mGTuUBXdtvnzCFLjxl3Kk6dYYFgmwhWI04P3JIB", "all about the www's", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373283&Signature=KIPnPqQCcifTzuRS43FhFyzCXei0rDK20JuVvXA3UkB%2Bj6R1a4SAH2sn%2BJO1ohLSxLswzbryMf81lr4eGQCMbr3Wwfwo7kHN1yHV4M187cNxRZlbZ4%2BzOZZgfWt3bJNLx2Z4%2B4aqarco7OzqkhcQizlq8frRttJQjcLcNxgWD3oV2QDxZxurniW%2BhRRUS%2Bv9uGXWIRhWYmbEA%2BaoQsvpX0AIeSUCn4qb%2Fh31hJe7JitkCE", "https://vtbehaviour.commondatastorage.googleapis.com/03a5d431bb42e7730a3ae3b3563cee73e7a782079cf56f57bad5fe665d261e54_SecneurX.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372244&Signature=fXjnCgFbGybFp%2BCRO6a%2FQ3LKU2uLiKNtjgwKzprL3LFL%2BTMgup6nbp7%2F9Hxy8bnBzlFtSzO0fcnf%2FpIsNim0UdrINmB63N9mKkBW1cOkjxV88PAy2nsFZA3FjOEYq4N0lgc8gAtS5eRTt%2Bwb7WjEnd3QQ7aPLuoVl2hjed4hC8Cit6efcSD9GbJCITMeX4%2FVHBYSjmDr4Pgip9ANSZ6wvzkRktqPpC23Qwl62gkuXE%2BKp0s%2Bq%", "https://vtbehaviour.commondatastorage.googleapis.com/14116af49a976b71f7ddd760161a1d50328baa280ac2c9a1f9f3a8996a3929b6_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372327&Signature=bhG0zZxkKhoz9temkLENxZsdN9KeMsxW4nt2II1lmaPLEGAhNM4EmX5e7z1UM9LLsnqrvuZBhQs7ZnBuwSpY5T8iiKIu2%2FfZ83pX1Tw8s%2Bn%2BfXlEl3jlhzXWewZ9i8ZlXd6YIeWETsAak1j93aNnJHB2IPoZn7VISupTj400x7E%2FSm0ilDz4zCCDAjz1eTp1N41HvmoviGQGwTSnjTW5oyBHDm8RglOnnNqcEsm6%2BkGBJToFomLsipvuVIz8", "https://vtbehaviour.commondatastorage.googleapis.com/539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372560&Signature=tXBHkUCyFp7E2Um%2FMUvRPbUvaQmYPeBV7KGbi%2Bssa%2FkYQyqgH4u8fy6h0A8bVbsyQMMPf2EEF2JkzkiD6SXcfLADGdVqHYQya%2F6s2Ox5QnOFkJSATlDdXCWVp%2F4wHxZHInIRcrBPZFjjYFQM0u7VYCEMtkMCS0pzld2nGLlcOuOXBFxGTQPy0A03dikBC4Yw4f%2BdiMLMxO0hxZSo9FxPq1ylB4gs57NBBniylVO4Qi%2BLzleU5", "https://www.virustotal.com/graph/ga565cd28cb004dfc90132273ccff8663cc04dfabd88947d49c378c82a31a01c3", "https://vtbehaviour.commondatastorage.googleapis.com/000bdbb9556e3474630b36d57190d5dae719886a6cdecf824af6a456243ebf88_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372160&Signature=wARiO6wRTZGhS9vOpI%2BvoWxpe55%2BBlHjfTVS2m1fsb3%2FyiqXoI5x8uRNh6fj6Qp6DpePIZAM2MHvDzi%2B5TT6VWKI4zyyc%2BeVp9gihB0djBnCJr%2BKCB18kdFNBE%2BicOTMmx5aJ1hSjWQcOBYm9PMkZ6%2BhLzxX3gxTMneBKGhh0ckFJRTRfM2gKMfEPrOQ6aVgfkTWJUR9FQYz5g2qKGSDh1CCNlEzXhO33BEPI9fN", "https://vtbehaviour.commondatastorage.googleapis.com/0ab7fad77871a45137c9f2e40e3cbf47e3d71315f71c8eca9c8d62bc24a53184_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372878&Signature=cLNwLw1L9ZCpQXZej7DaLTWH5w887X5wPnSpN1pwH2N4acSu8Llp25uprGRArg6qCuPbVQ2YPyIeCdwLCZvq%2FU0hP8m17ZPontiyR5zKb7jxcW57eEUuVnuSV9%2FnukwtPPJ%2BTY7a0%2B9rwSAU%2FL%2FJQ1yMke6VIX%2B%2F6KSWHgmLV%2F%2FR%2FbOxB0oZ4%2Fe%2Fsb2%2Fw12dZix7IY6c7wOj1OlWGQSkAZZsEoDw", "https://vtbehaviour.commondatastorage.googleapis.com/000007781f616194758c52c551ab2f198970675c9218eab9f1e4470f0a696e71_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373373&Signature=mjvxt7z8ajbHZY%2BdL0G02pE7trUx7SkineLNrDSnq8FxmEuCuDdnNDWKdPawPb4w2NnK5HFkV3BAdTJrRNBxBceLP%2FevhdkmR4C%2BiZZ8pz9GBeqwl0l6oJMBga2ZHfKcA%2BxqQgP5r1zzN%2BZPMH0zxPdHYZA2WlzkfzPBDQcTEDdz8aTIaX%2BOP5JUo4gYjqxxxrdBLVGv0i54PedBqgFw5IRrPpdH%2FwlQGTLKQ%2BSjslq2d0", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372451&Signature=Dv9FcZuWlVKlY26EcoSmR4Kcb44tKDv4kyBrDOputdJDLMvfDX9%2Fs4Ss4cLURTdCso74wPUHQpcMVcyeGGK%2F3RwYbxXwJjMGGAJSCfCxIDRiL%2BLOQKY3M7zGyXrkpuwr5lQS4CaKp1LFajsxxwnKpd%2F5eXNMLqlyxh%2ByO3dJWTkY8WqNnnwnSjW0lqpwB9%2BBjgEdIeWsnMRqF0t4JQ8dJsmCbbTXmAKIEZ46Rpio044%2BrsqH", "https://vtbehaviour.commondatastorage.googleapis.com/01f09136cb86f25635f91144946847d58c559228d50d9b84b0c021d4091b840b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373052&Signature=U7haY6XsgyJ83G1vAOPLrLLS%2BaMP9xAKOlnzSb4I9clIBLt9Y8xzP4qjfBxbeUfdF6s%2B6dtg4dXzqTjrAYSC3XOTEEtHZeK4ePz5qfS9n%2FWNrOKQb30VBhfUNL5DYUCd3XSOPjIVlbRz9ylDpwApfVK2AMarGiLLlnKRDv7M0S63SkQx8eWyabXd2afPPy96ZGNZVZfOhw5llZiztL6mYo%2BVivlyFsDcodH9F4XrS%2FPsSLeJRx5d" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 2817 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/vinacf.com", "whois": "http://whois.domaintools.com/vinacf.com", "domain": "vinacf.com", "hostname": "usage.vinacf.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "69d20ba20b81857c628e1d9e", "name": "VirusTotal Windows Sandbox", "description": "A security alert has been issued by the UK government over the weekend, with the result of a malicious web address being sent to a member of the public via an address address linked tolinkedin.", "modified": "2026-05-05T07:28:14.492000", "created": "2026-04-05T07:13:38.735000", "tags": [ "windows sandbox", "calls process", "time", "request header", "host", "windows nt", "win64", "khtml", "gecko", "acceptencoding", "accept", "response header", "date", "dword", "malware", "file type", "utf8", "crlf line", "unicode text", "yara", "binary", "found", "sample", "mitre attack", "malicious", "window", "next", "detail info", "tickcount", "behaviour", "processid", "threadid", "startaddress", "parameter", "offset", "windows xp", "professional", "write", "info", "shell", "cultureneutral", "count", "default", "subsys11001af4", "rev003", "rev033", "folders api", "skylakeibrs", "daba3ff", "inprocserver32", "first", "virustotal", "enterprise", "service", "close", "win32 exe", "pe32", "ms windows", "win16 ne", "icons library", "os2 executable", "generic windos", "executable", "pe64 library", "cname", "none rticon", "file size", "sha256", "mwdb", "bazaar", "sha3384", "crc32", "shutdown", "error", "back", "lsappdata", "inetfiles", "windowname", "protocol level", "application", "next connection", "address", "http url", "get http", "full path", "path", "filename", "targetprocess", "writeaddress", "size", "targetpid", "findfirstfileex", "class", "find", "open", "imagepath", "cmdline", "ping", "flags" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/000bdbb9556e3474630b36d57190d5dae719886a6cdecf824af6a456243ebf88_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372160&Signature=wARiO6wRTZGhS9vOpI%2BvoWxpe55%2BBlHjfTVS2m1fsb3%2FyiqXoI5x8uRNh6fj6Qp6DpePIZAM2MHvDzi%2B5TT6VWKI4zyyc%2BeVp9gihB0djBnCJr%2BKCB18kdFNBE%2BicOTMmx5aJ1hSjWQcOBYm9PMkZ6%2BhLzxX3gxTMneBKGhh0ckFJRTRfM2gKMfEPrOQ6aVgfkTWJUR9FQYz5g2qKGSDh1CCNlEzXhO33BEPI9fN", "https://vtbehaviour.commondatastorage.googleapis.com/03a5d431bb42e7730a3ae3b3563cee73e7a782079cf56f57bad5fe665d261e54_SecneurX.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372244&Signature=fXjnCgFbGybFp%2BCRO6a%2FQ3LKU2uLiKNtjgwKzprL3LFL%2BTMgup6nbp7%2F9Hxy8bnBzlFtSzO0fcnf%2FpIsNim0UdrINmB63N9mKkBW1cOkjxV88PAy2nsFZA3FjOEYq4N0lgc8gAtS5eRTt%2Bwb7WjEnd3QQ7aPLuoVl2hjed4hC8Cit6efcSD9GbJCITMeX4%2FVHBYSjmDr4Pgip9ANSZ6wvzkRktqPpC23Qwl62gkuXE%2BKp0s%2Bq%", "https://vtbehaviour.commondatastorage.googleapis.com/14116af49a976b71f7ddd760161a1d50328baa280ac2c9a1f9f3a8996a3929b6_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372327&Signature=bhG0zZxkKhoz9temkLENxZsdN9KeMsxW4nt2II1lmaPLEGAhNM4EmX5e7z1UM9LLsnqrvuZBhQs7ZnBuwSpY5T8iiKIu2%2FfZ83pX1Tw8s%2Bn%2BfXlEl3jlhzXWewZ9i8ZlXd6YIeWETsAak1j93aNnJHB2IPoZn7VISupTj400x7E%2FSm0ilDz4zCCDAjz1eTp1N41HvmoviGQGwTSnjTW5oyBHDm8RglOnnNqcEsm6%2BkGBJToFomLsipvuVIz8", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372451&Signature=Dv9FcZuWlVKlY26EcoSmR4Kcb44tKDv4kyBrDOputdJDLMvfDX9%2Fs4Ss4cLURTdCso74wPUHQpcMVcyeGGK%2F3RwYbxXwJjMGGAJSCfCxIDRiL%2BLOQKY3M7zGyXrkpuwr5lQS4CaKp1LFajsxxwnKpd%2F5eXNMLqlyxh%2ByO3dJWTkY8WqNnnwnSjW0lqpwB9%2BBjgEdIeWsnMRqF0t4JQ8dJsmCbbTXmAKIEZ46Rpio044%2BrsqH", "https://vtbehaviour.commondatastorage.googleapis.com/539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372560&Signature=tXBHkUCyFp7E2Um%2FMUvRPbUvaQmYPeBV7KGbi%2Bssa%2FkYQyqgH4u8fy6h0A8bVbsyQMMPf2EEF2JkzkiD6SXcfLADGdVqHYQya%2F6s2Ox5QnOFkJSATlDdXCWVp%2F4wHxZHInIRcrBPZFjjYFQM0u7VYCEMtkMCS0pzld2nGLlcOuOXBFxGTQPy0A03dikBC4Yw4f%2BdiMLMxO0hxZSo9FxPq1ylB4gs57NBBniylVO4Qi%2BLzleU5", "https://vtbehaviour.commondatastorage.googleapis.com/0ab7fad77871a45137c9f2e40e3cbf47e3d71315f71c8eca9c8d62bc24a53184_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372878&Signature=cLNwLw1L9ZCpQXZej7DaLTWH5w887X5wPnSpN1pwH2N4acSu8Llp25uprGRArg6qCuPbVQ2YPyIeCdwLCZvq%2FU0hP8m17ZPontiyR5zKb7jxcW57eEUuVnuSV9%2FnukwtPPJ%2BTY7a0%2B9rwSAU%2FL%2FJQ1yMke6VIX%2B%2F6KSWHgmLV%2F%2FR%2FbOxB0oZ4%2Fe%2Fsb2%2Fw12dZix7IY6c7wOj1OlWGQSkAZZsEoDw", "https://vtbehaviour.commondatastorage.googleapis.com/01f09136cb86f25635f91144946847d58c559228d50d9b84b0c021d4091b840b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373052&Signature=U7haY6XsgyJ83G1vAOPLrLLS%2BaMP9xAKOlnzSb4I9clIBLt9Y8xzP4qjfBxbeUfdF6s%2B6dtg4dXzqTjrAYSC3XOTEEtHZeK4ePz5qfS9n%2FWNrOKQb30VBhfUNL5DYUCd3XSOPjIVlbRz9ylDpwApfVK2AMarGiLLlnKRDv7M0S63SkQx8eWyabXd2afPPy96ZGNZVZfOhw5llZiztL6mYo%2BVivlyFsDcodH9F4XrS%2FPsSLeJRx5d", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373200&Signature=uMO8ESBCpu0oIIRS0CToWTN9KlOHyq4uWjWMjfdcUCGyliW%2FSy8KDIg6OMWLUQ6SBC45Jm0Mr%2FNV6m74hTSnpmGdVf6k6mA3QrTQwUMaMk2QbBLU1IwUG8wvylr6KXEqQYYCkZksYiZEyNm%2B2hKNvWtKFc%2BZlL7M12RBSER84%2FDRQlJnK6qbDW3DYX1tPsXxTynGj5YxQDlUqfWU8CjZtSAfUK%2Bw%2FoybwyMsJc68%2B01HQ", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373283&Signature=KIPnPqQCcifTzuRS43FhFyzCXei0rDK20JuVvXA3UkB%2Bj6R1a4SAH2sn%2BJO1ohLSxLswzbryMf81lr4eGQCMbr3Wwfwo7kHN1yHV4M187cNxRZlbZ4%2BzOZZgfWt3bJNLx2Z4%2B4aqarco7OzqkhcQizlq8frRttJQjcLcNxgWD3oV2QDxZxurniW%2BhRRUS%2Bv9uGXWIRhWYmbEA%2BaoQsvpX0AIeSUCn4qb%2Fh31hJe7JitkCE", "https://vtbehaviour.commondatastorage.googleapis.com/000007781f616194758c52c551ab2f198970675c9218eab9f1e4470f0a696e71_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373373&Signature=mjvxt7z8ajbHZY%2BdL0G02pE7trUx7SkineLNrDSnq8FxmEuCuDdnNDWKdPawPb4w2NnK5HFkV3BAdTJrRNBxBceLP%2FevhdkmR4C%2BiZZ8pz9GBeqwl0l6oJMBga2ZHfKcA%2BxqQgP5r1zzN%2BZPMH0zxPdHYZA2WlzkfzPBDQcTEDdz8aTIaX%2BOP5JUo4gYjqxxxrdBLVGv0i54PedBqgFw5IRrPpdH%2FwlQGTLKQ%2BSjslq2d0", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373454&Signature=oXNg992chHQhOJxpI2XcWdFB%2FxJme1ol4iA4aOgaKWQcqa9WXsYlPcTANPmFkyrHIciosnksXEJrIAfFsjAYeEqG%2F7oPGCQLBILFHUhwZVcoJR9PgFwUsHBu%2FqiWSOifVPER4vpDL0gbsuNlU6gHT5aWRW%2BwoOwbHSIt5jj%2FJ3%2FxGDBAUaZrSuQurOM0Nb3qRhNN1NOTUj7mGTuUBXdtvnzCFLjxl3Kk6dYYFgmwhWI04P3JIB" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 72, "FileHash-MD5": 56, "FileHash-SHA1": 27, "FileHash-SHA256": 113, "domain": 19, "hostname": 89 }, "indicator_count": 376, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "29 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d20ba21b989eb65ac172a8", "name": "VirusTotal Windows Sandbox", "description": "A security alert has been issued by the UK government over the weekend, with the result of a malicious web address being sent to a member of the public via an address address linked tolinkedin.", "modified": "2026-05-05T07:28:14.492000", "created": "2026-04-05T07:13:38.308000", "tags": [ "windows sandbox", "calls process", "time", "request header", "host", "windows nt", "win64", "khtml", "gecko", "acceptencoding", "accept", "response header", "date", "dword", "malware", "file type", "utf8", "crlf line", "unicode text", "yara", "binary", "found", "sample", "mitre attack", "malicious", "window", "next", "detail info", "tickcount", "behaviour", "processid", "threadid", "startaddress", "parameter", "offset", "windows xp", "professional", "write", "info", "shell", "cultureneutral", "count", "default", "subsys11001af4", "rev003", "rev033", "folders api", "skylakeibrs", "daba3ff", "inprocserver32", "first", "virustotal", "enterprise", "service", "close", "win32 exe", "pe32", "ms windows", "win16 ne", "icons library", "os2 executable", "generic windos", "executable", "pe64 library", "cname", "none rticon", "file size", "sha256", "mwdb", "bazaar", "sha3384", "crc32", "shutdown", "error", "back", "lsappdata", "inetfiles", "windowname", "protocol level", "application", "next connection", "address", "http url", "get http", "full path", "path", "filename", "targetprocess", "writeaddress", "size", "targetpid", "findfirstfileex", "class", "find", "open", "imagepath", "cmdline", "ping", "flags" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/000bdbb9556e3474630b36d57190d5dae719886a6cdecf824af6a456243ebf88_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372160&Signature=wARiO6wRTZGhS9vOpI%2BvoWxpe55%2BBlHjfTVS2m1fsb3%2FyiqXoI5x8uRNh6fj6Qp6DpePIZAM2MHvDzi%2B5TT6VWKI4zyyc%2BeVp9gihB0djBnCJr%2BKCB18kdFNBE%2BicOTMmx5aJ1hSjWQcOBYm9PMkZ6%2BhLzxX3gxTMneBKGhh0ckFJRTRfM2gKMfEPrOQ6aVgfkTWJUR9FQYz5g2qKGSDh1CCNlEzXhO33BEPI9fN", "https://vtbehaviour.commondatastorage.googleapis.com/03a5d431bb42e7730a3ae3b3563cee73e7a782079cf56f57bad5fe665d261e54_SecneurX.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372244&Signature=fXjnCgFbGybFp%2BCRO6a%2FQ3LKU2uLiKNtjgwKzprL3LFL%2BTMgup6nbp7%2F9Hxy8bnBzlFtSzO0fcnf%2FpIsNim0UdrINmB63N9mKkBW1cOkjxV88PAy2nsFZA3FjOEYq4N0lgc8gAtS5eRTt%2Bwb7WjEnd3QQ7aPLuoVl2hjed4hC8Cit6efcSD9GbJCITMeX4%2FVHBYSjmDr4Pgip9ANSZ6wvzkRktqPpC23Qwl62gkuXE%2BKp0s%2Bq%", "https://vtbehaviour.commondatastorage.googleapis.com/14116af49a976b71f7ddd760161a1d50328baa280ac2c9a1f9f3a8996a3929b6_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372327&Signature=bhG0zZxkKhoz9temkLENxZsdN9KeMsxW4nt2II1lmaPLEGAhNM4EmX5e7z1UM9LLsnqrvuZBhQs7ZnBuwSpY5T8iiKIu2%2FfZ83pX1Tw8s%2Bn%2BfXlEl3jlhzXWewZ9i8ZlXd6YIeWETsAak1j93aNnJHB2IPoZn7VISupTj400x7E%2FSm0ilDz4zCCDAjz1eTp1N41HvmoviGQGwTSnjTW5oyBHDm8RglOnnNqcEsm6%2BkGBJToFomLsipvuVIz8", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372451&Signature=Dv9FcZuWlVKlY26EcoSmR4Kcb44tKDv4kyBrDOputdJDLMvfDX9%2Fs4Ss4cLURTdCso74wPUHQpcMVcyeGGK%2F3RwYbxXwJjMGGAJSCfCxIDRiL%2BLOQKY3M7zGyXrkpuwr5lQS4CaKp1LFajsxxwnKpd%2F5eXNMLqlyxh%2ByO3dJWTkY8WqNnnwnSjW0lqpwB9%2BBjgEdIeWsnMRqF0t4JQ8dJsmCbbTXmAKIEZ46Rpio044%2BrsqH", "https://vtbehaviour.commondatastorage.googleapis.com/539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372560&Signature=tXBHkUCyFp7E2Um%2FMUvRPbUvaQmYPeBV7KGbi%2Bssa%2FkYQyqgH4u8fy6h0A8bVbsyQMMPf2EEF2JkzkiD6SXcfLADGdVqHYQya%2F6s2Ox5QnOFkJSATlDdXCWVp%2F4wHxZHInIRcrBPZFjjYFQM0u7VYCEMtkMCS0pzld2nGLlcOuOXBFxGTQPy0A03dikBC4Yw4f%2BdiMLMxO0hxZSo9FxPq1ylB4gs57NBBniylVO4Qi%2BLzleU5", "https://vtbehaviour.commondatastorage.googleapis.com/0ab7fad77871a45137c9f2e40e3cbf47e3d71315f71c8eca9c8d62bc24a53184_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372878&Signature=cLNwLw1L9ZCpQXZej7DaLTWH5w887X5wPnSpN1pwH2N4acSu8Llp25uprGRArg6qCuPbVQ2YPyIeCdwLCZvq%2FU0hP8m17ZPontiyR5zKb7jxcW57eEUuVnuSV9%2FnukwtPPJ%2BTY7a0%2B9rwSAU%2FL%2FJQ1yMke6VIX%2B%2F6KSWHgmLV%2F%2FR%2FbOxB0oZ4%2Fe%2Fsb2%2Fw12dZix7IY6c7wOj1OlWGQSkAZZsEoDw", "https://vtbehaviour.commondatastorage.googleapis.com/01f09136cb86f25635f91144946847d58c559228d50d9b84b0c021d4091b840b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373052&Signature=U7haY6XsgyJ83G1vAOPLrLLS%2BaMP9xAKOlnzSb4I9clIBLt9Y8xzP4qjfBxbeUfdF6s%2B6dtg4dXzqTjrAYSC3XOTEEtHZeK4ePz5qfS9n%2FWNrOKQb30VBhfUNL5DYUCd3XSOPjIVlbRz9ylDpwApfVK2AMarGiLLlnKRDv7M0S63SkQx8eWyabXd2afPPy96ZGNZVZfOhw5llZiztL6mYo%2BVivlyFsDcodH9F4XrS%2FPsSLeJRx5d", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373200&Signature=uMO8ESBCpu0oIIRS0CToWTN9KlOHyq4uWjWMjfdcUCGyliW%2FSy8KDIg6OMWLUQ6SBC45Jm0Mr%2FNV6m74hTSnpmGdVf6k6mA3QrTQwUMaMk2QbBLU1IwUG8wvylr6KXEqQYYCkZksYiZEyNm%2B2hKNvWtKFc%2BZlL7M12RBSER84%2FDRQlJnK6qbDW3DYX1tPsXxTynGj5YxQDlUqfWU8CjZtSAfUK%2Bw%2FoybwyMsJc68%2B01HQ", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373283&Signature=KIPnPqQCcifTzuRS43FhFyzCXei0rDK20JuVvXA3UkB%2Bj6R1a4SAH2sn%2BJO1ohLSxLswzbryMf81lr4eGQCMbr3Wwfwo7kHN1yHV4M187cNxRZlbZ4%2BzOZZgfWt3bJNLx2Z4%2B4aqarco7OzqkhcQizlq8frRttJQjcLcNxgWD3oV2QDxZxurniW%2BhRRUS%2Bv9uGXWIRhWYmbEA%2BaoQsvpX0AIeSUCn4qb%2Fh31hJe7JitkCE", "https://vtbehaviour.commondatastorage.googleapis.com/000007781f616194758c52c551ab2f198970675c9218eab9f1e4470f0a696e71_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373373&Signature=mjvxt7z8ajbHZY%2BdL0G02pE7trUx7SkineLNrDSnq8FxmEuCuDdnNDWKdPawPb4w2NnK5HFkV3BAdTJrRNBxBceLP%2FevhdkmR4C%2BiZZ8pz9GBeqwl0l6oJMBga2ZHfKcA%2BxqQgP5r1zzN%2BZPMH0zxPdHYZA2WlzkfzPBDQcTEDdz8aTIaX%2BOP5JUo4gYjqxxxrdBLVGv0i54PedBqgFw5IRrPpdH%2FwlQGTLKQ%2BSjslq2d0", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373454&Signature=oXNg992chHQhOJxpI2XcWdFB%2FxJme1ol4iA4aOgaKWQcqa9WXsYlPcTANPmFkyrHIciosnksXEJrIAfFsjAYeEqG%2F7oPGCQLBILFHUhwZVcoJR9PgFwUsHBu%2FqiWSOifVPER4vpDL0gbsuNlU6gHT5aWRW%2BwoOwbHSIt5jj%2FJ3%2FxGDBAUaZrSuQurOM0Nb3qRhNN1NOTUj7mGTuUBXdtvnzCFLjxl3Kk6dYYFgmwhWI04P3JIB" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 72, "FileHash-MD5": 56, "FileHash-SHA1": 27, "FileHash-SHA256": 113, "domain": 19, "hostname": 89 }, "indicator_count": 376, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "29 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d20ba2a469e45b8dfd8c31", "name": "VirusTotal Windows Sandbox", "description": "A security alert has been issued by the UK government over the weekend, with the result of a malicious web address being sent to a member of the public via an address address linked tolinkedin.", "modified": "2026-05-05T07:28:14.492000", "created": "2026-04-05T07:13:38.063000", "tags": [ "windows sandbox", "calls process", "time", "request header", "host", "windows nt", "win64", "khtml", "gecko", "acceptencoding", "accept", "response header", "date", "dword", "malware", "file type", "utf8", "crlf line", "unicode text", "yara", "binary", "found", "sample", "mitre attack", "malicious", "window", "next", "detail info", "tickcount", "behaviour", "processid", "threadid", "startaddress", "parameter", "offset", "windows xp", "professional", "write", "info", "shell", "cultureneutral", "count", "default", "subsys11001af4", "rev003", "rev033", "folders api", "skylakeibrs", "daba3ff", "inprocserver32", "first", "virustotal", "enterprise", "service", "close", "win32 exe", "pe32", "ms windows", "win16 ne", "icons library", "os2 executable", "generic windos", "executable", "pe64 library", "cname", "none rticon", "file size", "sha256", "mwdb", "bazaar", "sha3384", "crc32", "shutdown", "error", "back", "lsappdata", "inetfiles", "windowname", "protocol level", "application", "next connection", "address", "http url", "get http", "full path", "path", "filename", "targetprocess", "writeaddress", "size", "targetpid", "findfirstfileex", "class", "find", "open", "imagepath", "cmdline", "ping", "flags" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/000bdbb9556e3474630b36d57190d5dae719886a6cdecf824af6a456243ebf88_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372160&Signature=wARiO6wRTZGhS9vOpI%2BvoWxpe55%2BBlHjfTVS2m1fsb3%2FyiqXoI5x8uRNh6fj6Qp6DpePIZAM2MHvDzi%2B5TT6VWKI4zyyc%2BeVp9gihB0djBnCJr%2BKCB18kdFNBE%2BicOTMmx5aJ1hSjWQcOBYm9PMkZ6%2BhLzxX3gxTMneBKGhh0ckFJRTRfM2gKMfEPrOQ6aVgfkTWJUR9FQYz5g2qKGSDh1CCNlEzXhO33BEPI9fN", "https://vtbehaviour.commondatastorage.googleapis.com/03a5d431bb42e7730a3ae3b3563cee73e7a782079cf56f57bad5fe665d261e54_SecneurX.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372244&Signature=fXjnCgFbGybFp%2BCRO6a%2FQ3LKU2uLiKNtjgwKzprL3LFL%2BTMgup6nbp7%2F9Hxy8bnBzlFtSzO0fcnf%2FpIsNim0UdrINmB63N9mKkBW1cOkjxV88PAy2nsFZA3FjOEYq4N0lgc8gAtS5eRTt%2Bwb7WjEnd3QQ7aPLuoVl2hjed4hC8Cit6efcSD9GbJCITMeX4%2FVHBYSjmDr4Pgip9ANSZ6wvzkRktqPpC23Qwl62gkuXE%2BKp0s%2Bq%", "https://vtbehaviour.commondatastorage.googleapis.com/14116af49a976b71f7ddd760161a1d50328baa280ac2c9a1f9f3a8996a3929b6_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372327&Signature=bhG0zZxkKhoz9temkLENxZsdN9KeMsxW4nt2II1lmaPLEGAhNM4EmX5e7z1UM9LLsnqrvuZBhQs7ZnBuwSpY5T8iiKIu2%2FfZ83pX1Tw8s%2Bn%2BfXlEl3jlhzXWewZ9i8ZlXd6YIeWETsAak1j93aNnJHB2IPoZn7VISupTj400x7E%2FSm0ilDz4zCCDAjz1eTp1N41HvmoviGQGwTSnjTW5oyBHDm8RglOnnNqcEsm6%2BkGBJToFomLsipvuVIz8", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372451&Signature=Dv9FcZuWlVKlY26EcoSmR4Kcb44tKDv4kyBrDOputdJDLMvfDX9%2Fs4Ss4cLURTdCso74wPUHQpcMVcyeGGK%2F3RwYbxXwJjMGGAJSCfCxIDRiL%2BLOQKY3M7zGyXrkpuwr5lQS4CaKp1LFajsxxwnKpd%2F5eXNMLqlyxh%2ByO3dJWTkY8WqNnnwnSjW0lqpwB9%2BBjgEdIeWsnMRqF0t4JQ8dJsmCbbTXmAKIEZ46Rpio044%2BrsqH", "https://vtbehaviour.commondatastorage.googleapis.com/539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372560&Signature=tXBHkUCyFp7E2Um%2FMUvRPbUvaQmYPeBV7KGbi%2Bssa%2FkYQyqgH4u8fy6h0A8bVbsyQMMPf2EEF2JkzkiD6SXcfLADGdVqHYQya%2F6s2Ox5QnOFkJSATlDdXCWVp%2F4wHxZHInIRcrBPZFjjYFQM0u7VYCEMtkMCS0pzld2nGLlcOuOXBFxGTQPy0A03dikBC4Yw4f%2BdiMLMxO0hxZSo9FxPq1ylB4gs57NBBniylVO4Qi%2BLzleU5", "https://vtbehaviour.commondatastorage.googleapis.com/0ab7fad77871a45137c9f2e40e3cbf47e3d71315f71c8eca9c8d62bc24a53184_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372878&Signature=cLNwLw1L9ZCpQXZej7DaLTWH5w887X5wPnSpN1pwH2N4acSu8Llp25uprGRArg6qCuPbVQ2YPyIeCdwLCZvq%2FU0hP8m17ZPontiyR5zKb7jxcW57eEUuVnuSV9%2FnukwtPPJ%2BTY7a0%2B9rwSAU%2FL%2FJQ1yMke6VIX%2B%2F6KSWHgmLV%2F%2FR%2FbOxB0oZ4%2Fe%2Fsb2%2Fw12dZix7IY6c7wOj1OlWGQSkAZZsEoDw", "https://vtbehaviour.commondatastorage.googleapis.com/01f09136cb86f25635f91144946847d58c559228d50d9b84b0c021d4091b840b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373052&Signature=U7haY6XsgyJ83G1vAOPLrLLS%2BaMP9xAKOlnzSb4I9clIBLt9Y8xzP4qjfBxbeUfdF6s%2B6dtg4dXzqTjrAYSC3XOTEEtHZeK4ePz5qfS9n%2FWNrOKQb30VBhfUNL5DYUCd3XSOPjIVlbRz9ylDpwApfVK2AMarGiLLlnKRDv7M0S63SkQx8eWyabXd2afPPy96ZGNZVZfOhw5llZiztL6mYo%2BVivlyFsDcodH9F4XrS%2FPsSLeJRx5d", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373200&Signature=uMO8ESBCpu0oIIRS0CToWTN9KlOHyq4uWjWMjfdcUCGyliW%2FSy8KDIg6OMWLUQ6SBC45Jm0Mr%2FNV6m74hTSnpmGdVf6k6mA3QrTQwUMaMk2QbBLU1IwUG8wvylr6KXEqQYYCkZksYiZEyNm%2B2hKNvWtKFc%2BZlL7M12RBSER84%2FDRQlJnK6qbDW3DYX1tPsXxTynGj5YxQDlUqfWU8CjZtSAfUK%2Bw%2FoybwyMsJc68%2B01HQ", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373283&Signature=KIPnPqQCcifTzuRS43FhFyzCXei0rDK20JuVvXA3UkB%2Bj6R1a4SAH2sn%2BJO1ohLSxLswzbryMf81lr4eGQCMbr3Wwfwo7kHN1yHV4M187cNxRZlbZ4%2BzOZZgfWt3bJNLx2Z4%2B4aqarco7OzqkhcQizlq8frRttJQjcLcNxgWD3oV2QDxZxurniW%2BhRRUS%2Bv9uGXWIRhWYmbEA%2BaoQsvpX0AIeSUCn4qb%2Fh31hJe7JitkCE", "https://vtbehaviour.commondatastorage.googleapis.com/000007781f616194758c52c551ab2f198970675c9218eab9f1e4470f0a696e71_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373373&Signature=mjvxt7z8ajbHZY%2BdL0G02pE7trUx7SkineLNrDSnq8FxmEuCuDdnNDWKdPawPb4w2NnK5HFkV3BAdTJrRNBxBceLP%2FevhdkmR4C%2BiZZ8pz9GBeqwl0l6oJMBga2ZHfKcA%2BxqQgP5r1zzN%2BZPMH0zxPdHYZA2WlzkfzPBDQcTEDdz8aTIaX%2BOP5JUo4gYjqxxxrdBLVGv0i54PedBqgFw5IRrPpdH%2FwlQGTLKQ%2BSjslq2d0", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373454&Signature=oXNg992chHQhOJxpI2XcWdFB%2FxJme1ol4iA4aOgaKWQcqa9WXsYlPcTANPmFkyrHIciosnksXEJrIAfFsjAYeEqG%2F7oPGCQLBILFHUhwZVcoJR9PgFwUsHBu%2FqiWSOifVPER4vpDL0gbsuNlU6gHT5aWRW%2BwoOwbHSIt5jj%2FJ3%2FxGDBAUaZrSuQurOM0Nb3qRhNN1NOTUj7mGTuUBXdtvnzCFLjxl3Kk6dYYFgmwhWI04P3JIB" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 72, "FileHash-MD5": 60, "FileHash-SHA1": 31, "FileHash-SHA256": 149, "domain": 19, "hostname": 91 }, "indicator_count": 422, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "29 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d20ba3e768ce672f6faaf0", "name": "VirusTotal Windows Sandbox", "description": "A security alert has been issued by the UK government over the weekend, with the result of a malicious web address being sent to a member of the public via an address address linked tolinkedin.", "modified": "2026-05-05T07:28:14.492000", "created": "2026-04-05T07:13:39.327000", "tags": [ "windows sandbox", "calls process", "time", "request header", "host", "windows nt", "win64", "khtml", "gecko", "acceptencoding", "accept", "response header", "date", "dword", "malware", "file type", "utf8", "crlf line", "unicode text", "yara", "binary", "found", "sample", "mitre attack", "malicious", "window", "next", "detail info", "tickcount", "behaviour", "processid", "threadid", "startaddress", "parameter", "offset", "windows xp", "professional", "write", "info", "shell", "cultureneutral", "count", "default", "subsys11001af4", "rev003", "rev033", "folders api", "skylakeibrs", "daba3ff", "inprocserver32", "first", "virustotal", "enterprise", "service", "close", "win32 exe", "pe32", "ms windows", "win16 ne", "icons library", "os2 executable", "generic windos", "executable", "pe64 library", "cname", "none rticon", "file size", "sha256", "mwdb", "bazaar", "sha3384", "crc32", "shutdown", "error", "back", "lsappdata", "inetfiles", "windowname", "protocol level", "application", "next connection", "address", "http url", "get http", "full path", "path", "filename", "targetprocess", "writeaddress", "size", "targetpid", "findfirstfileex", "class", "find", "open", "imagepath", "cmdline", "ping", "flags" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/000bdbb9556e3474630b36d57190d5dae719886a6cdecf824af6a456243ebf88_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372160&Signature=wARiO6wRTZGhS9vOpI%2BvoWxpe55%2BBlHjfTVS2m1fsb3%2FyiqXoI5x8uRNh6fj6Qp6DpePIZAM2MHvDzi%2B5TT6VWKI4zyyc%2BeVp9gihB0djBnCJr%2BKCB18kdFNBE%2BicOTMmx5aJ1hSjWQcOBYm9PMkZ6%2BhLzxX3gxTMneBKGhh0ckFJRTRfM2gKMfEPrOQ6aVgfkTWJUR9FQYz5g2qKGSDh1CCNlEzXhO33BEPI9fN", "https://vtbehaviour.commondatastorage.googleapis.com/03a5d431bb42e7730a3ae3b3563cee73e7a782079cf56f57bad5fe665d261e54_SecneurX.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372244&Signature=fXjnCgFbGybFp%2BCRO6a%2FQ3LKU2uLiKNtjgwKzprL3LFL%2BTMgup6nbp7%2F9Hxy8bnBzlFtSzO0fcnf%2FpIsNim0UdrINmB63N9mKkBW1cOkjxV88PAy2nsFZA3FjOEYq4N0lgc8gAtS5eRTt%2Bwb7WjEnd3QQ7aPLuoVl2hjed4hC8Cit6efcSD9GbJCITMeX4%2FVHBYSjmDr4Pgip9ANSZ6wvzkRktqPpC23Qwl62gkuXE%2BKp0s%2Bq%", "https://vtbehaviour.commondatastorage.googleapis.com/14116af49a976b71f7ddd760161a1d50328baa280ac2c9a1f9f3a8996a3929b6_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372327&Signature=bhG0zZxkKhoz9temkLENxZsdN9KeMsxW4nt2II1lmaPLEGAhNM4EmX5e7z1UM9LLsnqrvuZBhQs7ZnBuwSpY5T8iiKIu2%2FfZ83pX1Tw8s%2Bn%2BfXlEl3jlhzXWewZ9i8ZlXd6YIeWETsAak1j93aNnJHB2IPoZn7VISupTj400x7E%2FSm0ilDz4zCCDAjz1eTp1N41HvmoviGQGwTSnjTW5oyBHDm8RglOnnNqcEsm6%2BkGBJToFomLsipvuVIz8", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372451&Signature=Dv9FcZuWlVKlY26EcoSmR4Kcb44tKDv4kyBrDOputdJDLMvfDX9%2Fs4Ss4cLURTdCso74wPUHQpcMVcyeGGK%2F3RwYbxXwJjMGGAJSCfCxIDRiL%2BLOQKY3M7zGyXrkpuwr5lQS4CaKp1LFajsxxwnKpd%2F5eXNMLqlyxh%2ByO3dJWTkY8WqNnnwnSjW0lqpwB9%2BBjgEdIeWsnMRqF0t4JQ8dJsmCbbTXmAKIEZ46Rpio044%2BrsqH", "https://vtbehaviour.commondatastorage.googleapis.com/539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372560&Signature=tXBHkUCyFp7E2Um%2FMUvRPbUvaQmYPeBV7KGbi%2Bssa%2FkYQyqgH4u8fy6h0A8bVbsyQMMPf2EEF2JkzkiD6SXcfLADGdVqHYQya%2F6s2Ox5QnOFkJSATlDdXCWVp%2F4wHxZHInIRcrBPZFjjYFQM0u7VYCEMtkMCS0pzld2nGLlcOuOXBFxGTQPy0A03dikBC4Yw4f%2BdiMLMxO0hxZSo9FxPq1ylB4gs57NBBniylVO4Qi%2BLzleU5", "https://vtbehaviour.commondatastorage.googleapis.com/0ab7fad77871a45137c9f2e40e3cbf47e3d71315f71c8eca9c8d62bc24a53184_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775372878&Signature=cLNwLw1L9ZCpQXZej7DaLTWH5w887X5wPnSpN1pwH2N4acSu8Llp25uprGRArg6qCuPbVQ2YPyIeCdwLCZvq%2FU0hP8m17ZPontiyR5zKb7jxcW57eEUuVnuSV9%2FnukwtPPJ%2BTY7a0%2B9rwSAU%2FL%2FJQ1yMke6VIX%2B%2F6KSWHgmLV%2F%2FR%2FbOxB0oZ4%2Fe%2Fsb2%2Fw12dZix7IY6c7wOj1OlWGQSkAZZsEoDw", "https://vtbehaviour.commondatastorage.googleapis.com/01f09136cb86f25635f91144946847d58c559228d50d9b84b0c021d4091b840b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373052&Signature=U7haY6XsgyJ83G1vAOPLrLLS%2BaMP9xAKOlnzSb4I9clIBLt9Y8xzP4qjfBxbeUfdF6s%2B6dtg4dXzqTjrAYSC3XOTEEtHZeK4ePz5qfS9n%2FWNrOKQb30VBhfUNL5DYUCd3XSOPjIVlbRz9ylDpwApfVK2AMarGiLLlnKRDv7M0S63SkQx8eWyabXd2afPPy96ZGNZVZfOhw5llZiztL6mYo%2BVivlyFsDcodH9F4XrS%2FPsSLeJRx5d", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373200&Signature=uMO8ESBCpu0oIIRS0CToWTN9KlOHyq4uWjWMjfdcUCGyliW%2FSy8KDIg6OMWLUQ6SBC45Jm0Mr%2FNV6m74hTSnpmGdVf6k6mA3QrTQwUMaMk2QbBLU1IwUG8wvylr6KXEqQYYCkZksYiZEyNm%2B2hKNvWtKFc%2BZlL7M12RBSER84%2FDRQlJnK6qbDW3DYX1tPsXxTynGj5YxQDlUqfWU8CjZtSAfUK%2Bw%2FoybwyMsJc68%2B01HQ", "https://vtbehaviour.commondatastorage.googleapis.com/7605fa9aeaae25656c40a553534d35418cca40dc48023d0b3237b402361c6816_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373283&Signature=KIPnPqQCcifTzuRS43FhFyzCXei0rDK20JuVvXA3UkB%2Bj6R1a4SAH2sn%2BJO1ohLSxLswzbryMf81lr4eGQCMbr3Wwfwo7kHN1yHV4M187cNxRZlbZ4%2BzOZZgfWt3bJNLx2Z4%2B4aqarco7OzqkhcQizlq8frRttJQjcLcNxgWD3oV2QDxZxurniW%2BhRRUS%2Bv9uGXWIRhWYmbEA%2BaoQsvpX0AIeSUCn4qb%2Fh31hJe7JitkCE", "https://vtbehaviour.commondatastorage.googleapis.com/000007781f616194758c52c551ab2f198970675c9218eab9f1e4470f0a696e71_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373373&Signature=mjvxt7z8ajbHZY%2BdL0G02pE7trUx7SkineLNrDSnq8FxmEuCuDdnNDWKdPawPb4w2NnK5HFkV3BAdTJrRNBxBceLP%2FevhdkmR4C%2BiZZ8pz9GBeqwl0l6oJMBga2ZHfKcA%2BxqQgP5r1zzN%2BZPMH0zxPdHYZA2WlzkfzPBDQcTEDdz8aTIaX%2BOP5JUo4gYjqxxxrdBLVGv0i54PedBqgFw5IRrPpdH%2FwlQGTLKQ%2BSjslq2d0", "https://vtbehaviour.commondatastorage.googleapis.com/39c58d0f868d4e8d1b959dce19d0bbcc57bb8b9b832f9efbe4e2244051237b95_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775373454&Signature=oXNg992chHQhOJxpI2XcWdFB%2FxJme1ol4iA4aOgaKWQcqa9WXsYlPcTANPmFkyrHIciosnksXEJrIAfFsjAYeEqG%2F7oPGCQLBILFHUhwZVcoJR9PgFwUsHBu%2FqiWSOifVPER4vpDL0gbsuNlU6gHT5aWRW%2BwoOwbHSIt5jj%2FJ3%2FxGDBAUaZrSuQurOM0Nb3qRhNN1NOTUj7mGTuUBXdtvnzCFLjxl3Kk6dYYFgmwhWI04P3JIB" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 72, "FileHash-MD5": 56, "FileHash-SHA1": 27, "FileHash-SHA256": 113, "domain": 19, "hostname": 89 }, "indicator_count": 376, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "29 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63f106ff111b27f61ceec85e", "name": "23", "description": "", "modified": "2023-02-18T17:12:31.066000", "created": "2023-02-18T17:12:31.066000", "tags": [ "www.lists.mwsys.mine.bz" ], "references": [ "https://www.virustotal.com/graph/ga565cd28cb004dfc90132273ccff8663cc04dfabd88947d49c378c82a31a01c3", "all about the www's" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "63bb5b61ab5d5c9ebc74a954", "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ikkeookniet", "id": "120587", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_120587/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 564, "URL": 875, "FileHash-SHA256": 491, "domain": 204, "FileHash-MD5": 83, "FileHash-SHA1": 83 }, "indicator_count": 2300, "is_author": false, "is_subscribing": null, "subscriber_count": 2, "modified_text": "1200 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63bb5b61ab5d5c9ebc74a954", "name": "evil.in bum.ms - www.lists.mwsys.mine.bz", "description": "", "modified": "2023-02-07T22:01:16.959000", "created": "2023-01-09T00:10:09.776000", "tags": [ "www.lists.mwsys.mine.bz" ], "references": [ "https://www.virustotal.com/graph/ga565cd28cb004dfc90132273ccff8663cc04dfabd88947d49c378c82a31a01c3", "all about the www's" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 564, "URL": 875, "FileHash-SHA256": 491, "domain": 204, "FileHash-MD5": 83, "FileHash-SHA1": 83 }, "indicator_count": 2300, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "1211 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "http://usage.vinacf.com/cgi-sys/defaultwebpage.cgi", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "http://usage.vinacf.com/cgi-sys/defaultwebpage.cgi", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780472306.6457832 }