{
  "type": "URL",
  "indicator": "https://beyondlabels.supportingcast.fm",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://beyondlabels.supportingcast.fm",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4098025155,
      "indicator": "https://beyondlabels.supportingcast.fm",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "686d28ec9208b0424e0ccad2",
          "name": "Remote Keylogger | Foundry",
          "description": "Keylogger Remotely installed on all of targets devices. Up until\u2026 target had to purchase and return more than 50\ndevices minus service plans. Apple\nengineers have been involved many times. Mercenary attacks also confirmed: A kind phone store owner gave her a free phone that was hacked within seconds. \nUnless someone has been \u2018framing Palantir / Foundry Tech Mafia is portrayed a playing a  significant involvement of SA victim potentially since  day of coerced disclosure in 2013.\nThe first clue was a YouTube follower with a menacing name and picture began to follow, change login,  network, dumped adult content, utilized web content scrapers,. stole\nPasswords,etc., Anyway .. Unruy  & remotely installed keylogger. \n#foundry #apple #soc #keylogger \n\nThis is risky to say but very wrong to do. She was a multi generational (MGM) American.",
          "modified": "2025-09-19T03:02:22.742000",
          "created": "2025-07-08T14:19:24.211000",
          "tags": [
            "delete",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "delete c",
            "intel",
            "write",
            "malware",
            "dynamicloader",
            "yara rule",
            "high",
            "vmware",
            "phishing",
            "remote",
            "keylogger",
            "remote keylogger",
            "type indicator",
            "related pulses",
            "no expiration",
            "url https",
            "showing",
            "reputation",
            "foundry",
            "apple",
            "downloader",
            "trojan"
          ],
          "references": [
            "http://www.download-servers.com/SysInfo/Validate.exe||random.exe||/S||access your PC from anywhere!||Remote Access to your Home or Office PC remotely. Work on your PC from any internet computer or mobile. Access All files and transfer them between computers. Invite friends to view your LiveScreen and share presentations.||",
            "\u2022 engine.remote-keylogger.net \u2022 logout-superset2.remote-keylogger.net \u2022 mail.remote-keylogger.net",
            "\u2022 http://appleid.apple.com-cgi-bin-wets-myapleid.woa-wa-direct.yimucentral.com/apple/cgibin/confirm/processing/cmd=/95d9e0a26d38b5f248bb389e1a4d14c0/webobjects",
            "\u2022  199.59.243.226",
            "\u2022 ww25.vpn.steamcommunity-site.info",
            "\u2022 apple-mac.us \u2022 zpwi8.itunes-apple-jp.xyz \u2022 applefanatic.org \u2022 appleemailaccounts.com \u2022 http://appleemailaccounts.com/",
            "\u2022 zgcdfoundry.com \u2022 https://zgcdfoundry.com/",
            "\u2022 ww25.vpn.twitte5r.com | http://paypal-online.5flix.net/ | court-supreme.us",
            "\u2022 https://animal64u.com/bestiality-animal-porn/dog \u2022 \thttp://xxnxporntube.com",
            "\u2022 starbucksmobilepay.5flix.net | https://mobilemobster.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Unruy",
              "display_name": "Unruy",
              "target": null
            },
            {
              "id": "Reputation.1",
              "display_name": "Reputation.1",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1133",
              "name": "External Remote Services",
              "display_name": "T1133 - External Remote Services"
            }
          ],
          "industries": [
            "Telecommunications",
            "Technology",
            "Media"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 260,
            "FileHash-SHA1": 244,
            "FileHash-SHA256": 4406,
            "URL": 9684,
            "domain": 3164,
            "hostname": 3370,
            "CVE": 1
          },
          "indicator_count": 21129,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "212 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "689b9b9fab42ca4f016a226f",
          "name": "Elastic's Al-driven Endpoint Security - Red Team Malicious (moved?)",
          "description": "Endgame - Unruy Activity -System infection | (Moved) Endpoint security (MOVED) from Elastic\nElastic's Al-driven security analytics empowers you with comprehensive endpoint protection. Detect, investigate, and respond to threats faster with a single agent and unified console. Gain actionable insights for a proactive defense posture. All built on the Search\nAl platform.\n| Used maliciously against monitored non-criminal targets. |\n{ virus - https://universitycenter.uccs.edu/}\n#unruy #activity #monitored_target #red_team_malicious #trojan #worm #moved\n#ai #adversarial #custom_malware #ransom #crypt #guardrails #dns #cnc #evasive #domain_generation #remote_access #devices #remotewd #virus #custom_malware #rip #endgame \n\u2022 TrojanDropper\t\t\t\n\u2022 Win32:Evo-gen\t\u2022 Cassini\n\u2022 RansomX-gen\u2022 Zombie.A\n\u2022 win32:MalwareX-gen\t\u2022 Win32:Malware-gen \u2022  Nymeria\n\u2022 Forcud +",
          "modified": "2025-09-11T13:03:18.814000",
          "created": "2025-08-12T19:53:03.953000",
          "tags": [
            "url http",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "entries",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "href",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "show technique",
            "ck matrix",
            "null",
            "refresh",
            "body",
            "span",
            "general",
            "local",
            "path",
            "iframe",
            "click",
            "date",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "united",
            "unknown ns",
            "ip address",
            "creation date",
            "search",
            "present sep",
            "moved",
            "domain add",
            "encrypt",
            "accept",
            "please",
            "passive dns",
            "msie",
            "next associated",
            "html",
            "background",
            "unknown site",
            "div div",
            "trojan",
            "zeus",
            "process32nextw",
            "read c",
            "show",
            "shellexecuteexw",
            "windows nt",
            "wow64",
            "copy",
            "dock",
            "write",
            "malware",
            "unknown",
            "defense evasion",
            "t1480 execution",
            "file defense",
            "august",
            "hybrid",
            "port",
            "destination",
            "tlsv1",
            "as15169",
            "ogoogle trust",
            "cngts ca",
            "execution",
            "next",
            "persistence",
            "data upload",
            "extraction",
            "win32",
            "ransom",
            "trojandropper",
            "mtb nov",
            "forcud",
            "files show",
            "date hash",
            "avast avg"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4179,
            "domain": 774,
            "hostname": 1673,
            "FileHash-MD5": 169,
            "FileHash-SHA1": 110,
            "FileHash-SHA256": 2073,
            "email": 1,
            "SSLCertFingerprint": 13,
            "CVE": 1
          },
          "indicator_count": 8993,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "220 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6893eee9bf1b30e08d1a6d8e",
          "name": "Ransom:Win32/CVE - Denver \u2022 Community Lifestyle Neighborhood",
          "description": "*Ransom:Win32/CVE - * Win.Dropper.Stone-9856966-0,\nDenver \u2022 Community Lifestyle Neighborhood. \nCorporate & Leasing Office corrupted with spyware. There is a single verified monitored target. All technology devices corrupted, at least 2 phones monitored, YouTube is courtesy of hackers. Several in person and phone investigations, staff change and they know nothing about leasing apartments, townhomes , etiquette, poor communication. Target also investigated. It appears to be harassment, intimidation and monitoring for unspecified reasons. The parking lot is stacked with obvious people sitting in their vehicles for hours. It\u2019s unclear if the staffing change is legitimate or part of an investigation.",
          "modified": "2025-09-05T23:02:52.811000",
          "created": "2025-08-07T00:10:17.696000",
          "tags": [
            "address google",
            "safe browsing",
            "united",
            "typeof",
            "passive dns",
            "body doctype",
            "nreum",
            "date",
            "gmt server",
            "apache x",
            "cnection",
            "content type",
            "span",
            "ok transfer",
            "encoding",
            "x powered",
            "unknown soa",
            "unknown ns",
            "showing",
            "entries",
            "next associated",
            "urls show",
            "body",
            "encrypt",
            "search",
            "ip address",
            "creation date",
            "record value",
            "present jul",
            "present may",
            "present apr",
            "certificate",
            "present aug",
            "present feb",
            "present dec",
            "present nov",
            "error",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "found",
            "development att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "mitre att",
            "show technique",
            "ck matrix",
            "pattern match",
            "ascii text",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "itre att",
            "accept",
            "sha256",
            "size",
            "type data",
            "utf8 text",
            "document file",
            "flag",
            "server",
            "european union",
            "name server",
            "tor analysis",
            "dns requests",
            "domain address",
            "ii llc",
            "windir",
            "openurl c",
            "prefetch2",
            "show process",
            "ogoogle trust",
            "network traffic",
            "organization",
            "elton avundano",
            "object",
            "title object",
            "header http2",
            "returnurl",
            "texas",
            "rsa ov",
            "ssl ca",
            "status",
            "australia",
            "netherlands",
            "urls",
            "gmt path",
            "hostname add",
            "pulse submit",
            "present oct",
            "e safe",
            "results jul",
            "response ip",
            "present jan",
            "name servers",
            "verdict",
            "domain",
            "files ip",
            "address domain",
            "xhr start",
            "xhr load",
            "aaaa",
            "read c",
            "show",
            "port",
            "destination",
            "high",
            "delete",
            "outbound m3",
            "copy",
            "write",
            "persistence",
            "execution",
            "malware",
            "generic",
            "unknown",
            "present mar",
            "dynamicloader",
            "wine emulator",
            "dynamic",
            "medium",
            "read",
            "associated urls",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "dnssec",
            "domain name",
            "solutions",
            "llc status",
            "next passive",
            "dns status",
            "hostname query",
            "files show",
            "date hash",
            "avast avg",
            "overview ip",
            "address",
            "related nids",
            "files location",
            "flag united",
            "hostname",
            "files domain",
            "win32",
            "mtb feb",
            "trojan",
            "susp",
            "trojandropper",
            "msr feb",
            "trojanspy",
            "virtool",
            "win64",
            "defense evasion",
            "t1480 execution",
            "file defense",
            "null",
            "refresh",
            "tools",
            "look",
            "verify",
            "restart",
            "file discovery",
            "utf8",
            "crlf line",
            "a domains",
            "script urls",
            "link",
            "unknown aaaa",
            "meta",
            "atom",
            "results jan",
            "present",
            "present sep",
            "akamai",
            "asn as16625",
            "less whois",
            "registrar",
            "http",
            "france flag",
            "france hostname",
            "files related",
            "url analysis",
            "files",
            "location france",
            "detailed error",
            "sec ch",
            "ch ua",
            "ua full",
            "ua platform",
            "moved",
            "name",
            "perfect privacy",
            "error jul",
            "next related",
            "domains show",
            "domain related",
            "url add",
            "pulse pulses",
            "hosting",
            "reverse dns",
            "france asn",
            "as16276",
            "dns resolutions",
            "datacenter",
            "regopenkeyexa",
            "regsetvalueexa",
            "windows nt",
            "regdword",
            "hostile",
            "service",
            "delphi",
            "next",
            "pulses none",
            "related tags",
            "ua bitness",
            "ua arch",
            "version sec",
            "mobile sec",
            "model sec",
            "review",
            "data upload",
            "extraction",
            "khtml",
            "gecko",
            "olet",
            "cnlet",
            "tlsv1",
            "hacktool",
            "push",
            "ms windows",
            "intel",
            "pe32",
            "users",
            "precreate read",
            "ransom",
            "code",
            "installer",
            "june",
            "media",
            "autorun",
            "next yara",
            "detections name",
            "aspackv2xxx",
            "eu alexey",
            "alerts",
            "pe file",
            "filehash",
            "sha256 add",
            "av detections",
            "ids detections",
            "yara detections",
            "analysis date",
            "april",
            "packing t1045",
            "t1045",
            "t1060",
            "registry run",
            "keys",
            "user execution",
            "icmp traffic"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1091",
              "name": "Replication Through Removable Media",
              "display_name": "T1091 - Replication Through Removable Media"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1132,
            "URL": 6245,
            "hostname": 2264,
            "FileHash-SHA256": 1857,
            "FileHash-SHA1": 491,
            "email": 9,
            "FileHash-MD5": 573,
            "SSLCertFingerprint": 16
          },
          "indicator_count": 12587,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "226 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d30048b95aaba628a5ee7",
          "name": "Working on it\u2026\u2026",
          "description": "\u2022 Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\n(onyx-ware.com)\nNS1.ENDGAME.COM\n(endgames.us)\nNS1.ENDGAME.COM\n#deadmau5 #janskyofficial #idk #soundcloud",
          "modified": "2025-08-19T17:00:59.379000",
          "created": "2025-07-20T18:05:56.587000",
          "tags": [
            "dynamicloader",
            "united",
            "as15169",
            "medium",
            "search",
            "show",
            "write c",
            "whitelisted",
            "brazil as396982",
            "high",
            "themida",
            "write",
            "delphi",
            "copy",
            "upatre",
            "encrypt",
            "june",
            "win32",
            "malware",
            "win64",
            "windows nt",
            "directui",
            "element",
            "classinfobase",
            "value",
            "hwndhost",
            "sapeav12",
            "delete c",
            "worm",
            "explorer",
            "insert",
            "movie",
            "alerts",
            "windows",
            "installs",
            "filehash",
            "sha256 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "passive dns",
            "urls",
            "http",
            "ip address",
            "related nids",
            "files location",
            "spain flag",
            "spain domain",
            "files related",
            "spain",
            "entries",
            "next associated",
            "meta name",
            "frame src",
            "ok set",
            "cookie",
            "gmt date",
            "gmt content",
            "filehashsha256",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "url http",
            "filehashmd5",
            "showing",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "iocs",
            "learn more",
            "filehashsha1",
            "types of",
            "united kingdom",
            "t1053",
            "taskjob",
            "t1055",
            "injection",
            "t1082",
            "t1119",
            "t1129",
            "modules",
            "t1143",
            "soundcloud",
            "created",
            "hour ago",
            "facebook",
            "twitter",
            "victims website",
            "youtube",
            "jansky",
            "trojandropper",
            "pulses url"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2012,
            "FileHash-MD5": 140,
            "FileHash-SHA1": 129,
            "FileHash-SHA256": 1348,
            "SSLCertFingerprint": 3,
            "domain": 288,
            "hostname": 812
          },
          "indicator_count": 4732,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "\u2022 apple-mac.us \u2022 zpwi8.itunes-apple-jp.xyz \u2022 applefanatic.org \u2022 appleemailaccounts.com \u2022 http://appleemailaccounts.com/",
        "\u2022 ww25.vpn.twitte5r.com | http://paypal-online.5flix.net/ | court-supreme.us",
        "\u2022 https://animal64u.com/bestiality-animal-porn/dog \u2022 \thttp://xxnxporntube.com",
        "\u2022 ww25.vpn.steamcommunity-site.info",
        "http://www.download-servers.com/SysInfo/Validate.exe||random.exe||/S||access your PC from anywhere!||Remote Access to your Home or Office PC remotely. Work on your PC from any internet computer or mobile. Access All files and transfer them between computers. Invite friends to view your LiveScreen and share presentations.||",
        "\u2022  199.59.243.226",
        "\u2022 engine.remote-keylogger.net \u2022 logout-superset2.remote-keylogger.net \u2022 mail.remote-keylogger.net",
        "\u2022 starbucksmobilepay.5flix.net | https://mobilemobster.com/",
        "\u2022 http://appleid.apple.com-cgi-bin-wets-myapleid.woa-wa-direct.yimucentral.com/apple/cgibin/confirm/processing/cmd=/95d9e0a26d38b5f248bb389e1a4d14c0/webobjects",
        "\u2022 zgcdfoundry.com \u2022 https://zgcdfoundry.com/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Reputation.1",
            "Unruy"
          ],
          "industries": [
            "Media",
            "Telecommunications",
            "Technology"
          ],
          "unique_indicators": 45007
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/supportingcast.fm",
    "whois": "http://whois.domaintools.com/supportingcast.fm",
    "domain": "supportingcast.fm",
    "hostname": "beyondlabels.supportingcast.fm"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "686d28ec9208b0424e0ccad2",
      "name": "Remote Keylogger | Foundry",
      "description": "Keylogger Remotely installed on all of targets devices. Up until\u2026 target had to purchase and return more than 50\ndevices minus service plans. Apple\nengineers have been involved many times. Mercenary attacks also confirmed: A kind phone store owner gave her a free phone that was hacked within seconds. \nUnless someone has been \u2018framing Palantir / Foundry Tech Mafia is portrayed a playing a  significant involvement of SA victim potentially since  day of coerced disclosure in 2013.\nThe first clue was a YouTube follower with a menacing name and picture began to follow, change login,  network, dumped adult content, utilized web content scrapers,. stole\nPasswords,etc., Anyway .. Unruy  & remotely installed keylogger. \n#foundry #apple #soc #keylogger \n\nThis is risky to say but very wrong to do. She was a multi generational (MGM) American.",
      "modified": "2025-09-19T03:02:22.742000",
      "created": "2025-07-08T14:19:24.211000",
      "tags": [
        "delete",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "delete c",
        "intel",
        "write",
        "malware",
        "dynamicloader",
        "yara rule",
        "high",
        "vmware",
        "phishing",
        "remote",
        "keylogger",
        "remote keylogger",
        "type indicator",
        "related pulses",
        "no expiration",
        "url https",
        "showing",
        "reputation",
        "foundry",
        "apple",
        "downloader",
        "trojan"
      ],
      "references": [
        "http://www.download-servers.com/SysInfo/Validate.exe||random.exe||/S||access your PC from anywhere!||Remote Access to your Home or Office PC remotely. Work on your PC from any internet computer or mobile. Access All files and transfer them between computers. Invite friends to view your LiveScreen and share presentations.||",
        "\u2022 engine.remote-keylogger.net \u2022 logout-superset2.remote-keylogger.net \u2022 mail.remote-keylogger.net",
        "\u2022 http://appleid.apple.com-cgi-bin-wets-myapleid.woa-wa-direct.yimucentral.com/apple/cgibin/confirm/processing/cmd=/95d9e0a26d38b5f248bb389e1a4d14c0/webobjects",
        "\u2022  199.59.243.226",
        "\u2022 ww25.vpn.steamcommunity-site.info",
        "\u2022 apple-mac.us \u2022 zpwi8.itunes-apple-jp.xyz \u2022 applefanatic.org \u2022 appleemailaccounts.com \u2022 http://appleemailaccounts.com/",
        "\u2022 zgcdfoundry.com \u2022 https://zgcdfoundry.com/",
        "\u2022 ww25.vpn.twitte5r.com | http://paypal-online.5flix.net/ | court-supreme.us",
        "\u2022 https://animal64u.com/bestiality-animal-porn/dog \u2022 \thttp://xxnxporntube.com",
        "\u2022 starbucksmobilepay.5flix.net | https://mobilemobster.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Unruy",
          "display_name": "Unruy",
          "target": null
        },
        {
          "id": "Reputation.1",
          "display_name": "Reputation.1",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1133",
          "name": "External Remote Services",
          "display_name": "T1133 - External Remote Services"
        }
      ],
      "industries": [
        "Telecommunications",
        "Technology",
        "Media"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 260,
        "FileHash-SHA1": 244,
        "FileHash-SHA256": 4406,
        "URL": 9684,
        "domain": 3164,
        "hostname": 3370,
        "CVE": 1
      },
      "indicator_count": 21129,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "212 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "689b9b9fab42ca4f016a226f",
      "name": "Elastic's Al-driven Endpoint Security - Red Team Malicious (moved?)",
      "description": "Endgame - Unruy Activity -System infection | (Moved) Endpoint security (MOVED) from Elastic\nElastic's Al-driven security analytics empowers you with comprehensive endpoint protection. Detect, investigate, and respond to threats faster with a single agent and unified console. Gain actionable insights for a proactive defense posture. All built on the Search\nAl platform.\n| Used maliciously against monitored non-criminal targets. |\n{ virus - https://universitycenter.uccs.edu/}\n#unruy #activity #monitored_target #red_team_malicious #trojan #worm #moved\n#ai #adversarial #custom_malware #ransom #crypt #guardrails #dns #cnc #evasive #domain_generation #remote_access #devices #remotewd #virus #custom_malware #rip #endgame \n\u2022 TrojanDropper\t\t\t\n\u2022 Win32:Evo-gen\t\u2022 Cassini\n\u2022 RansomX-gen\u2022 Zombie.A\n\u2022 win32:MalwareX-gen\t\u2022 Win32:Malware-gen \u2022  Nymeria\n\u2022 Forcud +",
      "modified": "2025-09-11T13:03:18.814000",
      "created": "2025-08-12T19:53:03.953000",
      "tags": [
        "url http",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "entries",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "mitre att",
        "ck techniques",
        "evasion att",
        "href",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "show technique",
        "ck matrix",
        "null",
        "refresh",
        "body",
        "span",
        "general",
        "local",
        "path",
        "iframe",
        "click",
        "date",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "united",
        "unknown ns",
        "ip address",
        "creation date",
        "search",
        "present sep",
        "moved",
        "domain add",
        "encrypt",
        "accept",
        "please",
        "passive dns",
        "msie",
        "next associated",
        "html",
        "background",
        "unknown site",
        "div div",
        "trojan",
        "zeus",
        "process32nextw",
        "read c",
        "show",
        "shellexecuteexw",
        "windows nt",
        "wow64",
        "copy",
        "dock",
        "write",
        "malware",
        "unknown",
        "defense evasion",
        "t1480 execution",
        "file defense",
        "august",
        "hybrid",
        "port",
        "destination",
        "tlsv1",
        "as15169",
        "ogoogle trust",
        "cngts ca",
        "execution",
        "next",
        "persistence",
        "data upload",
        "extraction",
        "win32",
        "ransom",
        "trojandropper",
        "mtb nov",
        "forcud",
        "files show",
        "date hash",
        "avast avg"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4179,
        "domain": 774,
        "hostname": 1673,
        "FileHash-MD5": 169,
        "FileHash-SHA1": 110,
        "FileHash-SHA256": 2073,
        "email": 1,
        "SSLCertFingerprint": 13,
        "CVE": 1
      },
      "indicator_count": 8993,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "220 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6893eee9bf1b30e08d1a6d8e",
      "name": "Ransom:Win32/CVE - Denver \u2022 Community Lifestyle Neighborhood",
      "description": "*Ransom:Win32/CVE - * Win.Dropper.Stone-9856966-0,\nDenver \u2022 Community Lifestyle Neighborhood. \nCorporate & Leasing Office corrupted with spyware. There is a single verified monitored target. All technology devices corrupted, at least 2 phones monitored, YouTube is courtesy of hackers. Several in person and phone investigations, staff change and they know nothing about leasing apartments, townhomes , etiquette, poor communication. Target also investigated. It appears to be harassment, intimidation and monitoring for unspecified reasons. The parking lot is stacked with obvious people sitting in their vehicles for hours. It\u2019s unclear if the staffing change is legitimate or part of an investigation.",
      "modified": "2025-09-05T23:02:52.811000",
      "created": "2025-08-07T00:10:17.696000",
      "tags": [
        "address google",
        "safe browsing",
        "united",
        "typeof",
        "passive dns",
        "body doctype",
        "nreum",
        "date",
        "gmt server",
        "apache x",
        "cnection",
        "content type",
        "span",
        "ok transfer",
        "encoding",
        "x powered",
        "unknown soa",
        "unknown ns",
        "showing",
        "entries",
        "next associated",
        "urls show",
        "body",
        "encrypt",
        "search",
        "ip address",
        "creation date",
        "record value",
        "present jul",
        "present may",
        "present apr",
        "certificate",
        "present aug",
        "present feb",
        "present dec",
        "present nov",
        "error",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "found",
        "development att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "mitre att",
        "show technique",
        "ck matrix",
        "pattern match",
        "ascii text",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "itre att",
        "accept",
        "sha256",
        "size",
        "type data",
        "utf8 text",
        "document file",
        "flag",
        "server",
        "european union",
        "name server",
        "tor analysis",
        "dns requests",
        "domain address",
        "ii llc",
        "windir",
        "openurl c",
        "prefetch2",
        "show process",
        "ogoogle trust",
        "network traffic",
        "organization",
        "elton avundano",
        "object",
        "title object",
        "header http2",
        "returnurl",
        "texas",
        "rsa ov",
        "ssl ca",
        "status",
        "australia",
        "netherlands",
        "urls",
        "gmt path",
        "hostname add",
        "pulse submit",
        "present oct",
        "e safe",
        "results jul",
        "response ip",
        "present jan",
        "name servers",
        "verdict",
        "domain",
        "files ip",
        "address domain",
        "xhr start",
        "xhr load",
        "aaaa",
        "read c",
        "show",
        "port",
        "destination",
        "high",
        "delete",
        "outbound m3",
        "copy",
        "write",
        "persistence",
        "execution",
        "malware",
        "generic",
        "unknown",
        "present mar",
        "dynamicloader",
        "wine emulator",
        "dynamic",
        "medium",
        "read",
        "associated urls",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "dnssec",
        "domain name",
        "solutions",
        "llc status",
        "next passive",
        "dns status",
        "hostname query",
        "files show",
        "date hash",
        "avast avg",
        "overview ip",
        "address",
        "related nids",
        "files location",
        "flag united",
        "hostname",
        "files domain",
        "win32",
        "mtb feb",
        "trojan",
        "susp",
        "trojandropper",
        "msr feb",
        "trojanspy",
        "virtool",
        "win64",
        "defense evasion",
        "t1480 execution",
        "file defense",
        "null",
        "refresh",
        "tools",
        "look",
        "verify",
        "restart",
        "file discovery",
        "utf8",
        "crlf line",
        "a domains",
        "script urls",
        "link",
        "unknown aaaa",
        "meta",
        "atom",
        "results jan",
        "present",
        "present sep",
        "akamai",
        "asn as16625",
        "less whois",
        "registrar",
        "http",
        "france flag",
        "france hostname",
        "files related",
        "url analysis",
        "files",
        "location france",
        "detailed error",
        "sec ch",
        "ch ua",
        "ua full",
        "ua platform",
        "moved",
        "name",
        "perfect privacy",
        "error jul",
        "next related",
        "domains show",
        "domain related",
        "url add",
        "pulse pulses",
        "hosting",
        "reverse dns",
        "france asn",
        "as16276",
        "dns resolutions",
        "datacenter",
        "regopenkeyexa",
        "regsetvalueexa",
        "windows nt",
        "regdword",
        "hostile",
        "service",
        "delphi",
        "next",
        "pulses none",
        "related tags",
        "ua bitness",
        "ua arch",
        "version sec",
        "mobile sec",
        "model sec",
        "review",
        "data upload",
        "extraction",
        "khtml",
        "gecko",
        "olet",
        "cnlet",
        "tlsv1",
        "hacktool",
        "push",
        "ms windows",
        "intel",
        "pe32",
        "users",
        "precreate read",
        "ransom",
        "code",
        "installer",
        "june",
        "media",
        "autorun",
        "next yara",
        "detections name",
        "aspackv2xxx",
        "eu alexey",
        "alerts",
        "pe file",
        "filehash",
        "sha256 add",
        "av detections",
        "ids detections",
        "yara detections",
        "analysis date",
        "april",
        "packing t1045",
        "t1045",
        "t1060",
        "registry run",
        "keys",
        "user execution",
        "icmp traffic"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1091",
          "name": "Replication Through Removable Media",
          "display_name": "T1091 - Replication Through Removable Media"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1132,
        "URL": 6245,
        "hostname": 2264,
        "FileHash-SHA256": 1857,
        "FileHash-SHA1": 491,
        "email": 9,
        "FileHash-MD5": 573,
        "SSLCertFingerprint": 16
      },
      "indicator_count": 12587,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "226 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d30048b95aaba628a5ee7",
      "name": "Working on it\u2026\u2026",
      "description": "\u2022 Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\n(onyx-ware.com)\nNS1.ENDGAME.COM\n(endgames.us)\nNS1.ENDGAME.COM\n#deadmau5 #janskyofficial #idk #soundcloud",
      "modified": "2025-08-19T17:00:59.379000",
      "created": "2025-07-20T18:05:56.587000",
      "tags": [
        "dynamicloader",
        "united",
        "as15169",
        "medium",
        "search",
        "show",
        "write c",
        "whitelisted",
        "brazil as396982",
        "high",
        "themida",
        "write",
        "delphi",
        "copy",
        "upatre",
        "encrypt",
        "june",
        "win32",
        "malware",
        "win64",
        "windows nt",
        "directui",
        "element",
        "classinfobase",
        "value",
        "hwndhost",
        "sapeav12",
        "delete c",
        "worm",
        "explorer",
        "insert",
        "movie",
        "alerts",
        "windows",
        "installs",
        "filehash",
        "sha256 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "passive dns",
        "urls",
        "http",
        "ip address",
        "related nids",
        "files location",
        "spain flag",
        "spain domain",
        "files related",
        "spain",
        "entries",
        "next associated",
        "meta name",
        "frame src",
        "ok set",
        "cookie",
        "gmt date",
        "gmt content",
        "filehashsha256",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "url http",
        "filehashmd5",
        "showing",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "iocs",
        "learn more",
        "filehashsha1",
        "types of",
        "united kingdom",
        "t1053",
        "taskjob",
        "t1055",
        "injection",
        "t1082",
        "t1119",
        "t1129",
        "modules",
        "t1143",
        "soundcloud",
        "created",
        "hour ago",
        "facebook",
        "twitter",
        "victims website",
        "youtube",
        "jansky",
        "trojandropper",
        "pulses url"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2012,
        "FileHash-MD5": 140,
        "FileHash-SHA1": 129,
        "FileHash-SHA256": 1348,
        "SSLCertFingerprint": 3,
        "domain": 288,
        "hostname": 812
      },
      "indicator_count": 4732,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://beyondlabels.supportingcast.fm",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://beyondlabels.supportingcast.fm",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776641863.2105975
}