{
  "type": "URL",
  "indicator": "https://airwolf1701.dmusic.net",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://airwolf1701.dmusic.net",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3385257974,
      "indicator": "https://airwolf1701.dmusic.net",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 10,
      "pulses": [
        {
          "id": "69a3c685d4b7c139ffe62930",
          "name": "Clone Pulse Reference",
          "description": "",
          "modified": "2026-04-01T00:44:45.494000",
          "created": "2026-03-01T04:54:29.384000",
          "tags": [
            "ipv4",
            "active related",
            "trojandropper",
            "mtb jun",
            "lowfi",
            "trojan",
            "mtb jan",
            "fastly error",
            "please",
            "united",
            "ttl value",
            "get na",
            "total",
            "delete",
            "search",
            "yara detections",
            "sinkhole cookie",
            "value snkz",
            "write",
            "suspicious",
            "ransom",
            "malware",
            "Ransom.Win32.Birele.gsg Checkin",
            "AnubisNetworks Sinkhole Cookie Value Snkz",
            "Possible Compromised Host",
            "dynamicloader",
            "delete c",
            "default",
            "medium",
            "write c",
            "settingswpad",
            "intel",
            "ms windows",
            "users",
            "number",
            "title",
            "installer",
            "top source",
            "top destination",
            "source source",
            "port",
            "filehash",
            "av detections",
            "ids detections",
            "yara rule",
            "gravityrat",
            "detectvm",
            "x00 x00",
            "x00x00",
            "doviacmd",
            "rootjob",
            "getfiles",
            "updateserver",
            "ethernetid",
            "ids signatures",
            "exploits",
            "sid name",
            "malware cve",
            "dns query",
            "dnsbin demo",
            "data exfil",
            "exif data",
            "DNS Query for Webhook/HTTP Request Inspection Service (x .pipedr",
            "DNSBin Demo (requestbin .net) - Data Exfitration",
            "source port",
            "destination",
            "present sep",
            "script urls",
            "script script",
            "a domains",
            "script domains",
            "ip address",
            "meta",
            "present nov",
            "passive dns",
            "next associated",
            "domain add",
            "pe executable",
            "entries",
            "show",
            "msie",
            "windows nt",
            "wow64",
            "copy",
            "present jan",
            "present feb",
            "domain",
            "pulse pulses",
            "urls",
            "files",
            "tam legal",
            "christopher ahmann",
            "https://unicef.se/assets/apple",
            "treece alfrey",
            "hours ago",
            "information",
            "report spam",
            "ahmann colorado",
            "state",
            "special cousel",
            "created",
            "expiro",
            "capture"
          ],
          "references": [
            "Fastly IP Block:  151.101.0.0/16 | Organizations like Palantir may use third-party services such as Fastly's CDN",
            "Fastly Error and Palantir blocked several times over the last few months.",
            "Denver ; ISP, Fastly, Inc. ; Organization, Fastly, Inc. ; Network, AS54113 Fastly, Inc. (VPN, CDN, DDOSM,)",
            "IP Region, Quebec. City ; Net Range, 151.101.0.0 - 151.101.255.255. CIDR ; Full Name, Fastly, Inc.",
            "Palantir quasi government client Ab/using Palantir subdomains , Fastly is CDN",
            "Yara: SUSP_ENV_Folder_Root_File_Jan23_1 %APPDATA%\\ewiuer2.exe SCRIPT",
            "Win.Trojan.Vundo-7170412-0\t#Lowfi:SuspiciousSectionName",
            "Link below used to defraud Tsara to think she\u2019d violated Patriot Act warranting NSA , Palinter espionage",
            "https://unicef.se/assets/apple"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/Neconyd.A",
              "display_name": "Trojan:Win32/Neconyd.A",
              "target": "/malware/Trojan:Win32/Neconyd.A"
            },
            {
              "id": "PWS:Win32/QQpass.FC",
              "display_name": "PWS:Win32/QQpass.FC",
              "target": "/malware/PWS:Win32/QQpass.FC"
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Malware.Urelas-9863836-0",
              "display_name": "Win.Malware.Urelas-9863836-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "target": null
            },
            {
              "id": "Win.Trojan.Vundo-7170412-0",
              "display_name": "Win.Trojan.Vundo-7170412-0",
              "target": null
            },
            {
              "id": "#Lowfi:SuspiciousSectionName",
              "display_name": "#Lowfi:SuspiciousSectionName",
              "target": null
            },
            {
              "id": "Multiple Malware\u2019s , Trojans and Rats",
              "display_name": "Multiple Malware\u2019s , Trojans and Rats",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6906bd99cadbd4140014c6af",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 909,
            "domain": 454,
            "hostname": 1404,
            "URL": 3557,
            "CIDR": 1,
            "FileHash-MD5": 242,
            "FileHash-SHA1": 185,
            "email": 1,
            "CVE": 1
          },
          "indicator_count": 6754,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 48,
          "modified_text": "19 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6906bd99cadbd4140014c6af",
          "name": "Espionage - Gravity RAT + | Legal entities are State owned.  Attacking severely injured  PT\u2019s SA victim.",
          "description": "Fastly CDN for Palantir (Verizon) unless updated.  Very malicious IoC\u2019s found evaluating IoC\u2019 from Christopher Ahmann - TAM Legal link.\n- Made contact with victim several times.\n- Illegal contact made with attorneys considering representing Tsara. \n- https://unicef.se/assets/apple - link related to defraud Tsara to think she\u2019d violated Patriot Act warranting NSA , Palinter espionage.\n\nAhmann is named as special counsel but he , like Brian Sabey are \u2018ONLY\u2019  cyber attacking Tsara Brashears.\n\n- protecting Jeffrey Reimer DPT, multiple doctors, Concentra,  blocked and denied care , hired a hitman/men and it would have. Even cheaper to pay her for the injuries she never sought compensation for due to aggressive attacks and threats.",
          "modified": "2025-12-02T01:05:30.331000",
          "created": "2025-11-02T02:10:33.546000",
          "tags": [
            "ipv4",
            "active related",
            "trojandropper",
            "mtb jun",
            "lowfi",
            "trojan",
            "mtb jan",
            "fastly error",
            "please",
            "united",
            "ttl value",
            "get na",
            "total",
            "delete",
            "search",
            "yara detections",
            "sinkhole cookie",
            "value snkz",
            "write",
            "suspicious",
            "ransom",
            "malware",
            "Ransom.Win32.Birele.gsg Checkin",
            "AnubisNetworks Sinkhole Cookie Value Snkz",
            "Possible Compromised Host",
            "dynamicloader",
            "delete c",
            "default",
            "medium",
            "write c",
            "settingswpad",
            "intel",
            "ms windows",
            "users",
            "number",
            "title",
            "installer",
            "top source",
            "top destination",
            "source source",
            "port",
            "filehash",
            "av detections",
            "ids detections",
            "yara rule",
            "gravityrat",
            "detectvm",
            "x00 x00",
            "x00x00",
            "doviacmd",
            "rootjob",
            "getfiles",
            "updateserver",
            "ethernetid",
            "ids signatures",
            "exploits",
            "sid name",
            "malware cve",
            "dns query",
            "dnsbin demo",
            "data exfil",
            "exif data",
            "DNS Query for Webhook/HTTP Request Inspection Service (x .pipedr",
            "DNSBin Demo (requestbin .net) - Data Exfitration",
            "source port",
            "destination",
            "present sep",
            "script urls",
            "script script",
            "a domains",
            "script domains",
            "ip address",
            "meta",
            "present nov",
            "passive dns",
            "next associated",
            "domain add",
            "pe executable",
            "entries",
            "show",
            "msie",
            "windows nt",
            "wow64",
            "copy",
            "present jan",
            "present feb",
            "domain",
            "pulse pulses",
            "urls",
            "files",
            "tam legal",
            "christopher ahmann",
            "https://unicef.se/assets/apple",
            "treece alfrey",
            "hours ago",
            "information",
            "report spam",
            "ahmann colorado",
            "state",
            "special cousel",
            "created",
            "expiro",
            "capture"
          ],
          "references": [
            "Fastly IP Block:  151.101.0.0/16 | Organizations like Palantir may use third-party services such as Fastly's CDN",
            "Fastly Error and Palantir blocked several times over the last few months.",
            "Denver ; ISP, Fastly, Inc. ; Organization, Fastly, Inc. ; Network, AS54113 Fastly, Inc. (VPN, CDN, DDOSM,)",
            "IP Region, Quebec. City ; Net Range, 151.101.0.0 - 151.101.255.255. CIDR ; Full Name, Fastly, Inc.",
            "Palantir quasi government client Ab/using Palantir subdomains , Fastly is CDN",
            "Yara: SUSP_ENV_Folder_Root_File_Jan23_1 %APPDATA%\\ewiuer2.exe SCRIPT",
            "Win.Trojan.Vundo-7170412-0\t#Lowfi:SuspiciousSectionName",
            "Link below used to defraud Tsara to think she\u2019d violated Patriot Act warranting NSA , Palinter espionage",
            "https://unicef.se/assets/apple"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/Neconyd.A",
              "display_name": "Trojan:Win32/Neconyd.A",
              "target": "/malware/Trojan:Win32/Neconyd.A"
            },
            {
              "id": "PWS:Win32/QQpass.FC",
              "display_name": "PWS:Win32/QQpass.FC",
              "target": "/malware/PWS:Win32/QQpass.FC"
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Malware.Urelas-9863836-0",
              "display_name": "Win.Malware.Urelas-9863836-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "target": null
            },
            {
              "id": "Win.Trojan.Vundo-7170412-0",
              "display_name": "Win.Trojan.Vundo-7170412-0",
              "target": null
            },
            {
              "id": "#Lowfi:SuspiciousSectionName",
              "display_name": "#Lowfi:SuspiciousSectionName",
              "target": null
            },
            {
              "id": "Multiple Malware\u2019s , Trojans and Rats",
              "display_name": "Multiple Malware\u2019s , Trojans and Rats",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 909,
            "domain": 449,
            "hostname": 1403,
            "URL": 3552,
            "CIDR": 1,
            "FileHash-MD5": 242,
            "FileHash-SHA1": 185,
            "email": 1
          },
          "indicator_count": 6742,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "139 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68f5cfa9b74d6faa43eb6585",
          "name": "Indicator Removal service affecting Threat Hunters  | Brian Sabey",
          "description": "Indicator  removal used by M. Brian Sabey to for the purpose of attacking networks and removing malicious indicators related to entities and attacks deployed by  & Co. Impacts: Threat hunting services. * Worm:Win32/AutoRun.XXY!bit (Emotet and Neshta relationship).\nThere are many other malicious indicators.\n\n* foundryvttcasero.roleros.cl",
          "modified": "2025-11-19T05:02:39.961000",
          "created": "2025-10-20T05:59:04.173000",
          "tags": [
            "url https",
            "url http",
            "hostname",
            "b9sdwan",
            "b9 no",
            "united",
            "passive dns",
            "ipv4 add",
            "urls",
            "location united",
            "america flag",
            "san jose",
            "trojan",
            "canada unknown",
            "hostname add",
            "url analysis",
            "http",
            "ip address",
            "related nids",
            "path",
            "america asn",
            "as4983 intel",
            "canada",
            "gmt p3p",
            "cp noi",
            "adm dev",
            "psai com",
            "unknown ns",
            "united states",
            "twitter",
            "url add",
            "files location",
            "flag united",
            "status",
            "emails",
            "servers",
            "mtb aug",
            "win32",
            "invalid url",
            "lowfi",
            "body html",
            "head title",
            "files",
            "files ip",
            "filehashmd5",
            "iocs",
            "type indicator",
            "role title",
            "related pulses",
            "dynamicloader",
            "directui",
            "write c",
            "element",
            "classinfobase",
            "forbidden",
            "write",
            "high",
            "worm",
            "delphi",
            "guard",
            "error",
            "vmprotect",
            "malware",
            "defender",
            "suspicious",
            "port",
            "read c",
            "destination",
            "crlf line",
            "rgba",
            "unicode",
            "png image",
            "td td",
            "td tr",
            "a td",
            "dynamic dns",
            "search",
            "arial",
            "trojandropper",
            "null",
            "enough",
            "hosts",
            "fast",
            "afraid",
            "a domains",
            "welcome",
            "ok server",
            "gmt content",
            "present sep",
            "unknown soa",
            "unknown cname",
            "present oct",
            "present aug",
            "event rocket",
            "title",
            "cookie",
            "encrypt",
            "sabey type"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Worm:Win32/AutoRun.XXY!bit",
              "display_name": "Worm:Win32/AutoRun.XXY!bit",
              "target": "/malware/Worm:Win32/AutoRun.XXY!bit"
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1434,
            "URL": 3982,
            "FileHash-MD5": 391,
            "FileHash-SHA1": 309,
            "FileHash-SHA256": 1525,
            "domain": 758,
            "email": 10,
            "SSLCertFingerprint": 3,
            "CVE": 1
          },
          "indicator_count": 8413,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "152 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68f80aa152fdd795fa008e2e",
          "name": "Small & Comisproc Indicator Removal service Affects Threat Hunter Sevices",
          "description": "",
          "modified": "2025-11-19T05:02:39.961000",
          "created": "2025-10-21T22:35:13.128000",
          "tags": [
            "url https",
            "url http",
            "hostname",
            "b9sdwan",
            "b9 no",
            "united",
            "passive dns",
            "ipv4 add",
            "urls",
            "location united",
            "america flag",
            "san jose",
            "trojan",
            "canada unknown",
            "hostname add",
            "url analysis",
            "http",
            "ip address",
            "related nids",
            "path",
            "america asn",
            "as4983 intel",
            "canada",
            "gmt p3p",
            "cp noi",
            "adm dev",
            "psai com",
            "unknown ns",
            "united states",
            "twitter",
            "url add",
            "files location",
            "flag united",
            "status",
            "emails",
            "servers",
            "mtb aug",
            "win32",
            "invalid url",
            "lowfi",
            "body html",
            "head title",
            "files",
            "files ip",
            "filehashmd5",
            "iocs",
            "type indicator",
            "role title",
            "related pulses",
            "dynamicloader",
            "directui",
            "write c",
            "element",
            "classinfobase",
            "forbidden",
            "write",
            "high",
            "worm",
            "delphi",
            "guard",
            "error",
            "vmprotect",
            "malware",
            "defender",
            "suspicious",
            "port",
            "read c",
            "destination",
            "crlf line",
            "rgba",
            "unicode",
            "png image",
            "td td",
            "td tr",
            "a td",
            "dynamic dns",
            "search",
            "arial",
            "trojandropper",
            "null",
            "enough",
            "hosts",
            "fast",
            "afraid",
            "a domains",
            "welcome",
            "ok server",
            "gmt content",
            "present sep",
            "unknown soa",
            "unknown cname",
            "present oct",
            "present aug",
            "event rocket",
            "title",
            "cookie",
            "encrypt",
            "sabey type"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Worm:Win32/AutoRun.XXY!bit",
              "display_name": "Worm:Win32/AutoRun.XXY!bit",
              "target": "/malware/Worm:Win32/AutoRun.XXY!bit"
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "68f5cfa9b74d6faa43eb6585",
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1434,
            "URL": 3982,
            "FileHash-MD5": 391,
            "FileHash-SHA1": 309,
            "FileHash-SHA256": 1525,
            "domain": 758,
            "email": 10,
            "SSLCertFingerprint": 3,
            "CVE": 1
          },
          "indicator_count": 8413,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "152 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "665ec0cfd110b0694c51fbe2",
          "name": "Eset - Dorkbot",
          "description": "Dorkbot a self-propagating program that can spread itself from one computer to another threatening to perform numerous f actions of a malicious hacker's choice on PC. Found on an updated windows machine. Hacker named  machine, installed apple viewing software programs, partitioned 'zombie' machine.  Network of compromised, sketchy remote transfer agents of a professional in the service industry.  Serious impact on or companies impact on remote workers contracted by company in question due to the abrupt cessation of business of a recognized brand it's industry. Unfortunately, the documentation of this Eset programs behavior has been misplaced. From recall. this install identified and allowed threats, d. It was a weird see with the names eye experience. Incoming request/ Remote operators, disallowed many transactions and other basic use of software. Workers potentially working a database from individuals whose PII & PHI was leaked.",
          "modified": "2024-07-04T06:01:28.799000",
          "created": "2024-06-04T07:22:55.572000",
          "tags": [
            "historical ssl",
            "referrer",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnamazon",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "first",
            "server",
            "registrar abuse",
            "date",
            "csl computer",
            "gmbh dba",
            "contact phone",
            "domain status",
            "registrar url",
            "registrar whois",
            "contact email",
            "code",
            "united",
            "unknown",
            "aaaa",
            "as14061",
            "cname",
            "search",
            "emails",
            "dnssec",
            "showing",
            "win32",
            "title error",
            "passive dns",
            "open ports",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "body",
            "dns replication",
            "domain",
            "lookups",
            "email",
            "name server",
            "slovensko",
            "tech contact",
            "valid",
            "admin contact",
            "a domains",
            "a li",
            "span h3",
            "header link",
            "option option",
            "united kingdom",
            "test",
            "april",
            "meta",
            "paris",
            "eset",
            "yara detections",
            "nod32",
            "amon",
            "internalname",
            "online payment",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "amz cf",
            "creation date",
            "record value",
            "expiration date",
            "name servers",
            "servers",
            "status",
            "next",
            "asnone united",
            "moved",
            "certificate",
            "ipv4",
            "urls",
            "files",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "cf2a",
            "xaax04x00",
            "high",
            "dns reply",
            "noip domain",
            "et trojan",
            "createsuspended",
            "malware traffic",
            "dorkbot",
            "malware",
            "copy",
            "name verdict",
            "falcon sandbox",
            "windows nt",
            "appdata",
            "png image",
            "pattern match",
            "indicator",
            "ascii text",
            "rgba",
            "get collect",
            "vj98",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "path",
            "ms windows",
            "pe32",
            "intel",
            "microsoft asf",
            "pe32 executable",
            "database",
            "english",
            "installer",
            "template",
            "tue jun",
            "service",
            "crlf line",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "tip"
          ],
          "references": [
            "bpp.eset.com",
            "IDS Detections: Win32/IRCBrute/Floder.ej/TKcik.A Checkin Dorkbot GeoIP Lookup to wipmania DNS Reply Sinkhole Microsoft NO-IP",
            "IDS Detections: Domain Win32/IRCBrute/Floder.ej/TKcik.A Pass Checkin External IP Lookup Attempt To Wipmania Suspicious Mozilla User-Agent - Likely Fake",
            "High Priority Alerts: nids_malware_alert injection_runpe network_icmp dumped_buffer2 network_irc nolookup_communication",
            "High Priority Alerts: allocates_execute_remote_process persistence_autorun injection_createremotethread injection_modifies_memory",
            "High Priority Alerts: injection_write_memory injection_write_memory_exe modifies_proxy_wpad injection_ntsetcontextthread injection_resumethread dumped_buffer network_http nids_alert suspicious_tld allocates_rwx .",
            "IP\u2019s Contacted: 172.217.14.226  172.217.14.234  162.217.99.134  204.95.99.243  212.83.168.196  216.58.193.67  216.58.217.42  99.86.38.99",
            "Domains Contacted: n.jntbxduhz.ru n.yqqufklho.ru n.lotys.ru api.wipmania.com n.vbemnggcj.ru n.hmiblgoja.ru dns.msftncsi.com n.ezjhyxxbf.ru",
            "https://otx.alienvault.com/indicator/file/8ad6f89c763315bf59bc3619139f8478f6bcc57d902123c8b5c413f251ff8778",
            "Alerts: dead_host network_icmp nolookup_communication packer_polymorphic origin_langid peid_packer",
            "https://healthinsurancecompanion.com/affordable-health-insurance?Landing_Page=https://healthinsurancecompanion.com/affordable-health-insurance&SRC=iDr_E",
            "appleremotesupport.com | http://thickapple.net/index.php",
            "https://normalexchange.com/v/155e44b6-11dc-11e8-9dff-01407350b0f6/c/1e289258-e09c-11e5-bea8-021988c520a1/?clickid=9023100005531544085-201802-3",
            "https://asserts.turbovpn.co/web/images/download/icons/apple-icon.png",
            "https://appleid-verify.servecounterstrike.com/",
            "http://schoolgirl.uxxxporn.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win32:GenMalicious-KAG\\ [Trj]",
              "display_name": "Win32:GenMalicious-KAG\\ [Trj]",
              "target": null
            },
            {
              "id": ",  Win.Trojan.Agent-1286703",
              "display_name": ",  Win.Trojan.Agent-1286703",
              "target": null
            },
            {
              "id": "Trojan:Win32/DorkBot.DU",
              "display_name": "Trojan:Win32/DorkBot.DU",
              "target": "/malware/Trojan:Win32/DorkBot.DU"
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win.Trojan.Cosmu-1058",
              "display_name": "Win.Trojan.Cosmu-1058",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            }
          ],
          "industries": [
            "Finance",
            "Healthcare",
            "Telecommunications",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 32,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 758,
            "FileHash-SHA1": 478,
            "FileHash-SHA256": 2561,
            "URL": 8210,
            "domain": 2202,
            "hostname": 2760,
            "email": 22,
            "CVE": 3
          },
          "indicator_count": 16994,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "655 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65618963e4e45d0c53f8e770",
          "name": "ww1.imobitracking.net",
          "description": "critical, cronup threat, cyber threat, data, serious, tracking, emails collection, relay router , emotet, exploit, content reputation.\n\nSerious tracking efforts, malicious.",
          "modified": "2023-12-25T03:01:27.395000",
          "created": "2023-11-25T05:42:59.043000",
          "tags": [
            "creation date",
            "search",
            "passive dns",
            "urls",
            "address",
            "record value",
            "emails",
            "date",
            "showing",
            "body",
            "unknown",
            "cowboy",
            "encrypt",
            "resolver ip",
            "whois lookups",
            "server",
            "iana id",
            "registrar abuse",
            "contact phone",
            "dnssec",
            "domain status",
            "registrar url",
            "registrar whois",
            "registrar",
            "first",
            "dns replication",
            "algorithm",
            "key usage",
            "google",
            "record type",
            "ttl value",
            "cname",
            "data",
            "v3 serial",
            "contacted",
            "ssl certificate",
            "threat roundup",
            "march",
            "august",
            "referrer",
            "whois record",
            "communicating",
            "june",
            "april",
            "copy",
            "february",
            "cobalt strike",
            "remcos",
            "emotet",
            "core",
            "noname057",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malware site",
            "phishing site",
            "malicious site",
            "malware",
            "internet storm",
            "united",
            "cyber threat",
            "heur",
            "malicious url",
            "mail spammer",
            "suppobox",
            "bambernek",
            "cronup threat",
            "team",
            "facebook",
            "malicious",
            "phishing",
            "download",
            "virut",
            "unruy",
            "bandoo",
            "matsnu",
            "tofsee",
            "simda",
            "vawtrak",
            "hotmail",
            "qakbot",
            "asyncrat",
            "tsara brashears",
            "no data",
            "count blacklist",
            "tag tag",
            "pattern match",
            "ascii text",
            "file",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "appdata",
            "path",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "tor known",
            "tor relayrouter",
            "node tcp",
            "traffic",
            "host",
            "cins active",
            "poor reputation",
            "spammer",
            "barracuda et",
            "artemis",
            "iframe",
            "cleaner",
            "unsafe",
            "riskware",
            "agent",
            "wacatac",
            "bank",
            "opencandy",
            "nircmd",
            "swrort",
            "downldr",
            "crack",
            "presenoker",
            "filetour",
            "conduit",
            "xtrat",
            "azorult",
            "service",
            "runescape",
            "acint",
            "systweak",
            "behav",
            "tiggre",
            "genkryptik",
            "exploit",
            "xrat",
            "installcore",
            "patcher",
            "adload",
            "win64",
            "softcnapp",
            "union",
            "ponmocup",
            "fusioncore",
            "trojanspy",
            "webtoolbar",
            "maltiverse",
            "114.114.114.114",
            "tulach",
            "tracking",
            "apple",
            "illegal",
            "target",
            "c2",
            "cnc",
            "scanning_host",
            "CVE-2011-0611",
            "CVE-2017-0147",
            "CVE-2014-3153",
            "CVE-2016-0189",
            "CVE-2017-0199",
            "CVE-2017-8570",
            "CVE-2017-11882",
            "CVE-2018-4893",
            "CVE-2018-8174",
            "CVE-2020-0601",
            "CVE-2023-22518"
          ],
          "references": [
            "ww1.imobitracking.net",
            "https://www.hybrid-analysis.com/sample/dcf9f5e78d4645b38540d25c4d8ca7fe3e019671caadf7cade4cc01008282bff",
            "114.114.114.114",
            "signin-appleid.jackpotiot.com",
            "https://www.anyxxxtube.net/media/favicon/apple",
            "http://manage.apple.com.webobjectsd5dbc98dcc983a7028bd82d1a47540.dsiblings.com/Info/information.html",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://httpdev.findatoyota.com",
            "https://secure.medicalexpo.com/request-management-ws/views/contact-details.xhtml?token=A3QIgyaKRur%2BIjZfA4R8MkKBwXLdgMI5Gg%2F0dwmuMj0",
            "t.prototype.hasownproperty.call",
            "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term=",
            "http://trkr.similarphotocleaner.com/trackerwcfsrv/tracker.svc/trackoffersview/?q=pxl=mco2191_mco2146_mco1132&utm_source=mcosfl&utm_medium=mcosfl&utm_campaign=mcosfl&x-count=1&x-context=osversion-5.1"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Private Internet Access",
              "display_name": "Private Internet Access",
              "target": null
            },
            {
              "id": "OpenCandy",
              "display_name": "OpenCandy",
              "target": null
            },
            {
              "id": "XRat",
              "display_name": "XRat",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "Bandoo",
              "display_name": "Bandoo",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "Remcos",
              "display_name": "Remcos",
              "target": null
            },
            {
              "id": "Vawtrak",
              "display_name": "Vawtrak",
              "target": null
            },
            {
              "id": "Tiggre",
              "display_name": "Tiggre",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Ponmocup",
              "display_name": "TrojanDropper:Win32/Ponmocup",
              "target": "/malware/TrojanDropper:Win32/Ponmocup"
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 45,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1569,
            "FileHash-MD5": 489,
            "URL": 7420,
            "domain": 917,
            "FileHash-SHA1": 247,
            "email": 3,
            "FileHash-SHA256": 2578,
            "CVE": 11
          },
          "indicator_count": 13234,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "847 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570800373899fd03e2e49db",
          "name": "Democrats.org",
          "description": "",
          "modified": "2023-12-06T14:06:59.250000",
          "created": "2023-12-06T14:06:59.250000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 3114,
            "domain": 3501,
            "hostname": 3860,
            "URL": 17938,
            "FileHash-MD5": 2,
            "FileHash-SHA1": 10
          },
          "indicator_count": 28425,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707f519ef27fa72eb62598",
          "name": "CambridgeAnalytica.org",
          "description": "",
          "modified": "2023-12-06T14:04:01.301000",
          "created": "2023-12-06T14:04:01.301000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 335,
            "URL": 13379,
            "hostname": 2501,
            "domain": 1501,
            "FileHash-SHA1": 15
          },
          "indicator_count": 17731,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6220c81aaf6fddde0116569a",
          "name": "Democrats.org",
          "description": "",
          "modified": "2022-04-02T00:04:50.405000",
          "created": "2022-03-03T13:52:26.328000",
          "tags": [
            "date",
            "dns replication"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 17938,
            "hostname": 3860,
            "domain": 3501,
            "FileHash-SHA256": 3114,
            "FileHash-MD5": 2,
            "FileHash-SHA1": 10
          },
          "indicator_count": 28425,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 408,
          "modified_text": "1479 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "621927dd57ee9ed86aeb9cb4",
          "name": "CambridgeAnalytica.org",
          "description": "",
          "modified": "2022-03-27T00:00:39.057000",
          "created": "2022-02-25T19:02:53.023000",
          "tags": [
            "win32 exe",
            "scott hanselman",
            "win32 dll",
            "llc creation",
            "date",
            "passive dns",
            "subdomains",
            "detections type",
            "name",
            "rich text",
            "format",
            "music",
            "first"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13379,
            "hostname": 2501,
            "domain": 1501,
            "FileHash-SHA256": 335,
            "FileHash-SHA1": 15
          },
          "indicator_count": 17731,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 406,
          "modified_text": "1485 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://asserts.turbovpn.co/web/images/download/icons/apple-icon.png",
        "Fastly Error and Palantir blocked several times over the last few months.",
        "Link below used to defraud Tsara to think she\u2019d violated Patriot Act warranting NSA , Palinter espionage",
        "High Priority Alerts: nids_malware_alert injection_runpe network_icmp dumped_buffer2 network_irc nolookup_communication",
        "IP\u2019s Contacted: 172.217.14.226  172.217.14.234  162.217.99.134  204.95.99.243  212.83.168.196  216.58.193.67  216.58.217.42  99.86.38.99",
        "Domains Contacted: n.jntbxduhz.ru n.yqqufklho.ru n.lotys.ru api.wipmania.com n.vbemnggcj.ru n.hmiblgoja.ru dns.msftncsi.com n.ezjhyxxbf.ru",
        "IP Region, Quebec. City ; Net Range, 151.101.0.0 - 151.101.255.255. CIDR ; Full Name, Fastly, Inc.",
        "https://www.hybrid-analysis.com/sample/dcf9f5e78d4645b38540d25c4d8ca7fe3e019671caadf7cade4cc01008282bff",
        "https://healthinsurancecompanion.com/affordable-health-insurance?Landing_Page=https://healthinsurancecompanion.com/affordable-health-insurance&SRC=iDr_E",
        "https://httpdev.findatoyota.com",
        "High Priority Alerts: allocates_execute_remote_process persistence_autorun injection_createremotethread injection_modifies_memory",
        "bpp.eset.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://secure.medicalexpo.com/request-management-ws/views/contact-details.xhtml?token=A3QIgyaKRur%2BIjZfA4R8MkKBwXLdgMI5Gg%2F0dwmuMj0",
        "Fastly IP Block:  151.101.0.0/16 | Organizations like Palantir may use third-party services such as Fastly's CDN",
        "Denver ; ISP, Fastly, Inc. ; Organization, Fastly, Inc. ; Network, AS54113 Fastly, Inc. (VPN, CDN, DDOSM,)",
        "https://appleid-verify.servecounterstrike.com/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "114.114.114.114",
        "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term=",
        "https://unicef.se/assets/apple",
        "appleremotesupport.com | http://thickapple.net/index.php",
        "ww1.imobitracking.net",
        "High Priority Alerts: injection_write_memory injection_write_memory_exe modifies_proxy_wpad injection_ntsetcontextthread injection_resumethread dumped_buffer network_http nids_alert suspicious_tld allocates_rwx .",
        "Win.Trojan.Vundo-7170412-0\t#Lowfi:SuspiciousSectionName",
        "IDS Detections: Win32/IRCBrute/Floder.ej/TKcik.A Checkin Dorkbot GeoIP Lookup to wipmania DNS Reply Sinkhole Microsoft NO-IP",
        "http://trkr.similarphotocleaner.com/trackerwcfsrv/tracker.svc/trackoffersview/?q=pxl=mco2191_mco2146_mco1132&utm_source=mcosfl&utm_medium=mcosfl&utm_campaign=mcosfl&x-count=1&x-context=osversion-5.1",
        "IDS Detections: Domain Win32/IRCBrute/Floder.ej/TKcik.A Pass Checkin External IP Lookup Attempt To Wipmania Suspicious Mozilla User-Agent - Likely Fake",
        "Yara: SUSP_ENV_Folder_Root_File_Jan23_1 %APPDATA%\\ewiuer2.exe SCRIPT",
        "https://otx.alienvault.com/indicator/file/8ad6f89c763315bf59bc3619139f8478f6bcc57d902123c8b5c413f251ff8778",
        "Alerts: dead_host network_icmp nolookup_communication packer_polymorphic origin_langid peid_packer",
        "Palantir quasi government client Ab/using Palantir subdomains , Fastly is CDN",
        "http://schoolgirl.uxxxporn.com",
        "http://manage.apple.com.webobjectsd5dbc98dcc983a7028bd82d1a47540.dsiblings.com/Info/information.html",
        "https://normalexchange.com/v/155e44b6-11dc-11e8-9dff-01407350b0f6/c/1e289258-e09c-11e5-bea8-021988c520a1/?clickid=9023100005531544085-201802-3",
        "signin-appleid.jackpotiot.com",
        "https://www.anyxxxtube.net/media/favicon/apple",
        "t.prototype.hasownproperty.call"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            ",  win.trojan.agent-1286703",
            "Bandoo",
            "Trojan:win32/zombie.a",
            "Xrat",
            "Trojandropper:win32/ponmocup",
            "Worm:win32/autorun.xxy!bit",
            "Suppobox",
            "Remcos",
            "Win.malware.urelas-9863836-0",
            "Private internet access",
            "Tofsee",
            "Trojanspy",
            "Win.trojan.vundo-7170412-0",
            "Pws:win32/qqpass.fc",
            "Trojan:win32/dorkbot.du",
            "#lowfi:suspicioussectionname",
            "Virut",
            "Multiple malware\u2019s , trojans and rats",
            "Alf:heraklezeval:trojan:msil/gravityrat!rfn",
            "Webtoolbar",
            "Tulach malware",
            "Win.trojan.cosmu-1058",
            "Win32:genmalicious-kag\\ [trj]",
            "Opencandy",
            "Vawtrak",
            "Win32:malware-gen",
            "Tiggre",
            "Trojan:win32/neconyd.a"
          ],
          "industries": [
            "Healthcare",
            "Telecommunications",
            "Technology",
            "Finance"
          ],
          "unique_indicators": 84986
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/dmusic.net",
    "whois": "http://whois.domaintools.com/dmusic.net",
    "domain": "dmusic.net",
    "hostname": "airwolf1701.dmusic.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 10,
  "pulses": [
    {
      "id": "69a3c685d4b7c139ffe62930",
      "name": "Clone Pulse Reference",
      "description": "",
      "modified": "2026-04-01T00:44:45.494000",
      "created": "2026-03-01T04:54:29.384000",
      "tags": [
        "ipv4",
        "active related",
        "trojandropper",
        "mtb jun",
        "lowfi",
        "trojan",
        "mtb jan",
        "fastly error",
        "please",
        "united",
        "ttl value",
        "get na",
        "total",
        "delete",
        "search",
        "yara detections",
        "sinkhole cookie",
        "value snkz",
        "write",
        "suspicious",
        "ransom",
        "malware",
        "Ransom.Win32.Birele.gsg Checkin",
        "AnubisNetworks Sinkhole Cookie Value Snkz",
        "Possible Compromised Host",
        "dynamicloader",
        "delete c",
        "default",
        "medium",
        "write c",
        "settingswpad",
        "intel",
        "ms windows",
        "users",
        "number",
        "title",
        "installer",
        "top source",
        "top destination",
        "source source",
        "port",
        "filehash",
        "av detections",
        "ids detections",
        "yara rule",
        "gravityrat",
        "detectvm",
        "x00 x00",
        "x00x00",
        "doviacmd",
        "rootjob",
        "getfiles",
        "updateserver",
        "ethernetid",
        "ids signatures",
        "exploits",
        "sid name",
        "malware cve",
        "dns query",
        "dnsbin demo",
        "data exfil",
        "exif data",
        "DNS Query for Webhook/HTTP Request Inspection Service (x .pipedr",
        "DNSBin Demo (requestbin .net) - Data Exfitration",
        "source port",
        "destination",
        "present sep",
        "script urls",
        "script script",
        "a domains",
        "script domains",
        "ip address",
        "meta",
        "present nov",
        "passive dns",
        "next associated",
        "domain add",
        "pe executable",
        "entries",
        "show",
        "msie",
        "windows nt",
        "wow64",
        "copy",
        "present jan",
        "present feb",
        "domain",
        "pulse pulses",
        "urls",
        "files",
        "tam legal",
        "christopher ahmann",
        "https://unicef.se/assets/apple",
        "treece alfrey",
        "hours ago",
        "information",
        "report spam",
        "ahmann colorado",
        "state",
        "special cousel",
        "created",
        "expiro",
        "capture"
      ],
      "references": [
        "Fastly IP Block:  151.101.0.0/16 | Organizations like Palantir may use third-party services such as Fastly's CDN",
        "Fastly Error and Palantir blocked several times over the last few months.",
        "Denver ; ISP, Fastly, Inc. ; Organization, Fastly, Inc. ; Network, AS54113 Fastly, Inc. (VPN, CDN, DDOSM,)",
        "IP Region, Quebec. City ; Net Range, 151.101.0.0 - 151.101.255.255. CIDR ; Full Name, Fastly, Inc.",
        "Palantir quasi government client Ab/using Palantir subdomains , Fastly is CDN",
        "Yara: SUSP_ENV_Folder_Root_File_Jan23_1 %APPDATA%\\ewiuer2.exe SCRIPT",
        "Win.Trojan.Vundo-7170412-0\t#Lowfi:SuspiciousSectionName",
        "Link below used to defraud Tsara to think she\u2019d violated Patriot Act warranting NSA , Palinter espionage",
        "https://unicef.se/assets/apple"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/Neconyd.A",
          "display_name": "Trojan:Win32/Neconyd.A",
          "target": "/malware/Trojan:Win32/Neconyd.A"
        },
        {
          "id": "PWS:Win32/QQpass.FC",
          "display_name": "PWS:Win32/QQpass.FC",
          "target": "/malware/PWS:Win32/QQpass.FC"
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Malware.Urelas-9863836-0",
          "display_name": "Win.Malware.Urelas-9863836-0",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "target": null
        },
        {
          "id": "Win.Trojan.Vundo-7170412-0",
          "display_name": "Win.Trojan.Vundo-7170412-0",
          "target": null
        },
        {
          "id": "#Lowfi:SuspiciousSectionName",
          "display_name": "#Lowfi:SuspiciousSectionName",
          "target": null
        },
        {
          "id": "Multiple Malware\u2019s , Trojans and Rats",
          "display_name": "Multiple Malware\u2019s , Trojans and Rats",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6906bd99cadbd4140014c6af",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 909,
        "domain": 454,
        "hostname": 1404,
        "URL": 3557,
        "CIDR": 1,
        "FileHash-MD5": 242,
        "FileHash-SHA1": 185,
        "email": 1,
        "CVE": 1
      },
      "indicator_count": 6754,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 48,
      "modified_text": "19 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6906bd99cadbd4140014c6af",
      "name": "Espionage - Gravity RAT + | Legal entities are State owned.  Attacking severely injured  PT\u2019s SA victim.",
      "description": "Fastly CDN for Palantir (Verizon) unless updated.  Very malicious IoC\u2019s found evaluating IoC\u2019 from Christopher Ahmann - TAM Legal link.\n- Made contact with victim several times.\n- Illegal contact made with attorneys considering representing Tsara. \n- https://unicef.se/assets/apple - link related to defraud Tsara to think she\u2019d violated Patriot Act warranting NSA , Palinter espionage.\n\nAhmann is named as special counsel but he , like Brian Sabey are \u2018ONLY\u2019  cyber attacking Tsara Brashears.\n\n- protecting Jeffrey Reimer DPT, multiple doctors, Concentra,  blocked and denied care , hired a hitman/men and it would have. Even cheaper to pay her for the injuries she never sought compensation for due to aggressive attacks and threats.",
      "modified": "2025-12-02T01:05:30.331000",
      "created": "2025-11-02T02:10:33.546000",
      "tags": [
        "ipv4",
        "active related",
        "trojandropper",
        "mtb jun",
        "lowfi",
        "trojan",
        "mtb jan",
        "fastly error",
        "please",
        "united",
        "ttl value",
        "get na",
        "total",
        "delete",
        "search",
        "yara detections",
        "sinkhole cookie",
        "value snkz",
        "write",
        "suspicious",
        "ransom",
        "malware",
        "Ransom.Win32.Birele.gsg Checkin",
        "AnubisNetworks Sinkhole Cookie Value Snkz",
        "Possible Compromised Host",
        "dynamicloader",
        "delete c",
        "default",
        "medium",
        "write c",
        "settingswpad",
        "intel",
        "ms windows",
        "users",
        "number",
        "title",
        "installer",
        "top source",
        "top destination",
        "source source",
        "port",
        "filehash",
        "av detections",
        "ids detections",
        "yara rule",
        "gravityrat",
        "detectvm",
        "x00 x00",
        "x00x00",
        "doviacmd",
        "rootjob",
        "getfiles",
        "updateserver",
        "ethernetid",
        "ids signatures",
        "exploits",
        "sid name",
        "malware cve",
        "dns query",
        "dnsbin demo",
        "data exfil",
        "exif data",
        "DNS Query for Webhook/HTTP Request Inspection Service (x .pipedr",
        "DNSBin Demo (requestbin .net) - Data Exfitration",
        "source port",
        "destination",
        "present sep",
        "script urls",
        "script script",
        "a domains",
        "script domains",
        "ip address",
        "meta",
        "present nov",
        "passive dns",
        "next associated",
        "domain add",
        "pe executable",
        "entries",
        "show",
        "msie",
        "windows nt",
        "wow64",
        "copy",
        "present jan",
        "present feb",
        "domain",
        "pulse pulses",
        "urls",
        "files",
        "tam legal",
        "christopher ahmann",
        "https://unicef.se/assets/apple",
        "treece alfrey",
        "hours ago",
        "information",
        "report spam",
        "ahmann colorado",
        "state",
        "special cousel",
        "created",
        "expiro",
        "capture"
      ],
      "references": [
        "Fastly IP Block:  151.101.0.0/16 | Organizations like Palantir may use third-party services such as Fastly's CDN",
        "Fastly Error and Palantir blocked several times over the last few months.",
        "Denver ; ISP, Fastly, Inc. ; Organization, Fastly, Inc. ; Network, AS54113 Fastly, Inc. (VPN, CDN, DDOSM,)",
        "IP Region, Quebec. City ; Net Range, 151.101.0.0 - 151.101.255.255. CIDR ; Full Name, Fastly, Inc.",
        "Palantir quasi government client Ab/using Palantir subdomains , Fastly is CDN",
        "Yara: SUSP_ENV_Folder_Root_File_Jan23_1 %APPDATA%\\ewiuer2.exe SCRIPT",
        "Win.Trojan.Vundo-7170412-0\t#Lowfi:SuspiciousSectionName",
        "Link below used to defraud Tsara to think she\u2019d violated Patriot Act warranting NSA , Palinter espionage",
        "https://unicef.se/assets/apple"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/Neconyd.A",
          "display_name": "Trojan:Win32/Neconyd.A",
          "target": "/malware/Trojan:Win32/Neconyd.A"
        },
        {
          "id": "PWS:Win32/QQpass.FC",
          "display_name": "PWS:Win32/QQpass.FC",
          "target": "/malware/PWS:Win32/QQpass.FC"
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Malware.Urelas-9863836-0",
          "display_name": "Win.Malware.Urelas-9863836-0",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "target": null
        },
        {
          "id": "Win.Trojan.Vundo-7170412-0",
          "display_name": "Win.Trojan.Vundo-7170412-0",
          "target": null
        },
        {
          "id": "#Lowfi:SuspiciousSectionName",
          "display_name": "#Lowfi:SuspiciousSectionName",
          "target": null
        },
        {
          "id": "Multiple Malware\u2019s , Trojans and Rats",
          "display_name": "Multiple Malware\u2019s , Trojans and Rats",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 909,
        "domain": 449,
        "hostname": 1403,
        "URL": 3552,
        "CIDR": 1,
        "FileHash-MD5": 242,
        "FileHash-SHA1": 185,
        "email": 1
      },
      "indicator_count": 6742,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "139 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68f5cfa9b74d6faa43eb6585",
      "name": "Indicator Removal service affecting Threat Hunters  | Brian Sabey",
      "description": "Indicator  removal used by M. Brian Sabey to for the purpose of attacking networks and removing malicious indicators related to entities and attacks deployed by  & Co. Impacts: Threat hunting services. * Worm:Win32/AutoRun.XXY!bit (Emotet and Neshta relationship).\nThere are many other malicious indicators.\n\n* foundryvttcasero.roleros.cl",
      "modified": "2025-11-19T05:02:39.961000",
      "created": "2025-10-20T05:59:04.173000",
      "tags": [
        "url https",
        "url http",
        "hostname",
        "b9sdwan",
        "b9 no",
        "united",
        "passive dns",
        "ipv4 add",
        "urls",
        "location united",
        "america flag",
        "san jose",
        "trojan",
        "canada unknown",
        "hostname add",
        "url analysis",
        "http",
        "ip address",
        "related nids",
        "path",
        "america asn",
        "as4983 intel",
        "canada",
        "gmt p3p",
        "cp noi",
        "adm dev",
        "psai com",
        "unknown ns",
        "united states",
        "twitter",
        "url add",
        "files location",
        "flag united",
        "status",
        "emails",
        "servers",
        "mtb aug",
        "win32",
        "invalid url",
        "lowfi",
        "body html",
        "head title",
        "files",
        "files ip",
        "filehashmd5",
        "iocs",
        "type indicator",
        "role title",
        "related pulses",
        "dynamicloader",
        "directui",
        "write c",
        "element",
        "classinfobase",
        "forbidden",
        "write",
        "high",
        "worm",
        "delphi",
        "guard",
        "error",
        "vmprotect",
        "malware",
        "defender",
        "suspicious",
        "port",
        "read c",
        "destination",
        "crlf line",
        "rgba",
        "unicode",
        "png image",
        "td td",
        "td tr",
        "a td",
        "dynamic dns",
        "search",
        "arial",
        "trojandropper",
        "null",
        "enough",
        "hosts",
        "fast",
        "afraid",
        "a domains",
        "welcome",
        "ok server",
        "gmt content",
        "present sep",
        "unknown soa",
        "unknown cname",
        "present oct",
        "present aug",
        "event rocket",
        "title",
        "cookie",
        "encrypt",
        "sabey type"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Worm:Win32/AutoRun.XXY!bit",
          "display_name": "Worm:Win32/AutoRun.XXY!bit",
          "target": "/malware/Worm:Win32/AutoRun.XXY!bit"
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1434,
        "URL": 3982,
        "FileHash-MD5": 391,
        "FileHash-SHA1": 309,
        "FileHash-SHA256": 1525,
        "domain": 758,
        "email": 10,
        "SSLCertFingerprint": 3,
        "CVE": 1
      },
      "indicator_count": 8413,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "152 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68f80aa152fdd795fa008e2e",
      "name": "Small & Comisproc Indicator Removal service Affects Threat Hunter Sevices",
      "description": "",
      "modified": "2025-11-19T05:02:39.961000",
      "created": "2025-10-21T22:35:13.128000",
      "tags": [
        "url https",
        "url http",
        "hostname",
        "b9sdwan",
        "b9 no",
        "united",
        "passive dns",
        "ipv4 add",
        "urls",
        "location united",
        "america flag",
        "san jose",
        "trojan",
        "canada unknown",
        "hostname add",
        "url analysis",
        "http",
        "ip address",
        "related nids",
        "path",
        "america asn",
        "as4983 intel",
        "canada",
        "gmt p3p",
        "cp noi",
        "adm dev",
        "psai com",
        "unknown ns",
        "united states",
        "twitter",
        "url add",
        "files location",
        "flag united",
        "status",
        "emails",
        "servers",
        "mtb aug",
        "win32",
        "invalid url",
        "lowfi",
        "body html",
        "head title",
        "files",
        "files ip",
        "filehashmd5",
        "iocs",
        "type indicator",
        "role title",
        "related pulses",
        "dynamicloader",
        "directui",
        "write c",
        "element",
        "classinfobase",
        "forbidden",
        "write",
        "high",
        "worm",
        "delphi",
        "guard",
        "error",
        "vmprotect",
        "malware",
        "defender",
        "suspicious",
        "port",
        "read c",
        "destination",
        "crlf line",
        "rgba",
        "unicode",
        "png image",
        "td td",
        "td tr",
        "a td",
        "dynamic dns",
        "search",
        "arial",
        "trojandropper",
        "null",
        "enough",
        "hosts",
        "fast",
        "afraid",
        "a domains",
        "welcome",
        "ok server",
        "gmt content",
        "present sep",
        "unknown soa",
        "unknown cname",
        "present oct",
        "present aug",
        "event rocket",
        "title",
        "cookie",
        "encrypt",
        "sabey type"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Worm:Win32/AutoRun.XXY!bit",
          "display_name": "Worm:Win32/AutoRun.XXY!bit",
          "target": "/malware/Worm:Win32/AutoRun.XXY!bit"
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "68f5cfa9b74d6faa43eb6585",
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1434,
        "URL": 3982,
        "FileHash-MD5": 391,
        "FileHash-SHA1": 309,
        "FileHash-SHA256": 1525,
        "domain": 758,
        "email": 10,
        "SSLCertFingerprint": 3,
        "CVE": 1
      },
      "indicator_count": 8413,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "152 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "665ec0cfd110b0694c51fbe2",
      "name": "Eset - Dorkbot",
      "description": "Dorkbot a self-propagating program that can spread itself from one computer to another threatening to perform numerous f actions of a malicious hacker's choice on PC. Found on an updated windows machine. Hacker named  machine, installed apple viewing software programs, partitioned 'zombie' machine.  Network of compromised, sketchy remote transfer agents of a professional in the service industry.  Serious impact on or companies impact on remote workers contracted by company in question due to the abrupt cessation of business of a recognized brand it's industry. Unfortunately, the documentation of this Eset programs behavior has been misplaced. From recall. this install identified and allowed threats, d. It was a weird see with the names eye experience. Incoming request/ Remote operators, disallowed many transactions and other basic use of software. Workers potentially working a database from individuals whose PII & PHI was leaked.",
      "modified": "2024-07-04T06:01:28.799000",
      "created": "2024-06-04T07:22:55.572000",
      "tags": [
        "historical ssl",
        "referrer",
        "algorithm",
        "v3 serial",
        "number",
        "cus cnamazon",
        "validity",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "first",
        "server",
        "registrar abuse",
        "date",
        "csl computer",
        "gmbh dba",
        "contact phone",
        "domain status",
        "registrar url",
        "registrar whois",
        "contact email",
        "code",
        "united",
        "unknown",
        "aaaa",
        "as14061",
        "cname",
        "search",
        "emails",
        "dnssec",
        "showing",
        "win32",
        "title error",
        "passive dns",
        "open ports",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "body",
        "dns replication",
        "domain",
        "lookups",
        "email",
        "name server",
        "slovensko",
        "tech contact",
        "valid",
        "admin contact",
        "a domains",
        "a li",
        "span h3",
        "header link",
        "option option",
        "united kingdom",
        "test",
        "april",
        "meta",
        "paris",
        "eset",
        "yara detections",
        "nod32",
        "amon",
        "internalname",
        "online payment",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "amz cf",
        "creation date",
        "record value",
        "expiration date",
        "name servers",
        "servers",
        "status",
        "next",
        "asnone united",
        "moved",
        "certificate",
        "ipv4",
        "urls",
        "files",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "cf2a",
        "xaax04x00",
        "high",
        "dns reply",
        "noip domain",
        "et trojan",
        "createsuspended",
        "malware traffic",
        "dorkbot",
        "malware",
        "copy",
        "name verdict",
        "falcon sandbox",
        "windows nt",
        "appdata",
        "png image",
        "pattern match",
        "indicator",
        "ascii text",
        "rgba",
        "get collect",
        "vj98",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "path",
        "ms windows",
        "pe32",
        "intel",
        "microsoft asf",
        "pe32 executable",
        "database",
        "english",
        "installer",
        "template",
        "tue jun",
        "service",
        "crlf line",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "tip"
      ],
      "references": [
        "bpp.eset.com",
        "IDS Detections: Win32/IRCBrute/Floder.ej/TKcik.A Checkin Dorkbot GeoIP Lookup to wipmania DNS Reply Sinkhole Microsoft NO-IP",
        "IDS Detections: Domain Win32/IRCBrute/Floder.ej/TKcik.A Pass Checkin External IP Lookup Attempt To Wipmania Suspicious Mozilla User-Agent - Likely Fake",
        "High Priority Alerts: nids_malware_alert injection_runpe network_icmp dumped_buffer2 network_irc nolookup_communication",
        "High Priority Alerts: allocates_execute_remote_process persistence_autorun injection_createremotethread injection_modifies_memory",
        "High Priority Alerts: injection_write_memory injection_write_memory_exe modifies_proxy_wpad injection_ntsetcontextthread injection_resumethread dumped_buffer network_http nids_alert suspicious_tld allocates_rwx .",
        "IP\u2019s Contacted: 172.217.14.226  172.217.14.234  162.217.99.134  204.95.99.243  212.83.168.196  216.58.193.67  216.58.217.42  99.86.38.99",
        "Domains Contacted: n.jntbxduhz.ru n.yqqufklho.ru n.lotys.ru api.wipmania.com n.vbemnggcj.ru n.hmiblgoja.ru dns.msftncsi.com n.ezjhyxxbf.ru",
        "https://otx.alienvault.com/indicator/file/8ad6f89c763315bf59bc3619139f8478f6bcc57d902123c8b5c413f251ff8778",
        "Alerts: dead_host network_icmp nolookup_communication packer_polymorphic origin_langid peid_packer",
        "https://healthinsurancecompanion.com/affordable-health-insurance?Landing_Page=https://healthinsurancecompanion.com/affordable-health-insurance&SRC=iDr_E",
        "appleremotesupport.com | http://thickapple.net/index.php",
        "https://normalexchange.com/v/155e44b6-11dc-11e8-9dff-01407350b0f6/c/1e289258-e09c-11e5-bea8-021988c520a1/?clickid=9023100005531544085-201802-3",
        "https://asserts.turbovpn.co/web/images/download/icons/apple-icon.png",
        "https://appleid-verify.servecounterstrike.com/",
        "http://schoolgirl.uxxxporn.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win32:GenMalicious-KAG\\ [Trj]",
          "display_name": "Win32:GenMalicious-KAG\\ [Trj]",
          "target": null
        },
        {
          "id": ",  Win.Trojan.Agent-1286703",
          "display_name": ",  Win.Trojan.Agent-1286703",
          "target": null
        },
        {
          "id": "Trojan:Win32/DorkBot.DU",
          "display_name": "Trojan:Win32/DorkBot.DU",
          "target": "/malware/Trojan:Win32/DorkBot.DU"
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win.Trojan.Cosmu-1058",
          "display_name": "Win.Trojan.Cosmu-1058",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        }
      ],
      "industries": [
        "Finance",
        "Healthcare",
        "Telecommunications",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 32,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 758,
        "FileHash-SHA1": 478,
        "FileHash-SHA256": 2561,
        "URL": 8210,
        "domain": 2202,
        "hostname": 2760,
        "email": 22,
        "CVE": 3
      },
      "indicator_count": 16994,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "655 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65618963e4e45d0c53f8e770",
      "name": "ww1.imobitracking.net",
      "description": "critical, cronup threat, cyber threat, data, serious, tracking, emails collection, relay router , emotet, exploit, content reputation.\n\nSerious tracking efforts, malicious.",
      "modified": "2023-12-25T03:01:27.395000",
      "created": "2023-11-25T05:42:59.043000",
      "tags": [
        "creation date",
        "search",
        "passive dns",
        "urls",
        "address",
        "record value",
        "emails",
        "date",
        "showing",
        "body",
        "unknown",
        "cowboy",
        "encrypt",
        "resolver ip",
        "whois lookups",
        "server",
        "iana id",
        "registrar abuse",
        "contact phone",
        "dnssec",
        "domain status",
        "registrar url",
        "registrar whois",
        "registrar",
        "first",
        "dns replication",
        "algorithm",
        "key usage",
        "google",
        "record type",
        "ttl value",
        "cname",
        "data",
        "v3 serial",
        "contacted",
        "ssl certificate",
        "threat roundup",
        "march",
        "august",
        "referrer",
        "whois record",
        "communicating",
        "june",
        "april",
        "copy",
        "february",
        "cobalt strike",
        "remcos",
        "emotet",
        "core",
        "noname057",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "malware site",
        "phishing site",
        "malicious site",
        "malware",
        "internet storm",
        "united",
        "cyber threat",
        "heur",
        "malicious url",
        "mail spammer",
        "suppobox",
        "bambernek",
        "cronup threat",
        "team",
        "facebook",
        "malicious",
        "phishing",
        "download",
        "virut",
        "unruy",
        "bandoo",
        "matsnu",
        "tofsee",
        "simda",
        "vawtrak",
        "hotmail",
        "qakbot",
        "asyncrat",
        "tsara brashears",
        "no data",
        "count blacklist",
        "tag tag",
        "pattern match",
        "ascii text",
        "file",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "appdata",
        "path",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "tor known",
        "tor relayrouter",
        "node tcp",
        "traffic",
        "host",
        "cins active",
        "poor reputation",
        "spammer",
        "barracuda et",
        "artemis",
        "iframe",
        "cleaner",
        "unsafe",
        "riskware",
        "agent",
        "wacatac",
        "bank",
        "opencandy",
        "nircmd",
        "swrort",
        "downldr",
        "crack",
        "presenoker",
        "filetour",
        "conduit",
        "xtrat",
        "azorult",
        "service",
        "runescape",
        "acint",
        "systweak",
        "behav",
        "tiggre",
        "genkryptik",
        "exploit",
        "xrat",
        "installcore",
        "patcher",
        "adload",
        "win64",
        "softcnapp",
        "union",
        "ponmocup",
        "fusioncore",
        "trojanspy",
        "webtoolbar",
        "maltiverse",
        "114.114.114.114",
        "tulach",
        "tracking",
        "apple",
        "illegal",
        "target",
        "c2",
        "cnc",
        "scanning_host",
        "CVE-2011-0611",
        "CVE-2017-0147",
        "CVE-2014-3153",
        "CVE-2016-0189",
        "CVE-2017-0199",
        "CVE-2017-8570",
        "CVE-2017-11882",
        "CVE-2018-4893",
        "CVE-2018-8174",
        "CVE-2020-0601",
        "CVE-2023-22518"
      ],
      "references": [
        "ww1.imobitracking.net",
        "https://www.hybrid-analysis.com/sample/dcf9f5e78d4645b38540d25c4d8ca7fe3e019671caadf7cade4cc01008282bff",
        "114.114.114.114",
        "signin-appleid.jackpotiot.com",
        "https://www.anyxxxtube.net/media/favicon/apple",
        "http://manage.apple.com.webobjectsd5dbc98dcc983a7028bd82d1a47540.dsiblings.com/Info/information.html",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://httpdev.findatoyota.com",
        "https://secure.medicalexpo.com/request-management-ws/views/contact-details.xhtml?token=A3QIgyaKRur%2BIjZfA4R8MkKBwXLdgMI5Gg%2F0dwmuMj0",
        "t.prototype.hasownproperty.call",
        "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term=",
        "http://trkr.similarphotocleaner.com/trackerwcfsrv/tracker.svc/trackoffersview/?q=pxl=mco2191_mco2146_mco1132&utm_source=mcosfl&utm_medium=mcosfl&utm_campaign=mcosfl&x-count=1&x-context=osversion-5.1"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "Tulach Malware",
          "display_name": "Tulach Malware",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Private Internet Access",
          "display_name": "Private Internet Access",
          "target": null
        },
        {
          "id": "OpenCandy",
          "display_name": "OpenCandy",
          "target": null
        },
        {
          "id": "XRat",
          "display_name": "XRat",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "Bandoo",
          "display_name": "Bandoo",
          "target": null
        },
        {
          "id": "Virut",
          "display_name": "Virut",
          "target": null
        },
        {
          "id": "Remcos",
          "display_name": "Remcos",
          "target": null
        },
        {
          "id": "Vawtrak",
          "display_name": "Vawtrak",
          "target": null
        },
        {
          "id": "Tiggre",
          "display_name": "Tiggre",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Ponmocup",
          "display_name": "TrojanDropper:Win32/Ponmocup",
          "target": "/malware/TrojanDropper:Win32/Ponmocup"
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1218",
          "name": "Signed Binary Proxy Execution",
          "display_name": "T1218 - Signed Binary Proxy Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 45,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1569,
        "FileHash-MD5": 489,
        "URL": 7420,
        "domain": 917,
        "FileHash-SHA1": 247,
        "email": 3,
        "FileHash-SHA256": 2578,
        "CVE": 11
      },
      "indicator_count": 13234,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 218,
      "modified_text": "847 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570800373899fd03e2e49db",
      "name": "Democrats.org",
      "description": "",
      "modified": "2023-12-06T14:06:59.250000",
      "created": "2023-12-06T14:06:59.250000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 3114,
        "domain": 3501,
        "hostname": 3860,
        "URL": 17938,
        "FileHash-MD5": 2,
        "FileHash-SHA1": 10
      },
      "indicator_count": 28425,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65707f519ef27fa72eb62598",
      "name": "CambridgeAnalytica.org",
      "description": "",
      "modified": "2023-12-06T14:04:01.301000",
      "created": "2023-12-06T14:04:01.301000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 335,
        "URL": 13379,
        "hostname": 2501,
        "domain": 1501,
        "FileHash-SHA1": 15
      },
      "indicator_count": 17731,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6220c81aaf6fddde0116569a",
      "name": "Democrats.org",
      "description": "",
      "modified": "2022-04-02T00:04:50.405000",
      "created": "2022-03-03T13:52:26.328000",
      "tags": [
        "date",
        "dns replication"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 17938,
        "hostname": 3860,
        "domain": 3501,
        "FileHash-SHA256": 3114,
        "FileHash-MD5": 2,
        "FileHash-SHA1": 10
      },
      "indicator_count": 28425,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 408,
      "modified_text": "1479 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "621927dd57ee9ed86aeb9cb4",
      "name": "CambridgeAnalytica.org",
      "description": "",
      "modified": "2022-03-27T00:00:39.057000",
      "created": "2022-02-25T19:02:53.023000",
      "tags": [
        "win32 exe",
        "scott hanselman",
        "win32 dll",
        "llc creation",
        "date",
        "passive dns",
        "subdomains",
        "detections type",
        "name",
        "rich text",
        "format",
        "music",
        "first"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13379,
        "hostname": 2501,
        "domain": 1501,
        "FileHash-SHA256": 335,
        "FileHash-SHA1": 15
      },
      "indicator_count": 17731,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 406,
      "modified_text": "1485 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://airwolf1701.dmusic.net",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://airwolf1701.dmusic.net",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776680282.6030042
}