{
  "type": "URL",
  "indicator": "https://cone.msoftupdates.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://cone.msoftupdates.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3869791804,
      "indicator": "https://cone.msoftupdates.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "69a3c685d4b7c139ffe62930",
          "name": "Clone Pulse Reference",
          "description": "",
          "modified": "2026-04-01T00:44:45.494000",
          "created": "2026-03-01T04:54:29.384000",
          "tags": [
            "ipv4",
            "active related",
            "trojandropper",
            "mtb jun",
            "lowfi",
            "trojan",
            "mtb jan",
            "fastly error",
            "please",
            "united",
            "ttl value",
            "get na",
            "total",
            "delete",
            "search",
            "yara detections",
            "sinkhole cookie",
            "value snkz",
            "write",
            "suspicious",
            "ransom",
            "malware",
            "Ransom.Win32.Birele.gsg Checkin",
            "AnubisNetworks Sinkhole Cookie Value Snkz",
            "Possible Compromised Host",
            "dynamicloader",
            "delete c",
            "default",
            "medium",
            "write c",
            "settingswpad",
            "intel",
            "ms windows",
            "users",
            "number",
            "title",
            "installer",
            "top source",
            "top destination",
            "source source",
            "port",
            "filehash",
            "av detections",
            "ids detections",
            "yara rule",
            "gravityrat",
            "detectvm",
            "x00 x00",
            "x00x00",
            "doviacmd",
            "rootjob",
            "getfiles",
            "updateserver",
            "ethernetid",
            "ids signatures",
            "exploits",
            "sid name",
            "malware cve",
            "dns query",
            "dnsbin demo",
            "data exfil",
            "exif data",
            "DNS Query for Webhook/HTTP Request Inspection Service (x .pipedr",
            "DNSBin Demo (requestbin .net) - Data Exfitration",
            "source port",
            "destination",
            "present sep",
            "script urls",
            "script script",
            "a domains",
            "script domains",
            "ip address",
            "meta",
            "present nov",
            "passive dns",
            "next associated",
            "domain add",
            "pe executable",
            "entries",
            "show",
            "msie",
            "windows nt",
            "wow64",
            "copy",
            "present jan",
            "present feb",
            "domain",
            "pulse pulses",
            "urls",
            "files",
            "tam legal",
            "christopher ahmann",
            "https://unicef.se/assets/apple",
            "treece alfrey",
            "hours ago",
            "information",
            "report spam",
            "ahmann colorado",
            "state",
            "special cousel",
            "created",
            "expiro",
            "capture"
          ],
          "references": [
            "Fastly IP Block:  151.101.0.0/16 | Organizations like Palantir may use third-party services such as Fastly's CDN",
            "Fastly Error and Palantir blocked several times over the last few months.",
            "Denver ; ISP, Fastly, Inc. ; Organization, Fastly, Inc. ; Network, AS54113 Fastly, Inc. (VPN, CDN, DDOSM,)",
            "IP Region, Quebec. City ; Net Range, 151.101.0.0 - 151.101.255.255. CIDR ; Full Name, Fastly, Inc.",
            "Palantir quasi government client Ab/using Palantir subdomains , Fastly is CDN",
            "Yara: SUSP_ENV_Folder_Root_File_Jan23_1 %APPDATA%\\ewiuer2.exe SCRIPT",
            "Win.Trojan.Vundo-7170412-0\t#Lowfi:SuspiciousSectionName",
            "Link below used to defraud Tsara to think she\u2019d violated Patriot Act warranting NSA , Palinter espionage",
            "https://unicef.se/assets/apple"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/Neconyd.A",
              "display_name": "Trojan:Win32/Neconyd.A",
              "target": "/malware/Trojan:Win32/Neconyd.A"
            },
            {
              "id": "PWS:Win32/QQpass.FC",
              "display_name": "PWS:Win32/QQpass.FC",
              "target": "/malware/PWS:Win32/QQpass.FC"
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Malware.Urelas-9863836-0",
              "display_name": "Win.Malware.Urelas-9863836-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "target": null
            },
            {
              "id": "Win.Trojan.Vundo-7170412-0",
              "display_name": "Win.Trojan.Vundo-7170412-0",
              "target": null
            },
            {
              "id": "#Lowfi:SuspiciousSectionName",
              "display_name": "#Lowfi:SuspiciousSectionName",
              "target": null
            },
            {
              "id": "Multiple Malware\u2019s , Trojans and Rats",
              "display_name": "Multiple Malware\u2019s , Trojans and Rats",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6906bd99cadbd4140014c6af",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 909,
            "domain": 454,
            "hostname": 1404,
            "URL": 3557,
            "CIDR": 1,
            "FileHash-MD5": 242,
            "FileHash-SHA1": 185,
            "email": 1,
            "CVE": 1
          },
          "indicator_count": 6754,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 48,
          "modified_text": "18 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "690a2c38de1708af54217faa",
          "name": "Access Token used to steal security credentials & hack and ride DND of targeted individuals",
          "description": "- https://shift.gearboxsoftware.com/link\n- Found embedded in targets phone.\n\nAccess Token used to steal security credentials & hack and ride DND of targeted individuals device. \nTAM Legal \u2022  Tulach \u2022 Hall Render \u2022 Quasi Government | Some type of Foundry user account found. \n\nStop illegally \n  stalking, harassment, attempts, hacking, death threats. . Because the Colorado government allowing entities like this to operate without any type of rules, oversight or boundaries \nMILLION$ were wasted in your own fraud, waste in abuse scheme. AT&T , CrowdStrike , United Healthcare , UC Healthcare, Intermountain Health, T-Mobile, Amazon East, the Colorado Government itself, Medicare and Medicaid. For what? You have zero talent so you take it from those who do. You have nothing coming to you so you steal it from those who do. Is this somehow legal? \n#contacted #all_hosts backdoor #ransomware  #cve #usa #american_terrorists #workers_compenstation_abuse #silencing #targeting #hitmen #illegal #malvertizing #aws_dns",
          "modified": "2025-12-04T15:01:02.531000",
          "created": "2025-11-04T16:39:20.035000",
          "tags": [
            "present aug",
            "moved",
            "encrypt",
            "present jul",
            "passive dns",
            "ipv4 add",
            "reverse dns",
            "united states",
            "present may",
            "ip address",
            "gmt content",
            "ipv4",
            "all ipv4",
            "america",
            "united",
            "present oct",
            "name servers",
            "redacted for",
            "emails",
            "for privacy",
            "unknown ns",
            "unknown aaaa",
            "dynamicloader",
            "focus region",
            "unicode text",
            "utf16",
            "ms windows",
            "bokeh onlycanon",
            "zeiss jena",
            "mcsonnar",
            "high",
            "win64",
            "stream",
            "write",
            "smartassembly",
            "trailer",
            "next",
            "search",
            "medium",
            "as15169",
            "write c",
            "reads",
            "team",
            "malware",
            "local",
            "yara detections",
            "delphi",
            "strings",
            "dcom",
            "form",
            "trojandropper",
            "mtb nov",
            "backdoor",
            "otx telemetry",
            "trojan",
            "type",
            "data upload",
            "extraction",
            "ol rop",
            "hash avast",
            "avg clamav",
            "msdefender nov",
            "win32upatre nov",
            "win32berbew nov",
            "dynamic",
            "pe section",
            "error",
            "close",
            "status",
            "urls",
            "expiration date",
            "hostname",
            "url analysis",
            "yara rule",
            "show",
            "binary file",
            "wine emulator",
            "mtb oct",
            "files",
            "denmark asn",
            "as32934",
            "candyopen",
            "possible",
            "smoke loader",
            "trojanspy",
            "filehash",
            "pulses otx",
            "related tags",
            "file type",
            "no analysis",
            "available",
            "api key",
            "screenshots",
            "present nov",
            "aaaa",
            "mtb may",
            "mexico",
            "hostname add",
            "registrar",
            "domain add",
            "location united",
            "email add",
            "none related",
            "domains",
            "email domain",
            "service",
            "domain",
            "america flag",
            "body",
            "title",
            "aws dns",
            "next associated",
            "risepro",
            "guard",
            "v full",
            "reports v",
            "t1059 shared",
            "modules",
            "t1129 system",
            "t1569",
            "help v",
            "t1179 boot",
            "logon autost",
            "encoding",
            "packing f0001",
            "hidden files",
            "e1203 windows",
            "file attributes",
            "registry value",
            "catalog tree",
            "analysis ob0001",
            "evasion b0003",
            "virtual machine",
            "ip traffic",
            "memory pattern",
            "pattern urls",
            "tls sni",
            "get https",
            "post https",
            "named pipe",
            "delete c",
            "radar",
            "defender",
            "format",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "country",
            "contacted hosts",
            "process details",
            "flag",
            "globalc",
            "intel",
            "win32",
            "worm",
            "path",
            "explorer",
            "script",
            "href",
            "external",
            "html content",
            "tulach",
            "hallrender",
            "tam legal",
            "brian sabey",
            "christopher ahmann",
            "apple",
            "msie",
            "chrome",
            "ascio",
            "creation date",
            "date",
            "germany unknown",
            "germany asn",
            "files ip",
            "address",
            "asn as24940",
            "less",
            "script urls",
            "a domains",
            "prox",
            "dennis schrder",
            "meta",
            "apache",
            "99u25f.exe",
            "entries",
            "as24940 hetzner",
            "dns resolutions",
            "status code",
            "body length",
            "kb body",
            "software/ hardware",
            "external-resources",
            "password-input",
            "overview",
            "colorado"
          ],
          "references": [
            "https://shift.gearboxsoftware.com/link",
            "https://tulach.cc/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  \u2022 alohatube.xyz \u2022 1001pornvideos.com",
            "x402.porn \u2022 http://alohatube.xyz/search/tsara-brashears \u2022 \thttps://ufovpn.io/blog/is-eporner-safe",
            "https://www.turbo.net/run/videolan/vlc",
            "http://www.forensickb.com/2013/03/file-entropy-explained.html",
            "https://www.xlabs.com.br/blog/cve-2013-3304-dell-equallogic-directory-traversal/ \u2022 http://cve.phidias.com/",
            "Overview \"Keeping money\" by the Colorado workers' compensation system can refer to",
            "legal deductions, legitimate reasons for payment delays or denial, or potential issues that require legal",
            "counsel. The system does not \"keep\" money without a valid reason.Lies. they\u2019ve Ben in trouble before ."
          ],
          "public": 1,
          "adversary": "Colorado Quasi Government | Workerk Compensation",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.Generic-9878032-0",
              "display_name": "Win.Trojan.Generic-9878032-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Starter-171",
              "display_name": "Win.Trojan.Starter-171",
              "target": null
            },
            {
              "id": "GravityRAT",
              "display_name": "GravityRAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Berbew.AA!MTB",
              "display_name": "Backdoor:Win32/Berbew.AA!MTB",
              "target": "/malware/Backdoor:Win32/Berbew.AA!MTB"
            },
            {
              "id": "Trojan:MSIL/AgentTesla.DW!MTB",
              "display_name": "Trojan:MSIL/AgentTesla.DW!MTB",
              "target": "/malware/Trojan:MSIL/AgentTesla.DW!MTB"
            },
            {
              "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "target": null
            },
            {
              "id": "Trojandropper:Win32/VB.IL",
              "display_name": "Trojandropper:Win32/VB.IL",
              "target": "/malware/Trojandropper:Win32/VB.IL"
            },
            {
              "id": "Nemucod",
              "display_name": "Nemucod",
              "target": null
            },
            {
              "id": "Berbew",
              "display_name": "Berbew",
              "target": null
            },
            {
              "id": "PWS:Win32/Zbot.MS!MTB",
              "display_name": "PWS:Win32/Zbot.MS!MTB",
              "target": "/malware/PWS:Win32/Zbot.MS!MTB"
            },
            {
              "id": "Win.Trojan.Barys-10005825-0",
              "display_name": "Win.Trojan.Barys-10005825-0",
              "target": null
            },
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Win.Exploit.Rozena-10038302-0",
              "display_name": "Win.Exploit.Rozena-10038302-0",
              "target": null
            },
            {
              "id": "Zombie",
              "display_name": "Zombie",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie",
              "display_name": "Trojan:Win32/Zombie",
              "target": "/malware/Trojan:Win32/Zombie"
            },
            {
              "id": "Muldrop",
              "display_name": "Muldrop",
              "target": null
            },
            {
              "id": "Worm:Win32/Mofksys.RND!MTB",
              "display_name": "Worm:Win32/Mofksys.RND!MTB",
              "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
            },
            {
              "id": "Dorv",
              "display_name": "Dorv",
              "target": null
            },
            {
              "id": "Win.Malware.Pits-10035540-0",
              "display_name": "Win.Malware.Pits-10035540-0",
              "target": null
            },
            {
              "id": "Win.Ransomware.Msilzilla-10014498-0",
              "display_name": "Win.Ransomware.Msilzilla-10014498-0",
              "target": null
            },
            {
              "id": "CVE-2023-4966",
              "display_name": "CVE-2023-4966",
              "target": null
            },
            {
              "id": "Exploit:Linux/CVE-2017-17215",
              "display_name": "Exploit:Linux/CVE-2017-17215",
              "target": "/malware/Exploit:Linux/CVE-2017-17215"
            },
            {
              "id": "Ransom:Win32/CVE-2017-0147",
              "display_name": "Ransom:Win32/CVE-2017-0147",
              "target": "/malware/Ransom:Win32/CVE-2017-0147"
            },
            {
              "id": "CVE-2022-26134",
              "display_name": "CVE-2022-26134",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1569",
              "name": "System Services",
              "display_name": "T1569 - System Services"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6051,
            "hostname": 2627,
            "FileHash-MD5": 401,
            "FileHash-SHA1": 257,
            "email": 11,
            "domain": 1838,
            "FileHash-SHA256": 1742,
            "CVE": 4,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 12934,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "135 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6906bd99cadbd4140014c6af",
          "name": "Espionage - Gravity RAT + | Legal entities are State owned.  Attacking severely injured  PT\u2019s SA victim.",
          "description": "Fastly CDN for Palantir (Verizon) unless updated.  Very malicious IoC\u2019s found evaluating IoC\u2019 from Christopher Ahmann - TAM Legal link.\n- Made contact with victim several times.\n- Illegal contact made with attorneys considering representing Tsara. \n- https://unicef.se/assets/apple - link related to defraud Tsara to think she\u2019d violated Patriot Act warranting NSA , Palinter espionage.\n\nAhmann is named as special counsel but he , like Brian Sabey are \u2018ONLY\u2019  cyber attacking Tsara Brashears.\n\n- protecting Jeffrey Reimer DPT, multiple doctors, Concentra,  blocked and denied care , hired a hitman/men and it would have. Even cheaper to pay her for the injuries she never sought compensation for due to aggressive attacks and threats.",
          "modified": "2025-12-02T01:05:30.331000",
          "created": "2025-11-02T02:10:33.546000",
          "tags": [
            "ipv4",
            "active related",
            "trojandropper",
            "mtb jun",
            "lowfi",
            "trojan",
            "mtb jan",
            "fastly error",
            "please",
            "united",
            "ttl value",
            "get na",
            "total",
            "delete",
            "search",
            "yara detections",
            "sinkhole cookie",
            "value snkz",
            "write",
            "suspicious",
            "ransom",
            "malware",
            "Ransom.Win32.Birele.gsg Checkin",
            "AnubisNetworks Sinkhole Cookie Value Snkz",
            "Possible Compromised Host",
            "dynamicloader",
            "delete c",
            "default",
            "medium",
            "write c",
            "settingswpad",
            "intel",
            "ms windows",
            "users",
            "number",
            "title",
            "installer",
            "top source",
            "top destination",
            "source source",
            "port",
            "filehash",
            "av detections",
            "ids detections",
            "yara rule",
            "gravityrat",
            "detectvm",
            "x00 x00",
            "x00x00",
            "doviacmd",
            "rootjob",
            "getfiles",
            "updateserver",
            "ethernetid",
            "ids signatures",
            "exploits",
            "sid name",
            "malware cve",
            "dns query",
            "dnsbin demo",
            "data exfil",
            "exif data",
            "DNS Query for Webhook/HTTP Request Inspection Service (x .pipedr",
            "DNSBin Demo (requestbin .net) - Data Exfitration",
            "source port",
            "destination",
            "present sep",
            "script urls",
            "script script",
            "a domains",
            "script domains",
            "ip address",
            "meta",
            "present nov",
            "passive dns",
            "next associated",
            "domain add",
            "pe executable",
            "entries",
            "show",
            "msie",
            "windows nt",
            "wow64",
            "copy",
            "present jan",
            "present feb",
            "domain",
            "pulse pulses",
            "urls",
            "files",
            "tam legal",
            "christopher ahmann",
            "https://unicef.se/assets/apple",
            "treece alfrey",
            "hours ago",
            "information",
            "report spam",
            "ahmann colorado",
            "state",
            "special cousel",
            "created",
            "expiro",
            "capture"
          ],
          "references": [
            "Fastly IP Block:  151.101.0.0/16 | Organizations like Palantir may use third-party services such as Fastly's CDN",
            "Fastly Error and Palantir blocked several times over the last few months.",
            "Denver ; ISP, Fastly, Inc. ; Organization, Fastly, Inc. ; Network, AS54113 Fastly, Inc. (VPN, CDN, DDOSM,)",
            "IP Region, Quebec. City ; Net Range, 151.101.0.0 - 151.101.255.255. CIDR ; Full Name, Fastly, Inc.",
            "Palantir quasi government client Ab/using Palantir subdomains , Fastly is CDN",
            "Yara: SUSP_ENV_Folder_Root_File_Jan23_1 %APPDATA%\\ewiuer2.exe SCRIPT",
            "Win.Trojan.Vundo-7170412-0\t#Lowfi:SuspiciousSectionName",
            "Link below used to defraud Tsara to think she\u2019d violated Patriot Act warranting NSA , Palinter espionage",
            "https://unicef.se/assets/apple"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/Neconyd.A",
              "display_name": "Trojan:Win32/Neconyd.A",
              "target": "/malware/Trojan:Win32/Neconyd.A"
            },
            {
              "id": "PWS:Win32/QQpass.FC",
              "display_name": "PWS:Win32/QQpass.FC",
              "target": "/malware/PWS:Win32/QQpass.FC"
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Malware.Urelas-9863836-0",
              "display_name": "Win.Malware.Urelas-9863836-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "target": null
            },
            {
              "id": "Win.Trojan.Vundo-7170412-0",
              "display_name": "Win.Trojan.Vundo-7170412-0",
              "target": null
            },
            {
              "id": "#Lowfi:SuspiciousSectionName",
              "display_name": "#Lowfi:SuspiciousSectionName",
              "target": null
            },
            {
              "id": "Multiple Malware\u2019s , Trojans and Rats",
              "display_name": "Multiple Malware\u2019s , Trojans and Rats",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 909,
            "domain": 449,
            "hostname": 1403,
            "URL": 3552,
            "CIDR": 1,
            "FileHash-MD5": 242,
            "FileHash-SHA1": 185,
            "email": 1
          },
          "indicator_count": 6742,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "138 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "688f1ce317fc8b3f9d5d5f33",
          "name": "Unknown  - Established hacker group. Affects banking, financial  and much more.",
          "description": "Crowdsourced. Identifies as a Dark Web gang stalking entity. Research suggests that this is a very organized, possibly quasi governmental entity with shadowy state figures that social engineer targets. Even though they have been considered scammers and they are grifters, they are very established, dangerous and a very large force with claims of military alignments which has not yet been fully confirmed.\n\nThis group is anything you want them to be, attorney, accountant, technician, nurse, uber driver.",
          "modified": "2025-09-02T08:02:34.108000",
          "created": "2025-08-03T08:25:07.135000",
          "tags": [
            "united",
            "search",
            "entries",
            "unknown ns",
            "ip address",
            "creation date",
            "record value",
            "date",
            "showing",
            "moved",
            "body",
            "encrypt",
            "lowfi",
            "trojanspy",
            "checkin",
            "passive dns",
            "trojan",
            "next associated",
            "cryp",
            "win32",
            "phishing",
            "virtool",
            "hstr",
            "backdoor",
            "ipv4",
            "pulse pulses",
            "associated urls",
            "show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results feb",
            "header http2",
            "accept encoding",
            "gmt related",
            "domains show",
            "domain related",
            "response ip",
            "address google",
            "safe browsing",
            "entries http",
            "scans show",
            "title",
            "link",
            "present mar",
            "meta",
            "starfield",
            "dynamicloader",
            "qaeaav12",
            "medium",
            "high",
            "malware",
            "windows wget",
            "qbeipbdii",
            "write",
            "suspicious",
            "copy",
            "yara rule",
            "gravityrat",
            "detectvm",
            "x00 x00",
            "x00x00",
            "doviacmd",
            "rootjob",
            "getfiles",
            "updateserver",
            "ethernetid",
            "unknown",
            "yara detections",
            "filehash",
            "sha256 add",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "oinetsim",
            "oudevelopment",
            "write c",
            "demo",
            "mtb sep",
            "trojandropper",
            "cookie",
            "path max",
            "age86400 set",
            "win32qqpass sep",
            "results aug",
            "script urls",
            "script domains",
            "a domains",
            "cache control",
            "cache status",
            "fury",
            "zenedge",
            "present jun",
            "present dec",
            "present jan",
            "present nov",
            "for privacy",
            "present may",
            "name servers",
            "no expiration",
            "filehashmd5",
            "filehashsha256",
            "filehashsha1",
            "iocs",
            "extract",
            "enter source",
            "url or",
            "text drag",
            "drop or",
            "domain",
            "expiration",
            "url http",
            "hostname",
            "email abuse"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 459,
            "FileHash-MD5": 553,
            "FileHash-SHA256": 1042,
            "URL": 1426,
            "hostname": 476,
            "domain": 521,
            "email": 3,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 4481,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "229 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "67f6c635cb8c3c8b256b6dba",
          "name": "sdfzsdf.ele   fac1ec40eea5a4fc05f17e019328e287",
          "description": "SHA1- 33008f85428a83996083c3da92a8f00595071403\nSHA256\ncdab1c3196887d4f749d82f014786a966c87f35a7189f0f3d078558b957847bf\nhttps://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=7b6726e20c513baebf7fd387a3dd1b7d67a4c7c4\nhttps://ti.qianxin.com/v2/search?type=file&value=fac1ec40eea5a4fc05f17e019328e287\nhttps://www.virustotal.com/gui/file/cdab1c3196887d4f749d82f014786a966c87f35a7189f0f3d078558b957847bf/relations",
          "modified": "2025-09-01T08:05:17.675000",
          "created": "2025-04-09T19:10:45.337000",
          "tags": [
            "sha1",
            "rozmiar",
            "typ pliku",
            "win32",
            "numer wersji",
            "wersja",
            "nieznany",
            "sha512",
            "crc32",
            "ssd gboki",
            "win64",
            "security",
            "license v2",
            "f6 d9",
            "windows nt",
            "detects",
            "gecko",
            "khtml",
            "msie",
            "wow64",
            "stealer",
            "error",
            "userprofile",
            "hunt",
            "keylogger",
            "encrypt",
            "antivm",
            "span",
            "main",
            "grabber",
            "hello",
            "android",
            "dcrat",
            "kill",
            "revengerat",
            "sandbox",
            "pass",
            "chat",
            "first",
            "asyncrat",
            "crypto",
            "injector",
            "dropper",
            "infostealer",
            "lockfile",
            "worldwind",
            "stealerium",
            "toxiceye",
            "avemaria",
            "fast",
            "persistence",
            "trojan",
            "restart",
            "snakekeylogger",
            "snake",
            "accept",
            "cookie",
            "code",
            "killproc",
            "lazarus",
            "dearcry",
            "njrat",
            "cyrus",
            "powershell",
            "info",
            "body",
            "floodfix",
            "downloader",
            "ransomware",
            "core",
            "loki",
            "fpspy",
            "klogexe",
            "firebird",
            "patch",
            "explorer",
            "avkiller",
            "masslogger",
            "baldr",
            "modi rat",
            "helpme",
            "osno",
            "import",
            "keylog",
            "screencapture",
            "ransom",
            "crypted",
            "silent",
            "xorddos",
            "stormkitty",
            "ordinal",
            "locker",
            "hyperbro",
            "lamepyre",
            "parallaxrat",
            "null",
            "shurk steal",
            "arkeistealer",
            "strongpity",
            "desktop",
            "myagent",
            "bypass",
            "fatduke",
            "miniduke",
            "polyglotduke",
            "guildma",
            "spyeye",
            "corebot",
            "killmbr",
            "ooops",
            "lcpdot",
            "torisma",
            "codec",
            "prometheus",
            "spook",
            "crypt",
            "logger",
            "zegost",
            "poshkeylogger",
            "systembc",
            "hdlocker",
            "cryptolocker",
            "fivehands",
            "kitty",
            "goldmax",
            "rents",
            "maurigo",
            "done",
            "hidewindow",
            "bokbot",
            "bladabindi",
            "darktrack",
            "darksky",
            "alien",
            "karkoff",
            "inject",
            "windigo",
            "rest",
            "softcnapp",
            "elysiumstealer",
            "leivion",
            "banload",
            "ultrareach",
            "ultrasurf",
            "buterat",
            "tools",
            "beasty",
            "shut",
            "gravityrat",
            "fatalrat",
            "discord",
            "deadwood",
            "turian",
            "markirat",
            "mark",
            "klingonrat",
            "path",
            "reverserat",
            "grab",
            "meta",
            "voidcrypt",
            "darkvnc",
            "ryzerlo",
            "hiddentear",
            "boxcaon",
            "stream",
            "crimsonrat",
            "delfi",
            "infinity",
            "stealthworker",
            "gasket",
            "spoolss",
            "lu0bot",
            "target",
            "attack",
            "cobaltstrike",
            "bits",
            "chaos",
            "bitcoin",
            "wiper",
            "delphi",
            "slackbot",
            "neshta",
            "belarus",
            "apanas",
            "runner",
            "darkcomet",
            "macoute",
            "iframe",
            "vanillarat",
            "sectoprat",
            "melt",
            "tomiris",
            "apostle",
            "blackbyte",
            "kutaki",
            "override",
            "windealer",
            "mkdir",
            "brbbot",
            "config",
            "babylon rat",
            "spynet",
            "bazarloader",
            "clipper",
            "banker",
            "gh0st",
            "piratestealer",
            "witch",
            "killme",
            "vulturi",
            "tofsee",
            "slow",
            "owowa",
            "flagpro",
            "write",
            "dazzlespy",
            "decryptor",
            "bandit stealer",
            "bandit",
            "darkeye",
            "recordbreaker",
            "truebot",
            "svchost",
            "clipbanker",
            "service",
            "koivm",
            "arrowrat",
            "ducktail",
            "confuser",
            "gobrat",
            "modiloader",
            "chilelocker",
            "noclose",
            "strelastealer",
            "comfoo",
            "babar",
            "blankgrabber",
            "solarmarker",
            "darkgate",
            "stub",
            "banned",
            "globeimposter",
            "rhysida",
            "janelarat",
            "kraken",
            "recon",
            "quiterat",
            "venomrat",
            "venom rat",
            "sapphirestealer",
            "ntospy",
            "raccoon",
            "shifu",
            "mediapi",
            "poolrat",
            "cicada3301",
            "remoteexec",
            "babylockerkz",
            "new service",
            "creation id",
            "nextron"
          ],
          "references": [
            "Windows_Trojan_Tofsee.yar",
            "Suspicious New Service Creation (1).yml"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1543",
              "name": "Create or Modify System Process",
              "display_name": "T1543 - Create or Modify System Process"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 353,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 28,
            "FileHash-SHA1": 27,
            "FileHash-SHA256": 1077,
            "domain": 282,
            "hostname": 316,
            "URL": 1092,
            "YARA": 535,
            "email": 4
          },
          "indicator_count": 3361,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 124,
          "modified_text": "230 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66246ff49ed29ea9bb2bf122",
          "name": "S\u0105d Rejonowy w Jeleniej Gorze  POLAND",
          "description": "Przechowywania lub dost\u0119pu do plik\u00f3w cookies w Twojej przegl\u0105darce\nhttps://www.virustotal.com/gui/domain/jelenia-gora.sr.gov.pl/relations",
          "modified": "2025-05-14T21:18:36.989000",
          "created": "2024-04-21T01:46:28.554000",
          "tags": [
            "jeleniej grze",
            "aktualnoci",
            "informacje",
            "jednostka",
            "rejonowy",
            "konkurs",
            "najczciej",
            "sd rejonowy",
            "przejd",
            "czytaj",
            "click",
            "sdzia jarosaw",
            "wydziau",
            "sdzia grzegorz",
            "katarzyna",
            "rudnicka dane",
            "kontaktowe sd",
            "jelenia gra",
            "mickiewicza",
            "zawarto",
            "html",
            "nazwa meta",
            "robotw",
            "telefon",
            "brak",
            "skala",
            "ua zgodna",
            "head body",
            "zasb",
            "cname",
            "kod odpowiedzi",
            "kodowanie treci",
            "wygasa",
            "gmt serwer",
            "pragma",
            "kontrola pamici",
            "podrcznej",
            "data",
            "gmt kontrola",
            "dostpuzezwl na",
            "czytaj wicej",
            "sd okrgowy",
            "jednostki",
            "okrgowy",
            "ogoszenia",
            "sha256",
            "vhash",
            "ssdeep",
            "https odcisk",
            "palca jarma",
            "https dane",
            "v3 numer",
            "odcisk palca",
            "tworzy katalog",
            "tworzy pliki",
            "typ pliku",
            "json",
            "ascii",
            "windows",
            "sqlite",
            "foxpro fpt",
            "links typ",
            "mapa",
            "152 x",
            "sqlite w",
            "sha1",
            "sha512",
            "file size",
            "b file",
            "testing",
            "komornik sdowy",
            "sdzie rejonowym",
            "tomasz rodacki",
            "obwieszczenie",
            "komornicze",
            "tumacza migam",
            "tumacz czynny",
            "zamknite",
            "wiadczenia",
            "schedule",
            "error",
            "javascript",
            "bakers hall",
            "ixaction",
            "script",
            "ixchatlauncher",
            "compatibility",
            "com dla",
            "t1055 pewno",
            "unikanie obrony",
            "t1036 maskarada",
            "t1082 pewno",
            "informacje o",
            "nazwa pliku",
            "dokument pdf",
            "rozmiar pliku",
            "zapowied",
            "type",
            "iii dbt",
            "utf8",
            "dziennik"
          ],
          "references": [
            "S?d Rejonowy w Jeleniej G\u00f3rze.htm",
            "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm",
            "http://www.jelenia-gora.so.gov.pl/",
            "https://www.jelenia-gora.so.gov.pl/",
            "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze",
            "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora",
            "https://www.jelenia-gora.sr.gov.pl/spacer",
            "https://waf.intelix.pl/957476/Chat/Script/Compatibility"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "",
              "display_name": "",
              "target": null
            },
            {
              "id": "serwer",
              "display_name": "serwer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "email": 71,
            "domain": 7651,
            "hostname": 7680,
            "IPv4": 331,
            "FileHash-SHA256": 16168,
            "URL": 10399,
            "FileHash-MD5": 3639,
            "FileHash-SHA1": 3468,
            "CIDR": 4,
            "CVE": 89,
            "YARA": 521,
            "SSLCertFingerprint": 25,
            "JA3": 1,
            "IPv6": 5813
          },
          "indicator_count": 55860,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "339 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "67cb982432751ed32fd0404b",
          "name": "Svchost id: 16c37b52-b141-42a5-a3ea-bbe098444397",
          "description": "The following rules for the Windows.Trojan.Tofsee malware have been revealed by the BBC's Panorama programme and are subject to a review by BBC Newsnight and BBC Radio 5 live.",
          "modified": "2025-05-14T21:10:44.900000",
          "created": "2025-03-08T01:06:44.421000",
          "tags": [
            "vhash",
            "authentihash",
            "ssdeep",
            "rticon serbian",
            "arabic libya",
            "ico rtgroupicon",
            "serbian arabic",
            "libya",
            "windows nt",
            "detects",
            "gecko",
            "khtml",
            "msie",
            "wow64",
            "stealer",
            "win64",
            "error",
            "userprofile",
            "hunt",
            "keylogger",
            "encrypt",
            "antivm",
            "span",
            "main",
            "grabber",
            "hello",
            "android",
            "dcrat",
            "win32",
            "kill",
            "revengerat",
            "sandbox",
            "pass",
            "chat",
            "first",
            "asyncrat",
            "crypto",
            "injector",
            "dropper",
            "infostealer",
            "lockfile",
            "worldwind",
            "stealerium",
            "toxiceye",
            "avemaria",
            "fast",
            "persistence",
            "trojan",
            "restart",
            "snakekeylogger",
            "snake",
            "accept",
            "cookie",
            "code",
            "killproc",
            "lazarus",
            "dearcry",
            "njrat",
            "cyrus",
            "powershell",
            "info",
            "body",
            "floodfix",
            "downloader",
            "ransomware",
            "core",
            "loki",
            "fpspy",
            "klogexe",
            "firebird",
            "patch",
            "explorer",
            "avkiller",
            "masslogger",
            "baldr",
            "modi rat",
            "helpme",
            "osno",
            "import",
            "keylog",
            "screencapture",
            "ransom",
            "crypted",
            "silent",
            "xorddos",
            "stormkitty",
            "ordinal",
            "locker",
            "hyperbro",
            "lamepyre",
            "parallaxrat",
            "null",
            "shurk steal",
            "arkeistealer",
            "strongpity",
            "desktop",
            "myagent",
            "bypass",
            "fatduke",
            "miniduke",
            "polyglotduke",
            "guildma",
            "spyeye",
            "corebot",
            "killmbr",
            "ooops",
            "lcpdot",
            "torisma",
            "codec",
            "prometheus",
            "spook",
            "crypt",
            "logger",
            "zegost",
            "poshkeylogger",
            "systembc",
            "hdlocker",
            "cryptolocker",
            "fivehands",
            "kitty",
            "goldmax",
            "rents",
            "maurigo",
            "done",
            "hidewindow",
            "bokbot",
            "bladabindi",
            "darktrack",
            "darksky",
            "alien",
            "karkoff",
            "inject",
            "windigo",
            "rest",
            "softcnapp",
            "elysiumstealer",
            "leivion",
            "banload",
            "ultrareach",
            "ultrasurf",
            "buterat",
            "tools",
            "beasty",
            "shut",
            "gravityrat",
            "fatalrat",
            "discord",
            "deadwood",
            "turian",
            "markirat",
            "mark",
            "klingonrat",
            "path",
            "reverserat",
            "grab",
            "meta",
            "voidcrypt",
            "darkvnc",
            "ryzerlo",
            "hiddentear",
            "boxcaon",
            "stream",
            "crimsonrat",
            "delfi",
            "infinity",
            "stealthworker",
            "gasket",
            "spoolss",
            "lu0bot",
            "target",
            "attack",
            "cobaltstrike",
            "bits",
            "chaos",
            "bitcoin",
            "wiper",
            "delphi",
            "slackbot",
            "neshta",
            "belarus",
            "apanas",
            "runner",
            "darkcomet",
            "macoute",
            "iframe",
            "vanillarat",
            "sectoprat",
            "melt",
            "tomiris",
            "apostle",
            "blackbyte",
            "kutaki",
            "override",
            "windealer",
            "mkdir",
            "brbbot",
            "config",
            "babylon rat",
            "spynet",
            "bazarloader",
            "clipper",
            "banker",
            "gh0st",
            "piratestealer",
            "witch",
            "killme",
            "vulturi",
            "tofsee",
            "slow",
            "owowa",
            "flagpro",
            "write",
            "dazzlespy",
            "decryptor",
            "bandit stealer",
            "bandit",
            "darkeye",
            "recordbreaker",
            "truebot",
            "svchost",
            "clipbanker",
            "service",
            "koivm",
            "arrowrat",
            "ducktail",
            "confuser",
            "gobrat",
            "modiloader",
            "chilelocker",
            "noclose",
            "strelastealer",
            "comfoo",
            "babar",
            "blankgrabber",
            "solarmarker",
            "darkgate",
            "stub",
            "banned",
            "globeimposter",
            "rhysida",
            "janelarat",
            "kraken",
            "recon",
            "quiterat",
            "venomrat",
            "venom rat",
            "sapphirestealer",
            "ntospy",
            "raccoon",
            "shifu",
            "mediapi",
            "poolrat",
            "cicada3301",
            "remoteexec",
            "security",
            "license v2",
            "f6 d9",
            "sha256",
            "imphasz",
            "externalnet",
            "homenet",
            "unreachable",
            "imageendswith",
            "example",
            "imagestartswith",
            "files",
            "sandbox author",
            "securityuserid",
            "windows upgrade",
            "k netsvcs",
            "defender",
            "update",
            "code integrity",
            "checks id",
            "detects code",
            "thomas patzke",
            "filessophos",
            "outbound smtp",
            "connections id",
            "smtp",
            "david burkett",
            "signalblur",
            "commandline",
            "svchost parent",
            "process id",
            "roth",
            "nextron",
            "service binary",
            "system",
            "automatic",
            "manual",
            "filter fp",
            "avast software",
            "new service",
            "creation id"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1048",
              "name": "Exfiltration Over Alternative Protocol",
              "display_name": "T1048 - Exfiltration Over Alternative Protocol"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1543",
              "name": "Create or Modify System Process",
              "display_name": "T1543 - Create or Modify System Process"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 168,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 39,
            "FileHash-SHA1": 28,
            "FileHash-SHA256": 1065,
            "URL": 984,
            "YARA": 535,
            "domain": 262,
            "email": 4,
            "hostname": 316
          },
          "indicator_count": 3233,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 124,
          "modified_text": "339 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Palantir quasi government client Ab/using Palantir subdomains , Fastly is CDN",
        "Yara: SUSP_ENV_Folder_Root_File_Jan23_1 %APPDATA%\\ewiuer2.exe SCRIPT",
        "https://tulach.cc/",
        "https://www.jelenia-gora.sr.gov.pl/spacer",
        "Suspicious New Service Creation (1).yml",
        "http://www.jelenia-gora.so.gov.pl/",
        "Fastly IP Block:  151.101.0.0/16 | Organizations like Palantir may use third-party services such as Fastly's CDN",
        "https://www.turbo.net/run/videolan/vlc",
        "Overview \"Keeping money\" by the Colorado workers' compensation system can refer to",
        "S?d Rejonowy w Jeleniej G\u00f3rze.htm",
        "http://www.forensickb.com/2013/03/file-entropy-explained.html",
        "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze",
        "Denver ; ISP, Fastly, Inc. ; Organization, Fastly, Inc. ; Network, AS54113 Fastly, Inc. (VPN, CDN, DDOSM,)",
        "https://shift.gearboxsoftware.com/link",
        "counsel. The system does not \"keep\" money without a valid reason.Lies. they\u2019ve Ben in trouble before .",
        "Win.Trojan.Vundo-7170412-0\t#Lowfi:SuspiciousSectionName",
        "Windows_Trojan_Tofsee.yar",
        "legal deductions, legitimate reasons for payment delays or denial, or potential issues that require legal",
        "https://unicef.se/assets/apple",
        "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora",
        "https://www.jelenia-gora.so.gov.pl/",
        "https://waf.intelix.pl/957476/Chat/Script/Compatibility",
        "IP Region, Quebec. City ; Net Range, 151.101.0.0 - 151.101.255.255. CIDR ; Full Name, Fastly, Inc.",
        "x402.porn \u2022 http://alohatube.xyz/search/tsara-brashears \u2022 \thttps://ufovpn.io/blog/is-eporner-safe",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  \u2022 alohatube.xyz \u2022 1001pornvideos.com",
        "Fastly Error and Palantir blocked several times over the last few months.",
        "Link below used to defraud Tsara to think she\u2019d violated Patriot Act warranting NSA , Palinter espionage",
        "https://www.xlabs.com.br/blog/cve-2013-3304-dell-equallogic-directory-traversal/ \u2022 http://cve.phidias.com/",
        "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Colorado Quasi Government | Workerk Compensation"
          ],
          "malware_families": [
            "",
            "Win.trojan.generic-9878032-0",
            "Trojan:win32/zombie",
            "Win.ransomware.msilzilla-10014498-0",
            "Serwer",
            "Win.trojan.starter-171",
            "Win.malware.urelas-9863836-0",
            "Ransom:win32/cve-2017-0147",
            "Dorv",
            "Exploit:linux/cve-2017-17215",
            "Worm:win32/mofksys.rnd!mtb",
            "Win.exploit.rozena-10038302-0",
            "Trojan:win32/zombie.a",
            "Win.trojan.vundo-7170412-0",
            "Backdoor:win32/berbew.aa!mtb",
            "Zombie",
            "Pws:win32/zbot.ms!mtb",
            "Nemucod",
            "Trojanspy",
            "Gravityrat",
            "Trojandropper:win32/vb.il",
            "Win.malware.pits-10035540-0",
            "Trojan:win32/neconyd.a",
            "Cve-2022-26134",
            "Win.trojan.barys-10005825-0",
            "#lowfi:suspicioussectionname",
            "Alf:heraklezeval:trojan:msil/gravityrat!rfn",
            "Muldrop",
            "Multiple malware\u2019s , trojans and rats",
            "Berbew",
            "Cve-2023-4966",
            "Trojan:msil/agenttesla.dw!mtb",
            "Pws:win32/qqpass.fc",
            "Upatre"
          ],
          "industries": [],
          "unique_indicators": 73126
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/msoftupdates.com",
    "whois": "http://whois.domaintools.com/msoftupdates.com",
    "domain": "msoftupdates.com",
    "hostname": "cone.msoftupdates.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "69a3c685d4b7c139ffe62930",
      "name": "Clone Pulse Reference",
      "description": "",
      "modified": "2026-04-01T00:44:45.494000",
      "created": "2026-03-01T04:54:29.384000",
      "tags": [
        "ipv4",
        "active related",
        "trojandropper",
        "mtb jun",
        "lowfi",
        "trojan",
        "mtb jan",
        "fastly error",
        "please",
        "united",
        "ttl value",
        "get na",
        "total",
        "delete",
        "search",
        "yara detections",
        "sinkhole cookie",
        "value snkz",
        "write",
        "suspicious",
        "ransom",
        "malware",
        "Ransom.Win32.Birele.gsg Checkin",
        "AnubisNetworks Sinkhole Cookie Value Snkz",
        "Possible Compromised Host",
        "dynamicloader",
        "delete c",
        "default",
        "medium",
        "write c",
        "settingswpad",
        "intel",
        "ms windows",
        "users",
        "number",
        "title",
        "installer",
        "top source",
        "top destination",
        "source source",
        "port",
        "filehash",
        "av detections",
        "ids detections",
        "yara rule",
        "gravityrat",
        "detectvm",
        "x00 x00",
        "x00x00",
        "doviacmd",
        "rootjob",
        "getfiles",
        "updateserver",
        "ethernetid",
        "ids signatures",
        "exploits",
        "sid name",
        "malware cve",
        "dns query",
        "dnsbin demo",
        "data exfil",
        "exif data",
        "DNS Query for Webhook/HTTP Request Inspection Service (x .pipedr",
        "DNSBin Demo (requestbin .net) - Data Exfitration",
        "source port",
        "destination",
        "present sep",
        "script urls",
        "script script",
        "a domains",
        "script domains",
        "ip address",
        "meta",
        "present nov",
        "passive dns",
        "next associated",
        "domain add",
        "pe executable",
        "entries",
        "show",
        "msie",
        "windows nt",
        "wow64",
        "copy",
        "present jan",
        "present feb",
        "domain",
        "pulse pulses",
        "urls",
        "files",
        "tam legal",
        "christopher ahmann",
        "https://unicef.se/assets/apple",
        "treece alfrey",
        "hours ago",
        "information",
        "report spam",
        "ahmann colorado",
        "state",
        "special cousel",
        "created",
        "expiro",
        "capture"
      ],
      "references": [
        "Fastly IP Block:  151.101.0.0/16 | Organizations like Palantir may use third-party services such as Fastly's CDN",
        "Fastly Error and Palantir blocked several times over the last few months.",
        "Denver ; ISP, Fastly, Inc. ; Organization, Fastly, Inc. ; Network, AS54113 Fastly, Inc. (VPN, CDN, DDOSM,)",
        "IP Region, Quebec. City ; Net Range, 151.101.0.0 - 151.101.255.255. CIDR ; Full Name, Fastly, Inc.",
        "Palantir quasi government client Ab/using Palantir subdomains , Fastly is CDN",
        "Yara: SUSP_ENV_Folder_Root_File_Jan23_1 %APPDATA%\\ewiuer2.exe SCRIPT",
        "Win.Trojan.Vundo-7170412-0\t#Lowfi:SuspiciousSectionName",
        "Link below used to defraud Tsara to think she\u2019d violated Patriot Act warranting NSA , Palinter espionage",
        "https://unicef.se/assets/apple"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/Neconyd.A",
          "display_name": "Trojan:Win32/Neconyd.A",
          "target": "/malware/Trojan:Win32/Neconyd.A"
        },
        {
          "id": "PWS:Win32/QQpass.FC",
          "display_name": "PWS:Win32/QQpass.FC",
          "target": "/malware/PWS:Win32/QQpass.FC"
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Malware.Urelas-9863836-0",
          "display_name": "Win.Malware.Urelas-9863836-0",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "target": null
        },
        {
          "id": "Win.Trojan.Vundo-7170412-0",
          "display_name": "Win.Trojan.Vundo-7170412-0",
          "target": null
        },
        {
          "id": "#Lowfi:SuspiciousSectionName",
          "display_name": "#Lowfi:SuspiciousSectionName",
          "target": null
        },
        {
          "id": "Multiple Malware\u2019s , Trojans and Rats",
          "display_name": "Multiple Malware\u2019s , Trojans and Rats",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6906bd99cadbd4140014c6af",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 909,
        "domain": 454,
        "hostname": 1404,
        "URL": 3557,
        "CIDR": 1,
        "FileHash-MD5": 242,
        "FileHash-SHA1": 185,
        "email": 1,
        "CVE": 1
      },
      "indicator_count": 6754,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 48,
      "modified_text": "18 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "690a2c38de1708af54217faa",
      "name": "Access Token used to steal security credentials & hack and ride DND of targeted individuals",
      "description": "- https://shift.gearboxsoftware.com/link\n- Found embedded in targets phone.\n\nAccess Token used to steal security credentials & hack and ride DND of targeted individuals device. \nTAM Legal \u2022  Tulach \u2022 Hall Render \u2022 Quasi Government | Some type of Foundry user account found. \n\nStop illegally \n  stalking, harassment, attempts, hacking, death threats. . Because the Colorado government allowing entities like this to operate without any type of rules, oversight or boundaries \nMILLION$ were wasted in your own fraud, waste in abuse scheme. AT&T , CrowdStrike , United Healthcare , UC Healthcare, Intermountain Health, T-Mobile, Amazon East, the Colorado Government itself, Medicare and Medicaid. For what? You have zero talent so you take it from those who do. You have nothing coming to you so you steal it from those who do. Is this somehow legal? \n#contacted #all_hosts backdoor #ransomware  #cve #usa #american_terrorists #workers_compenstation_abuse #silencing #targeting #hitmen #illegal #malvertizing #aws_dns",
      "modified": "2025-12-04T15:01:02.531000",
      "created": "2025-11-04T16:39:20.035000",
      "tags": [
        "present aug",
        "moved",
        "encrypt",
        "present jul",
        "passive dns",
        "ipv4 add",
        "reverse dns",
        "united states",
        "present may",
        "ip address",
        "gmt content",
        "ipv4",
        "all ipv4",
        "america",
        "united",
        "present oct",
        "name servers",
        "redacted for",
        "emails",
        "for privacy",
        "unknown ns",
        "unknown aaaa",
        "dynamicloader",
        "focus region",
        "unicode text",
        "utf16",
        "ms windows",
        "bokeh onlycanon",
        "zeiss jena",
        "mcsonnar",
        "high",
        "win64",
        "stream",
        "write",
        "smartassembly",
        "trailer",
        "next",
        "search",
        "medium",
        "as15169",
        "write c",
        "reads",
        "team",
        "malware",
        "local",
        "yara detections",
        "delphi",
        "strings",
        "dcom",
        "form",
        "trojandropper",
        "mtb nov",
        "backdoor",
        "otx telemetry",
        "trojan",
        "type",
        "data upload",
        "extraction",
        "ol rop",
        "hash avast",
        "avg clamav",
        "msdefender nov",
        "win32upatre nov",
        "win32berbew nov",
        "dynamic",
        "pe section",
        "error",
        "close",
        "status",
        "urls",
        "expiration date",
        "hostname",
        "url analysis",
        "yara rule",
        "show",
        "binary file",
        "wine emulator",
        "mtb oct",
        "files",
        "denmark asn",
        "as32934",
        "candyopen",
        "possible",
        "smoke loader",
        "trojanspy",
        "filehash",
        "pulses otx",
        "related tags",
        "file type",
        "no analysis",
        "available",
        "api key",
        "screenshots",
        "present nov",
        "aaaa",
        "mtb may",
        "mexico",
        "hostname add",
        "registrar",
        "domain add",
        "location united",
        "email add",
        "none related",
        "domains",
        "email domain",
        "service",
        "domain",
        "america flag",
        "body",
        "title",
        "aws dns",
        "next associated",
        "risepro",
        "guard",
        "v full",
        "reports v",
        "t1059 shared",
        "modules",
        "t1129 system",
        "t1569",
        "help v",
        "t1179 boot",
        "logon autost",
        "encoding",
        "packing f0001",
        "hidden files",
        "e1203 windows",
        "file attributes",
        "registry value",
        "catalog tree",
        "analysis ob0001",
        "evasion b0003",
        "virtual machine",
        "ip traffic",
        "memory pattern",
        "pattern urls",
        "tls sni",
        "get https",
        "post https",
        "named pipe",
        "delete c",
        "radar",
        "defender",
        "format",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "mitre att",
        "ck techniques",
        "evasion att",
        "country",
        "contacted hosts",
        "process details",
        "flag",
        "globalc",
        "intel",
        "win32",
        "worm",
        "path",
        "explorer",
        "script",
        "href",
        "external",
        "html content",
        "tulach",
        "hallrender",
        "tam legal",
        "brian sabey",
        "christopher ahmann",
        "apple",
        "msie",
        "chrome",
        "ascio",
        "creation date",
        "date",
        "germany unknown",
        "germany asn",
        "files ip",
        "address",
        "asn as24940",
        "less",
        "script urls",
        "a domains",
        "prox",
        "dennis schrder",
        "meta",
        "apache",
        "99u25f.exe",
        "entries",
        "as24940 hetzner",
        "dns resolutions",
        "status code",
        "body length",
        "kb body",
        "software/ hardware",
        "external-resources",
        "password-input",
        "overview",
        "colorado"
      ],
      "references": [
        "https://shift.gearboxsoftware.com/link",
        "https://tulach.cc/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  \u2022 alohatube.xyz \u2022 1001pornvideos.com",
        "x402.porn \u2022 http://alohatube.xyz/search/tsara-brashears \u2022 \thttps://ufovpn.io/blog/is-eporner-safe",
        "https://www.turbo.net/run/videolan/vlc",
        "http://www.forensickb.com/2013/03/file-entropy-explained.html",
        "https://www.xlabs.com.br/blog/cve-2013-3304-dell-equallogic-directory-traversal/ \u2022 http://cve.phidias.com/",
        "Overview \"Keeping money\" by the Colorado workers' compensation system can refer to",
        "legal deductions, legitimate reasons for payment delays or denial, or potential issues that require legal",
        "counsel. The system does not \"keep\" money without a valid reason.Lies. they\u2019ve Ben in trouble before ."
      ],
      "public": 1,
      "adversary": "Colorado Quasi Government | Workerk Compensation",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.Generic-9878032-0",
          "display_name": "Win.Trojan.Generic-9878032-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Starter-171",
          "display_name": "Win.Trojan.Starter-171",
          "target": null
        },
        {
          "id": "GravityRAT",
          "display_name": "GravityRAT",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Berbew.AA!MTB",
          "display_name": "Backdoor:Win32/Berbew.AA!MTB",
          "target": "/malware/Backdoor:Win32/Berbew.AA!MTB"
        },
        {
          "id": "Trojan:MSIL/AgentTesla.DW!MTB",
          "display_name": "Trojan:MSIL/AgentTesla.DW!MTB",
          "target": "/malware/Trojan:MSIL/AgentTesla.DW!MTB"
        },
        {
          "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "target": null
        },
        {
          "id": "Trojandropper:Win32/VB.IL",
          "display_name": "Trojandropper:Win32/VB.IL",
          "target": "/malware/Trojandropper:Win32/VB.IL"
        },
        {
          "id": "Nemucod",
          "display_name": "Nemucod",
          "target": null
        },
        {
          "id": "Berbew",
          "display_name": "Berbew",
          "target": null
        },
        {
          "id": "PWS:Win32/Zbot.MS!MTB",
          "display_name": "PWS:Win32/Zbot.MS!MTB",
          "target": "/malware/PWS:Win32/Zbot.MS!MTB"
        },
        {
          "id": "Win.Trojan.Barys-10005825-0",
          "display_name": "Win.Trojan.Barys-10005825-0",
          "target": null
        },
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Win.Exploit.Rozena-10038302-0",
          "display_name": "Win.Exploit.Rozena-10038302-0",
          "target": null
        },
        {
          "id": "Zombie",
          "display_name": "Zombie",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie",
          "display_name": "Trojan:Win32/Zombie",
          "target": "/malware/Trojan:Win32/Zombie"
        },
        {
          "id": "Muldrop",
          "display_name": "Muldrop",
          "target": null
        },
        {
          "id": "Worm:Win32/Mofksys.RND!MTB",
          "display_name": "Worm:Win32/Mofksys.RND!MTB",
          "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
        },
        {
          "id": "Dorv",
          "display_name": "Dorv",
          "target": null
        },
        {
          "id": "Win.Malware.Pits-10035540-0",
          "display_name": "Win.Malware.Pits-10035540-0",
          "target": null
        },
        {
          "id": "Win.Ransomware.Msilzilla-10014498-0",
          "display_name": "Win.Ransomware.Msilzilla-10014498-0",
          "target": null
        },
        {
          "id": "CVE-2023-4966",
          "display_name": "CVE-2023-4966",
          "target": null
        },
        {
          "id": "Exploit:Linux/CVE-2017-17215",
          "display_name": "Exploit:Linux/CVE-2017-17215",
          "target": "/malware/Exploit:Linux/CVE-2017-17215"
        },
        {
          "id": "Ransom:Win32/CVE-2017-0147",
          "display_name": "Ransom:Win32/CVE-2017-0147",
          "target": "/malware/Ransom:Win32/CVE-2017-0147"
        },
        {
          "id": "CVE-2022-26134",
          "display_name": "CVE-2022-26134",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1569",
          "name": "System Services",
          "display_name": "T1569 - System Services"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6051,
        "hostname": 2627,
        "FileHash-MD5": 401,
        "FileHash-SHA1": 257,
        "email": 11,
        "domain": 1838,
        "FileHash-SHA256": 1742,
        "CVE": 4,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 12934,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "135 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6906bd99cadbd4140014c6af",
      "name": "Espionage - Gravity RAT + | Legal entities are State owned.  Attacking severely injured  PT\u2019s SA victim.",
      "description": "Fastly CDN for Palantir (Verizon) unless updated.  Very malicious IoC\u2019s found evaluating IoC\u2019 from Christopher Ahmann - TAM Legal link.\n- Made contact with victim several times.\n- Illegal contact made with attorneys considering representing Tsara. \n- https://unicef.se/assets/apple - link related to defraud Tsara to think she\u2019d violated Patriot Act warranting NSA , Palinter espionage.\n\nAhmann is named as special counsel but he , like Brian Sabey are \u2018ONLY\u2019  cyber attacking Tsara Brashears.\n\n- protecting Jeffrey Reimer DPT, multiple doctors, Concentra,  blocked and denied care , hired a hitman/men and it would have. Even cheaper to pay her for the injuries she never sought compensation for due to aggressive attacks and threats.",
      "modified": "2025-12-02T01:05:30.331000",
      "created": "2025-11-02T02:10:33.546000",
      "tags": [
        "ipv4",
        "active related",
        "trojandropper",
        "mtb jun",
        "lowfi",
        "trojan",
        "mtb jan",
        "fastly error",
        "please",
        "united",
        "ttl value",
        "get na",
        "total",
        "delete",
        "search",
        "yara detections",
        "sinkhole cookie",
        "value snkz",
        "write",
        "suspicious",
        "ransom",
        "malware",
        "Ransom.Win32.Birele.gsg Checkin",
        "AnubisNetworks Sinkhole Cookie Value Snkz",
        "Possible Compromised Host",
        "dynamicloader",
        "delete c",
        "default",
        "medium",
        "write c",
        "settingswpad",
        "intel",
        "ms windows",
        "users",
        "number",
        "title",
        "installer",
        "top source",
        "top destination",
        "source source",
        "port",
        "filehash",
        "av detections",
        "ids detections",
        "yara rule",
        "gravityrat",
        "detectvm",
        "x00 x00",
        "x00x00",
        "doviacmd",
        "rootjob",
        "getfiles",
        "updateserver",
        "ethernetid",
        "ids signatures",
        "exploits",
        "sid name",
        "malware cve",
        "dns query",
        "dnsbin demo",
        "data exfil",
        "exif data",
        "DNS Query for Webhook/HTTP Request Inspection Service (x .pipedr",
        "DNSBin Demo (requestbin .net) - Data Exfitration",
        "source port",
        "destination",
        "present sep",
        "script urls",
        "script script",
        "a domains",
        "script domains",
        "ip address",
        "meta",
        "present nov",
        "passive dns",
        "next associated",
        "domain add",
        "pe executable",
        "entries",
        "show",
        "msie",
        "windows nt",
        "wow64",
        "copy",
        "present jan",
        "present feb",
        "domain",
        "pulse pulses",
        "urls",
        "files",
        "tam legal",
        "christopher ahmann",
        "https://unicef.se/assets/apple",
        "treece alfrey",
        "hours ago",
        "information",
        "report spam",
        "ahmann colorado",
        "state",
        "special cousel",
        "created",
        "expiro",
        "capture"
      ],
      "references": [
        "Fastly IP Block:  151.101.0.0/16 | Organizations like Palantir may use third-party services such as Fastly's CDN",
        "Fastly Error and Palantir blocked several times over the last few months.",
        "Denver ; ISP, Fastly, Inc. ; Organization, Fastly, Inc. ; Network, AS54113 Fastly, Inc. (VPN, CDN, DDOSM,)",
        "IP Region, Quebec. City ; Net Range, 151.101.0.0 - 151.101.255.255. CIDR ; Full Name, Fastly, Inc.",
        "Palantir quasi government client Ab/using Palantir subdomains , Fastly is CDN",
        "Yara: SUSP_ENV_Folder_Root_File_Jan23_1 %APPDATA%\\ewiuer2.exe SCRIPT",
        "Win.Trojan.Vundo-7170412-0\t#Lowfi:SuspiciousSectionName",
        "Link below used to defraud Tsara to think she\u2019d violated Patriot Act warranting NSA , Palinter espionage",
        "https://unicef.se/assets/apple"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/Neconyd.A",
          "display_name": "Trojan:Win32/Neconyd.A",
          "target": "/malware/Trojan:Win32/Neconyd.A"
        },
        {
          "id": "PWS:Win32/QQpass.FC",
          "display_name": "PWS:Win32/QQpass.FC",
          "target": "/malware/PWS:Win32/QQpass.FC"
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Malware.Urelas-9863836-0",
          "display_name": "Win.Malware.Urelas-9863836-0",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "target": null
        },
        {
          "id": "Win.Trojan.Vundo-7170412-0",
          "display_name": "Win.Trojan.Vundo-7170412-0",
          "target": null
        },
        {
          "id": "#Lowfi:SuspiciousSectionName",
          "display_name": "#Lowfi:SuspiciousSectionName",
          "target": null
        },
        {
          "id": "Multiple Malware\u2019s , Trojans and Rats",
          "display_name": "Multiple Malware\u2019s , Trojans and Rats",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 909,
        "domain": 449,
        "hostname": 1403,
        "URL": 3552,
        "CIDR": 1,
        "FileHash-MD5": 242,
        "FileHash-SHA1": 185,
        "email": 1
      },
      "indicator_count": 6742,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "138 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "688f1ce317fc8b3f9d5d5f33",
      "name": "Unknown  - Established hacker group. Affects banking, financial  and much more.",
      "description": "Crowdsourced. Identifies as a Dark Web gang stalking entity. Research suggests that this is a very organized, possibly quasi governmental entity with shadowy state figures that social engineer targets. Even though they have been considered scammers and they are grifters, they are very established, dangerous and a very large force with claims of military alignments which has not yet been fully confirmed.\n\nThis group is anything you want them to be, attorney, accountant, technician, nurse, uber driver.",
      "modified": "2025-09-02T08:02:34.108000",
      "created": "2025-08-03T08:25:07.135000",
      "tags": [
        "united",
        "search",
        "entries",
        "unknown ns",
        "ip address",
        "creation date",
        "record value",
        "date",
        "showing",
        "moved",
        "body",
        "encrypt",
        "lowfi",
        "trojanspy",
        "checkin",
        "passive dns",
        "trojan",
        "next associated",
        "cryp",
        "win32",
        "phishing",
        "virtool",
        "hstr",
        "backdoor",
        "ipv4",
        "pulse pulses",
        "associated urls",
        "show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results feb",
        "header http2",
        "accept encoding",
        "gmt related",
        "domains show",
        "domain related",
        "response ip",
        "address google",
        "safe browsing",
        "entries http",
        "scans show",
        "title",
        "link",
        "present mar",
        "meta",
        "starfield",
        "dynamicloader",
        "qaeaav12",
        "medium",
        "high",
        "malware",
        "windows wget",
        "qbeipbdii",
        "write",
        "suspicious",
        "copy",
        "yara rule",
        "gravityrat",
        "detectvm",
        "x00 x00",
        "x00x00",
        "doviacmd",
        "rootjob",
        "getfiles",
        "updateserver",
        "ethernetid",
        "unknown",
        "yara detections",
        "filehash",
        "sha256 add",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "oinetsim",
        "oudevelopment",
        "write c",
        "demo",
        "mtb sep",
        "trojandropper",
        "cookie",
        "path max",
        "age86400 set",
        "win32qqpass sep",
        "results aug",
        "script urls",
        "script domains",
        "a domains",
        "cache control",
        "cache status",
        "fury",
        "zenedge",
        "present jun",
        "present dec",
        "present jan",
        "present nov",
        "for privacy",
        "present may",
        "name servers",
        "no expiration",
        "filehashmd5",
        "filehashsha256",
        "filehashsha1",
        "iocs",
        "extract",
        "enter source",
        "url or",
        "text drag",
        "drop or",
        "domain",
        "expiration",
        "url http",
        "hostname",
        "email abuse"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 459,
        "FileHash-MD5": 553,
        "FileHash-SHA256": 1042,
        "URL": 1426,
        "hostname": 476,
        "domain": 521,
        "email": 3,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 4481,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "229 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "67f6c635cb8c3c8b256b6dba",
      "name": "sdfzsdf.ele   fac1ec40eea5a4fc05f17e019328e287",
      "description": "SHA1- 33008f85428a83996083c3da92a8f00595071403\nSHA256\ncdab1c3196887d4f749d82f014786a966c87f35a7189f0f3d078558b957847bf\nhttps://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=7b6726e20c513baebf7fd387a3dd1b7d67a4c7c4\nhttps://ti.qianxin.com/v2/search?type=file&value=fac1ec40eea5a4fc05f17e019328e287\nhttps://www.virustotal.com/gui/file/cdab1c3196887d4f749d82f014786a966c87f35a7189f0f3d078558b957847bf/relations",
      "modified": "2025-09-01T08:05:17.675000",
      "created": "2025-04-09T19:10:45.337000",
      "tags": [
        "sha1",
        "rozmiar",
        "typ pliku",
        "win32",
        "numer wersji",
        "wersja",
        "nieznany",
        "sha512",
        "crc32",
        "ssd gboki",
        "win64",
        "security",
        "license v2",
        "f6 d9",
        "windows nt",
        "detects",
        "gecko",
        "khtml",
        "msie",
        "wow64",
        "stealer",
        "error",
        "userprofile",
        "hunt",
        "keylogger",
        "encrypt",
        "antivm",
        "span",
        "main",
        "grabber",
        "hello",
        "android",
        "dcrat",
        "kill",
        "revengerat",
        "sandbox",
        "pass",
        "chat",
        "first",
        "asyncrat",
        "crypto",
        "injector",
        "dropper",
        "infostealer",
        "lockfile",
        "worldwind",
        "stealerium",
        "toxiceye",
        "avemaria",
        "fast",
        "persistence",
        "trojan",
        "restart",
        "snakekeylogger",
        "snake",
        "accept",
        "cookie",
        "code",
        "killproc",
        "lazarus",
        "dearcry",
        "njrat",
        "cyrus",
        "powershell",
        "info",
        "body",
        "floodfix",
        "downloader",
        "ransomware",
        "core",
        "loki",
        "fpspy",
        "klogexe",
        "firebird",
        "patch",
        "explorer",
        "avkiller",
        "masslogger",
        "baldr",
        "modi rat",
        "helpme",
        "osno",
        "import",
        "keylog",
        "screencapture",
        "ransom",
        "crypted",
        "silent",
        "xorddos",
        "stormkitty",
        "ordinal",
        "locker",
        "hyperbro",
        "lamepyre",
        "parallaxrat",
        "null",
        "shurk steal",
        "arkeistealer",
        "strongpity",
        "desktop",
        "myagent",
        "bypass",
        "fatduke",
        "miniduke",
        "polyglotduke",
        "guildma",
        "spyeye",
        "corebot",
        "killmbr",
        "ooops",
        "lcpdot",
        "torisma",
        "codec",
        "prometheus",
        "spook",
        "crypt",
        "logger",
        "zegost",
        "poshkeylogger",
        "systembc",
        "hdlocker",
        "cryptolocker",
        "fivehands",
        "kitty",
        "goldmax",
        "rents",
        "maurigo",
        "done",
        "hidewindow",
        "bokbot",
        "bladabindi",
        "darktrack",
        "darksky",
        "alien",
        "karkoff",
        "inject",
        "windigo",
        "rest",
        "softcnapp",
        "elysiumstealer",
        "leivion",
        "banload",
        "ultrareach",
        "ultrasurf",
        "buterat",
        "tools",
        "beasty",
        "shut",
        "gravityrat",
        "fatalrat",
        "discord",
        "deadwood",
        "turian",
        "markirat",
        "mark",
        "klingonrat",
        "path",
        "reverserat",
        "grab",
        "meta",
        "voidcrypt",
        "darkvnc",
        "ryzerlo",
        "hiddentear",
        "boxcaon",
        "stream",
        "crimsonrat",
        "delfi",
        "infinity",
        "stealthworker",
        "gasket",
        "spoolss",
        "lu0bot",
        "target",
        "attack",
        "cobaltstrike",
        "bits",
        "chaos",
        "bitcoin",
        "wiper",
        "delphi",
        "slackbot",
        "neshta",
        "belarus",
        "apanas",
        "runner",
        "darkcomet",
        "macoute",
        "iframe",
        "vanillarat",
        "sectoprat",
        "melt",
        "tomiris",
        "apostle",
        "blackbyte",
        "kutaki",
        "override",
        "windealer",
        "mkdir",
        "brbbot",
        "config",
        "babylon rat",
        "spynet",
        "bazarloader",
        "clipper",
        "banker",
        "gh0st",
        "piratestealer",
        "witch",
        "killme",
        "vulturi",
        "tofsee",
        "slow",
        "owowa",
        "flagpro",
        "write",
        "dazzlespy",
        "decryptor",
        "bandit stealer",
        "bandit",
        "darkeye",
        "recordbreaker",
        "truebot",
        "svchost",
        "clipbanker",
        "service",
        "koivm",
        "arrowrat",
        "ducktail",
        "confuser",
        "gobrat",
        "modiloader",
        "chilelocker",
        "noclose",
        "strelastealer",
        "comfoo",
        "babar",
        "blankgrabber",
        "solarmarker",
        "darkgate",
        "stub",
        "banned",
        "globeimposter",
        "rhysida",
        "janelarat",
        "kraken",
        "recon",
        "quiterat",
        "venomrat",
        "venom rat",
        "sapphirestealer",
        "ntospy",
        "raccoon",
        "shifu",
        "mediapi",
        "poolrat",
        "cicada3301",
        "remoteexec",
        "babylockerkz",
        "new service",
        "creation id",
        "nextron"
      ],
      "references": [
        "Windows_Trojan_Tofsee.yar",
        "Suspicious New Service Creation (1).yml"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1543",
          "name": "Create or Modify System Process",
          "display_name": "T1543 - Create or Modify System Process"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 353,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 28,
        "FileHash-SHA1": 27,
        "FileHash-SHA256": 1077,
        "domain": 282,
        "hostname": 316,
        "URL": 1092,
        "YARA": 535,
        "email": 4
      },
      "indicator_count": 3361,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 124,
      "modified_text": "230 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66246ff49ed29ea9bb2bf122",
      "name": "S\u0105d Rejonowy w Jeleniej Gorze  POLAND",
      "description": "Przechowywania lub dost\u0119pu do plik\u00f3w cookies w Twojej przegl\u0105darce\nhttps://www.virustotal.com/gui/domain/jelenia-gora.sr.gov.pl/relations",
      "modified": "2025-05-14T21:18:36.989000",
      "created": "2024-04-21T01:46:28.554000",
      "tags": [
        "jeleniej grze",
        "aktualnoci",
        "informacje",
        "jednostka",
        "rejonowy",
        "konkurs",
        "najczciej",
        "sd rejonowy",
        "przejd",
        "czytaj",
        "click",
        "sdzia jarosaw",
        "wydziau",
        "sdzia grzegorz",
        "katarzyna",
        "rudnicka dane",
        "kontaktowe sd",
        "jelenia gra",
        "mickiewicza",
        "zawarto",
        "html",
        "nazwa meta",
        "robotw",
        "telefon",
        "brak",
        "skala",
        "ua zgodna",
        "head body",
        "zasb",
        "cname",
        "kod odpowiedzi",
        "kodowanie treci",
        "wygasa",
        "gmt serwer",
        "pragma",
        "kontrola pamici",
        "podrcznej",
        "data",
        "gmt kontrola",
        "dostpuzezwl na",
        "czytaj wicej",
        "sd okrgowy",
        "jednostki",
        "okrgowy",
        "ogoszenia",
        "sha256",
        "vhash",
        "ssdeep",
        "https odcisk",
        "palca jarma",
        "https dane",
        "v3 numer",
        "odcisk palca",
        "tworzy katalog",
        "tworzy pliki",
        "typ pliku",
        "json",
        "ascii",
        "windows",
        "sqlite",
        "foxpro fpt",
        "links typ",
        "mapa",
        "152 x",
        "sqlite w",
        "sha1",
        "sha512",
        "file size",
        "b file",
        "testing",
        "komornik sdowy",
        "sdzie rejonowym",
        "tomasz rodacki",
        "obwieszczenie",
        "komornicze",
        "tumacza migam",
        "tumacz czynny",
        "zamknite",
        "wiadczenia",
        "schedule",
        "error",
        "javascript",
        "bakers hall",
        "ixaction",
        "script",
        "ixchatlauncher",
        "compatibility",
        "com dla",
        "t1055 pewno",
        "unikanie obrony",
        "t1036 maskarada",
        "t1082 pewno",
        "informacje o",
        "nazwa pliku",
        "dokument pdf",
        "rozmiar pliku",
        "zapowied",
        "type",
        "iii dbt",
        "utf8",
        "dziennik"
      ],
      "references": [
        "S?d Rejonowy w Jeleniej G\u00f3rze.htm",
        "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm",
        "http://www.jelenia-gora.so.gov.pl/",
        "https://www.jelenia-gora.so.gov.pl/",
        "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze",
        "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora",
        "https://www.jelenia-gora.sr.gov.pl/spacer",
        "https://waf.intelix.pl/957476/Chat/Script/Compatibility"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "",
          "display_name": "",
          "target": null
        },
        {
          "id": "serwer",
          "display_name": "serwer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "email": 71,
        "domain": 7651,
        "hostname": 7680,
        "IPv4": 331,
        "FileHash-SHA256": 16168,
        "URL": 10399,
        "FileHash-MD5": 3639,
        "FileHash-SHA1": 3468,
        "CIDR": 4,
        "CVE": 89,
        "YARA": 521,
        "SSLCertFingerprint": 25,
        "JA3": 1,
        "IPv6": 5813
      },
      "indicator_count": 55860,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "339 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "67cb982432751ed32fd0404b",
      "name": "Svchost id: 16c37b52-b141-42a5-a3ea-bbe098444397",
      "description": "The following rules for the Windows.Trojan.Tofsee malware have been revealed by the BBC's Panorama programme and are subject to a review by BBC Newsnight and BBC Radio 5 live.",
      "modified": "2025-05-14T21:10:44.900000",
      "created": "2025-03-08T01:06:44.421000",
      "tags": [
        "vhash",
        "authentihash",
        "ssdeep",
        "rticon serbian",
        "arabic libya",
        "ico rtgroupicon",
        "serbian arabic",
        "libya",
        "windows nt",
        "detects",
        "gecko",
        "khtml",
        "msie",
        "wow64",
        "stealer",
        "win64",
        "error",
        "userprofile",
        "hunt",
        "keylogger",
        "encrypt",
        "antivm",
        "span",
        "main",
        "grabber",
        "hello",
        "android",
        "dcrat",
        "win32",
        "kill",
        "revengerat",
        "sandbox",
        "pass",
        "chat",
        "first",
        "asyncrat",
        "crypto",
        "injector",
        "dropper",
        "infostealer",
        "lockfile",
        "worldwind",
        "stealerium",
        "toxiceye",
        "avemaria",
        "fast",
        "persistence",
        "trojan",
        "restart",
        "snakekeylogger",
        "snake",
        "accept",
        "cookie",
        "code",
        "killproc",
        "lazarus",
        "dearcry",
        "njrat",
        "cyrus",
        "powershell",
        "info",
        "body",
        "floodfix",
        "downloader",
        "ransomware",
        "core",
        "loki",
        "fpspy",
        "klogexe",
        "firebird",
        "patch",
        "explorer",
        "avkiller",
        "masslogger",
        "baldr",
        "modi rat",
        "helpme",
        "osno",
        "import",
        "keylog",
        "screencapture",
        "ransom",
        "crypted",
        "silent",
        "xorddos",
        "stormkitty",
        "ordinal",
        "locker",
        "hyperbro",
        "lamepyre",
        "parallaxrat",
        "null",
        "shurk steal",
        "arkeistealer",
        "strongpity",
        "desktop",
        "myagent",
        "bypass",
        "fatduke",
        "miniduke",
        "polyglotduke",
        "guildma",
        "spyeye",
        "corebot",
        "killmbr",
        "ooops",
        "lcpdot",
        "torisma",
        "codec",
        "prometheus",
        "spook",
        "crypt",
        "logger",
        "zegost",
        "poshkeylogger",
        "systembc",
        "hdlocker",
        "cryptolocker",
        "fivehands",
        "kitty",
        "goldmax",
        "rents",
        "maurigo",
        "done",
        "hidewindow",
        "bokbot",
        "bladabindi",
        "darktrack",
        "darksky",
        "alien",
        "karkoff",
        "inject",
        "windigo",
        "rest",
        "softcnapp",
        "elysiumstealer",
        "leivion",
        "banload",
        "ultrareach",
        "ultrasurf",
        "buterat",
        "tools",
        "beasty",
        "shut",
        "gravityrat",
        "fatalrat",
        "discord",
        "deadwood",
        "turian",
        "markirat",
        "mark",
        "klingonrat",
        "path",
        "reverserat",
        "grab",
        "meta",
        "voidcrypt",
        "darkvnc",
        "ryzerlo",
        "hiddentear",
        "boxcaon",
        "stream",
        "crimsonrat",
        "delfi",
        "infinity",
        "stealthworker",
        "gasket",
        "spoolss",
        "lu0bot",
        "target",
        "attack",
        "cobaltstrike",
        "bits",
        "chaos",
        "bitcoin",
        "wiper",
        "delphi",
        "slackbot",
        "neshta",
        "belarus",
        "apanas",
        "runner",
        "darkcomet",
        "macoute",
        "iframe",
        "vanillarat",
        "sectoprat",
        "melt",
        "tomiris",
        "apostle",
        "blackbyte",
        "kutaki",
        "override",
        "windealer",
        "mkdir",
        "brbbot",
        "config",
        "babylon rat",
        "spynet",
        "bazarloader",
        "clipper",
        "banker",
        "gh0st",
        "piratestealer",
        "witch",
        "killme",
        "vulturi",
        "tofsee",
        "slow",
        "owowa",
        "flagpro",
        "write",
        "dazzlespy",
        "decryptor",
        "bandit stealer",
        "bandit",
        "darkeye",
        "recordbreaker",
        "truebot",
        "svchost",
        "clipbanker",
        "service",
        "koivm",
        "arrowrat",
        "ducktail",
        "confuser",
        "gobrat",
        "modiloader",
        "chilelocker",
        "noclose",
        "strelastealer",
        "comfoo",
        "babar",
        "blankgrabber",
        "solarmarker",
        "darkgate",
        "stub",
        "banned",
        "globeimposter",
        "rhysida",
        "janelarat",
        "kraken",
        "recon",
        "quiterat",
        "venomrat",
        "venom rat",
        "sapphirestealer",
        "ntospy",
        "raccoon",
        "shifu",
        "mediapi",
        "poolrat",
        "cicada3301",
        "remoteexec",
        "security",
        "license v2",
        "f6 d9",
        "sha256",
        "imphasz",
        "externalnet",
        "homenet",
        "unreachable",
        "imageendswith",
        "example",
        "imagestartswith",
        "files",
        "sandbox author",
        "securityuserid",
        "windows upgrade",
        "k netsvcs",
        "defender",
        "update",
        "code integrity",
        "checks id",
        "detects code",
        "thomas patzke",
        "filessophos",
        "outbound smtp",
        "connections id",
        "smtp",
        "david burkett",
        "signalblur",
        "commandline",
        "svchost parent",
        "process id",
        "roth",
        "nextron",
        "service binary",
        "system",
        "automatic",
        "manual",
        "filter fp",
        "avast software",
        "new service",
        "creation id"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1048",
          "name": "Exfiltration Over Alternative Protocol",
          "display_name": "T1048 - Exfiltration Over Alternative Protocol"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1543",
          "name": "Create or Modify System Process",
          "display_name": "T1543 - Create or Modify System Process"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 168,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 39,
        "FileHash-SHA1": 28,
        "FileHash-SHA256": 1065,
        "URL": 984,
        "YARA": 535,
        "domain": 262,
        "email": 4,
        "hostname": 316
      },
      "indicator_count": 3233,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 124,
      "modified_text": "339 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://cone.msoftupdates.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://cone.msoftupdates.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776591758.521947
}