{
  "type": "URL",
  "indicator": "https://comics.anime-studio.org",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://comics.anime-studio.org",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4154968123,
      "indicator": "https://comics.anime-studio.org",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 12,
      "pulses": [
        {
          "id": "69b49ad5dd40a24d83cd6a72",
          "name": "Chris P. Ahmann \u2022 PRIVATE PROPERTY Colorado State Fixer!",
          "description": "",
          "modified": "2026-03-13T23:16:37.716000",
          "created": "2026-03-13T23:16:37.716000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "69631fbd16e306ee2b76c4da",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "37 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69b496396ca4987e95ad37d1",
          "name": "Chris Buzz by QVashni (wow)",
          "description": "",
          "modified": "2026-03-13T22:56:57.314000",
          "created": "2026-03-13T22:56:57.314000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "69482caa00d327da8f0a87bc",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 47,
          "modified_text": "38 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69b49587dd104e342dda1628",
          "name": "C Ahman Attorney Clone by Top Tier, Q.Vashti",
          "description": "",
          "modified": "2026-03-13T22:53:59.112000",
          "created": "2026-03-13T22:53:59.112000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "691f4d4ef0a2a570b8b21cd2",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 47,
          "modified_text": "38 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "691f4d4ef0a2a570b8b21cd2",
          "name": "Chris P. Ahmann Colorado State Criminal Defense Attorney",
          "description": "Chris P. Ahmann Colorado State Criminal Defense attorney hired by quasi government Workers Compensation to completely destroy Tsara Brashears literally to death. None of her spinal cord injuries , and other assault injuries discussed or compensated for in rushed settlement case. Her awful racist attorney refused to represent plaintiffs in hearing. Never met with in person  for no good reason. Tsara represented herself.  Less that 24 hour notice. No briefings, no awareness or mention that Ahmann was representing Jeffrey Scott Reimer for assault\n case. Brashears required 24 hour care by end of life. Received 0 workers compsarion payments. But if this doesn\u2019t prove Reimer\u2019s guilt what does? Continued harassment of associated. \n\nNotice the outages? You\u2019ve cost BILLIONS? Stop threatening everyone.",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2025-11-20T17:18:06.929000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "90 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69482caa00d327da8f0a87bc",
          "name": "Chris P.\u2019 Buzz\u2019 Ahmann Colorado State Criminal Defense Attorney (22.20.2025)",
          "description": "",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2025-12-21T17:21:46.434000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "691f4d4ef0a2a570b8b21cd2",
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "90 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "695557ee134b978b00883c29",
          "name": "Chris P. Ahmann \u2022 Stay out of PRIVATE PROPERTY HITMAN!  Colorado State",
          "description": "",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2025-12-31T17:05:50.134000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "691f4d4ef0a2a570b8b21cd2",
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "90 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69631fbd16e306ee2b76c4da",
          "name": "Chris P. Ahmann \u2022 STAY Away!f PRIVATE PROPERTY Colorado State Fixer!",
          "description": "",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2026-01-11T03:57:49.242000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "695557ee134b978b00883c29",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "90 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "695ea667a062ed6688b104ab",
          "name": "Frost Security | Attorneys | Government | Crazy | Stop Tampering ",
          "description": "",
          "modified": "2026-01-07T18:31:03.104000",
          "created": "2026-01-07T18:31:03.104000",
          "tags": [
            "active",
            "type win32",
            "exe size",
            "first seen",
            "malicious avg",
            "win32",
            "gdata",
            "dynamicloader",
            "fe ff",
            "high",
            "write c",
            "data",
            "x00bx00",
            "uswv",
            "write",
            "redline",
            "stream",
            "guard",
            "malware",
            "push",
            "local",
            "crazyfrost",
            "adversarial",
            "hacker",
            "extraction",
            "enter sc",
            "data upload",
            "extre data",
            "included iocs",
            "url http",
            "url https",
            "include review",
            "exclude sugges",
            "frost security",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "contacted hosts",
            "ip address",
            "process details",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "signing defense",
            "united",
            "flag",
            "contacted",
            "http traffic",
            "file defense",
            "mitre att",
            "ck techniques",
            "evasion att",
            "belize",
            "div div",
            "passive dns",
            "link",
            "ipv4 add",
            "url analysis",
            "urls",
            "files",
            "meta",
            "ddos",
            "indicators show",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "hostname",
            "types",
            "hosanna",
            "x show",
            "ck ids",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "t1036",
            "capture",
            "cookie",
            "palantir",
            "indicator role",
            "active related",
            "description",
            "trump supporter",
            "types of",
            "germany",
            "china",
            "netherlands",
            "https",
            "notice",
            "billions",
            "stop",
            "boobs130432 no",
            "expiration",
            "location poland",
            "asn as29522",
            "learn more",
            "domain",
            "foundry",
            "hallrender",
            "brian sabey",
            "tam legal",
            "christopher p ahmann",
            "palantir",
            "quasi government",
            "pentagon"
          ],
          "references": [
            "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg\t URL",
            "http://frostsecurity.net/frost/driver/ \u2022 http://frostsecurity.net/frost/frostupdater/",
            "https://tamlegal.com/attorneys/christopher-p-ahmann/",
            "https://www.hallrender.com/attorney/brian-sabey/Accept",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://vtwctr.org/explore/tsara-brashears-defeats-jeffrey-reimer/ phishing",
            "http://alohatube.xyz/search/tsara-brashears No Expiration\t278\t  URL http://alohatube.xyz/search/tsara-brashears/ No Expiration\t62\t  URL http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears No Expiration\t49\t  URL http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us No Expiration\t27\t  URL http://browntubeporn.com/tsara-brashears.html No Expiration\t40\t  URL http://flexporn.net/tsara-brashears.html",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge phishing",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
            "http://advocate-smyslova.ru/tsara-brashears/",
            "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn/;0.48692189815948833",
            "http://orangeporntube.net/tsara-brashears.html",
            "http://onlyindianporn2.com/videos/tsara-brashears/",
            "http://videolal.com/tsara-brashears-dead.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
            "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language",
            "http://www.bukaporn.net/trend/tsara-brashears/ No Expiration\t41\t  URL http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html No Expiration\t41\t  URL http://www.sweetheartvideo.com/tsara-brashears No Expiration\t81\t  URL http://www.tryporn.net/seach/tsara-brashears/ No Expiration\t41\t  URL http://www.tryporno.net/movies/tsara-brashears/ No Expiration\t42\t  URL https://alohatube.xyz/search/tsara-brashears No Expiration\t211\t  URL https://alohatube.xyz/search/tsara-brashears+ No Expiration\t51\t  URL https://browntubeporn.com/tsara-brashearsAccept-Language No Expiratio",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "http://www.tryporn.net/seach/tsara-brashears/",
            "https://alohatube.xyz/search/tsara-brashearsL",
            "http://onlyindianporn2.com/videos/tsara-brashears/",
            "http://orangeporntube.net/tsara-brashears.html",
            "https://www.dirtsearch.org/data/TSARA/BRASHEARS/",
            "https://youjizz.sex/tsara-brashears.html",
            "https://www.feestzalenvanvlaanderen.be/seach/tsara-brashears/",
            "https://www.xvxx.me/search/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://www.sweetheartvideo.com/tsara-brashear",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
            "http://www.bukaporn.net/trend/tsara-brashears/",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://mom2fuck.mobi/tsara-brashears.html",
            "http://vtwctr.org/explore/tsara- brashears-defeats-jeffrey-reimer/",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears",
            "www.palantir.com \u2022   palantir.io \u2022 http://datafoundry.com/",
            "http://watchhers.net/index.php \u2022  foundry2sdbl.dvr.dn2.n-helix.com",
            "https://steam.exacg.cc/ \u2022  http://tesgm.ru/_ld/5/584_steam_apidll_Th.rar",
            "Targeting Tsara Brasheras and associated",
            "Targeting Candace Owens"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1116",
              "name": "Code Signing",
              "display_name": "T1116 - Code Signing"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1051",
              "name": "Shared Webroot",
              "display_name": "T1051 - Shared Webroot"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1085",
              "name": "Rundll32",
              "display_name": "T1085 - Rundll32"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1506",
              "name": "Web Session Cookie",
              "display_name": "T1506 - Web Session Cookie"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            }
          ],
          "industries": [
            "Government",
            "Defense",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": "692897a64c0e255409b5a67e",
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3709,
            "hostname": 1109,
            "FileHash-SHA256": 2872,
            "FileHash-MD5": 214,
            "FileHash-SHA1": 203,
            "domain": 557
          },
          "indicator_count": 8664,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "103 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "695ea6590a50f71a156c9a7f",
          "name": "Frost Security | Attorneys | Government | Crazy | Stop Tampering ",
          "description": "",
          "modified": "2026-01-07T18:30:49.442000",
          "created": "2026-01-07T18:30:49.442000",
          "tags": [
            "active",
            "type win32",
            "exe size",
            "first seen",
            "malicious avg",
            "win32",
            "gdata",
            "dynamicloader",
            "fe ff",
            "high",
            "write c",
            "data",
            "x00bx00",
            "uswv",
            "write",
            "redline",
            "stream",
            "guard",
            "malware",
            "push",
            "local",
            "crazyfrost",
            "adversarial",
            "hacker",
            "extraction",
            "enter sc",
            "data upload",
            "extre data",
            "included iocs",
            "url http",
            "url https",
            "include review",
            "exclude sugges",
            "frost security",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "contacted hosts",
            "ip address",
            "process details",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "signing defense",
            "united",
            "flag",
            "contacted",
            "http traffic",
            "file defense",
            "mitre att",
            "ck techniques",
            "evasion att",
            "belize",
            "div div",
            "passive dns",
            "link",
            "ipv4 add",
            "url analysis",
            "urls",
            "files",
            "meta",
            "ddos",
            "indicators show",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "hostname",
            "types",
            "hosanna",
            "x show",
            "ck ids",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "t1036",
            "capture",
            "cookie",
            "palantir",
            "indicator role",
            "active related",
            "description",
            "trump supporter",
            "types of",
            "germany",
            "china",
            "netherlands",
            "https",
            "notice",
            "billions",
            "stop",
            "boobs130432 no",
            "expiration",
            "location poland",
            "asn as29522",
            "learn more",
            "domain",
            "foundry",
            "hallrender",
            "brian sabey",
            "tam legal",
            "christopher p ahmann",
            "palantir",
            "quasi government",
            "pentagon"
          ],
          "references": [
            "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg\t URL",
            "http://frostsecurity.net/frost/driver/ \u2022 http://frostsecurity.net/frost/frostupdater/",
            "https://tamlegal.com/attorneys/christopher-p-ahmann/",
            "https://www.hallrender.com/attorney/brian-sabey/Accept",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://vtwctr.org/explore/tsara-brashears-defeats-jeffrey-reimer/ phishing",
            "http://alohatube.xyz/search/tsara-brashears No Expiration\t278\t  URL http://alohatube.xyz/search/tsara-brashears/ No Expiration\t62\t  URL http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears No Expiration\t49\t  URL http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us No Expiration\t27\t  URL http://browntubeporn.com/tsara-brashears.html No Expiration\t40\t  URL http://flexporn.net/tsara-brashears.html",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge phishing",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
            "http://advocate-smyslova.ru/tsara-brashears/",
            "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn/;0.48692189815948833",
            "http://orangeporntube.net/tsara-brashears.html",
            "http://onlyindianporn2.com/videos/tsara-brashears/",
            "http://videolal.com/tsara-brashears-dead.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
            "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language",
            "http://www.bukaporn.net/trend/tsara-brashears/ No Expiration\t41\t  URL http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html No Expiration\t41\t  URL http://www.sweetheartvideo.com/tsara-brashears No Expiration\t81\t  URL http://www.tryporn.net/seach/tsara-brashears/ No Expiration\t41\t  URL http://www.tryporno.net/movies/tsara-brashears/ No Expiration\t42\t  URL https://alohatube.xyz/search/tsara-brashears No Expiration\t211\t  URL https://alohatube.xyz/search/tsara-brashears+ No Expiration\t51\t  URL https://browntubeporn.com/tsara-brashearsAccept-Language No Expiratio",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "http://www.tryporn.net/seach/tsara-brashears/",
            "https://alohatube.xyz/search/tsara-brashearsL",
            "http://onlyindianporn2.com/videos/tsara-brashears/",
            "http://orangeporntube.net/tsara-brashears.html",
            "https://www.dirtsearch.org/data/TSARA/BRASHEARS/",
            "https://youjizz.sex/tsara-brashears.html",
            "https://www.feestzalenvanvlaanderen.be/seach/tsara-brashears/",
            "https://www.xvxx.me/search/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://www.sweetheartvideo.com/tsara-brashear",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
            "http://www.bukaporn.net/trend/tsara-brashears/",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://mom2fuck.mobi/tsara-brashears.html",
            "http://vtwctr.org/explore/tsara- brashears-defeats-jeffrey-reimer/",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears",
            "www.palantir.com \u2022   palantir.io \u2022 http://datafoundry.com/",
            "http://watchhers.net/index.php \u2022  foundry2sdbl.dvr.dn2.n-helix.com",
            "https://steam.exacg.cc/ \u2022  http://tesgm.ru/_ld/5/584_steam_apidll_Th.rar",
            "Targeting Tsara Brasheras and associated",
            "Targeting Candace Owens"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1116",
              "name": "Code Signing",
              "display_name": "T1116 - Code Signing"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1051",
              "name": "Shared Webroot",
              "display_name": "T1051 - Shared Webroot"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1085",
              "name": "Rundll32",
              "display_name": "T1085 - Rundll32"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1506",
              "name": "Web Session Cookie",
              "display_name": "T1506 - Web Session Cookie"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            }
          ],
          "industries": [
            "Government",
            "Defense",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": "692897a64c0e255409b5a67e",
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3709,
            "hostname": 1109,
            "FileHash-SHA256": 2872,
            "FileHash-MD5": 214,
            "FileHash-SHA1": 203,
            "domain": 557
          },
          "indicator_count": 8664,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "103 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6907cc66855b7dfe1306b0d8",
          "name": "Inject : Defense Counsel attaches to Apple Notebooks - Targeting",
          "description": "TAM Legal attacking Tsara Brashears and associated. Christopher P. Ahmann Esq Is the Special Counsel assigned to pester , smear, tamper with, terrorize, arrange murders, dispatch stalkers, deny care, swatting , botnets, attach to  devices , deflect award for life ending injuries to you and your Mafia, choose malicious media companies (Hall Render) to smear Jeffrey Scott Reimers assault victim. This is silencing. Not everyone has someone to speak. Back off. You\u2019re sick. Enjoying that money, while Tsara slept on air mattress during a couch tour. Demyelinating, from denied disclosed of cord compression; like George Floyd. You should turn yourself in, write a HUGA check , shut down this criminal operation , find Jesus , self exit to a place out away from you targets ,  go to your bunker forever. You are a God Forsaken terrorist hitman! You\u2019re all SO sick!\nEnd Game Now.",
          "modified": "2026-01-01T07:03:18.851000",
          "created": "2025-11-02T21:25:58.814000",
          "tags": [
            "present nov",
            "unknown aaaa",
            "ip address",
            "win32",
            "america asn",
            "twitter",
            "united states",
            "america",
            "ipv4",
            "united",
            "a domains",
            "443 ma86400",
            "super",
            "read c",
            "memcommit",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "regsetvalueexa",
            "hack",
            "write",
            "february",
            "local",
            "unknown",
            "persistence",
            "execution",
            "xport",
            "kb body",
            "present aug",
            "present sep",
            "present oct",
            "for privacy",
            "false",
            "expirestue",
            "path",
            "p2404",
            "accept",
            "p11762282638",
            "host",
            "gmt range",
            "gmt ifnonematch",
            "p11762466264",
            "p11762417453",
            "nothing",
            "shutdown",
            "process32nextw",
            "langturkish",
            "sublangdefault",
            "regdword",
            "rtrcdata",
            "microsoft excel",
            "delphi",
            "worm",
            "malware",
            "error",
            "next",
            "format",
            "suspicious",
            "less see",
            "contacted",
            "all ip",
            "domains",
            "all related",
            "pulses otx",
            "related tags",
            "file type",
            "pexe",
            "christopher ahmann",
            "tam legal",
            "treece",
            "hacking",
            "highjacking",
            "modified",
            "quasi government",
            "ai google",
            "inject",
            "adversaries",
            "government",
            "insurance",
            "apple"
          ],
          "references": [
            "External Apple Connection: Notepad.pw",
            "Sex Tools: m.pornsexer.xxx.3.1.adiosfil.roksit.net |",
            "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process\t h",
            "takedown-communication-api.prod-c15a-awsuse.ppops.net",
            "L\u00b0\u00b0k @ You, okay Chris\u2026abgubdf.apple.cloudns.biz \u2022 cloudns.biz \u2022 https://abgubdf.apple.cloudns",
            "http://www.mof.gov.cn.lxcvc.com/ \u2022 https://r//www.csrc.gov.cn.lxcvc.com/",
            "http://www.mohurd.gov.cn.lxcvc.com/",
            "config.uca.cloud.unity3d.com",
            "0.0.iphone.8dyf8rf5k3.fr.mobiletrend.rtl2.adsenseformobileapps.com",
            "http://mp7tf.best-cell-phone-plans-for-seniors.cfd/",
            "sipphone.com",
            "uk5seki2ygz3kyfgliqe37477miq6jsf.nlsexolehxry4opotgpq"
          ],
          "public": 1,
          "adversary": "TAM Legal Christopher P. Ahmann Chief Terrorist",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win.Malware.004bf-6866449-0",
              "display_name": "Win.Malware.004bf-6866449-0",
              "target": null
            },
            {
              "id": "Custom Malware",
              "display_name": "Custom Malware",
              "target": null
            },
            {
              "id": "Worn:Win32/AutoRun.XXY!bit",
              "display_name": "Worn:Win32/AutoRun.XXY!bit",
              "target": "/malware/Worn:Win32/AutoRun.XXY!bit"
            }
          ],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1094",
              "name": "Custom Command and Control Protocol",
              "display_name": "T1094 - Custom Command and Control Protocol"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1055.001",
              "name": "Dynamic-link Library Injection",
              "display_name": "T1055.001 - Dynamic-link Library Injection"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1184",
              "name": "SSH Hijacking",
              "display_name": "T1184 - SSH Hijacking"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            }
          ],
          "industries": [
            "Legal",
            "Government",
            "Healthcare",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2615,
            "URL": 7521,
            "hostname": 1775,
            "domain": 689,
            "FileHash-MD5": 448,
            "FileHash-SHA1": 295,
            "SSLCertFingerprint": 12,
            "email": 1
          },
          "indicator_count": 13356,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "109 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692e9b142a8508d5257d1662",
          "name": "Criminal Defender Chris Ahmann responsible for continued Apple hackathons removing IoC\u2019 l Targeting Tsara Brashears evidence of crime . Hit Man",
          "description": "",
          "modified": "2026-01-01T07:03:18.851000",
          "created": "2025-12-02T07:53:56.560000",
          "tags": [
            "present nov",
            "unknown aaaa",
            "ip address",
            "win32",
            "america asn",
            "twitter",
            "united states",
            "america",
            "ipv4",
            "united",
            "a domains",
            "443 ma86400",
            "super",
            "read c",
            "memcommit",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "regsetvalueexa",
            "hack",
            "write",
            "february",
            "local",
            "unknown",
            "persistence",
            "execution",
            "xport",
            "kb body",
            "present aug",
            "present sep",
            "present oct",
            "for privacy",
            "false",
            "expirestue",
            "path",
            "p2404",
            "accept",
            "p11762282638",
            "host",
            "gmt range",
            "gmt ifnonematch",
            "p11762466264",
            "p11762417453",
            "nothing",
            "shutdown",
            "process32nextw",
            "langturkish",
            "sublangdefault",
            "regdword",
            "rtrcdata",
            "microsoft excel",
            "delphi",
            "worm",
            "malware",
            "error",
            "next",
            "format",
            "suspicious",
            "less see",
            "contacted",
            "all ip",
            "domains",
            "all related",
            "pulses otx",
            "related tags",
            "file type",
            "pexe",
            "christopher ahmann",
            "tam legal",
            "treece",
            "hacking",
            "highjacking",
            "modified",
            "quasi government",
            "ai google",
            "inject",
            "adversaries",
            "government",
            "insurance",
            "apple"
          ],
          "references": [
            "External Apple Connection: Notepad.pw",
            "Sex Tools: m.pornsexer.xxx.3.1.adiosfil.roksit.net |",
            "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process\t h",
            "takedown-communication-api.prod-c15a-awsuse.ppops.net",
            "L\u00b0\u00b0k @ You, okay Chris\u2026abgubdf.apple.cloudns.biz \u2022 cloudns.biz \u2022 https://abgubdf.apple.cloudns",
            "http://www.mof.gov.cn.lxcvc.com/ \u2022 https://r//www.csrc.gov.cn.lxcvc.com/",
            "http://www.mohurd.gov.cn.lxcvc.com/",
            "config.uca.cloud.unity3d.com",
            "0.0.iphone.8dyf8rf5k3.fr.mobiletrend.rtl2.adsenseformobileapps.com",
            "http://mp7tf.best-cell-phone-plans-for-seniors.cfd/",
            "sipphone.com",
            "uk5seki2ygz3kyfgliqe37477miq6jsf.nlsexolehxry4opotgpq"
          ],
          "public": 1,
          "adversary": "TAM Legal Christopher P. Ahmann Chief Terrorist",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win.Malware.004bf-6866449-0",
              "display_name": "Win.Malware.004bf-6866449-0",
              "target": null
            },
            {
              "id": "Custom Malware",
              "display_name": "Custom Malware",
              "target": null
            },
            {
              "id": "Worn:Win32/AutoRun.XXY!bit",
              "display_name": "Worn:Win32/AutoRun.XXY!bit",
              "target": "/malware/Worn:Win32/AutoRun.XXY!bit"
            }
          ],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1094",
              "name": "Custom Command and Control Protocol",
              "display_name": "T1094 - Custom Command and Control Protocol"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1055.001",
              "name": "Dynamic-link Library Injection",
              "display_name": "T1055.001 - Dynamic-link Library Injection"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1184",
              "name": "SSH Hijacking",
              "display_name": "T1184 - SSH Hijacking"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            }
          ],
          "industries": [
            "Legal",
            "Government",
            "Healthcare",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": "6907cc66855b7dfe1306b0d8",
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2615,
            "URL": 7437,
            "hostname": 1765,
            "domain": 686,
            "FileHash-MD5": 448,
            "FileHash-SHA1": 295,
            "SSLCertFingerprint": 12,
            "email": 1
          },
          "indicator_count": 13259,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "109 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692897a64c0e255409b5a67e",
          "name": "Frost Security | Attorneys | Government | Crazy",
          "description": "Dangerous. Being abused by the usual quasi government suspects. Affecting many targets including Candace Owens. Who can you turn to when your own government is 100% corrupt. \n\nCall me crazy. Idk. DJT was likely shot with a High Velocity Paint Ball. Why isn\u2019t anyone interviewing the families of the 3 \u2018allegedly\u2019 successfully assassinated. \n\nIs Charlie Kirk Dead or in hiding, an alien that doesn\u2019t bleed? \n\nLook it up. High Velocity Paint Ball is a very intensely underrated, nharsky spoken about sport enjoyed by gun enthusiast , snipers , military, civilians. Something weird is going on and it\u2019s actually obvious because they just want results.\n There\u2019s more disturbing things to come. I think more people are being taken out this way than we know.\nBy now I\u2019m under too much surveillance to just leave out casually. \nTerrifying for sure. I know Hos of the Bible is bigger.",
          "modified": "2025-12-27T17:01:06.155000",
          "created": "2025-11-27T18:25:42.570000",
          "tags": [
            "active",
            "type win32",
            "exe size",
            "first seen",
            "malicious avg",
            "win32",
            "gdata",
            "dynamicloader",
            "fe ff",
            "high",
            "write c",
            "data",
            "x00bx00",
            "uswv",
            "write",
            "redline",
            "stream",
            "guard",
            "malware",
            "push",
            "local",
            "crazyfrost",
            "adversarial",
            "hacker",
            "extraction",
            "enter sc",
            "data upload",
            "extre data",
            "included iocs",
            "url http",
            "url https",
            "include review",
            "exclude sugges",
            "frost security",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "contacted hosts",
            "ip address",
            "process details",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "signing defense",
            "united",
            "flag",
            "contacted",
            "http traffic",
            "file defense",
            "mitre att",
            "ck techniques",
            "evasion att",
            "belize",
            "div div",
            "passive dns",
            "link",
            "ipv4 add",
            "url analysis",
            "urls",
            "files",
            "meta",
            "ddos",
            "indicators show",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "hostname",
            "types",
            "hosanna",
            "x show",
            "ck ids",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "t1036",
            "capture",
            "cookie",
            "palantir",
            "indicator role",
            "active related",
            "description",
            "trump supporter",
            "types of",
            "germany",
            "china",
            "netherlands",
            "https",
            "notice",
            "billions",
            "stop",
            "boobs130432 no",
            "expiration",
            "location poland",
            "asn as29522",
            "learn more",
            "domain",
            "foundry",
            "hallrender",
            "brian sabey",
            "tam legal",
            "christopher p ahmann",
            "palantir",
            "quasi government",
            "pentagon"
          ],
          "references": [
            "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg\t URL",
            "http://frostsecurity.net/frost/driver/ \u2022 http://frostsecurity.net/frost/frostupdater/",
            "https://tamlegal.com/attorneys/christopher-p-ahmann/",
            "https://www.hallrender.com/attorney/brian-sabey/Accept",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://vtwctr.org/explore/tsara-brashears-defeats-jeffrey-reimer/ phishing",
            "http://alohatube.xyz/search/tsara-brashears No Expiration\t278\t  URL http://alohatube.xyz/search/tsara-brashears/ No Expiration\t62\t  URL http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears No Expiration\t49\t  URL http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us No Expiration\t27\t  URL http://browntubeporn.com/tsara-brashears.html No Expiration\t40\t  URL http://flexporn.net/tsara-brashears.html",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge phishing",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
            "http://advocate-smyslova.ru/tsara-brashears/",
            "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn/;0.48692189815948833",
            "http://orangeporntube.net/tsara-brashears.html",
            "http://onlyindianporn2.com/videos/tsara-brashears/",
            "http://videolal.com/tsara-brashears-dead.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
            "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language",
            "http://www.bukaporn.net/trend/tsara-brashears/ No Expiration\t41\t  URL http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html No Expiration\t41\t  URL http://www.sweetheartvideo.com/tsara-brashears No Expiration\t81\t  URL http://www.tryporn.net/seach/tsara-brashears/ No Expiration\t41\t  URL http://www.tryporno.net/movies/tsara-brashears/ No Expiration\t42\t  URL https://alohatube.xyz/search/tsara-brashears No Expiration\t211\t  URL https://alohatube.xyz/search/tsara-brashears+ No Expiration\t51\t  URL https://browntubeporn.com/tsara-brashearsAccept-Language No Expiratio",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "http://www.tryporn.net/seach/tsara-brashears/",
            "https://alohatube.xyz/search/tsara-brashearsL",
            "http://onlyindianporn2.com/videos/tsara-brashears/",
            "http://orangeporntube.net/tsara-brashears.html",
            "https://www.dirtsearch.org/data/TSARA/BRASHEARS/",
            "https://youjizz.sex/tsara-brashears.html",
            "https://www.feestzalenvanvlaanderen.be/seach/tsara-brashears/",
            "https://www.xvxx.me/search/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://www.sweetheartvideo.com/tsara-brashear",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
            "http://www.bukaporn.net/trend/tsara-brashears/",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://mom2fuck.mobi/tsara-brashears.html",
            "http://vtwctr.org/explore/tsara- brashears-defeats-jeffrey-reimer/",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears",
            "www.palantir.com \u2022   palantir.io \u2022 http://datafoundry.com/",
            "http://watchhers.net/index.php \u2022  foundry2sdbl.dvr.dn2.n-helix.com",
            "https://steam.exacg.cc/ \u2022  http://tesgm.ru/_ld/5/584_steam_apidll_Th.rar",
            "Targeting Tsara Brasheras and associated",
            "Targeting Candace Owens"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1116",
              "name": "Code Signing",
              "display_name": "T1116 - Code Signing"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1051",
              "name": "Shared Webroot",
              "display_name": "T1051 - Shared Webroot"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1085",
              "name": "Rundll32",
              "display_name": "T1085 - Rundll32"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1506",
              "name": "Web Session Cookie",
              "display_name": "T1506 - Web Session Cookie"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            }
          ],
          "industries": [
            "Government",
            "Defense",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3709,
            "hostname": 1109,
            "FileHash-SHA256": 2872,
            "FileHash-MD5": 214,
            "FileHash-SHA1": 203,
            "domain": 557
          },
          "indicator_count": 8664,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "114 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "Targeting Candace Owens",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
        "remotewd.com device local",
        "http://alohatube.xyz/search/tsara-brashears No Expiration\t278\t  URL http://alohatube.xyz/search/tsara-brashears/ No Expiration\t62\t  URL http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears No Expiration\t49\t  URL http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us No Expiration\t27\t  URL http://browntubeporn.com/tsara-brashears.html No Expiration\t40\t  URL http://flexporn.net/tsara-brashears.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://www.mohurd.gov.cn.lxcvc.com/",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "config.uca.cloud.unity3d.com",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "0.0.iphone.8dyf8rf5k3.fr.mobiletrend.rtl2.adsenseformobileapps.com",
        "http://www.mof.gov.cn.lxcvc.com/ \u2022 https://r//www.csrc.gov.cn.lxcvc.com/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "http://www.tryporn.net/seach/tsara-brashears/",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://mom2fuck.mobi/tsara-brashears.html",
        "https://youjizz.sex/tsara-brashears.html",
        "Sex Tools: m.pornsexer.xxx.3.1.adiosfil.roksit.net |",
        "http://advocate-smyslova.ru/tsara-brashears/",
        "http://www.bukaporn.net/trend/tsara-brashears/",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "https://www.hallrender.com/attorney/brian-sabey/Accept",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "uk5seki2ygz3kyfgliqe37477miq6jsf.nlsexolehxry4opotgpq",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://vtwctr.org/explore/tsara- brashears-defeats-jeffrey-reimer/",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "http://videolal.com/tsara-brashears-dead.html",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://watchhers.net/index.php",
        "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process\t h",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears",
        "http://mp7tf.best-cell-phone-plans-for-seniors.cfd/",
        "sipphone.com",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "Targeting Tsara Brasheras and associated",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "http://orangeporntube.net/tsara-brashears.html",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "https://www.feestzalenvanvlaanderen.be/seach/tsara-brashears/",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://steam.exacg.cc/ \u2022  http://tesgm.ru/_ld/5/584_steam_apidll_Th.rar",
        "www.palantir.com \u2022   palantir.io \u2022 http://datafoundry.com/",
        "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn/;0.48692189815948833",
        "http://onlyindianporn2.com/videos/tsara-brashears/",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge phishing",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://alohatube.xyz/search/tsara-brashearsL",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "External Apple Connection: Notepad.pw",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "L\u00b0\u00b0k @ You, okay Chris\u2026abgubdf.apple.cloudns.biz \u2022 cloudns.biz \u2022 https://abgubdf.apple.cloudns",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "takedown-communication-api.prod-c15a-awsuse.ppops.net",
        "http://www.bukaporn.net/trend/tsara-brashears/ No Expiration\t41\t  URL http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
        "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg\t URL",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "http://vtwctr.org/explore/tsara-brashears-defeats-jeffrey-reimer/ phishing",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "https://www.sweetheartvideo.com/tsara-brashear",
        "http://watchhers.net/index.php \u2022  foundry2sdbl.dvr.dn2.n-helix.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png",
        "https://www.dirtsearch.org/data/TSARA/BRASHEARS/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://frostsecurity.net/frost/driver/ \u2022 http://frostsecurity.net/frost/frostupdater/",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.xvxx.me/search/tsara-brashears/",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html No Expiration\t41\t  URL http://www.sweetheartvideo.com/tsara-brashears No Expiration\t81\t  URL http://www.tryporn.net/seach/tsara-brashears/ No Expiration\t41\t  URL http://www.tryporno.net/movies/tsara-brashears/ No Expiration\t42\t  URL https://alohatube.xyz/search/tsara-brashears No Expiration\t211\t  URL https://alohatube.xyz/search/tsara-brashears+ No Expiration\t51\t  URL https://browntubeporn.com/tsara-brashearsAccept-Language No Expiratio",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "TAM Legal Christopher P. Ahmann Chief Terrorist"
          ],
          "malware_families": [
            "Custom malware",
            "Trojan:win32/qshell",
            "Other malware",
            "Tofsee",
            "Worm:win32/autorun",
            "Worn:win32/autorun.xxy!bit",
            "Trojan:win32/mydoom",
            "Ms defender\talf:heraklezeval:trojan:win32/clipbanker",
            "Win.malware.004bf-6866449-0",
            "Jaik",
            "Trojanspy:win32/nivdort"
          ],
          "industries": [
            "Healthcare",
            "Technology",
            "Defense",
            "Telecommunications",
            "Government",
            "Legal"
          ],
          "unique_indicators": 31241
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/anime-studio.org",
    "whois": "http://whois.domaintools.com/anime-studio.org",
    "domain": "anime-studio.org",
    "hostname": "comics.anime-studio.org"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 12,
  "pulses": [
    {
      "id": "69b49ad5dd40a24d83cd6a72",
      "name": "Chris P. Ahmann \u2022 PRIVATE PROPERTY Colorado State Fixer!",
      "description": "",
      "modified": "2026-03-13T23:16:37.716000",
      "created": "2026-03-13T23:16:37.716000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "69631fbd16e306ee2b76c4da",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "37 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69b496396ca4987e95ad37d1",
      "name": "Chris Buzz by QVashni (wow)",
      "description": "",
      "modified": "2026-03-13T22:56:57.314000",
      "created": "2026-03-13T22:56:57.314000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "69482caa00d327da8f0a87bc",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 47,
      "modified_text": "38 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69b49587dd104e342dda1628",
      "name": "C Ahman Attorney Clone by Top Tier, Q.Vashti",
      "description": "",
      "modified": "2026-03-13T22:53:59.112000",
      "created": "2026-03-13T22:53:59.112000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "691f4d4ef0a2a570b8b21cd2",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 47,
      "modified_text": "38 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "691f4d4ef0a2a570b8b21cd2",
      "name": "Chris P. Ahmann Colorado State Criminal Defense Attorney",
      "description": "Chris P. Ahmann Colorado State Criminal Defense attorney hired by quasi government Workers Compensation to completely destroy Tsara Brashears literally to death. None of her spinal cord injuries , and other assault injuries discussed or compensated for in rushed settlement case. Her awful racist attorney refused to represent plaintiffs in hearing. Never met with in person  for no good reason. Tsara represented herself.  Less that 24 hour notice. No briefings, no awareness or mention that Ahmann was representing Jeffrey Scott Reimer for assault\n case. Brashears required 24 hour care by end of life. Received 0 workers compsarion payments. But if this doesn\u2019t prove Reimer\u2019s guilt what does? Continued harassment of associated. \n\nNotice the outages? You\u2019ve cost BILLIONS? Stop threatening everyone.",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2025-11-20T17:18:06.929000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "90 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69482caa00d327da8f0a87bc",
      "name": "Chris P.\u2019 Buzz\u2019 Ahmann Colorado State Criminal Defense Attorney (22.20.2025)",
      "description": "",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2025-12-21T17:21:46.434000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "691f4d4ef0a2a570b8b21cd2",
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "90 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "695557ee134b978b00883c29",
      "name": "Chris P. Ahmann \u2022 Stay out of PRIVATE PROPERTY HITMAN!  Colorado State",
      "description": "",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2025-12-31T17:05:50.134000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "691f4d4ef0a2a570b8b21cd2",
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "90 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69631fbd16e306ee2b76c4da",
      "name": "Chris P. Ahmann \u2022 STAY Away!f PRIVATE PROPERTY Colorado State Fixer!",
      "description": "",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2026-01-11T03:57:49.242000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "695557ee134b978b00883c29",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "90 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "695ea667a062ed6688b104ab",
      "name": "Frost Security | Attorneys | Government | Crazy | Stop Tampering ",
      "description": "",
      "modified": "2026-01-07T18:31:03.104000",
      "created": "2026-01-07T18:31:03.104000",
      "tags": [
        "active",
        "type win32",
        "exe size",
        "first seen",
        "malicious avg",
        "win32",
        "gdata",
        "dynamicloader",
        "fe ff",
        "high",
        "write c",
        "data",
        "x00bx00",
        "uswv",
        "write",
        "redline",
        "stream",
        "guard",
        "malware",
        "push",
        "local",
        "crazyfrost",
        "adversarial",
        "hacker",
        "extraction",
        "enter sc",
        "data upload",
        "extre data",
        "included iocs",
        "url http",
        "url https",
        "include review",
        "exclude sugges",
        "frost security",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "contacted hosts",
        "ip address",
        "process details",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "signing defense",
        "united",
        "flag",
        "contacted",
        "http traffic",
        "file defense",
        "mitre att",
        "ck techniques",
        "evasion att",
        "belize",
        "div div",
        "passive dns",
        "link",
        "ipv4 add",
        "url analysis",
        "urls",
        "files",
        "meta",
        "ddos",
        "indicators show",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "hostname",
        "types",
        "hosanna",
        "x show",
        "ck ids",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "t1036",
        "capture",
        "cookie",
        "palantir",
        "indicator role",
        "active related",
        "description",
        "trump supporter",
        "types of",
        "germany",
        "china",
        "netherlands",
        "https",
        "notice",
        "billions",
        "stop",
        "boobs130432 no",
        "expiration",
        "location poland",
        "asn as29522",
        "learn more",
        "domain",
        "foundry",
        "hallrender",
        "brian sabey",
        "tam legal",
        "christopher p ahmann",
        "palantir",
        "quasi government",
        "pentagon"
      ],
      "references": [
        "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg\t URL",
        "http://frostsecurity.net/frost/driver/ \u2022 http://frostsecurity.net/frost/frostupdater/",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/",
        "https://www.hallrender.com/attorney/brian-sabey/Accept",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://vtwctr.org/explore/tsara-brashears-defeats-jeffrey-reimer/ phishing",
        "http://alohatube.xyz/search/tsara-brashears No Expiration\t278\t  URL http://alohatube.xyz/search/tsara-brashears/ No Expiration\t62\t  URL http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears No Expiration\t49\t  URL http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us No Expiration\t27\t  URL http://browntubeporn.com/tsara-brashears.html No Expiration\t40\t  URL http://flexporn.net/tsara-brashears.html",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge phishing",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "http://advocate-smyslova.ru/tsara-brashears/",
        "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn/;0.48692189815948833",
        "http://orangeporntube.net/tsara-brashears.html",
        "http://onlyindianporn2.com/videos/tsara-brashears/",
        "http://videolal.com/tsara-brashears-dead.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
        "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language",
        "http://www.bukaporn.net/trend/tsara-brashears/ No Expiration\t41\t  URL http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html No Expiration\t41\t  URL http://www.sweetheartvideo.com/tsara-brashears No Expiration\t81\t  URL http://www.tryporn.net/seach/tsara-brashears/ No Expiration\t41\t  URL http://www.tryporno.net/movies/tsara-brashears/ No Expiration\t42\t  URL https://alohatube.xyz/search/tsara-brashears No Expiration\t211\t  URL https://alohatube.xyz/search/tsara-brashears+ No Expiration\t51\t  URL https://browntubeporn.com/tsara-brashearsAccept-Language No Expiratio",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "http://www.tryporn.net/seach/tsara-brashears/",
        "https://alohatube.xyz/search/tsara-brashearsL",
        "http://onlyindianporn2.com/videos/tsara-brashears/",
        "http://orangeporntube.net/tsara-brashears.html",
        "https://www.dirtsearch.org/data/TSARA/BRASHEARS/",
        "https://youjizz.sex/tsara-brashears.html",
        "https://www.feestzalenvanvlaanderen.be/seach/tsara-brashears/",
        "https://www.xvxx.me/search/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://www.sweetheartvideo.com/tsara-brashear",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
        "http://www.bukaporn.net/trend/tsara-brashears/",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://mom2fuck.mobi/tsara-brashears.html",
        "http://vtwctr.org/explore/tsara- brashears-defeats-jeffrey-reimer/",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears",
        "www.palantir.com \u2022   palantir.io \u2022 http://datafoundry.com/",
        "http://watchhers.net/index.php \u2022  foundry2sdbl.dvr.dn2.n-helix.com",
        "https://steam.exacg.cc/ \u2022  http://tesgm.ru/_ld/5/584_steam_apidll_Th.rar",
        "Targeting Tsara Brasheras and associated",
        "Targeting Candace Owens"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1116",
          "name": "Code Signing",
          "display_name": "T1116 - Code Signing"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1051",
          "name": "Shared Webroot",
          "display_name": "T1051 - Shared Webroot"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1085",
          "name": "Rundll32",
          "display_name": "T1085 - Rundll32"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1506",
          "name": "Web Session Cookie",
          "display_name": "T1506 - Web Session Cookie"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        }
      ],
      "industries": [
        "Government",
        "Defense",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": "692897a64c0e255409b5a67e",
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3709,
        "hostname": 1109,
        "FileHash-SHA256": 2872,
        "FileHash-MD5": 214,
        "FileHash-SHA1": 203,
        "domain": 557
      },
      "indicator_count": 8664,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "103 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "695ea6590a50f71a156c9a7f",
      "name": "Frost Security | Attorneys | Government | Crazy | Stop Tampering ",
      "description": "",
      "modified": "2026-01-07T18:30:49.442000",
      "created": "2026-01-07T18:30:49.442000",
      "tags": [
        "active",
        "type win32",
        "exe size",
        "first seen",
        "malicious avg",
        "win32",
        "gdata",
        "dynamicloader",
        "fe ff",
        "high",
        "write c",
        "data",
        "x00bx00",
        "uswv",
        "write",
        "redline",
        "stream",
        "guard",
        "malware",
        "push",
        "local",
        "crazyfrost",
        "adversarial",
        "hacker",
        "extraction",
        "enter sc",
        "data upload",
        "extre data",
        "included iocs",
        "url http",
        "url https",
        "include review",
        "exclude sugges",
        "frost security",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "contacted hosts",
        "ip address",
        "process details",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "signing defense",
        "united",
        "flag",
        "contacted",
        "http traffic",
        "file defense",
        "mitre att",
        "ck techniques",
        "evasion att",
        "belize",
        "div div",
        "passive dns",
        "link",
        "ipv4 add",
        "url analysis",
        "urls",
        "files",
        "meta",
        "ddos",
        "indicators show",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "hostname",
        "types",
        "hosanna",
        "x show",
        "ck ids",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "t1036",
        "capture",
        "cookie",
        "palantir",
        "indicator role",
        "active related",
        "description",
        "trump supporter",
        "types of",
        "germany",
        "china",
        "netherlands",
        "https",
        "notice",
        "billions",
        "stop",
        "boobs130432 no",
        "expiration",
        "location poland",
        "asn as29522",
        "learn more",
        "domain",
        "foundry",
        "hallrender",
        "brian sabey",
        "tam legal",
        "christopher p ahmann",
        "palantir",
        "quasi government",
        "pentagon"
      ],
      "references": [
        "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg\t URL",
        "http://frostsecurity.net/frost/driver/ \u2022 http://frostsecurity.net/frost/frostupdater/",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/",
        "https://www.hallrender.com/attorney/brian-sabey/Accept",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://vtwctr.org/explore/tsara-brashears-defeats-jeffrey-reimer/ phishing",
        "http://alohatube.xyz/search/tsara-brashears No Expiration\t278\t  URL http://alohatube.xyz/search/tsara-brashears/ No Expiration\t62\t  URL http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears No Expiration\t49\t  URL http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us No Expiration\t27\t  URL http://browntubeporn.com/tsara-brashears.html No Expiration\t40\t  URL http://flexporn.net/tsara-brashears.html",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge phishing",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "http://advocate-smyslova.ru/tsara-brashears/",
        "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn/;0.48692189815948833",
        "http://orangeporntube.net/tsara-brashears.html",
        "http://onlyindianporn2.com/videos/tsara-brashears/",
        "http://videolal.com/tsara-brashears-dead.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
        "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language",
        "http://www.bukaporn.net/trend/tsara-brashears/ No Expiration\t41\t  URL http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html No Expiration\t41\t  URL http://www.sweetheartvideo.com/tsara-brashears No Expiration\t81\t  URL http://www.tryporn.net/seach/tsara-brashears/ No Expiration\t41\t  URL http://www.tryporno.net/movies/tsara-brashears/ No Expiration\t42\t  URL https://alohatube.xyz/search/tsara-brashears No Expiration\t211\t  URL https://alohatube.xyz/search/tsara-brashears+ No Expiration\t51\t  URL https://browntubeporn.com/tsara-brashearsAccept-Language No Expiratio",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "http://www.tryporn.net/seach/tsara-brashears/",
        "https://alohatube.xyz/search/tsara-brashearsL",
        "http://onlyindianporn2.com/videos/tsara-brashears/",
        "http://orangeporntube.net/tsara-brashears.html",
        "https://www.dirtsearch.org/data/TSARA/BRASHEARS/",
        "https://youjizz.sex/tsara-brashears.html",
        "https://www.feestzalenvanvlaanderen.be/seach/tsara-brashears/",
        "https://www.xvxx.me/search/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://www.sweetheartvideo.com/tsara-brashear",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
        "http://www.bukaporn.net/trend/tsara-brashears/",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://mom2fuck.mobi/tsara-brashears.html",
        "http://vtwctr.org/explore/tsara- brashears-defeats-jeffrey-reimer/",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears",
        "www.palantir.com \u2022   palantir.io \u2022 http://datafoundry.com/",
        "http://watchhers.net/index.php \u2022  foundry2sdbl.dvr.dn2.n-helix.com",
        "https://steam.exacg.cc/ \u2022  http://tesgm.ru/_ld/5/584_steam_apidll_Th.rar",
        "Targeting Tsara Brasheras and associated",
        "Targeting Candace Owens"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1116",
          "name": "Code Signing",
          "display_name": "T1116 - Code Signing"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1051",
          "name": "Shared Webroot",
          "display_name": "T1051 - Shared Webroot"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1085",
          "name": "Rundll32",
          "display_name": "T1085 - Rundll32"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1506",
          "name": "Web Session Cookie",
          "display_name": "T1506 - Web Session Cookie"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        }
      ],
      "industries": [
        "Government",
        "Defense",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": "692897a64c0e255409b5a67e",
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3709,
        "hostname": 1109,
        "FileHash-SHA256": 2872,
        "FileHash-MD5": 214,
        "FileHash-SHA1": 203,
        "domain": 557
      },
      "indicator_count": 8664,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "103 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6907cc66855b7dfe1306b0d8",
      "name": "Inject : Defense Counsel attaches to Apple Notebooks - Targeting",
      "description": "TAM Legal attacking Tsara Brashears and associated. Christopher P. Ahmann Esq Is the Special Counsel assigned to pester , smear, tamper with, terrorize, arrange murders, dispatch stalkers, deny care, swatting , botnets, attach to  devices , deflect award for life ending injuries to you and your Mafia, choose malicious media companies (Hall Render) to smear Jeffrey Scott Reimers assault victim. This is silencing. Not everyone has someone to speak. Back off. You\u2019re sick. Enjoying that money, while Tsara slept on air mattress during a couch tour. Demyelinating, from denied disclosed of cord compression; like George Floyd. You should turn yourself in, write a HUGA check , shut down this criminal operation , find Jesus , self exit to a place out away from you targets ,  go to your bunker forever. You are a God Forsaken terrorist hitman! You\u2019re all SO sick!\nEnd Game Now.",
      "modified": "2026-01-01T07:03:18.851000",
      "created": "2025-11-02T21:25:58.814000",
      "tags": [
        "present nov",
        "unknown aaaa",
        "ip address",
        "win32",
        "america asn",
        "twitter",
        "united states",
        "america",
        "ipv4",
        "united",
        "a domains",
        "443 ma86400",
        "super",
        "read c",
        "memcommit",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "regsetvalueexa",
        "hack",
        "write",
        "february",
        "local",
        "unknown",
        "persistence",
        "execution",
        "xport",
        "kb body",
        "present aug",
        "present sep",
        "present oct",
        "for privacy",
        "false",
        "expirestue",
        "path",
        "p2404",
        "accept",
        "p11762282638",
        "host",
        "gmt range",
        "gmt ifnonematch",
        "p11762466264",
        "p11762417453",
        "nothing",
        "shutdown",
        "process32nextw",
        "langturkish",
        "sublangdefault",
        "regdword",
        "rtrcdata",
        "microsoft excel",
        "delphi",
        "worm",
        "malware",
        "error",
        "next",
        "format",
        "suspicious",
        "less see",
        "contacted",
        "all ip",
        "domains",
        "all related",
        "pulses otx",
        "related tags",
        "file type",
        "pexe",
        "christopher ahmann",
        "tam legal",
        "treece",
        "hacking",
        "highjacking",
        "modified",
        "quasi government",
        "ai google",
        "inject",
        "adversaries",
        "government",
        "insurance",
        "apple"
      ],
      "references": [
        "External Apple Connection: Notepad.pw",
        "Sex Tools: m.pornsexer.xxx.3.1.adiosfil.roksit.net |",
        "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process\t h",
        "takedown-communication-api.prod-c15a-awsuse.ppops.net",
        "L\u00b0\u00b0k @ You, okay Chris\u2026abgubdf.apple.cloudns.biz \u2022 cloudns.biz \u2022 https://abgubdf.apple.cloudns",
        "http://www.mof.gov.cn.lxcvc.com/ \u2022 https://r//www.csrc.gov.cn.lxcvc.com/",
        "http://www.mohurd.gov.cn.lxcvc.com/",
        "config.uca.cloud.unity3d.com",
        "0.0.iphone.8dyf8rf5k3.fr.mobiletrend.rtl2.adsenseformobileapps.com",
        "http://mp7tf.best-cell-phone-plans-for-seniors.cfd/",
        "sipphone.com",
        "uk5seki2ygz3kyfgliqe37477miq6jsf.nlsexolehxry4opotgpq"
      ],
      "public": 1,
      "adversary": "TAM Legal Christopher P. Ahmann Chief Terrorist",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win.Malware.004bf-6866449-0",
          "display_name": "Win.Malware.004bf-6866449-0",
          "target": null
        },
        {
          "id": "Custom Malware",
          "display_name": "Custom Malware",
          "target": null
        },
        {
          "id": "Worn:Win32/AutoRun.XXY!bit",
          "display_name": "Worn:Win32/AutoRun.XXY!bit",
          "target": "/malware/Worn:Win32/AutoRun.XXY!bit"
        }
      ],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1094",
          "name": "Custom Command and Control Protocol",
          "display_name": "T1094 - Custom Command and Control Protocol"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1055.001",
          "name": "Dynamic-link Library Injection",
          "display_name": "T1055.001 - Dynamic-link Library Injection"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1184",
          "name": "SSH Hijacking",
          "display_name": "T1184 - SSH Hijacking"
        },
        {
          "id": "T1122",
          "name": "Component Object Model Hijacking",
          "display_name": "T1122 - Component Object Model Hijacking"
        }
      ],
      "industries": [
        "Legal",
        "Government",
        "Healthcare",
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 2615,
        "URL": 7521,
        "hostname": 1775,
        "domain": 689,
        "FileHash-MD5": 448,
        "FileHash-SHA1": 295,
        "SSLCertFingerprint": 12,
        "email": 1
      },
      "indicator_count": 13356,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "109 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://comics.anime-studio.org",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://comics.anime-studio.org",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776726137.5210643
}