{
  "type": "URL",
  "indicator": "https://clikshop.ru/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://clikshop.ru/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4114481352,
      "indicator": "https://clikshop.ru/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "6894fd48178a2cc0c287af71",
          "name": "Polymorphic | Worm & Trojan:Win32/Mydoom. IoC\u2019s +  | Device local *Remowted.com",
          "description": "",
          "modified": "2025-09-06T19:01:20.165000",
          "created": "2025-08-07T19:23:52.346000",
          "tags": [
            "filehashmd5",
            "indicator role",
            "title added",
            "active related",
            "filehashsha256",
            "t1105",
            "tool transfer",
            "t1480",
            "guardrails",
            "t1566",
            "t1568",
            "t1012",
            "t1023",
            "t1031",
            "service",
            "filehashsha1",
            "iocs",
            "learn more",
            "hostname",
            "types of",
            "netherlands",
            "united",
            "denmark",
            "belgium",
            "dynamicloader",
            "yara rule",
            "vmdetect",
            "write c",
            "search",
            "medium",
            "show",
            "entries",
            "high",
            "worm",
            "copy",
            "write",
            "unknown",
            "markus",
            "malware",
            "suspicious",
            "crlf line",
            "unicode text",
            "utf8",
            "ascii text",
            "trojan",
            "music",
            "next",
            "autorun"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 221,
            "FileHash-SHA1": 129,
            "FileHash-SHA256": 713,
            "URL": 2616,
            "domain": 338,
            "hostname": 598,
            "email": 7
          },
          "indicator_count": 4622,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "224 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6893eee9bf1b30e08d1a6d8e",
          "name": "Ransom:Win32/CVE - Denver \u2022 Community Lifestyle Neighborhood",
          "description": "*Ransom:Win32/CVE - * Win.Dropper.Stone-9856966-0,\nDenver \u2022 Community Lifestyle Neighborhood. \nCorporate & Leasing Office corrupted with spyware. There is a single verified monitored target. All technology devices corrupted, at least 2 phones monitored, YouTube is courtesy of hackers. Several in person and phone investigations, staff change and they know nothing about leasing apartments, townhomes , etiquette, poor communication. Target also investigated. It appears to be harassment, intimidation and monitoring for unspecified reasons. The parking lot is stacked with obvious people sitting in their vehicles for hours. It\u2019s unclear if the staffing change is legitimate or part of an investigation.",
          "modified": "2025-09-05T23:02:52.811000",
          "created": "2025-08-07T00:10:17.696000",
          "tags": [
            "address google",
            "safe browsing",
            "united",
            "typeof",
            "passive dns",
            "body doctype",
            "nreum",
            "date",
            "gmt server",
            "apache x",
            "cnection",
            "content type",
            "span",
            "ok transfer",
            "encoding",
            "x powered",
            "unknown soa",
            "unknown ns",
            "showing",
            "entries",
            "next associated",
            "urls show",
            "body",
            "encrypt",
            "search",
            "ip address",
            "creation date",
            "record value",
            "present jul",
            "present may",
            "present apr",
            "certificate",
            "present aug",
            "present feb",
            "present dec",
            "present nov",
            "error",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "found",
            "development att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "mitre att",
            "show technique",
            "ck matrix",
            "pattern match",
            "ascii text",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "itre att",
            "accept",
            "sha256",
            "size",
            "type data",
            "utf8 text",
            "document file",
            "flag",
            "server",
            "european union",
            "name server",
            "tor analysis",
            "dns requests",
            "domain address",
            "ii llc",
            "windir",
            "openurl c",
            "prefetch2",
            "show process",
            "ogoogle trust",
            "network traffic",
            "organization",
            "elton avundano",
            "object",
            "title object",
            "header http2",
            "returnurl",
            "texas",
            "rsa ov",
            "ssl ca",
            "status",
            "australia",
            "netherlands",
            "urls",
            "gmt path",
            "hostname add",
            "pulse submit",
            "present oct",
            "e safe",
            "results jul",
            "response ip",
            "present jan",
            "name servers",
            "verdict",
            "domain",
            "files ip",
            "address domain",
            "xhr start",
            "xhr load",
            "aaaa",
            "read c",
            "show",
            "port",
            "destination",
            "high",
            "delete",
            "outbound m3",
            "copy",
            "write",
            "persistence",
            "execution",
            "malware",
            "generic",
            "unknown",
            "present mar",
            "dynamicloader",
            "wine emulator",
            "dynamic",
            "medium",
            "read",
            "associated urls",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "dnssec",
            "domain name",
            "solutions",
            "llc status",
            "next passive",
            "dns status",
            "hostname query",
            "files show",
            "date hash",
            "avast avg",
            "overview ip",
            "address",
            "related nids",
            "files location",
            "flag united",
            "hostname",
            "files domain",
            "win32",
            "mtb feb",
            "trojan",
            "susp",
            "trojandropper",
            "msr feb",
            "trojanspy",
            "virtool",
            "win64",
            "defense evasion",
            "t1480 execution",
            "file defense",
            "null",
            "refresh",
            "tools",
            "look",
            "verify",
            "restart",
            "file discovery",
            "utf8",
            "crlf line",
            "a domains",
            "script urls",
            "link",
            "unknown aaaa",
            "meta",
            "atom",
            "results jan",
            "present",
            "present sep",
            "akamai",
            "asn as16625",
            "less whois",
            "registrar",
            "http",
            "france flag",
            "france hostname",
            "files related",
            "url analysis",
            "files",
            "location france",
            "detailed error",
            "sec ch",
            "ch ua",
            "ua full",
            "ua platform",
            "moved",
            "name",
            "perfect privacy",
            "error jul",
            "next related",
            "domains show",
            "domain related",
            "url add",
            "pulse pulses",
            "hosting",
            "reverse dns",
            "france asn",
            "as16276",
            "dns resolutions",
            "datacenter",
            "regopenkeyexa",
            "regsetvalueexa",
            "windows nt",
            "regdword",
            "hostile",
            "service",
            "delphi",
            "next",
            "pulses none",
            "related tags",
            "ua bitness",
            "ua arch",
            "version sec",
            "mobile sec",
            "model sec",
            "review",
            "data upload",
            "extraction",
            "khtml",
            "gecko",
            "olet",
            "cnlet",
            "tlsv1",
            "hacktool",
            "push",
            "ms windows",
            "intel",
            "pe32",
            "users",
            "precreate read",
            "ransom",
            "code",
            "installer",
            "june",
            "media",
            "autorun",
            "next yara",
            "detections name",
            "aspackv2xxx",
            "eu alexey",
            "alerts",
            "pe file",
            "filehash",
            "sha256 add",
            "av detections",
            "ids detections",
            "yara detections",
            "analysis date",
            "april",
            "packing t1045",
            "t1045",
            "t1060",
            "registry run",
            "keys",
            "user execution",
            "icmp traffic"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1091",
              "name": "Replication Through Removable Media",
              "display_name": "T1091 - Replication Through Removable Media"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1132,
            "URL": 6245,
            "hostname": 2264,
            "FileHash-SHA256": 1857,
            "FileHash-SHA1": 491,
            "email": 9,
            "FileHash-MD5": 573,
            "SSLCertFingerprint": 16
          },
          "indicator_count": 12587,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "225 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6892e73b32af18aa302df0dc",
          "name": "Part 1.5",
          "description": "Dark web media \u2022 Political news \u2022 Malvertizing\nlocate \u2022\ntrack [stalk] \u2022 record calls \u2022 control media [youtube , etc] http://t.name?n[++i]=e:this.removeEventListener\t\t\nJeeng &\nPowebox [ accidentally left out in original post pulse]",
          "modified": "2025-09-05T04:03:06.929000",
          "created": "2025-08-06T05:25:15.369000",
          "tags": [
            "chromeua",
            "optout",
            "object",
            "path",
            "value",
            "access type",
            "setval",
            "windir",
            "localappdata",
            "null",
            "win64",
            "error",
            "generator",
            "close",
            "roboto",
            "date",
            "format",
            "light",
            "span",
            "template",
            "void",
            "android",
            "body",
            "trident",
            "mexico",
            "sonic",
            "black",
            "critical",
            "desktop",
            "dark",
            "meta",
            "this",
            "june",
            "hybrid",
            "apache",
            "write",
            "crypto",
            "autodetect",
            "face",
            "courier",
            "gigi",
            "impact",
            "shadow",
            "click",
            "strings",
            "cray",
            "smwg",
            "eret",
            "footer",
            "infinity",
            "window",
            "canvas",
            "legend",
            "nuke",
            "lion",
            "4629",
            "ahav",
            "olsa",
            "false",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "file defense",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "script",
            "mitre att",
            "pattern match",
            "show technique",
            "iframe",
            "refresh",
            "august",
            "general",
            "local",
            "tools",
            "demo",
            "look",
            "verify",
            "restart",
            "url http",
            "small",
            "pulses url",
            "tellyoun",
            "showing",
            "entries",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "cc08",
            "f06a6b",
            "sfurl",
            "filehashsha256",
            "types",
            "indicators show",
            "search",
            "pulses",
            "filehashsha1",
            "adversaries",
            "found",
            "webp image",
            "ascii text",
            "riff",
            "size",
            "encrypt",
            "legacy",
            "filehashmd5",
            "united",
            "flag",
            "server",
            "markmonitor",
            "name server",
            "llc name",
            "overview dns",
            "requests domain",
            "country",
            "win32",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "medium risk",
            "yara",
            "detections",
            "malware",
            "copy",
            "show",
            "icmp traffic",
            "packing t1045",
            "t1045",
            "pdb path",
            "pe resource",
            "extraction",
            "data upload",
            "enter sc",
            "type",
            "extra data",
            "please",
            "failed",
            "review",
            "exclude data",
            "included review",
            "ic data",
            "suggeste",
            "stop",
            "type onow",
            "domain",
            "passive dns",
            "urls",
            "files related",
            "pulses none",
            "related tags",
            "none google",
            "safe browsing",
            "sc data",
            "extr amanuav",
            "review included",
            "manualy",
            "sugges excluded",
            "filehash",
            "md5 add",
            "pulse pulses",
            "url add",
            "http",
            "hostname",
            "files domain",
            "pulses otx",
            "virustotal",
            "hsmi192547107",
            "pulses hostname",
            "r dec",
            "customer dec",
            "iski dec",
            "decision dec",
            "va dec",
            "bitcoin",
            "bitcoin dec",
            "petra",
            "torstatus dec",
            "paul dec",
            "sodesc",
            "planet dec",
            "emilia",
            "heroin dec",
            "difference dec",
            "palantir dec",
            "loraxlive dec",
            "chaturbate dec",
            "sandra",
            "free dec",
            "marvel dec",
            "benjis dec",
            "fresh dec",
            "sodesc dec",
            "srdirport",
            "srhostname",
            "link dec",
            "types of",
            "italy",
            "china",
            "australia",
            "france",
            "turkey",
            "discovery",
            "information",
            "ck ids",
            "t1005",
            "local system",
            "t1007",
            "system service",
            "part",
            "track",
            "locate",
            "political",
            "civil society",
            "news",
            "created",
            "hours ago",
            "report spam",
            "t1555",
            "password",
            "t1560",
            "collected data",
            "t1573",
            "channel",
            "t1574",
            "execution flow",
            "scan",
            "iocs",
            "t1497",
            "u0lhmq",
            "mtawmq",
            "t1480",
            "guardrails",
            "t1486",
            "data encrypted",
            "learn more",
            "unsubscribe aug",
            "protocol",
            "t1074",
            "staged",
            "t1083",
            "t1102",
            "web service",
            "t1105",
            "tool transfer",
            "t1140",
            "data engineer",
            "candidate",
            "tlsv1",
            "odigicert inc",
            "stcalifornia",
            "lsan jose",
            "oadobe systems",
            "incorporated",
            "cndigicert sha2",
            "push",
            "next",
            "high",
            "write c",
            "ireland as16509",
            "delete",
            "dirty",
            "tags",
            "t1012",
            "flow endpoint",
            "security scan",
            "t1106",
            "copyright",
            "levelblue"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1007",
              "name": "System Service Discovery",
              "display_name": "T1007 - System Service Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1074",
              "name": "Data Staged",
              "display_name": "T1074 - Data Staged"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1120",
              "name": "Peripheral Device Discovery",
              "display_name": "T1120 - Peripheral Device Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1486",
              "name": "Data Encrypted for Impact",
              "display_name": "T1486 - Data Encrypted for Impact"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 608,
            "FileHash-SHA1": 433,
            "FileHash-SHA256": 3663,
            "URL": 17104,
            "domain": 1316,
            "email": 39,
            "hostname": 4208,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 27388,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "226 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 43775
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/clikshop.ru",
    "whois": "http://whois.domaintools.com/clikshop.ru",
    "domain": "clikshop.ru",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "6894fd48178a2cc0c287af71",
      "name": "Polymorphic | Worm & Trojan:Win32/Mydoom. IoC\u2019s +  | Device local *Remowted.com",
      "description": "",
      "modified": "2025-09-06T19:01:20.165000",
      "created": "2025-08-07T19:23:52.346000",
      "tags": [
        "filehashmd5",
        "indicator role",
        "title added",
        "active related",
        "filehashsha256",
        "t1105",
        "tool transfer",
        "t1480",
        "guardrails",
        "t1566",
        "t1568",
        "t1012",
        "t1023",
        "t1031",
        "service",
        "filehashsha1",
        "iocs",
        "learn more",
        "hostname",
        "types of",
        "netherlands",
        "united",
        "denmark",
        "belgium",
        "dynamicloader",
        "yara rule",
        "vmdetect",
        "write c",
        "search",
        "medium",
        "show",
        "entries",
        "high",
        "worm",
        "copy",
        "write",
        "unknown",
        "markus",
        "malware",
        "suspicious",
        "crlf line",
        "unicode text",
        "utf8",
        "ascii text",
        "trojan",
        "music",
        "next",
        "autorun"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 221,
        "FileHash-SHA1": 129,
        "FileHash-SHA256": 713,
        "URL": 2616,
        "domain": 338,
        "hostname": 598,
        "email": 7
      },
      "indicator_count": 4622,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "224 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6893eee9bf1b30e08d1a6d8e",
      "name": "Ransom:Win32/CVE - Denver \u2022 Community Lifestyle Neighborhood",
      "description": "*Ransom:Win32/CVE - * Win.Dropper.Stone-9856966-0,\nDenver \u2022 Community Lifestyle Neighborhood. \nCorporate & Leasing Office corrupted with spyware. There is a single verified monitored target. All technology devices corrupted, at least 2 phones monitored, YouTube is courtesy of hackers. Several in person and phone investigations, staff change and they know nothing about leasing apartments, townhomes , etiquette, poor communication. Target also investigated. It appears to be harassment, intimidation and monitoring for unspecified reasons. The parking lot is stacked with obvious people sitting in their vehicles for hours. It\u2019s unclear if the staffing change is legitimate or part of an investigation.",
      "modified": "2025-09-05T23:02:52.811000",
      "created": "2025-08-07T00:10:17.696000",
      "tags": [
        "address google",
        "safe browsing",
        "united",
        "typeof",
        "passive dns",
        "body doctype",
        "nreum",
        "date",
        "gmt server",
        "apache x",
        "cnection",
        "content type",
        "span",
        "ok transfer",
        "encoding",
        "x powered",
        "unknown soa",
        "unknown ns",
        "showing",
        "entries",
        "next associated",
        "urls show",
        "body",
        "encrypt",
        "search",
        "ip address",
        "creation date",
        "record value",
        "present jul",
        "present may",
        "present apr",
        "certificate",
        "present aug",
        "present feb",
        "present dec",
        "present nov",
        "error",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "found",
        "development att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "mitre att",
        "show technique",
        "ck matrix",
        "pattern match",
        "ascii text",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "itre att",
        "accept",
        "sha256",
        "size",
        "type data",
        "utf8 text",
        "document file",
        "flag",
        "server",
        "european union",
        "name server",
        "tor analysis",
        "dns requests",
        "domain address",
        "ii llc",
        "windir",
        "openurl c",
        "prefetch2",
        "show process",
        "ogoogle trust",
        "network traffic",
        "organization",
        "elton avundano",
        "object",
        "title object",
        "header http2",
        "returnurl",
        "texas",
        "rsa ov",
        "ssl ca",
        "status",
        "australia",
        "netherlands",
        "urls",
        "gmt path",
        "hostname add",
        "pulse submit",
        "present oct",
        "e safe",
        "results jul",
        "response ip",
        "present jan",
        "name servers",
        "verdict",
        "domain",
        "files ip",
        "address domain",
        "xhr start",
        "xhr load",
        "aaaa",
        "read c",
        "show",
        "port",
        "destination",
        "high",
        "delete",
        "outbound m3",
        "copy",
        "write",
        "persistence",
        "execution",
        "malware",
        "generic",
        "unknown",
        "present mar",
        "dynamicloader",
        "wine emulator",
        "dynamic",
        "medium",
        "read",
        "associated urls",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "dnssec",
        "domain name",
        "solutions",
        "llc status",
        "next passive",
        "dns status",
        "hostname query",
        "files show",
        "date hash",
        "avast avg",
        "overview ip",
        "address",
        "related nids",
        "files location",
        "flag united",
        "hostname",
        "files domain",
        "win32",
        "mtb feb",
        "trojan",
        "susp",
        "trojandropper",
        "msr feb",
        "trojanspy",
        "virtool",
        "win64",
        "defense evasion",
        "t1480 execution",
        "file defense",
        "null",
        "refresh",
        "tools",
        "look",
        "verify",
        "restart",
        "file discovery",
        "utf8",
        "crlf line",
        "a domains",
        "script urls",
        "link",
        "unknown aaaa",
        "meta",
        "atom",
        "results jan",
        "present",
        "present sep",
        "akamai",
        "asn as16625",
        "less whois",
        "registrar",
        "http",
        "france flag",
        "france hostname",
        "files related",
        "url analysis",
        "files",
        "location france",
        "detailed error",
        "sec ch",
        "ch ua",
        "ua full",
        "ua platform",
        "moved",
        "name",
        "perfect privacy",
        "error jul",
        "next related",
        "domains show",
        "domain related",
        "url add",
        "pulse pulses",
        "hosting",
        "reverse dns",
        "france asn",
        "as16276",
        "dns resolutions",
        "datacenter",
        "regopenkeyexa",
        "regsetvalueexa",
        "windows nt",
        "regdword",
        "hostile",
        "service",
        "delphi",
        "next",
        "pulses none",
        "related tags",
        "ua bitness",
        "ua arch",
        "version sec",
        "mobile sec",
        "model sec",
        "review",
        "data upload",
        "extraction",
        "khtml",
        "gecko",
        "olet",
        "cnlet",
        "tlsv1",
        "hacktool",
        "push",
        "ms windows",
        "intel",
        "pe32",
        "users",
        "precreate read",
        "ransom",
        "code",
        "installer",
        "june",
        "media",
        "autorun",
        "next yara",
        "detections name",
        "aspackv2xxx",
        "eu alexey",
        "alerts",
        "pe file",
        "filehash",
        "sha256 add",
        "av detections",
        "ids detections",
        "yara detections",
        "analysis date",
        "april",
        "packing t1045",
        "t1045",
        "t1060",
        "registry run",
        "keys",
        "user execution",
        "icmp traffic"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1091",
          "name": "Replication Through Removable Media",
          "display_name": "T1091 - Replication Through Removable Media"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1132,
        "URL": 6245,
        "hostname": 2264,
        "FileHash-SHA256": 1857,
        "FileHash-SHA1": 491,
        "email": 9,
        "FileHash-MD5": 573,
        "SSLCertFingerprint": 16
      },
      "indicator_count": 12587,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "225 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6892e73b32af18aa302df0dc",
      "name": "Part 1.5",
      "description": "Dark web media \u2022 Political news \u2022 Malvertizing\nlocate \u2022\ntrack [stalk] \u2022 record calls \u2022 control media [youtube , etc] http://t.name?n[++i]=e:this.removeEventListener\t\t\nJeeng &\nPowebox [ accidentally left out in original post pulse]",
      "modified": "2025-09-05T04:03:06.929000",
      "created": "2025-08-06T05:25:15.369000",
      "tags": [
        "chromeua",
        "optout",
        "object",
        "path",
        "value",
        "access type",
        "setval",
        "windir",
        "localappdata",
        "null",
        "win64",
        "error",
        "generator",
        "close",
        "roboto",
        "date",
        "format",
        "light",
        "span",
        "template",
        "void",
        "android",
        "body",
        "trident",
        "mexico",
        "sonic",
        "black",
        "critical",
        "desktop",
        "dark",
        "meta",
        "this",
        "june",
        "hybrid",
        "apache",
        "write",
        "crypto",
        "autodetect",
        "face",
        "courier",
        "gigi",
        "impact",
        "shadow",
        "click",
        "strings",
        "cray",
        "smwg",
        "eret",
        "footer",
        "infinity",
        "window",
        "canvas",
        "legend",
        "nuke",
        "lion",
        "4629",
        "ahav",
        "olsa",
        "false",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "file defense",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "script",
        "mitre att",
        "pattern match",
        "show technique",
        "iframe",
        "refresh",
        "august",
        "general",
        "local",
        "tools",
        "demo",
        "look",
        "verify",
        "restart",
        "url http",
        "small",
        "pulses url",
        "tellyoun",
        "showing",
        "entries",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "cc08",
        "f06a6b",
        "sfurl",
        "filehashsha256",
        "types",
        "indicators show",
        "search",
        "pulses",
        "filehashsha1",
        "adversaries",
        "found",
        "webp image",
        "ascii text",
        "riff",
        "size",
        "encrypt",
        "legacy",
        "filehashmd5",
        "united",
        "flag",
        "server",
        "markmonitor",
        "name server",
        "llc name",
        "overview dns",
        "requests domain",
        "country",
        "win32",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "medium risk",
        "yara",
        "detections",
        "malware",
        "copy",
        "show",
        "icmp traffic",
        "packing t1045",
        "t1045",
        "pdb path",
        "pe resource",
        "extraction",
        "data upload",
        "enter sc",
        "type",
        "extra data",
        "please",
        "failed",
        "review",
        "exclude data",
        "included review",
        "ic data",
        "suggeste",
        "stop",
        "type onow",
        "domain",
        "passive dns",
        "urls",
        "files related",
        "pulses none",
        "related tags",
        "none google",
        "safe browsing",
        "sc data",
        "extr amanuav",
        "review included",
        "manualy",
        "sugges excluded",
        "filehash",
        "md5 add",
        "pulse pulses",
        "url add",
        "http",
        "hostname",
        "files domain",
        "pulses otx",
        "virustotal",
        "hsmi192547107",
        "pulses hostname",
        "r dec",
        "customer dec",
        "iski dec",
        "decision dec",
        "va dec",
        "bitcoin",
        "bitcoin dec",
        "petra",
        "torstatus dec",
        "paul dec",
        "sodesc",
        "planet dec",
        "emilia",
        "heroin dec",
        "difference dec",
        "palantir dec",
        "loraxlive dec",
        "chaturbate dec",
        "sandra",
        "free dec",
        "marvel dec",
        "benjis dec",
        "fresh dec",
        "sodesc dec",
        "srdirport",
        "srhostname",
        "link dec",
        "types of",
        "italy",
        "china",
        "australia",
        "france",
        "turkey",
        "discovery",
        "information",
        "ck ids",
        "t1005",
        "local system",
        "t1007",
        "system service",
        "part",
        "track",
        "locate",
        "political",
        "civil society",
        "news",
        "created",
        "hours ago",
        "report spam",
        "t1555",
        "password",
        "t1560",
        "collected data",
        "t1573",
        "channel",
        "t1574",
        "execution flow",
        "scan",
        "iocs",
        "t1497",
        "u0lhmq",
        "mtawmq",
        "t1480",
        "guardrails",
        "t1486",
        "data encrypted",
        "learn more",
        "unsubscribe aug",
        "protocol",
        "t1074",
        "staged",
        "t1083",
        "t1102",
        "web service",
        "t1105",
        "tool transfer",
        "t1140",
        "data engineer",
        "candidate",
        "tlsv1",
        "odigicert inc",
        "stcalifornia",
        "lsan jose",
        "oadobe systems",
        "incorporated",
        "cndigicert sha2",
        "push",
        "next",
        "high",
        "write c",
        "ireland as16509",
        "delete",
        "dirty",
        "tags",
        "t1012",
        "flow endpoint",
        "security scan",
        "t1106",
        "copyright",
        "levelblue"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1007",
          "name": "System Service Discovery",
          "display_name": "T1007 - System Service Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1074",
          "name": "Data Staged",
          "display_name": "T1074 - Data Staged"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1120",
          "name": "Peripheral Device Discovery",
          "display_name": "T1120 - Peripheral Device Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1486",
          "name": "Data Encrypted for Impact",
          "display_name": "T1486 - Data Encrypted for Impact"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 608,
        "FileHash-SHA1": 433,
        "FileHash-SHA256": 3663,
        "URL": 17104,
        "domain": 1316,
        "email": 39,
        "hostname": 4208,
        "SSLCertFingerprint": 17
      },
      "indicator_count": 27388,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "226 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://clikshop.ru/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://clikshop.ru/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776615615.6497602
}