{ "type": "URL", "indicator": "https://cr.mckesson.net", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://cr.mckesson.net", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3016310263, "indicator": "https://cr.mckesson.net", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 13, "pulses": [ { "id": "68923ea4efbf58b7ba48acec", "name": "Hosted App", "description": "", "modified": "2025-09-04T16:03:17.037000", "created": "2025-08-05T17:25:56.454000", "tags": [ "issuer wr3", "log id", "gmtn", "abn timestamp", "ad180b80", "full name", "extensionsstr", "web server", "ca issuers", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "ssl certificate", "spawns", "mitre att", "sha1", "copy md5", "copy sha1", "copy sha256", "sha256", "ascii text", "pattern match", "show technique", "date", "format", "august", "hybrid", "local", "path", "click", "strings", "flag", "usa windows", "hwp support", "march", "december", "united", "markmonitor", "overview dns", "requests domain", "country", "contacted hosts", "ip address", "process details", "t1179 hooking", "access windows", "installs", "control att", "found", "development att", "name server", "show process", "programfiles", "command decode", "suricata ipv4", "ck matrix", "comspec", "model", "general", "dynamicloader", "unknown", "as16509", "whitelisted", "medium", "write c", "as15169", "search", "high", "write", "android", "malware", "copy", "next", "formbook cnc", "checkin", "entries", "passive dns", "next associated", "site", "neue", "ipv4", "pulse pulses", "exploit", "trojan", "virtool", "body", "refer", "present dec", "epub", "present jan", "present nov", "present oct", "showing", "urls show", "win32", "win64", "date checked", "url hostname", "server response", "google safe", "prefetch8", "localappdata", "prefetch1" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 3409, "hostname": 4127, "URL": 8408, "SSLCertFingerprint": 9, "FileHash-SHA256": 1175, "FileHash-MD5": 144, "FileHash-SHA1": 134, "CVE": 2 }, "indicator_count": 17408, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "227 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708b4fe416f6d10793d0d0", "name": "malware", "description": "", "modified": "2023-12-06T14:55:11.659000", "created": "2023-12-06T14:55:11.659000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1778, "FileHash-MD5": 781, "FileHash-SHA1": 499, "hostname": 3563, "URL": 9459, "domain": 692, "email": 9, "CIDR": 1, "SSLCertFingerprint": 18 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708b44eddb0e778213b050", "name": "malware", "description": "", "modified": "2023-12-06T14:55:00.045000", "created": "2023-12-06T14:55:00.045000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1778, "FileHash-MD5": 781, "FileHash-SHA1": 499, "hostname": 3563, "URL": 9459, "domain": 692, "email": 9, "CIDR": 1, "SSLCertFingerprint": 18 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708b383c8b03479a9c500f", "name": "malware", "description": "", "modified": "2023-12-06T14:54:48.631000", "created": "2023-12-06T14:54:48.631000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1778, "FileHash-MD5": 781, "FileHash-SHA1": 499, "hostname": 3563, "URL": 9459, "domain": 692, "email": 9, "CIDR": 1, "SSLCertFingerprint": 18 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708b2e1289df77178ac02a", "name": "malware", "description": "", "modified": "2023-12-06T14:54:38.099000", "created": "2023-12-06T14:54:38.099000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1778, "FileHash-MD5": 781, "FileHash-SHA1": 499, "hostname": 3563, "URL": 9459, "domain": 692, "email": 9, "CIDR": 1, "SSLCertFingerprint": 18 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708b21e8b64037edbd6a89", "name": "malware", "description": "", "modified": "2023-12-06T14:54:25.584000", "created": "2023-12-06T14:54:25.584000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1778, "FileHash-MD5": 781, "FileHash-SHA1": 499, "hostname": 3563, "URL": 9459, "domain": 692, "email": 9, "CIDR": 1, "SSLCertFingerprint": 18 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708acfbf9280d126a8e668", "name": "McKesson.com ~ 04.06.2022", "description": "", "modified": "2023-12-06T14:53:03.195000", "created": "2023-12-06T14:53:03.195000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1751, "hostname": 2775, "URL": 9984, "domain": 665, "email": 3, "FileHash-SHA1": 2, "FileHash-MD5": 4 }, "indicator_count": 15184, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624d8d844d2bc304c780d158", "name": "McKesson.com ~ 04.06.2022", "description": "", "modified": "2022-08-20T16:20:43.684000", "created": "2022-04-06T12:54:28.513000", "tags": [ "registrar csc", "date", "sophos health", "comodo valkyrie", "verdict mobile", "businesseconomy", "ranks rank", "value ingestion", "time majestic", "utc statvoo", "umbrella", "algorithm", "key identifier", "x509v3 subject", "data", "v3 serial", "number", "issuer", "atlas r3", "dv tls", "q1 oglobalsign", "server", "domain status", "code", "registrar abuse", "rancho cordova", "contact phone", "registrar url", "csc corporate", "domains", "community", "links https", "httponly", "submission", "samesitelax", "navlanguage1033", "sitecurrency840", "conttype", "userculture1033", "health comodo", "Ransomware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [ { "id": "W32/Scribble-B", "display_name": "W32/Scribble-B", "target": null }, { "id": "Win32/Virut.E", "display_name": "Win32/Virut.E", "target": null }, { "id": "Trojan.Dropper.UXZ", "display_name": "Trojan.Dropper.UXZ", "target": null }, { "id": "Win32/Virut.NBP", "display_name": "Win32/Virut.NBP", "target": null }, { "id": "Win32:Vitro", "display_name": "Win32:Vitro", "target": null }, { "id": "W32/Virut.n.gen", "display_name": "W32/Virut.n.gen", "target": null }, { "id": "Backdoor.Win32.Pushdo.rns", "display_name": "Backdoor.Win32.Pushdo.rns", "target": null }, { "id": "PE_VIRUX.Q-1", "display_name": "PE_VIRUX.Q-1", "target": null }, { "id": "Win.Trojan.Agent-1139129", "display_name": "Win.Trojan.Agent-1139129", "target": null }, { "id": "W32.Virut.CF", "display_name": "W32.Virut.CF", "target": null }, { "id": "Virus:Win32/Virut.EPO", "display_name": "Virus:Win32/Virut.EPO", "target": "/malware/Virus:Win32/Virut.EPO" }, { "id": "Ransom:Win64/Gojdu.A", "display_name": "Ransom:Win64/Gojdu.A", "target": "/malware/Ransom:Win64/Gojdu.A" } ], "attack_ids": [], "industries": [ "Healthcare" ], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 9984, "hostname": 2775, "domain": 665, "FileHash-SHA256": 1751, "email": 3, "FileHash-SHA1": 2, "FileHash-MD5": 4 }, "indicator_count": 15184, "is_author": false, "is_subscribing": null, "subscriber_count": 411, "modified_text": "1338 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624fd91848164eef74985f1a", "name": "malware", "description": "", "modified": "2022-05-08T00:03:14.586000", "created": "2022-04-08T06:41:28.719000", "tags": [ "filehashsha256", "ipv4", "quaqv1", "prvideo", "ptsnmapp", "bdunknown", "dvs898tp", "mdlenovoa360t", "mflenovo", "zoneid", "core", "explorer", "service", "demo", "model" ], "references": [ "624d8d844d2bc304c780d158.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tthanhtung643@gmail.com", "id": "187831", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 781, "FileHash-SHA1": 499, "FileHash-SHA256": 1778, "CIDR": 1, "SSLCertFingerprint": 18, "URL": 9459, "domain": 692, "email": 9, "hostname": 3563 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 42, "modified_text": "1442 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624fd91a4f52435d6ab3002a", "name": "malware", "description": "", "modified": "2022-05-08T00:03:14.586000", "created": "2022-04-08T06:41:30.292000", "tags": [ "filehashsha256", "ipv4", "quaqv1", "prvideo", "ptsnmapp", "bdunknown", "dvs898tp", "mdlenovoa360t", "mflenovo", "zoneid", "core", "explorer", "service", "demo", "model" ], "references": [ "624d8d844d2bc304c780d158.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tthanhtung643@gmail.com", "id": "187831", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 781, "FileHash-SHA1": 499, "FileHash-SHA256": 1778, "CIDR": 1, "SSLCertFingerprint": 18, "URL": 9459, "domain": 692, "email": 9, "hostname": 3563 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "1442 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624fd9250470ff789e1b6142", "name": "malware", "description": "", "modified": "2022-05-08T00:03:14.586000", "created": "2022-04-08T06:41:41.637000", "tags": [ "filehashsha256", "ipv4", "quaqv1", "prvideo", "ptsnmapp", "bdunknown", "dvs898tp", "mdlenovoa360t", "mflenovo", "zoneid", "core", "explorer", "service", "demo", "model" ], "references": [ "624d8d844d2bc304c780d158.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tthanhtung643@gmail.com", "id": "187831", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 781, "FileHash-SHA1": 499, "FileHash-SHA256": 1778, "CIDR": 1, "SSLCertFingerprint": 18, "URL": 9459, "domain": 692, "email": 9, "hostname": 3563 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 40, "modified_text": "1442 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624fd927bbc761bd6c6a426d", "name": "malware", "description": "", "modified": "2022-05-08T00:03:14.586000", "created": "2022-04-08T06:41:43.346000", "tags": [ "filehashsha256", "ipv4", "quaqv1", "prvideo", "ptsnmapp", "bdunknown", "dvs898tp", "mdlenovoa360t", "mflenovo", "zoneid", "core", "explorer", "service", "demo", "model" ], "references": [ "624d8d844d2bc304c780d158.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tthanhtung643@gmail.com", "id": "187831", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 781, "FileHash-SHA1": 499, "FileHash-SHA256": 1778, "CIDR": 1, "SSLCertFingerprint": 18, "URL": 9459, "domain": 692, "email": 9, "hostname": 3563 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 40, "modified_text": "1442 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624fd927e52d5ef693a5cd77", "name": "malware", "description": "", "modified": "2022-05-08T00:03:14.586000", "created": "2022-04-08T06:41:43.877000", "tags": [ "filehashsha256", "ipv4", "quaqv1", "prvideo", "ptsnmapp", "bdunknown", "dvs898tp", "mdlenovoa360t", "mflenovo", "zoneid", "core", "explorer", "service", "demo", "model" ], "references": [ "624d8d844d2bc304c780d158.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tthanhtung643@gmail.com", "id": "187831", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 781, "FileHash-SHA1": 499, "FileHash-SHA256": 1778, "CIDR": 1, "SSLCertFingerprint": 18, "URL": 9459, "domain": 692, "email": 9, "hostname": 3563 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 43, "modified_text": "1442 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "624d8d844d2bc304c780d158.csv" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Pe_virux.q-1", "W32.virut.cf", "Ransom:win64/gojdu.a", "Virus:win32/virut.epo", "Win.trojan.agent-1139129", "Win32:vitro", "W32/virut.n.gen", "Win32/virut.nbp", "W32/scribble-b", "Trojan.dropper.uxz", "Backdoor.win32.pushdo.rns", "Win32/virut.e" ], "industries": [ "Healthcare" ], "unique_indicators": 35690 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/mckesson.net", "whois": "http://whois.domaintools.com/mckesson.net", "domain": "mckesson.net", "hostname": "cr.mckesson.net" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 13, "pulses": [ { "id": "68923ea4efbf58b7ba48acec", "name": "Hosted App", "description": "", "modified": "2025-09-04T16:03:17.037000", "created": "2025-08-05T17:25:56.454000", "tags": [ "issuer wr3", "log id", "gmtn", "abn timestamp", "ad180b80", "full name", "extensionsstr", "web server", "ca issuers", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "ssl certificate", "spawns", "mitre att", "sha1", "copy md5", "copy sha1", "copy sha256", "sha256", "ascii text", "pattern match", "show technique", "date", "format", "august", "hybrid", "local", "path", "click", "strings", "flag", "usa windows", "hwp support", "march", "december", "united", "markmonitor", "overview dns", "requests domain", "country", "contacted hosts", "ip address", "process details", "t1179 hooking", "access windows", "installs", "control att", "found", "development att", "name server", "show process", "programfiles", "command decode", "suricata ipv4", "ck matrix", "comspec", "model", "general", "dynamicloader", "unknown", "as16509", "whitelisted", "medium", "write c", "as15169", "search", "high", "write", "android", "malware", "copy", "next", "formbook cnc", "checkin", "entries", "passive dns", "next associated", "site", "neue", "ipv4", "pulse pulses", "exploit", "trojan", "virtool", "body", "refer", "present dec", "epub", "present jan", "present nov", "present oct", "showing", "urls show", "win32", "win64", "date checked", "url hostname", "server response", "google safe", "prefetch8", "localappdata", "prefetch1" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 3409, "hostname": 4127, "URL": 8408, "SSLCertFingerprint": 9, "FileHash-SHA256": 1175, "FileHash-MD5": 144, "FileHash-SHA1": 134, "CVE": 2 }, "indicator_count": 17408, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "227 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708b4fe416f6d10793d0d0", "name": "malware", "description": "", "modified": "2023-12-06T14:55:11.659000", "created": "2023-12-06T14:55:11.659000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1778, "FileHash-MD5": 781, "FileHash-SHA1": 499, "hostname": 3563, "URL": 9459, "domain": 692, "email": 9, "CIDR": 1, "SSLCertFingerprint": 18 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708b44eddb0e778213b050", "name": "malware", "description": "", "modified": "2023-12-06T14:55:00.045000", "created": "2023-12-06T14:55:00.045000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1778, "FileHash-MD5": 781, "FileHash-SHA1": 499, "hostname": 3563, "URL": 9459, "domain": 692, "email": 9, "CIDR": 1, "SSLCertFingerprint": 18 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708b383c8b03479a9c500f", "name": "malware", "description": "", "modified": "2023-12-06T14:54:48.631000", "created": "2023-12-06T14:54:48.631000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1778, "FileHash-MD5": 781, "FileHash-SHA1": 499, "hostname": 3563, "URL": 9459, "domain": 692, "email": 9, "CIDR": 1, "SSLCertFingerprint": 18 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708b2e1289df77178ac02a", "name": "malware", "description": "", "modified": "2023-12-06T14:54:38.099000", "created": "2023-12-06T14:54:38.099000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1778, "FileHash-MD5": 781, "FileHash-SHA1": 499, "hostname": 3563, "URL": 9459, "domain": 692, "email": 9, "CIDR": 1, "SSLCertFingerprint": 18 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708b21e8b64037edbd6a89", "name": "malware", "description": "", "modified": "2023-12-06T14:54:25.584000", "created": "2023-12-06T14:54:25.584000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1778, "FileHash-MD5": 781, "FileHash-SHA1": 499, "hostname": 3563, "URL": 9459, "domain": 692, "email": 9, "CIDR": 1, "SSLCertFingerprint": 18 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708acfbf9280d126a8e668", "name": "McKesson.com ~ 04.06.2022", "description": "", "modified": "2023-12-06T14:53:03.195000", "created": "2023-12-06T14:53:03.195000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1751, "hostname": 2775, "URL": 9984, "domain": 665, "email": 3, "FileHash-SHA1": 2, "FileHash-MD5": 4 }, "indicator_count": 15184, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624d8d844d2bc304c780d158", "name": "McKesson.com ~ 04.06.2022", "description": "", "modified": "2022-08-20T16:20:43.684000", "created": "2022-04-06T12:54:28.513000", "tags": [ "registrar csc", "date", "sophos health", "comodo valkyrie", "verdict mobile", "businesseconomy", "ranks rank", "value ingestion", "time majestic", "utc statvoo", "umbrella", "algorithm", "key identifier", "x509v3 subject", "data", "v3 serial", "number", "issuer", "atlas r3", "dv tls", "q1 oglobalsign", "server", "domain status", "code", "registrar abuse", "rancho cordova", "contact phone", "registrar url", "csc corporate", "domains", "community", "links https", "httponly", "submission", "samesitelax", "navlanguage1033", "sitecurrency840", "conttype", "userculture1033", "health comodo", "Ransomware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [ { "id": "W32/Scribble-B", "display_name": "W32/Scribble-B", "target": null }, { "id": "Win32/Virut.E", "display_name": "Win32/Virut.E", "target": null }, { "id": "Trojan.Dropper.UXZ", "display_name": "Trojan.Dropper.UXZ", "target": null }, { "id": "Win32/Virut.NBP", "display_name": "Win32/Virut.NBP", "target": null }, { "id": "Win32:Vitro", "display_name": "Win32:Vitro", "target": null }, { "id": "W32/Virut.n.gen", "display_name": "W32/Virut.n.gen", "target": null }, { "id": "Backdoor.Win32.Pushdo.rns", "display_name": "Backdoor.Win32.Pushdo.rns", "target": null }, { "id": "PE_VIRUX.Q-1", "display_name": "PE_VIRUX.Q-1", "target": null }, { "id": "Win.Trojan.Agent-1139129", "display_name": "Win.Trojan.Agent-1139129", "target": null }, { "id": "W32.Virut.CF", "display_name": "W32.Virut.CF", "target": null }, { "id": "Virus:Win32/Virut.EPO", "display_name": "Virus:Win32/Virut.EPO", "target": "/malware/Virus:Win32/Virut.EPO" }, { "id": "Ransom:Win64/Gojdu.A", "display_name": "Ransom:Win64/Gojdu.A", "target": "/malware/Ransom:Win64/Gojdu.A" } ], "attack_ids": [], "industries": [ "Healthcare" ], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 9984, "hostname": 2775, "domain": 665, "FileHash-SHA256": 1751, "email": 3, "FileHash-SHA1": 2, "FileHash-MD5": 4 }, "indicator_count": 15184, "is_author": false, "is_subscribing": null, "subscriber_count": 411, "modified_text": "1338 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624fd91848164eef74985f1a", "name": "malware", "description": "", "modified": "2022-05-08T00:03:14.586000", "created": "2022-04-08T06:41:28.719000", "tags": [ "filehashsha256", "ipv4", "quaqv1", "prvideo", "ptsnmapp", "bdunknown", "dvs898tp", "mdlenovoa360t", "mflenovo", "zoneid", "core", "explorer", "service", "demo", "model" ], "references": [ "624d8d844d2bc304c780d158.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tthanhtung643@gmail.com", "id": "187831", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 781, "FileHash-SHA1": 499, "FileHash-SHA256": 1778, "CIDR": 1, "SSLCertFingerprint": 18, "URL": 9459, "domain": 692, "email": 9, "hostname": 3563 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 42, "modified_text": "1442 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624fd91a4f52435d6ab3002a", "name": "malware", "description": "", "modified": "2022-05-08T00:03:14.586000", "created": "2022-04-08T06:41:30.292000", "tags": [ "filehashsha256", "ipv4", "quaqv1", "prvideo", "ptsnmapp", "bdunknown", "dvs898tp", "mdlenovoa360t", "mflenovo", "zoneid", "core", "explorer", "service", "demo", "model" ], "references": [ "624d8d844d2bc304c780d158.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tthanhtung643@gmail.com", "id": "187831", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 781, "FileHash-SHA1": 499, "FileHash-SHA256": 1778, "CIDR": 1, "SSLCertFingerprint": 18, "URL": 9459, "domain": 692, "email": 9, "hostname": 3563 }, "indicator_count": 16800, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "1442 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://cr.mckesson.net", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://cr.mckesson.net", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776640756.9003246 }