{
  "type": "URL",
  "indicator": "https://api-howonk.ingenosya.mg",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://api-howonk.ingenosya.mg",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4079043084,
      "indicator": "https://api-howonk.ingenosya.mg",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "68d40c9a87988555c2e23626",
          "name": "Described as \u2018Haunted\u2019 - Ransom & espionage continues to plague  residential communities | HighMark Residential",
          "description": "A national apartment apartment and townhome community that describes itself as luxury has developed such a poor reputation for poor conditions, communication, discrimination, a belief legal entities are running communities some which have been converted hospitals has a terrible spyware , ransom  problem they seem unwilling to address. Compromised to the hilt & famously known to have its own Reddit thread dedicated to a haunted\u2019 Denver community our team has  researched in the past. Denver community  had a compromise that likely brought attention to or spearheaded the AT&T outage. whitesky.us or the outage was a coincidence.\n\nConcerns about espionage, passwords, outages, ransomware. \ntips from former residents from Phoenix, Texas and Utah in on weekend. Broad research required.\nThailand live?",
          "modified": "2025-10-24T14:04:50.784000",
          "created": "2025-09-24T15:22:02.262000",
          "tags": [
            "encrypt",
            "residential",
            "benefits",
            "contact us",
            "email",
            "denver highmark",
            "windows nt",
            "dynamicloader",
            "generic http",
            "exe upload",
            "medium",
            "host",
            "inbound",
            "trojan",
            "write",
            "markus",
            "malware",
            "checkin",
            "trojandropper",
            "mtb sep",
            "united",
            "passive dns",
            "win32upatre sep",
            "ipv4",
            "reverse dns",
            "alerts",
            "av detections",
            "ids detections",
            "yara detections",
            "high",
            "dynamic",
            "reads",
            "pe file",
            "checks system",
            "write c",
            "a domains",
            "gmt server",
            "certificate",
            "hostname add",
            "url analysis",
            "title",
            "apache",
            "name servers",
            "ip address",
            "emails",
            "servers",
            "users",
            "recycle bin",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "defense evasion",
            "t1480 execution",
            "windir",
            "openurl c",
            "eregec4",
            "kl0hsy",
            "pattern match",
            "ascii text",
            "mitre att",
            "ck matrix",
            "t1057",
            "prefetch2",
            "yara signature",
            "general",
            "local",
            "path",
            "click",
            "ipv4 add",
            "urls",
            "files",
            "outbound",
            "cname",
            "apache x",
            "powered",
            "modified",
            "moved",
            "body doctype",
            "content type",
            "accept",
            "script script",
            "script urls",
            "queue security",
            "script begin",
            "url add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "dominet",
            "record value",
            "domain",
            "meta",
            "gmt etag",
            "pulse submit",
            "alive thailand",
            "xml title",
            "x tec",
            "html public",
            "show",
            "copy",
            "pe section",
            "contacted",
            "md5 add",
            "pulse pulses",
            "analysis date",
            "file score",
            "search",
            "win64",
            "khtml",
            "gecko",
            "json",
            "themida",
            "download",
            "next",
            "public folder",
            "windows",
            "highest",
            "a file",
            "checks adapter",
            "mpgph131 hr",
            "hourly rl",
            "mpgph131 lg",
            "onlogon rl",
            "entries",
            "checks",
            "high automated",
            "ollydbg",
            "gbdyllo",
            "file monitor",
            "process monitor",
            "cape",
            "related nids",
            "files location",
            "flag united",
            "pulses none",
            "next associated",
            "hosting",
            "33",
            "customercare"
          ],
          "references": [
            "IDS Detections: Win32/Vflooder.B Checkin | Virus Total vtapi DOS"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/Vflooder",
              "display_name": "Trojan:Win32/Vflooder",
              "target": "/malware/Trojan:Win32/Vflooder"
            },
            {
              "id": "Trojandownloader:Win32/Upatre",
              "display_name": "Trojandownloader:Win32/Upatre",
              "target": "/malware/Trojandownloader:Win32/Upatre"
            },
            {
              "id": "Win.Trojan.Agent",
              "display_name": "Win.Trojan.Agent",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/G3nasom!imp",
              "display_name": "ALF:Trojan:Win32/G3nasom!imp",
              "target": null
            },
            {
              "id": "Trojandropper:Win32/Muldrop.V!MTB",
              "display_name": "Trojandropper:Win32/Muldrop.V!MTB",
              "target": "/malware/Trojandropper:Win32/Muldrop.V!MTB"
            },
            {
              "id": "Themida",
              "display_name": "Themida",
              "target": null
            },
            {
              "id": "TEL:CreateScheduledTask.A!Sigattr",
              "display_name": "TEL:CreateScheduledTask.A!Sigattr",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1211",
              "name": "Exploitation for Defense Evasion",
              "display_name": "T1211 - Exploitation for Defense Evasion"
            },
            {
              "id": "T1048.001",
              "name": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol",
              "display_name": "T1048.001 - Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            },
            {
              "id": "T1595.001",
              "name": "Scanning IP Blocks",
              "display_name": "T1595.001 - Scanning IP Blocks"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3081,
            "FileHash-MD5": 756,
            "FileHash-SHA1": 724,
            "FileHash-SHA256": 3089,
            "domain": 1476,
            "email": 8,
            "hostname": 1198,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 10335,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "177 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68abf66e97031d0ff0c04fed",
          "name": "Packed sentient.industries links to a targets business website",
          "description": "Very malicious link found in a targets business.\nPacked. Needs to be categorized.\n(FoundryPalantir rich?) Tracking, hacking, and serious espionage.\nAvailable public Information: \nSENTIENT INDUSTRIES\nsentient.industries\nSentient industries provides design and engineering services, from prototyping to small-batch manufacturing, empowering clients to overcome complex challenges. |\nMore about sentient\nMission sentient accelerates mission critical technology for\u2026\nSENTIENT INDUSTRIES\nAccelerating mission-critical tech for disaster response, defense ...\nContact Now\nAustin, tx 78758. United States. EMAIL us. info@sentient \n\nWorse than it looks. Spying on a several threat researchers.",
          "modified": "2025-09-24T04:04:05.604000",
          "created": "2025-08-25T05:36:46.327000",
          "tags": [
            "moved",
            "body",
            "x cache",
            "cloudfront x",
            "cph50 c2",
            "certificate",
            "record value",
            "title",
            "h1 center",
            "server",
            "redacted for",
            "servers",
            "name redacted",
            "for privacy",
            "name servers",
            "org data",
            "privacy city",
            "privacy country",
            "ca creation",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "asn as57033",
            "less whois",
            "registrar",
            "tucows domains",
            "key identifier",
            "data",
            "v3 serial",
            "number",
            "cat ozerossl",
            "cnzerossl ecc",
            "domain secure",
            "site ca",
            "validity",
            "subject public",
            "extraction",
            "data upload",
            "extra data",
            "include review",
            "find",
            "failed",
            "typ no",
            "ms windows",
            "intel",
            "pe32",
            "united",
            "search",
            "as16509",
            "from win32bios",
            "show",
            "high",
            "medium",
            "delphi",
            "copy",
            "write",
            "launcher",
            "next",
            "present aug",
            "present jul",
            "lowfi",
            "win32",
            "a div",
            "div div",
            "learn xml",
            "babylon",
            "win64",
            "trojan",
            "colors",
            "python",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "mitre att",
            "ck techniques",
            "et info",
            "tls handshake",
            "bad traffic",
            "failure",
            "date",
            "august",
            "hybrid",
            "general",
            "path",
            "starfield",
            "click",
            "strings",
            "se bethseda",
            "n bethseda",
            "n data",
            "error",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results aug",
            "read c",
            "tlsv1",
            "port",
            "destination",
            "module load",
            "execution",
            "dock",
            "persistence",
            "malware",
            "unknown",
            "cname",
            "aaaa",
            "creation date",
            "showing",
            "domain",
            "dga domains",
            "palantirfoundry",
            "foundry",
            "status",
            "unknown ns",
            "g2 tls",
            "rsa sha256",
            "italy unknown",
            "mtb may",
            "trojandropper",
            "invalid url",
            "next associated",
            "ddos",
            "body html",
            "hacktool",
            "ipv4",
            "url analysis",
            "ukraine",
            "encrypt",
            "rl add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "present jun",
            "entries",
            "title error",
            "all ipv4",
            "reverse dns",
            "yara detections",
            "top source",
            "top destination",
            "source source",
            "sha256 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity amazon4",
            "handle",
            "canada unknown",
            "content type",
            "javascript src",
            "script script",
            "x powered",
            "ipv4 add",
            "pulse submit",
            "submit url",
            "analysis",
            "url add",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "unknown aaaa",
            "ascii text",
            "user agent",
            "powershell",
            "agent",
            "czechia unknown",
            "domain add",
            "dynamicloader",
            "hostname add",
            "pentagon",
            "defense"
          ],
          "references": [
            "sentient.industries affects independent artists. Affects several others.",
            "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
            "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
            "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
            "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
            "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
            "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
            "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
            "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
            "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
            "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
            "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
            "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
            "http://link.monetizer101.com/widget/custom-2.0.2/templates/1",
            "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
            "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
            "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
            "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
            "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
            "https://link.monetizer101.com/widget/code/dailystaruk.js",
            "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
            "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
            "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical",
            "(Can't access file- Malware infection files)",
            "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
            "constellation.pcfrpegaservice.net (Pegasus related? idk)",
            "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
            "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
            "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post",
            "Remotewd.com devices",
            "If you find anything interesting please research it."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "nUFS_inno",
              "display_name": "nUFS_inno",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:MSIL/Malicious",
              "display_name": "#Lowfi:HSTR:MSIL/Malicious",
              "target": null
            },
            {
              "id": "ALF:JASYP:PUA:Win32/Bibado",
              "display_name": "ALF:JASYP:PUA:Win32/Bibado",
              "target": null
            },
            {
              "id": "Trojan:Win32/Toga",
              "display_name": "Trojan:Win32/Toga",
              "target": "/malware/Trojan:Win32/Toga"
            },
            {
              "id": "Win32:Downloader-GJK\\ [Trj]",
              "display_name": "Win32:Downloader-GJK\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Downloader.109205-1",
              "display_name": "Win.Downloader.109205-1",
              "target": null
            },
            {
              "id": "Custom Malware",
              "display_name": "Custom Malware",
              "target": null
            },
            {
              "id": "#LowFiEnableDTContinueAfterUnpacking",
              "display_name": "#LowFiEnableDTContinueAfterUnpacking",
              "target": null
            },
            {
              "id": "Win32:Downloader-GJK\\ [Trj]",
              "display_name": "Win32:Downloader-GJK\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Downloader.109205-1",
              "display_name": "Win.Downloader.109205-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Jorik-149",
              "display_name": "Win.Trojan.Jorik-149",
              "target": null
            },
            {
              "id": "#LowFiDetectsVmWare",
              "display_name": "#LowFiDetectsVmWare",
              "target": null
            },
            {
              "id": "Win.Trojan.Jorik-130",
              "display_name": "Win.Trojan.Jorik-130",
              "target": null
            },
            {
              "id": "Win.Trojan.Fakecodecs-119",
              "display_name": "Win.Trojan.Fakecodecs-119",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Trojan.Bulz-9860169-0",
              "display_name": "Win.Trojan.Bulz-9860169-0",
              "target": null
            },
            {
              "id": "Win.Malware.Midie-6847892-0",
              "display_name": "Win.Malware.Midie-6847892-0",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Muldrop.V!MTB",
              "display_name": "TrojanDropper:Win32/Muldrop.V!MTB",
              "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB"
            },
            {
              "id": "Win.Packed.Razy-9785185-0",
              "display_name": "Win.Packed.Razy-9785185-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "PWS",
              "display_name": "PWS",
              "target": null
            },
            {
              "id": "DDOS:Win32/Stormser.A",
              "display_name": "DDOS:Win32/Stormser.A",
              "target": "/malware/DDOS:Win32/Stormser.A"
            },
            {
              "id": "ALF:HSTR:DotNET",
              "display_name": "ALF:HSTR:DotNET",
              "target": null
            },
            {
              "id": "DotNET",
              "display_name": "DotNET",
              "target": null
            },
            {
              "id": "Script Exploit",
              "display_name": "Script Exploit",
              "target": null
            },
            {
              "id": "HackTool:Win32/AutoKMS",
              "display_name": "HackTool:Win32/AutoKMS",
              "target": "/malware/HackTool:Win32/AutoKMS"
            },
            {
              "id": "Xanfpezes.A",
              "display_name": "Xanfpezes.A",
              "target": null
            },
            {
              "id": "Trojan:Win32/Gandcrab",
              "display_name": "Trojan:Win32/Gandcrab",
              "target": "/malware/Trojan:Win32/Gandcrab"
            },
            {
              "id": "Win.Trojan.Generic-9862772-0",
              "display_name": "Win.Trojan.Generic-9862772-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zbot.SIBL!MTB",
              "display_name": "Trojan:Win32/Zbot.SIBL!MTB",
              "target": "/malware/Trojan:Win32/Zbot.SIBL!MTB"
            },
            {
              "id": "Win32/Nemucod",
              "display_name": "Win32/Nemucod",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
              "display_name": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
              "target": null
            },
            {
              "id": "Trojan:Win32/Blihan.A",
              "display_name": "Trojan:Win32/Blihan.A",
              "target": "/malware/Trojan:Win32/Blihan.A"
            },
            {
              "id": "TrojanDropper:Win32/Muldrop",
              "display_name": "TrojanDropper:Win32/Muldrop",
              "target": "/malware/TrojanDropper:Win32/Muldrop"
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "target": null
            },
            {
              "id": "Win.Malware.Kolab-9885903-0",
              "display_name": "Win.Malware.Kolab-9885903-0",
              "target": null
            },
            {
              "id": "Win.Malware (30)",
              "display_name": "Win.Malware (30)",
              "target": null
            },
            {
              "id": "Ransom",
              "display_name": "Ransom",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
              "display_name": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
              "target": null
            },
            {
              "id": "E5",
              "display_name": "E5",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1003.008",
              "name": "/etc/passwd and /etc/shadow",
              "display_name": "T1003.008 - /etc/passwd and /etc/shadow"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 40,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 6232,
            "URL": 24908,
            "hostname": 7993,
            "FileHash-SHA256": 11128,
            "email": 6,
            "FileHash-MD5": 1054,
            "FileHash-SHA1": 932,
            "SSLCertFingerprint": 14,
            "CIDR": 3,
            "CVE": 3
          },
          "indicator_count": 52273,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 146,
          "modified_text": "207 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68596260a9ca6c4cc92ca068",
          "name": "Delete service | Affects Threat Research Platforms",
          "description": "Delete service attacking threat researchers platforms. Deletes , blocks, scrambles , attaches to accounts like an overlord monitoring and deletion of Io\u2019s across various platforms. \n\nIDS Rules: PROTOCOL-ICMP PATH MTU denial of service attempt\n\u2022 PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\u2022 Matches rule PROTOCOL-ICMP Echo Reply\nInteresting: TLS: SNI: slscr.update.microsoft.com\nSNI: nexusrules.officeapps.live.com\nSNI: login.live.com\nSNI: client.wns.windows.com",
          "modified": "2025-08-20T04:13:22.641000",
          "created": "2025-06-23T14:19:12.328000",
          "tags": [
            "ta0004 defense",
            "evasion ta0005",
            "command",
            "control ta0011",
            "oc0006",
            "get http",
            "resolved ips",
            "dns resolutions",
            "request",
            "response",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "ip address",
            "country name",
            "cname",
            "port",
            "accept",
            "gmt ifnonematch",
            "url data",
            "icmp",
            "mutexes nothing",
            "data",
            "datacrashpad",
            "edge",
            "created",
            "nothing",
            "html internet",
            "html document",
            "ascii text",
            "gtmkvjvztk dl"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 2401,
            "URL": 5856,
            "FileHash-SHA256": 3473,
            "domain": 2188,
            "FileHash-MD5": 123,
            "FileHash-SHA1": 120,
            "CVE": 2
          },
          "indicator_count": 14163,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "242 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d18d829739be014393c59",
          "name": "SoundCloud - Hear the world\u2019s sounds",
          "description": "Social engineering included lots of contact via Facebook, Twitter, SoundCloud, Victims website, iCloud.. iCloud was erased and the hacker left the man \u2018deadmau5\u2018 .  deadmau5 was used threatening posts emails and whoever they are sent photos and became overly interested in victims music. 1st to report music was not showing up on YouTube. Statements show victim had millions of views redirected. Hackers would often thank artistss for another million views. Songs pirated. Jansky on SoundCloud contacted victims daughter often, sent a photo and said he was from Great Britain. \n\u2022 ALFPER:PUA:Win32/InstallCore\n\u2022 TrojanDropper:Win32/VB.IL\n\u2022 Win.Trojan.Agent-\n|| blog.jpcert.or.jp \n\n\u2022 Registrant Org: Japan Computer Emergency Response Team Coordination Center\n\nI feel like this is very dangerous. These people are in Colorado no matter where they say they are.",
          "modified": "2025-08-19T14:03:11.976000",
          "created": "2025-07-20T16:27:04.872000",
          "tags": [
            "read c",
            "search",
            "medium",
            "entries",
            "show",
            "unicode",
            "tls handshake",
            "memcommit",
            "delete",
            "crlf line",
            "next",
            "dock",
            "write",
            "execution",
            "malware",
            "copy",
            "no expiration",
            "filehashmd5",
            "filehashsha256",
            "showing",
            "urls",
            "passive dns",
            "http",
            "unique",
            "l add",
            "pulse pulses",
            "ip address",
            "related nids",
            "files location",
            "united",
            "code",
            "present jul",
            "present showing",
            "title error",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jul",
            "next associated",
            "files show",
            "win32",
            "date",
            "urls show",
            "error",
            "creation date",
            "name servers",
            "value emails",
            "name eric",
            "wahlforss name",
            "org soundcloud",
            "city berlin",
            "country de",
            "dnssec unsigned",
            "files",
            "verdict",
            "domain",
            "files ip",
            "address",
            "location united",
            "asn as16509",
            "less",
            "results nov",
            "associated urls",
            "results jan",
            "present feb",
            "related tags",
            "none indicator",
            "facts domain",
            "present",
            "akamai external",
            "resources whois",
            "urlvoid",
            "related",
            "png image",
            "rgba",
            "alfper",
            "ipv4 add",
            "trojandropper",
            "present may",
            "present jun",
            "cname",
            "emails",
            "status",
            "servers",
            "less whois",
            "body",
            "fastly error",
            "please",
            "sea p",
            "america flag",
            "america asn",
            "trojan",
            "accept",
            "url add",
            "ip related",
            "pulses none",
            "cdhc",
            "oxq xr8w1",
            "fv5hc9a2l",
            "s showing",
            "next related",
            "domains domain",
            "script urls",
            "present sep",
            "cookie",
            "hostname add"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6020,
            "hostname": 1865,
            "FileHash-SHA256": 676,
            "FileHash-MD5": 106,
            "FileHash-SHA1": 86,
            "domain": 990,
            "email": 5
          },
          "indicator_count": 9748,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d18de7177474b759ab2b7",
          "name": "SoundCloud - Hear the world\u2019s sounds",
          "description": "Social engineering included lots of contact via Facebook, Twitter, SoundCloud, Victims website, iCloud.. iCloud was erased and the hacker left the man \u2018deadmau5\u2018 .  deadmau5 was used threatening posts emails and whoever they are sent photos and became overly interested in victims music. 1st to report music was not showing up on YouTube. Statements show victim had millions of views redirected. Hackers would often thank artistss for another million views. Songs pirated. Jansky on SoundCloud contacted victims daughter often, sent a photo and said he was from Great Britain. \n\u2022 ALFPER:PUA:Win32/InstallCore\n\u2022 TrojanDropper:Win32/VB.IL\n\u2022 Win.Trojan.Agent-\n|| blog.jpcert.or.jp \n\n\u2022 Registrant Org: Japan Computer Emergency Response Team Coordination Center\n\nI feel like this is very dangerous. These people are in Colorado no matter where they say they are.",
          "modified": "2025-08-19T14:03:11.976000",
          "created": "2025-07-20T16:27:10.608000",
          "tags": [
            "read c",
            "search",
            "medium",
            "entries",
            "show",
            "unicode",
            "tls handshake",
            "memcommit",
            "delete",
            "crlf line",
            "next",
            "dock",
            "write",
            "execution",
            "malware",
            "copy",
            "no expiration",
            "filehashmd5",
            "filehashsha256",
            "showing",
            "urls",
            "passive dns",
            "http",
            "unique",
            "l add",
            "pulse pulses",
            "ip address",
            "related nids",
            "files location",
            "united",
            "code",
            "present jul",
            "present showing",
            "title error",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jul",
            "next associated",
            "files show",
            "win32",
            "date",
            "urls show",
            "error",
            "creation date",
            "name servers",
            "value emails",
            "name eric",
            "wahlforss name",
            "org soundcloud",
            "city berlin",
            "country de",
            "dnssec unsigned",
            "files",
            "verdict",
            "domain",
            "files ip",
            "address",
            "location united",
            "asn as16509",
            "less",
            "results nov",
            "associated urls",
            "results jan",
            "present feb",
            "related tags",
            "none indicator",
            "facts domain",
            "present",
            "akamai external",
            "resources whois",
            "urlvoid",
            "related",
            "png image",
            "rgba",
            "alfper",
            "ipv4 add",
            "trojandropper",
            "present may",
            "present jun",
            "cname",
            "emails",
            "status",
            "servers",
            "less whois",
            "body",
            "fastly error",
            "please",
            "sea p",
            "america flag",
            "america asn",
            "trojan",
            "accept",
            "url add",
            "ip related",
            "pulses none",
            "cdhc",
            "oxq xr8w1",
            "fv5hc9a2l",
            "s showing",
            "next related",
            "domains domain",
            "script urls",
            "present sep",
            "cookie",
            "hostname add"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6020,
            "hostname": 1865,
            "FileHash-SHA256": 676,
            "FileHash-MD5": 106,
            "FileHash-SHA1": 86,
            "domain": 990,
            "email": 5
          },
          "indicator_count": 9748,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6875e98438889e51b3fdd18f",
          "name": "Critical \u2022 Schedule system process - Mirai | Foundry Overwatch",
          "description": "",
          "modified": "2025-08-14T05:04:16.839000",
          "created": "2025-07-15T05:39:16.652000",
          "tags": [
            "win32 exe",
            "country",
            "include review",
            "exclude",
            "defense evasion",
            "access ta0006",
            "command",
            "control ta0011",
            "impact ta0040",
            "impact ob0008",
            "file system",
            "system oc0008",
            "match unknown",
            "adversaries",
            "match info",
            "info",
            "execution flow",
            "t1574 dll",
            "tries",
            "registry",
            "modify system",
            "process t1543",
            "unknown",
            "window",
            "ob0009 install",
            "ob0012 install",
            "insecure",
            "b0047 modify",
            "registry e1112",
            "hidden files",
            "registry run",
            "keys",
            "startup folder",
            "f0012 file",
            "critical",
            "united",
            "as15169",
            "delete c",
            "as16509",
            "show",
            "search",
            "intel",
            "ms windows",
            "entries",
            "medium",
            "worm",
            "copy",
            "write",
            "explorer",
            "malware",
            "next",
            "present jul",
            "status",
            "date",
            "ip address",
            "domain",
            "servers",
            "showing",
            "unknown ns",
            "related pulses",
            "pulses",
            "tags",
            "related tags",
            "more file",
            "type",
            "date april",
            "am size",
            "sha1 sha256",
            "as14618",
            "united kingdom",
            "as54113",
            "as15133 verizon",
            "top source",
            "top destination",
            "status domain",
            "ip whitelisted",
            "whitelisted",
            "tcp include",
            "source source",
            "oamazon",
            "cnamazon rsa",
            "odigicert inc",
            "sweden as20940",
            "as20940",
            "entries tls",
            "ip destination",
            "encrypt",
            "aaaa",
            "found",
            "certificate",
            "next associated",
            "urls show",
            "date checked",
            "error",
            "windows",
            "high",
            "yara detections",
            "installs",
            "checks",
            "filehash",
            "sha256 add",
            "themida",
            "data upload",
            "extraction",
            "md5 add",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "win32",
            "ddos",
            "passive dns",
            "activity",
            "checkin",
            "win64",
            "mtb jan",
            "lowfi",
            "trojan",
            "ransom",
            "trojandropper",
            "yara",
            "nsis",
            "nss bv",
            "su data",
            "windo alerts",
            "andariel",
            "malware traffic",
            "nids",
            "icmp traffic",
            "dns query",
            "id deadhost",
            "connects",
            "andariel high",
            "richhash",
            "external",
            "virustotal api",
            "screenshots",
            "failed",
            "auurtonany data",
            "themida andarie",
            "present may",
            "japan unknown",
            "unknown cname",
            "domain add",
            "urls",
            "files",
            "http headers",
            "msie",
            "windows nt",
            "tcp syn",
            "resolverror",
            "externalport",
            "internalport",
            "wget command",
            "devices home",
            "execution",
            "foundry",
            "home networks",
            "mirai",
            "x.com",
            "porn",
            "monitored target",
            "d link",
            "targets"
          ],
          "references": [
            "TJprojMain.exe {79c7303a1a49b85569245a8ca1c1a26be720387845af9391fa1e4677308bd6b6}",
            "Crowdsourced Signa: Schedule system process by Joe Security",
            "Sigma \u2022 Suspicious Process Masquerading As SvcHost.EXE by Swachchhanda Shrawan Poudel",
            "Sigma \u2022 System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)",
            "Yara \u2022  NSIS from ruleset NSIS by kevoreilly",
            "Yara \u2022 rule SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "Yara \u2022 Windows_Generic_Threat_7526f106 from ruleset Windows_Generic_Threat by Elastic Security",
            "Alerts: persistence_autorun \u2022 persistence_autorun_tasks stealth_hiddenreg \u2022 suspicious_command",
            "IDS : Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI",
            "Mirai - ]1.0.0.0 - Unix.Trojan.Mirai-6981169-0",
            "*Themida_2xx. Oreans,Technologies",
            "*Andariel Backdoor Activity (Checkin)",
            "Alert: dead_host nids_malware_alert network_icmp nolookup_communication",
            "IDS: WGET Command Specifying Output in HTTP Headers",
            "IDS: D-Link Devices Home Network Administration Protocol Command Execution",
            "foundry2-lbl.dvr.dn2.n-helix.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://foundry2sdbl",
            "https://xn--72c9abh1f8ad1lzc.com/video_tag/pornthai/ \u2022 https://ro.theskinnyfoodco.com/en-fr/blogs/recipes/pornstar-martini-recipe \u2022 m.pornsexer.xxx.3.1.adiosfil.roksit.net",
            "x.com \u2022 nr-data.net \u2022 apple.k8s.joewa.com",
            "http://apple.cc.lvlid.com/ \u2022 http://apple.cc.lvlid.com/ios/ \u2022 http://www.apple.cc.lvlid.com/ios",
            "Devices remotely connected, tracked , monitored"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Worm:Win32/Mofksys.RND!MTB",
              "display_name": "Worm:Win32/Mofksys.RND!MTB",
              "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
            },
            {
              "id": "Unix.Trojan.Mirai-6981169-0",
              "display_name": "Unix.Trojan.Mirai-6981169-0",
              "target": null
            },
            {
              "id": "Win.Malware.Ursu-9856871-0",
              "display_name": "Win.Malware.Ursu-9856871-0",
              "target": null
            },
            {
              "id": "ELF:DDoS-Y\\ [Trj]",
              "display_name": "ELF:DDoS-Y\\ [Trj]",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1134",
              "name": "Access Token Manipulation",
              "display_name": "T1134 - Access Token Manipulation"
            },
            {
              "id": "T1485",
              "name": "Data Destruction",
              "display_name": "T1485 - Data Destruction"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1543",
              "name": "Create or Modify System Process",
              "display_name": "T1543 - Create or Modify System Process"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [
            "Healthcare",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 448,
            "FileHash-SHA1": 435,
            "FileHash-SHA256": 5851,
            "hostname": 2580,
            "domain": 1176,
            "URL": 7133,
            "SSLCertFingerprint": 30,
            "email": 3,
            "CVE": 3
          },
          "indicator_count": 17659,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "248 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Yara \u2022  NSIS from ruleset NSIS by kevoreilly",
        "sentient.industries affects independent artists. Affects several others.",
        "Alerts: persistence_autorun \u2022 persistence_autorun_tasks stealth_hiddenreg \u2022 suspicious_command",
        "x.com \u2022 nr-data.net \u2022 apple.k8s.joewa.com",
        "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
        "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
        "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
        "Remotewd.com devices",
        "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
        "*Andariel Backdoor Activity (Checkin)",
        "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
        "Alert: dead_host nids_malware_alert network_icmp nolookup_communication",
        "https://xn--72c9abh1f8ad1lzc.com/video_tag/pornthai/ \u2022 https://ro.theskinnyfoodco.com/en-fr/blogs/recipes/pornstar-martini-recipe \u2022 m.pornsexer.xxx.3.1.adiosfil.roksit.net",
        "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical",
        "https://link.monetizer101.com/widget/code/dailystaruk.js",
        "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
        "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
        "IDS: WGET Command Specifying Output in HTTP Headers",
        "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
        "foundry2-lbl.dvr.dn2.n-helix.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://foundry2sdbl",
        "Devices remotely connected, tracked , monitored",
        "Sigma \u2022 Suspicious Process Masquerading As SvcHost.EXE by Swachchhanda Shrawan Poudel",
        "Yara \u2022 rule SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post",
        "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
        "http://apple.cc.lvlid.com/ \u2022 http://apple.cc.lvlid.com/ios/ \u2022 http://www.apple.cc.lvlid.com/ios",
        "Mirai - ]1.0.0.0 - Unix.Trojan.Mirai-6981169-0",
        "(Can't access file- Malware infection files)",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
        "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
        "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
        "TJprojMain.exe {79c7303a1a49b85569245a8ca1c1a26be720387845af9391fa1e4677308bd6b6}",
        "*Themida_2xx. Oreans,Technologies",
        "If you find anything interesting please research it.",
        "constellation.pcfrpegaservice.net (Pegasus related? idk)",
        "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
        "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
        "Sigma \u2022 System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)",
        "Yara \u2022 Windows_Generic_Threat_7526f106 from ruleset Windows_Generic_Threat by Elastic Security",
        "IDS : Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI",
        "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "IDS: D-Link Devices Home Network Administration Protocol Command Execution",
        "IDS Detections: Win32/Vflooder.B Checkin | Virus Total vtapi DOS",
        "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
        "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
        "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
        "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
        "Crowdsourced Signa: Schedule system process by Joe Security",
        "http://link.monetizer101.com/widget/custom-2.0.2/templates/1"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "E5",
            "Dotnet",
            "Trojan:win32/glupteba.mt!mtb",
            "Win.packed.razy-9785185-0",
            "Trojan:win32/gandcrab",
            "Trojan:win32/zbot.sibl!mtb",
            "Trojan:win32/blihan.a",
            "Nufs_inno",
            "Themida",
            "Mydoom",
            "Ransom",
            "Win32:downloader-gjk\\ [trj]",
            "Tel:createscheduledtask.a!sigattr",
            "Unix.trojan.mirai-6981169-0",
            "Pws",
            "Worm:win32/mofksys.rnd!mtb",
            "Trojan:win32/zombie.a",
            "Win.trojan.jorik-149",
            "Xanfpezes.a",
            "Win.trojan.agent",
            "Hacktool:win32/autokms",
            "Alf:heraklezeval:trojan:win32/ymacco.aa47",
            "#lowfi:hstr:msil/malicious",
            "Win.malware (30)",
            "Alf:jasyp:pua:win32/bibado",
            "Alf:heraklezeval:trojandownloader:html/adodb!rfn",
            "#lowfidetectsvmware",
            "Trojandropper:win32/muldrop",
            "Elf:ddos-y\\ [trj]",
            "Script exploit",
            "Trojan:win32/toga",
            "Win.downloader.109205-1",
            "Ddos:win32/stormser.a",
            "Win.trojan.fakecodecs-119",
            "Alf:trojan:win32/g3nasom!imp",
            "Alf:hstr:dotnet",
            "Win.trojan.generic-9862772-0",
            "Win.malware.kolab-9885903-0",
            "#lowfi:hstr:msil/malicious.decryption",
            "Win.malware.ursu-9856871-0",
            "Trojan:win32/vflooder",
            "Win.malware.midie-6847892-0",
            "Trojandownloader:win32/upatre",
            "Win.trojan.jorik-130",
            "Win.trojan.bulz-9860169-0",
            "Trojandropper:win32/muldrop.v!mtb",
            "Custom malware",
            "#lowfienabledtcontinueafterunpacking",
            "Win32/nemucod"
          ],
          "industries": [
            "Technology",
            "Healthcare"
          ],
          "unique_indicators": 99147
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/ingenosya.mg",
    "whois": "http://whois.domaintools.com/ingenosya.mg",
    "domain": "ingenosya.mg",
    "hostname": "api-howonk.ingenosya.mg"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "68d40c9a87988555c2e23626",
      "name": "Described as \u2018Haunted\u2019 - Ransom & espionage continues to plague  residential communities | HighMark Residential",
      "description": "A national apartment apartment and townhome community that describes itself as luxury has developed such a poor reputation for poor conditions, communication, discrimination, a belief legal entities are running communities some which have been converted hospitals has a terrible spyware , ransom  problem they seem unwilling to address. Compromised to the hilt & famously known to have its own Reddit thread dedicated to a haunted\u2019 Denver community our team has  researched in the past. Denver community  had a compromise that likely brought attention to or spearheaded the AT&T outage. whitesky.us or the outage was a coincidence.\n\nConcerns about espionage, passwords, outages, ransomware. \ntips from former residents from Phoenix, Texas and Utah in on weekend. Broad research required.\nThailand live?",
      "modified": "2025-10-24T14:04:50.784000",
      "created": "2025-09-24T15:22:02.262000",
      "tags": [
        "encrypt",
        "residential",
        "benefits",
        "contact us",
        "email",
        "denver highmark",
        "windows nt",
        "dynamicloader",
        "generic http",
        "exe upload",
        "medium",
        "host",
        "inbound",
        "trojan",
        "write",
        "markus",
        "malware",
        "checkin",
        "trojandropper",
        "mtb sep",
        "united",
        "passive dns",
        "win32upatre sep",
        "ipv4",
        "reverse dns",
        "alerts",
        "av detections",
        "ids detections",
        "yara detections",
        "high",
        "dynamic",
        "reads",
        "pe file",
        "checks system",
        "write c",
        "a domains",
        "gmt server",
        "certificate",
        "hostname add",
        "url analysis",
        "title",
        "apache",
        "name servers",
        "ip address",
        "emails",
        "servers",
        "users",
        "recycle bin",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "defense evasion",
        "t1480 execution",
        "windir",
        "openurl c",
        "eregec4",
        "kl0hsy",
        "pattern match",
        "ascii text",
        "mitre att",
        "ck matrix",
        "t1057",
        "prefetch2",
        "yara signature",
        "general",
        "local",
        "path",
        "click",
        "ipv4 add",
        "urls",
        "files",
        "outbound",
        "cname",
        "apache x",
        "powered",
        "modified",
        "moved",
        "body doctype",
        "content type",
        "accept",
        "script script",
        "script urls",
        "queue security",
        "script begin",
        "url add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "dominet",
        "record value",
        "domain",
        "meta",
        "gmt etag",
        "pulse submit",
        "alive thailand",
        "xml title",
        "x tec",
        "html public",
        "show",
        "copy",
        "pe section",
        "contacted",
        "md5 add",
        "pulse pulses",
        "analysis date",
        "file score",
        "search",
        "win64",
        "khtml",
        "gecko",
        "json",
        "themida",
        "download",
        "next",
        "public folder",
        "windows",
        "highest",
        "a file",
        "checks adapter",
        "mpgph131 hr",
        "hourly rl",
        "mpgph131 lg",
        "onlogon rl",
        "entries",
        "checks",
        "high automated",
        "ollydbg",
        "gbdyllo",
        "file monitor",
        "process monitor",
        "cape",
        "related nids",
        "files location",
        "flag united",
        "pulses none",
        "next associated",
        "hosting",
        "33",
        "customercare"
      ],
      "references": [
        "IDS Detections: Win32/Vflooder.B Checkin | Virus Total vtapi DOS"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/Vflooder",
          "display_name": "Trojan:Win32/Vflooder",
          "target": "/malware/Trojan:Win32/Vflooder"
        },
        {
          "id": "Trojandownloader:Win32/Upatre",
          "display_name": "Trojandownloader:Win32/Upatre",
          "target": "/malware/Trojandownloader:Win32/Upatre"
        },
        {
          "id": "Win.Trojan.Agent",
          "display_name": "Win.Trojan.Agent",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/G3nasom!imp",
          "display_name": "ALF:Trojan:Win32/G3nasom!imp",
          "target": null
        },
        {
          "id": "Trojandropper:Win32/Muldrop.V!MTB",
          "display_name": "Trojandropper:Win32/Muldrop.V!MTB",
          "target": "/malware/Trojandropper:Win32/Muldrop.V!MTB"
        },
        {
          "id": "Themida",
          "display_name": "Themida",
          "target": null
        },
        {
          "id": "TEL:CreateScheduledTask.A!Sigattr",
          "display_name": "TEL:CreateScheduledTask.A!Sigattr",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1211",
          "name": "Exploitation for Defense Evasion",
          "display_name": "T1211 - Exploitation for Defense Evasion"
        },
        {
          "id": "T1048.001",
          "name": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol",
          "display_name": "T1048.001 - Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        {
          "id": "T1595.001",
          "name": "Scanning IP Blocks",
          "display_name": "T1595.001 - Scanning IP Blocks"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3081,
        "FileHash-MD5": 756,
        "FileHash-SHA1": 724,
        "FileHash-SHA256": 3089,
        "domain": 1476,
        "email": 8,
        "hostname": 1198,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 10335,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "177 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68abf66e97031d0ff0c04fed",
      "name": "Packed sentient.industries links to a targets business website",
      "description": "Very malicious link found in a targets business.\nPacked. Needs to be categorized.\n(FoundryPalantir rich?) Tracking, hacking, and serious espionage.\nAvailable public Information: \nSENTIENT INDUSTRIES\nsentient.industries\nSentient industries provides design and engineering services, from prototyping to small-batch manufacturing, empowering clients to overcome complex challenges. |\nMore about sentient\nMission sentient accelerates mission critical technology for\u2026\nSENTIENT INDUSTRIES\nAccelerating mission-critical tech for disaster response, defense ...\nContact Now\nAustin, tx 78758. United States. EMAIL us. info@sentient \n\nWorse than it looks. Spying on a several threat researchers.",
      "modified": "2025-09-24T04:04:05.604000",
      "created": "2025-08-25T05:36:46.327000",
      "tags": [
        "moved",
        "body",
        "x cache",
        "cloudfront x",
        "cph50 c2",
        "certificate",
        "record value",
        "title",
        "h1 center",
        "server",
        "redacted for",
        "servers",
        "name redacted",
        "for privacy",
        "name servers",
        "org data",
        "privacy city",
        "privacy country",
        "ca creation",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "asn as57033",
        "less whois",
        "registrar",
        "tucows domains",
        "key identifier",
        "data",
        "v3 serial",
        "number",
        "cat ozerossl",
        "cnzerossl ecc",
        "domain secure",
        "site ca",
        "validity",
        "subject public",
        "extraction",
        "data upload",
        "extra data",
        "include review",
        "find",
        "failed",
        "typ no",
        "ms windows",
        "intel",
        "pe32",
        "united",
        "search",
        "as16509",
        "from win32bios",
        "show",
        "high",
        "medium",
        "delphi",
        "copy",
        "write",
        "launcher",
        "next",
        "present aug",
        "present jul",
        "lowfi",
        "win32",
        "a div",
        "div div",
        "learn xml",
        "babylon",
        "win64",
        "trojan",
        "colors",
        "python",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "mitre att",
        "ck techniques",
        "et info",
        "tls handshake",
        "bad traffic",
        "failure",
        "date",
        "august",
        "hybrid",
        "general",
        "path",
        "starfield",
        "click",
        "strings",
        "se bethseda",
        "n bethseda",
        "n data",
        "error",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results aug",
        "read c",
        "tlsv1",
        "port",
        "destination",
        "module load",
        "execution",
        "dock",
        "persistence",
        "malware",
        "unknown",
        "cname",
        "aaaa",
        "creation date",
        "showing",
        "domain",
        "dga domains",
        "palantirfoundry",
        "foundry",
        "status",
        "unknown ns",
        "g2 tls",
        "rsa sha256",
        "italy unknown",
        "mtb may",
        "trojandropper",
        "invalid url",
        "next associated",
        "ddos",
        "body html",
        "hacktool",
        "ipv4",
        "url analysis",
        "ukraine",
        "encrypt",
        "rl add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "present jun",
        "entries",
        "title error",
        "all ipv4",
        "reverse dns",
        "yara detections",
        "top source",
        "top destination",
        "source source",
        "sha256 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity amazon4",
        "handle",
        "canada unknown",
        "content type",
        "javascript src",
        "script script",
        "x powered",
        "ipv4 add",
        "pulse submit",
        "submit url",
        "analysis",
        "url add",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "unknown aaaa",
        "ascii text",
        "user agent",
        "powershell",
        "agent",
        "czechia unknown",
        "domain add",
        "dynamicloader",
        "hostname add",
        "pentagon",
        "defense"
      ],
      "references": [
        "sentient.industries affects independent artists. Affects several others.",
        "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
        "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
        "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
        "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
        "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
        "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
        "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
        "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
        "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
        "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
        "http://link.monetizer101.com/widget/custom-2.0.2/templates/1",
        "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
        "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
        "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
        "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
        "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
        "https://link.monetizer101.com/widget/code/dailystaruk.js",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
        "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical",
        "(Can't access file- Malware infection files)",
        "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
        "constellation.pcfrpegaservice.net (Pegasus related? idk)",
        "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
        "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
        "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post",
        "Remotewd.com devices",
        "If you find anything interesting please research it."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "nUFS_inno",
          "display_name": "nUFS_inno",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:MSIL/Malicious",
          "display_name": "#Lowfi:HSTR:MSIL/Malicious",
          "target": null
        },
        {
          "id": "ALF:JASYP:PUA:Win32/Bibado",
          "display_name": "ALF:JASYP:PUA:Win32/Bibado",
          "target": null
        },
        {
          "id": "Trojan:Win32/Toga",
          "display_name": "Trojan:Win32/Toga",
          "target": "/malware/Trojan:Win32/Toga"
        },
        {
          "id": "Win32:Downloader-GJK\\ [Trj]",
          "display_name": "Win32:Downloader-GJK\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Downloader.109205-1",
          "display_name": "Win.Downloader.109205-1",
          "target": null
        },
        {
          "id": "Custom Malware",
          "display_name": "Custom Malware",
          "target": null
        },
        {
          "id": "#LowFiEnableDTContinueAfterUnpacking",
          "display_name": "#LowFiEnableDTContinueAfterUnpacking",
          "target": null
        },
        {
          "id": "Win32:Downloader-GJK\\ [Trj]",
          "display_name": "Win32:Downloader-GJK\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Downloader.109205-1",
          "display_name": "Win.Downloader.109205-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Jorik-149",
          "display_name": "Win.Trojan.Jorik-149",
          "target": null
        },
        {
          "id": "#LowFiDetectsVmWare",
          "display_name": "#LowFiDetectsVmWare",
          "target": null
        },
        {
          "id": "Win.Trojan.Jorik-130",
          "display_name": "Win.Trojan.Jorik-130",
          "target": null
        },
        {
          "id": "Win.Trojan.Fakecodecs-119",
          "display_name": "Win.Trojan.Fakecodecs-119",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Trojan.Bulz-9860169-0",
          "display_name": "Win.Trojan.Bulz-9860169-0",
          "target": null
        },
        {
          "id": "Win.Malware.Midie-6847892-0",
          "display_name": "Win.Malware.Midie-6847892-0",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Muldrop.V!MTB",
          "display_name": "TrojanDropper:Win32/Muldrop.V!MTB",
          "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB"
        },
        {
          "id": "Win.Packed.Razy-9785185-0",
          "display_name": "Win.Packed.Razy-9785185-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "PWS",
          "display_name": "PWS",
          "target": null
        },
        {
          "id": "DDOS:Win32/Stormser.A",
          "display_name": "DDOS:Win32/Stormser.A",
          "target": "/malware/DDOS:Win32/Stormser.A"
        },
        {
          "id": "ALF:HSTR:DotNET",
          "display_name": "ALF:HSTR:DotNET",
          "target": null
        },
        {
          "id": "DotNET",
          "display_name": "DotNET",
          "target": null
        },
        {
          "id": "Script Exploit",
          "display_name": "Script Exploit",
          "target": null
        },
        {
          "id": "HackTool:Win32/AutoKMS",
          "display_name": "HackTool:Win32/AutoKMS",
          "target": "/malware/HackTool:Win32/AutoKMS"
        },
        {
          "id": "Xanfpezes.A",
          "display_name": "Xanfpezes.A",
          "target": null
        },
        {
          "id": "Trojan:Win32/Gandcrab",
          "display_name": "Trojan:Win32/Gandcrab",
          "target": "/malware/Trojan:Win32/Gandcrab"
        },
        {
          "id": "Win.Trojan.Generic-9862772-0",
          "display_name": "Win.Trojan.Generic-9862772-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zbot.SIBL!MTB",
          "display_name": "Trojan:Win32/Zbot.SIBL!MTB",
          "target": "/malware/Trojan:Win32/Zbot.SIBL!MTB"
        },
        {
          "id": "Win32/Nemucod",
          "display_name": "Win32/Nemucod",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
          "display_name": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
          "target": null
        },
        {
          "id": "Trojan:Win32/Blihan.A",
          "display_name": "Trojan:Win32/Blihan.A",
          "target": "/malware/Trojan:Win32/Blihan.A"
        },
        {
          "id": "TrojanDropper:Win32/Muldrop",
          "display_name": "TrojanDropper:Win32/Muldrop",
          "target": "/malware/TrojanDropper:Win32/Muldrop"
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "target": null
        },
        {
          "id": "Win.Malware.Kolab-9885903-0",
          "display_name": "Win.Malware.Kolab-9885903-0",
          "target": null
        },
        {
          "id": "Win.Malware (30)",
          "display_name": "Win.Malware (30)",
          "target": null
        },
        {
          "id": "Ransom",
          "display_name": "Ransom",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
          "display_name": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
          "target": null
        },
        {
          "id": "E5",
          "display_name": "E5",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1003.008",
          "name": "/etc/passwd and /etc/shadow",
          "display_name": "T1003.008 - /etc/passwd and /etc/shadow"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 40,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 6232,
        "URL": 24908,
        "hostname": 7993,
        "FileHash-SHA256": 11128,
        "email": 6,
        "FileHash-MD5": 1054,
        "FileHash-SHA1": 932,
        "SSLCertFingerprint": 14,
        "CIDR": 3,
        "CVE": 3
      },
      "indicator_count": 52273,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 146,
      "modified_text": "207 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68596260a9ca6c4cc92ca068",
      "name": "Delete service | Affects Threat Research Platforms",
      "description": "Delete service attacking threat researchers platforms. Deletes , blocks, scrambles , attaches to accounts like an overlord monitoring and deletion of Io\u2019s across various platforms. \n\nIDS Rules: PROTOCOL-ICMP PATH MTU denial of service attempt\n\u2022 PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\u2022 Matches rule PROTOCOL-ICMP Echo Reply\nInteresting: TLS: SNI: slscr.update.microsoft.com\nSNI: nexusrules.officeapps.live.com\nSNI: login.live.com\nSNI: client.wns.windows.com",
      "modified": "2025-08-20T04:13:22.641000",
      "created": "2025-06-23T14:19:12.328000",
      "tags": [
        "ta0004 defense",
        "evasion ta0005",
        "command",
        "control ta0011",
        "oc0006",
        "get http",
        "resolved ips",
        "dns resolutions",
        "request",
        "response",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "ip address",
        "country name",
        "cname",
        "port",
        "accept",
        "gmt ifnonematch",
        "url data",
        "icmp",
        "mutexes nothing",
        "data",
        "datacrashpad",
        "edge",
        "created",
        "nothing",
        "html internet",
        "html document",
        "ascii text",
        "gtmkvjvztk dl"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 2401,
        "URL": 5856,
        "FileHash-SHA256": 3473,
        "domain": 2188,
        "FileHash-MD5": 123,
        "FileHash-SHA1": 120,
        "CVE": 2
      },
      "indicator_count": 14163,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "242 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d18d829739be014393c59",
      "name": "SoundCloud - Hear the world\u2019s sounds",
      "description": "Social engineering included lots of contact via Facebook, Twitter, SoundCloud, Victims website, iCloud.. iCloud was erased and the hacker left the man \u2018deadmau5\u2018 .  deadmau5 was used threatening posts emails and whoever they are sent photos and became overly interested in victims music. 1st to report music was not showing up on YouTube. Statements show victim had millions of views redirected. Hackers would often thank artistss for another million views. Songs pirated. Jansky on SoundCloud contacted victims daughter often, sent a photo and said he was from Great Britain. \n\u2022 ALFPER:PUA:Win32/InstallCore\n\u2022 TrojanDropper:Win32/VB.IL\n\u2022 Win.Trojan.Agent-\n|| blog.jpcert.or.jp \n\n\u2022 Registrant Org: Japan Computer Emergency Response Team Coordination Center\n\nI feel like this is very dangerous. These people are in Colorado no matter where they say they are.",
      "modified": "2025-08-19T14:03:11.976000",
      "created": "2025-07-20T16:27:04.872000",
      "tags": [
        "read c",
        "search",
        "medium",
        "entries",
        "show",
        "unicode",
        "tls handshake",
        "memcommit",
        "delete",
        "crlf line",
        "next",
        "dock",
        "write",
        "execution",
        "malware",
        "copy",
        "no expiration",
        "filehashmd5",
        "filehashsha256",
        "showing",
        "urls",
        "passive dns",
        "http",
        "unique",
        "l add",
        "pulse pulses",
        "ip address",
        "related nids",
        "files location",
        "united",
        "code",
        "present jul",
        "present showing",
        "title error",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jul",
        "next associated",
        "files show",
        "win32",
        "date",
        "urls show",
        "error",
        "creation date",
        "name servers",
        "value emails",
        "name eric",
        "wahlforss name",
        "org soundcloud",
        "city berlin",
        "country de",
        "dnssec unsigned",
        "files",
        "verdict",
        "domain",
        "files ip",
        "address",
        "location united",
        "asn as16509",
        "less",
        "results nov",
        "associated urls",
        "results jan",
        "present feb",
        "related tags",
        "none indicator",
        "facts domain",
        "present",
        "akamai external",
        "resources whois",
        "urlvoid",
        "related",
        "png image",
        "rgba",
        "alfper",
        "ipv4 add",
        "trojandropper",
        "present may",
        "present jun",
        "cname",
        "emails",
        "status",
        "servers",
        "less whois",
        "body",
        "fastly error",
        "please",
        "sea p",
        "america flag",
        "america asn",
        "trojan",
        "accept",
        "url add",
        "ip related",
        "pulses none",
        "cdhc",
        "oxq xr8w1",
        "fv5hc9a2l",
        "s showing",
        "next related",
        "domains domain",
        "script urls",
        "present sep",
        "cookie",
        "hostname add"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6020,
        "hostname": 1865,
        "FileHash-SHA256": 676,
        "FileHash-MD5": 106,
        "FileHash-SHA1": 86,
        "domain": 990,
        "email": 5
      },
      "indicator_count": 9748,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d18de7177474b759ab2b7",
      "name": "SoundCloud - Hear the world\u2019s sounds",
      "description": "Social engineering included lots of contact via Facebook, Twitter, SoundCloud, Victims website, iCloud.. iCloud was erased and the hacker left the man \u2018deadmau5\u2018 .  deadmau5 was used threatening posts emails and whoever they are sent photos and became overly interested in victims music. 1st to report music was not showing up on YouTube. Statements show victim had millions of views redirected. Hackers would often thank artistss for another million views. Songs pirated. Jansky on SoundCloud contacted victims daughter often, sent a photo and said he was from Great Britain. \n\u2022 ALFPER:PUA:Win32/InstallCore\n\u2022 TrojanDropper:Win32/VB.IL\n\u2022 Win.Trojan.Agent-\n|| blog.jpcert.or.jp \n\n\u2022 Registrant Org: Japan Computer Emergency Response Team Coordination Center\n\nI feel like this is very dangerous. These people are in Colorado no matter where they say they are.",
      "modified": "2025-08-19T14:03:11.976000",
      "created": "2025-07-20T16:27:10.608000",
      "tags": [
        "read c",
        "search",
        "medium",
        "entries",
        "show",
        "unicode",
        "tls handshake",
        "memcommit",
        "delete",
        "crlf line",
        "next",
        "dock",
        "write",
        "execution",
        "malware",
        "copy",
        "no expiration",
        "filehashmd5",
        "filehashsha256",
        "showing",
        "urls",
        "passive dns",
        "http",
        "unique",
        "l add",
        "pulse pulses",
        "ip address",
        "related nids",
        "files location",
        "united",
        "code",
        "present jul",
        "present showing",
        "title error",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jul",
        "next associated",
        "files show",
        "win32",
        "date",
        "urls show",
        "error",
        "creation date",
        "name servers",
        "value emails",
        "name eric",
        "wahlforss name",
        "org soundcloud",
        "city berlin",
        "country de",
        "dnssec unsigned",
        "files",
        "verdict",
        "domain",
        "files ip",
        "address",
        "location united",
        "asn as16509",
        "less",
        "results nov",
        "associated urls",
        "results jan",
        "present feb",
        "related tags",
        "none indicator",
        "facts domain",
        "present",
        "akamai external",
        "resources whois",
        "urlvoid",
        "related",
        "png image",
        "rgba",
        "alfper",
        "ipv4 add",
        "trojandropper",
        "present may",
        "present jun",
        "cname",
        "emails",
        "status",
        "servers",
        "less whois",
        "body",
        "fastly error",
        "please",
        "sea p",
        "america flag",
        "america asn",
        "trojan",
        "accept",
        "url add",
        "ip related",
        "pulses none",
        "cdhc",
        "oxq xr8w1",
        "fv5hc9a2l",
        "s showing",
        "next related",
        "domains domain",
        "script urls",
        "present sep",
        "cookie",
        "hostname add"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6020,
        "hostname": 1865,
        "FileHash-SHA256": 676,
        "FileHash-MD5": 106,
        "FileHash-SHA1": 86,
        "domain": 990,
        "email": 5
      },
      "indicator_count": 9748,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6875e98438889e51b3fdd18f",
      "name": "Critical \u2022 Schedule system process - Mirai | Foundry Overwatch",
      "description": "",
      "modified": "2025-08-14T05:04:16.839000",
      "created": "2025-07-15T05:39:16.652000",
      "tags": [
        "win32 exe",
        "country",
        "include review",
        "exclude",
        "defense evasion",
        "access ta0006",
        "command",
        "control ta0011",
        "impact ta0040",
        "impact ob0008",
        "file system",
        "system oc0008",
        "match unknown",
        "adversaries",
        "match info",
        "info",
        "execution flow",
        "t1574 dll",
        "tries",
        "registry",
        "modify system",
        "process t1543",
        "unknown",
        "window",
        "ob0009 install",
        "ob0012 install",
        "insecure",
        "b0047 modify",
        "registry e1112",
        "hidden files",
        "registry run",
        "keys",
        "startup folder",
        "f0012 file",
        "critical",
        "united",
        "as15169",
        "delete c",
        "as16509",
        "show",
        "search",
        "intel",
        "ms windows",
        "entries",
        "medium",
        "worm",
        "copy",
        "write",
        "explorer",
        "malware",
        "next",
        "present jul",
        "status",
        "date",
        "ip address",
        "domain",
        "servers",
        "showing",
        "unknown ns",
        "related pulses",
        "pulses",
        "tags",
        "related tags",
        "more file",
        "type",
        "date april",
        "am size",
        "sha1 sha256",
        "as14618",
        "united kingdom",
        "as54113",
        "as15133 verizon",
        "top source",
        "top destination",
        "status domain",
        "ip whitelisted",
        "whitelisted",
        "tcp include",
        "source source",
        "oamazon",
        "cnamazon rsa",
        "odigicert inc",
        "sweden as20940",
        "as20940",
        "entries tls",
        "ip destination",
        "encrypt",
        "aaaa",
        "found",
        "certificate",
        "next associated",
        "urls show",
        "date checked",
        "error",
        "windows",
        "high",
        "yara detections",
        "installs",
        "checks",
        "filehash",
        "sha256 add",
        "themida",
        "data upload",
        "extraction",
        "md5 add",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "win32",
        "ddos",
        "passive dns",
        "activity",
        "checkin",
        "win64",
        "mtb jan",
        "lowfi",
        "trojan",
        "ransom",
        "trojandropper",
        "yara",
        "nsis",
        "nss bv",
        "su data",
        "windo alerts",
        "andariel",
        "malware traffic",
        "nids",
        "icmp traffic",
        "dns query",
        "id deadhost",
        "connects",
        "andariel high",
        "richhash",
        "external",
        "virustotal api",
        "screenshots",
        "failed",
        "auurtonany data",
        "themida andarie",
        "present may",
        "japan unknown",
        "unknown cname",
        "domain add",
        "urls",
        "files",
        "http headers",
        "msie",
        "windows nt",
        "tcp syn",
        "resolverror",
        "externalport",
        "internalport",
        "wget command",
        "devices home",
        "execution",
        "foundry",
        "home networks",
        "mirai",
        "x.com",
        "porn",
        "monitored target",
        "d link",
        "targets"
      ],
      "references": [
        "TJprojMain.exe {79c7303a1a49b85569245a8ca1c1a26be720387845af9391fa1e4677308bd6b6}",
        "Crowdsourced Signa: Schedule system process by Joe Security",
        "Sigma \u2022 Suspicious Process Masquerading As SvcHost.EXE by Swachchhanda Shrawan Poudel",
        "Sigma \u2022 System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)",
        "Yara \u2022  NSIS from ruleset NSIS by kevoreilly",
        "Yara \u2022 rule SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "Yara \u2022 Windows_Generic_Threat_7526f106 from ruleset Windows_Generic_Threat by Elastic Security",
        "Alerts: persistence_autorun \u2022 persistence_autorun_tasks stealth_hiddenreg \u2022 suspicious_command",
        "IDS : Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI",
        "Mirai - ]1.0.0.0 - Unix.Trojan.Mirai-6981169-0",
        "*Themida_2xx. Oreans,Technologies",
        "*Andariel Backdoor Activity (Checkin)",
        "Alert: dead_host nids_malware_alert network_icmp nolookup_communication",
        "IDS: WGET Command Specifying Output in HTTP Headers",
        "IDS: D-Link Devices Home Network Administration Protocol Command Execution",
        "foundry2-lbl.dvr.dn2.n-helix.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://foundry2sdbl",
        "https://xn--72c9abh1f8ad1lzc.com/video_tag/pornthai/ \u2022 https://ro.theskinnyfoodco.com/en-fr/blogs/recipes/pornstar-martini-recipe \u2022 m.pornsexer.xxx.3.1.adiosfil.roksit.net",
        "x.com \u2022 nr-data.net \u2022 apple.k8s.joewa.com",
        "http://apple.cc.lvlid.com/ \u2022 http://apple.cc.lvlid.com/ios/ \u2022 http://www.apple.cc.lvlid.com/ios",
        "Devices remotely connected, tracked , monitored"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Worm:Win32/Mofksys.RND!MTB",
          "display_name": "Worm:Win32/Mofksys.RND!MTB",
          "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
        },
        {
          "id": "Unix.Trojan.Mirai-6981169-0",
          "display_name": "Unix.Trojan.Mirai-6981169-0",
          "target": null
        },
        {
          "id": "Win.Malware.Ursu-9856871-0",
          "display_name": "Win.Malware.Ursu-9856871-0",
          "target": null
        },
        {
          "id": "ELF:DDoS-Y\\ [Trj]",
          "display_name": "ELF:DDoS-Y\\ [Trj]",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1134",
          "name": "Access Token Manipulation",
          "display_name": "T1134 - Access Token Manipulation"
        },
        {
          "id": "T1485",
          "name": "Data Destruction",
          "display_name": "T1485 - Data Destruction"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1543",
          "name": "Create or Modify System Process",
          "display_name": "T1543 - Create or Modify System Process"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [
        "Healthcare",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 448,
        "FileHash-SHA1": 435,
        "FileHash-SHA256": 5851,
        "hostname": 2580,
        "domain": 1176,
        "URL": 7133,
        "SSLCertFingerprint": 30,
        "email": 3,
        "CVE": 3
      },
      "indicator_count": 17659,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "248 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://api-howonk.ingenosya.mg",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://api-howonk.ingenosya.mg",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776640825.3162086
}