{
  "type": "URL",
  "indicator": "https://dmg.dmge.cc",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://dmg.dmge.cc",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3899887686,
      "indicator": "https://dmg.dmge.cc",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "667d131a14a61dd078e00ecc",
          "name": "UAlberta - Cisco Related Samples from U of A Infrastructure",
          "description": "Cisco AnyConnect Secure Client\nUAlberta - Cisco Related Samples from U of A Infrastructure",
          "modified": "2025-03-22T11:01:47.545000",
          "created": "2024-06-27T07:22:02.067000",
          "tags": [
            "please",
            "javascript",
            "entity",
            "onlink",
            "preferred",
            "encrypted",
            "dns suffix",
            "ipv6 address",
            "secure mobility",
            "control bytes",
            "control",
            "inbound",
            "outbound"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/summary",
            "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/iocs",
            "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/graph"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 152,
            "CIDR": 42,
            "FileHash-MD5": 20,
            "FileHash-SHA1": 20,
            "URL": 321,
            "domain": 375,
            "hostname": 116
          },
          "indicator_count": 1046,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 130,
          "modified_text": "438 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6647908c09468f42bc1249f1",
          "name": "University of Alberta Azure/Entra Compromised Tenant Compromized Institution",
          "description": "Update: Academic/Non-Academic Staff Unions, 3rd party org, & some profs/students/alumni tried raising concerns to Admins/President/IST & CISO => Maintaining position they will not be looking into reported problems re: Cybersecurity under any circumstances = more time more problems? Attempts to advocate -> Harrass./Discrim./De-humanizing responses from admins (representing all folks - recorded). \nTenant ID: 718b8a9b-44d8-441a-a344-4294ea842172 = This pulse is 1 example (small) of problems.\n\nPrimary domain\nualbertaca.onmicrosoft.com\nCustom Domain Names\nualberta.ca\nVerified\nualbertaca.onmicrosoft.com",
          "modified": "2025-03-01T04:59:57.222000",
          "created": "2024-05-17T17:14:52.317000",
          "tags": [
            "false",
            "true",
            "visible",
            "application",
            "microsoft teams",
            "microsoft azure",
            "office",
            "service",
            "dynamics",
            "hidden",
            "android",
            "explorer",
            "write",
            "connector",
            "test",
            "sharepoint",
            "live",
            "meister",
            "tools",
            "desktop",
            "spark",
            "front",
            "enterprise",
            "designer",
            "atlas",
            "premium",
            "assistant",
            "allow",
            "azureadmyorg",
            "game",
            "verify",
            "microsoft power",
            "channelsurfcli",
            "mtd1",
            "file transfer",
            "magnus",
            "microsoft crm",
            "youth"
          ],
          "references": [
            "All - EnterpriseAppsList.csv",
            "AppRegistrationList.csv",
            "https://tria.ge/240517-vc7c1shc62/behavioral1",
            "https://tria.ge/240517-vdwb5shc71/behavioral1",
            "https://tria.ge/240517-vqxezaaa33/behavioral1",
            "https://tria.ge/240517-t9pc2ahb2t",
            "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
            "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
            "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
            "Thor Scan: S-I9VvMTB6cZU",
            "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
            "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
            "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
            "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
            "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
            "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
            "https://tria.ge/240521-q4s79agb25/static1",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
            "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
            "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
            "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
            "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
            "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
            "https://www.hudsonrock.com/search?domain=ualberta.ca",
            "https://www.criminalip.io/domain/report?scan_id=13798622",
            "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
            "https://urlscan.io/search/#ualberta.ca",
            "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
            "https://sitereport.netcraft.com/?url=http://ualberta.ca",
            "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
            "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
            "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
            "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Healthcare",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 7,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1703,
            "FileHash-SHA256": 90472,
            "URL": 99185,
            "domain": 82954,
            "hostname": 39041,
            "FileHash-SHA1": 1624,
            "email": 4658,
            "CVE": 12
          },
          "indicator_count": 319649,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "459 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "677463d6f31303c33c73baa0",
          "name": "crystal-launcher.pl    registrant type: 96a5b33175f055cb",
          "description": "918e9d6c63359abf4ea0499f11aa7de94b2a4f9f88b 2e88c607efec72c69d64fc.",
          "modified": "2025-01-30T21:04:15.962000",
          "created": "2024-12-31T21:36:22.926000",
          "tags": [
            "extensions id",
            "nextron",
            "clr logs",
            "creation id",
            "cobalt strike",
            "administrator",
            "level",
            "number"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 35,
            "FileHash-SHA1": 36,
            "FileHash-SHA256": 219,
            "hostname": 222,
            "domain": 150,
            "URL": 508
          },
          "indicator_count": 1170,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 123,
          "modified_text": "488 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d0a996b288ca46ab7e63ae",
          "name": "CEIDG (www.pitprojekt.pl , pitprojekt.pl) jak otworzy\u0107 firm\u0119, jak rozpocz\u0105\u0107 biznes, dzia\u0142alno\u015b\u0107 gospodarcza zak\u0142adanie, jak rozpocz\u0105\u0107 dzia\u0142alno\u015b\u0107 gospodarcz\u0105",
          "description": "Zawarte zasoby wed\u0142ug j\u0119zyka \u00c2\u00a31.1bn, a total of 7.4bn euros ($9.6bn; \u00a36.3bn)",
          "modified": "2024-12-05T21:16:06.820000",
          "created": "2024-08-29T17:02:13.392000",
          "tags": [
            "admin",
            "asset",
            "dufur",
            "jnswj",
            "3px center",
            "saxla",
            "zjloj",
            "whasz htm",
            "oszczdno",
            "png ikona",
            "rt angielski",
            "angielski usa",
            "wersja rt",
            "narzuta chi2",
            "plik",
            "whasz",
            "bogaty hash",
            "sha256",
            "ssdeep",
            "schema",
            "strings",
            "guid",
            "blob",
            "sha256 file",
            "type type",
            "vhash",
            "imphash",
            "bvgquf",
            "cblrxf",
            "coqbmf",
            "efq78c",
            "gkrikb",
            "hdvrde",
            "hlo3ef",
            "izt63",
            "jnoxi",
            "kg2exe",
            "pejzasz",
            "rticon english",
            "english us",
            "chi2",
            "png rticon",
            "ico rtgroupicon",
            "code signing",
            "algorithm",
            "serial number",
            "sectigo public",
            "thumbprint",
            "rsa time",
            "valid from",
            "name sectigo",
            "valid",
            "valid usage",
            "ascii text",
            "neutral",
            "data rtcursor",
            "data rtdialog",
            "default",
            "rticon maori",
            "ceidg",
            "informacja o",
            "usugi",
            "z wniosek",
            "sprawd",
            "zarejestruj spk",
            "centralna",
            "ewidencja",
            "strona gwna",
            "formularze i",
            "sha1",
            "pehash",
            "richhash",
            "authentihash",
            "skrt",
            "system",
            "podaj",
            "windows z",
            "kreator",
            "dostawca",
            "wifi",
            "nazwa typ",
            "md5 nazwa",
            "imphasz",
            "kropelka",
            "smyczki",
            "zasb manifestu",
            "neutralny",
            "ikona rt",
            "zawarte zasoby",
            "md5 chi2",
            "ikonagrupyrt",
            "rtmanifest",
            "zawarte",
            "sha256 typ"
          ],
          "references": [
            "https://aplikacja.ceidg.gov.pl/ceidg.cms.engine/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 4501,
            "URL": 4559,
            "hostname": 1957,
            "domain": 729,
            "FileHash-MD5": 903,
            "FileHash-SHA1": 849,
            "IPv4": 180,
            "email": 3,
            "IPv6": 2,
            "CVE": 1
          },
          "indicator_count": 13684,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 125,
          "modified_text": "544 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "670c5ff728e6e5b891e26e45",
          "name": "IOC",
          "description": "",
          "modified": "2024-10-14T00:04:07.913000",
          "created": "2024-10-14T00:04:07.913000",
          "tags": [
            "admin",
            "asset",
            "dufur",
            "jnswj",
            "3px center",
            "saxla",
            "zjloj",
            "whasz htm",
            "oszczdno",
            "png ikona",
            "rt angielski",
            "angielski usa",
            "wersja rt",
            "narzuta chi2",
            "plik",
            "whasz",
            "bogaty hash",
            "sha256",
            "ssdeep",
            "schema",
            "strings",
            "guid",
            "blob",
            "sha256 file",
            "type type",
            "vhash",
            "imphash",
            "bvgquf",
            "cblrxf",
            "coqbmf",
            "efq78c",
            "gkrikb",
            "hdvrde",
            "hlo3ef",
            "izt63",
            "jnoxi",
            "kg2exe",
            "pejzasz",
            "rticon english",
            "english us",
            "chi2",
            "png rticon",
            "ico rtgroupicon",
            "code signing",
            "algorithm",
            "serial number",
            "sectigo public",
            "thumbprint",
            "rsa time",
            "valid from",
            "name sectigo",
            "valid",
            "valid usage",
            "ascii text",
            "neutral",
            "data rtcursor",
            "data rtdialog",
            "default",
            "rticon maori",
            "ceidg",
            "informacja o",
            "usugi",
            "z wniosek",
            "sprawd",
            "zarejestruj spk",
            "centralna",
            "ewidencja",
            "strona gwna",
            "formularze i",
            "sha1",
            "pehash",
            "richhash",
            "authentihash",
            "skrt",
            "system",
            "podaj",
            "windows z",
            "kreator",
            "dostawca",
            "wifi",
            "nazwa typ",
            "md5 nazwa",
            "imphasz",
            "kropelka",
            "smyczki",
            "zasb manifestu",
            "neutralny",
            "ikona rt",
            "zawarte zasoby",
            "md5 chi2",
            "ikonagrupyrt",
            "rtmanifest",
            "zawarte",
            "sha256 typ"
          ],
          "references": [
            "https://aplikacja.ceidg.gov.pl/ceidg.cms.engine/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "66d0a996b288ca46ab7e63ae",
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "WayneState",
            "id": "296756",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 4243,
            "URL": 4550,
            "hostname": 1957,
            "domain": 729,
            "FileHash-MD5": 801,
            "FileHash-SHA1": 747,
            "IPv4": 180,
            "email": 3,
            "IPv6": 2
          },
          "indicator_count": 13212,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 4,
          "modified_text": "597 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "665e54dbff4658a62e79cc66",
          "name": "Trojan Dropper | Ransomware | Weaponized Underage Pornography",
          "description": "69.165.78.78 (Command \"target\" 'ty connection') \nFraming\nibiceteena.media\nhttps://www.govolunteerabroad.org/blog/best-teen-and-high-school-volunteer-programs-abroad\n\n\nDomain\ntheteenxxx1.co\nhttps://theteenxxx1.com\nhttp://theteenxxx1.com\nhttp://www.hear-movie.com/wp-content/plugins/gkplugins-for-wordpress/sabeydee/plugins/gkplugins_mthai.swf\t\t\tJun 3, 2024, 11:04:48 PM\t\t6\t\n\nURL\thttp://www.hear-movie.com/wp-content/plugins/gkplugins-for-wordpress/sabeydee/plugins/gkplugins_sendspace.swf\t\t\t\t\t\n (Resources: \nat6800d.exe | https://www.virustotal.com/gui/file/e78282d8d71f0dd9bff906d3ed39d42c08d8e563f2ce36e2ce6e4f20eb14ea97/community)",
          "modified": "2024-07-03T23:02:42.914000",
          "created": "2024-06-03T23:42:19.702000",
          "tags": [
            "historical ssl",
            "june",
            "threat roundup",
            "referrer",
            "unknown win",
            "executable",
            "url http",
            "indicator role",
            "title added",
            "active related",
            "pulses ipv4",
            "filehashmd5",
            "showing",
            "entries",
            "log id",
            "gmtn",
            "passive dns",
            "urls",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "united",
            "as30148 sucuri",
            "unknown",
            "meta",
            "ransom",
            "sucuri website",
            "sucuri security",
            "a domains",
            "win32",
            "trojandropper",
            "trojan",
            "error",
            "null",
            "back",
            "simda",
            "best targets",
            "sites",
            "amazon 02",
            "metro",
            "malware",
            "formbook",
            "win32 exe",
            "detections type",
            "name",
            "html",
            "summary",
            "submission",
            "ssdeep",
            "file type",
            "html internet",
            "magic ascii",
            "html document",
            "crlf line",
            "file size",
            "history first",
            "analysis"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 35,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 528,
            "domain": 1070,
            "hostname": 1578,
            "URL": 4320,
            "FileHash-MD5": 49,
            "FileHash-SHA1": 46,
            "CVE": 2,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 7595,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "699 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
        "https://aplikacja.ceidg.gov.pl/ceidg.cms.engine/",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/iocs",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
        "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
        "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
        "AppRegistrationList.csv",
        "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
        "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
        "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
        "https://www.criminalip.io/domain/report?scan_id=13798622",
        "https://tria.ge/240517-t9pc2ahb2t",
        "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
        "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/summary",
        "https://tria.ge/240517-vc7c1shc62/behavioral1",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
        "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
        "Thor Scan: S-I9VvMTB6cZU",
        "https://www.hudsonrock.com/search?domain=ualberta.ca",
        "https://sitereport.netcraft.com/?url=http://ualberta.ca",
        "https://tria.ge/240517-vdwb5shc71/behavioral1",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
        "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
        "https://tria.ge/240517-vqxezaaa33/behavioral1",
        "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
        "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
        "All - EnterpriseAppsList.csv",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List",
        "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
        "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
        "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
        "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
        "https://tria.ge/240521-q4s79agb25/static1",
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/graph",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
        "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
        "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
        "https://urlscan.io/search/#ualberta.ca",
        "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
        "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
        "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Technology",
            "Healthcare",
            "Education",
            "Telecommunications",
            "Government"
          ],
          "unique_indicators": 63193
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/dmge.cc",
    "whois": "http://whois.domaintools.com/dmge.cc",
    "domain": "dmge.cc",
    "hostname": "dmg.dmge.cc"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "667d131a14a61dd078e00ecc",
      "name": "UAlberta - Cisco Related Samples from U of A Infrastructure",
      "description": "Cisco AnyConnect Secure Client\nUAlberta - Cisco Related Samples from U of A Infrastructure",
      "modified": "2025-03-22T11:01:47.545000",
      "created": "2024-06-27T07:22:02.067000",
      "tags": [
        "please",
        "javascript",
        "entity",
        "onlink",
        "preferred",
        "encrypted",
        "dns suffix",
        "ipv6 address",
        "secure mobility",
        "control bytes",
        "control",
        "inbound",
        "outbound"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/summary",
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/iocs",
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/graph"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 152,
        "CIDR": 42,
        "FileHash-MD5": 20,
        "FileHash-SHA1": 20,
        "URL": 321,
        "domain": 375,
        "hostname": 116
      },
      "indicator_count": 1046,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 130,
      "modified_text": "438 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6647908c09468f42bc1249f1",
      "name": "University of Alberta Azure/Entra Compromised Tenant Compromized Institution",
      "description": "Update: Academic/Non-Academic Staff Unions, 3rd party org, & some profs/students/alumni tried raising concerns to Admins/President/IST & CISO => Maintaining position they will not be looking into reported problems re: Cybersecurity under any circumstances = more time more problems? Attempts to advocate -> Harrass./Discrim./De-humanizing responses from admins (representing all folks - recorded). \nTenant ID: 718b8a9b-44d8-441a-a344-4294ea842172 = This pulse is 1 example (small) of problems.\n\nPrimary domain\nualbertaca.onmicrosoft.com\nCustom Domain Names\nualberta.ca\nVerified\nualbertaca.onmicrosoft.com",
      "modified": "2025-03-01T04:59:57.222000",
      "created": "2024-05-17T17:14:52.317000",
      "tags": [
        "false",
        "true",
        "visible",
        "application",
        "microsoft teams",
        "microsoft azure",
        "office",
        "service",
        "dynamics",
        "hidden",
        "android",
        "explorer",
        "write",
        "connector",
        "test",
        "sharepoint",
        "live",
        "meister",
        "tools",
        "desktop",
        "spark",
        "front",
        "enterprise",
        "designer",
        "atlas",
        "premium",
        "assistant",
        "allow",
        "azureadmyorg",
        "game",
        "verify",
        "microsoft power",
        "channelsurfcli",
        "mtd1",
        "file transfer",
        "magnus",
        "microsoft crm",
        "youth"
      ],
      "references": [
        "All - EnterpriseAppsList.csv",
        "AppRegistrationList.csv",
        "https://tria.ge/240517-vc7c1shc62/behavioral1",
        "https://tria.ge/240517-vdwb5shc71/behavioral1",
        "https://tria.ge/240517-vqxezaaa33/behavioral1",
        "https://tria.ge/240517-t9pc2ahb2t",
        "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
        "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
        "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
        "Thor Scan: S-I9VvMTB6cZU",
        "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
        "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
        "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
        "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
        "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
        "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
        "https://tria.ge/240521-q4s79agb25/static1",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
        "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
        "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
        "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
        "https://www.hudsonrock.com/search?domain=ualberta.ca",
        "https://www.criminalip.io/domain/report?scan_id=13798622",
        "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
        "https://urlscan.io/search/#ualberta.ca",
        "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
        "https://sitereport.netcraft.com/?url=http://ualberta.ca",
        "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
        "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
        "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
        "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Healthcare",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 7,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1703,
        "FileHash-SHA256": 90472,
        "URL": 99185,
        "domain": 82954,
        "hostname": 39041,
        "FileHash-SHA1": 1624,
        "email": 4658,
        "CVE": 12
      },
      "indicator_count": 319649,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "459 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "677463d6f31303c33c73baa0",
      "name": "crystal-launcher.pl    registrant type: 96a5b33175f055cb",
      "description": "918e9d6c63359abf4ea0499f11aa7de94b2a4f9f88b 2e88c607efec72c69d64fc.",
      "modified": "2025-01-30T21:04:15.962000",
      "created": "2024-12-31T21:36:22.926000",
      "tags": [
        "extensions id",
        "nextron",
        "clr logs",
        "creation id",
        "cobalt strike",
        "administrator",
        "level",
        "number"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 35,
        "FileHash-SHA1": 36,
        "FileHash-SHA256": 219,
        "hostname": 222,
        "domain": 150,
        "URL": 508
      },
      "indicator_count": 1170,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 123,
      "modified_text": "488 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66d0a996b288ca46ab7e63ae",
      "name": "CEIDG (www.pitprojekt.pl , pitprojekt.pl) jak otworzy\u0107 firm\u0119, jak rozpocz\u0105\u0107 biznes, dzia\u0142alno\u015b\u0107 gospodarcza zak\u0142adanie, jak rozpocz\u0105\u0107 dzia\u0142alno\u015b\u0107 gospodarcz\u0105",
      "description": "Zawarte zasoby wed\u0142ug j\u0119zyka \u00c2\u00a31.1bn, a total of 7.4bn euros ($9.6bn; \u00a36.3bn)",
      "modified": "2024-12-05T21:16:06.820000",
      "created": "2024-08-29T17:02:13.392000",
      "tags": [
        "admin",
        "asset",
        "dufur",
        "jnswj",
        "3px center",
        "saxla",
        "zjloj",
        "whasz htm",
        "oszczdno",
        "png ikona",
        "rt angielski",
        "angielski usa",
        "wersja rt",
        "narzuta chi2",
        "plik",
        "whasz",
        "bogaty hash",
        "sha256",
        "ssdeep",
        "schema",
        "strings",
        "guid",
        "blob",
        "sha256 file",
        "type type",
        "vhash",
        "imphash",
        "bvgquf",
        "cblrxf",
        "coqbmf",
        "efq78c",
        "gkrikb",
        "hdvrde",
        "hlo3ef",
        "izt63",
        "jnoxi",
        "kg2exe",
        "pejzasz",
        "rticon english",
        "english us",
        "chi2",
        "png rticon",
        "ico rtgroupicon",
        "code signing",
        "algorithm",
        "serial number",
        "sectigo public",
        "thumbprint",
        "rsa time",
        "valid from",
        "name sectigo",
        "valid",
        "valid usage",
        "ascii text",
        "neutral",
        "data rtcursor",
        "data rtdialog",
        "default",
        "rticon maori",
        "ceidg",
        "informacja o",
        "usugi",
        "z wniosek",
        "sprawd",
        "zarejestruj spk",
        "centralna",
        "ewidencja",
        "strona gwna",
        "formularze i",
        "sha1",
        "pehash",
        "richhash",
        "authentihash",
        "skrt",
        "system",
        "podaj",
        "windows z",
        "kreator",
        "dostawca",
        "wifi",
        "nazwa typ",
        "md5 nazwa",
        "imphasz",
        "kropelka",
        "smyczki",
        "zasb manifestu",
        "neutralny",
        "ikona rt",
        "zawarte zasoby",
        "md5 chi2",
        "ikonagrupyrt",
        "rtmanifest",
        "zawarte",
        "sha256 typ"
      ],
      "references": [
        "https://aplikacja.ceidg.gov.pl/ceidg.cms.engine/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 4501,
        "URL": 4559,
        "hostname": 1957,
        "domain": 729,
        "FileHash-MD5": 903,
        "FileHash-SHA1": 849,
        "IPv4": 180,
        "email": 3,
        "IPv6": 2,
        "CVE": 1
      },
      "indicator_count": 13684,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 125,
      "modified_text": "544 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "670c5ff728e6e5b891e26e45",
      "name": "IOC",
      "description": "",
      "modified": "2024-10-14T00:04:07.913000",
      "created": "2024-10-14T00:04:07.913000",
      "tags": [
        "admin",
        "asset",
        "dufur",
        "jnswj",
        "3px center",
        "saxla",
        "zjloj",
        "whasz htm",
        "oszczdno",
        "png ikona",
        "rt angielski",
        "angielski usa",
        "wersja rt",
        "narzuta chi2",
        "plik",
        "whasz",
        "bogaty hash",
        "sha256",
        "ssdeep",
        "schema",
        "strings",
        "guid",
        "blob",
        "sha256 file",
        "type type",
        "vhash",
        "imphash",
        "bvgquf",
        "cblrxf",
        "coqbmf",
        "efq78c",
        "gkrikb",
        "hdvrde",
        "hlo3ef",
        "izt63",
        "jnoxi",
        "kg2exe",
        "pejzasz",
        "rticon english",
        "english us",
        "chi2",
        "png rticon",
        "ico rtgroupicon",
        "code signing",
        "algorithm",
        "serial number",
        "sectigo public",
        "thumbprint",
        "rsa time",
        "valid from",
        "name sectigo",
        "valid",
        "valid usage",
        "ascii text",
        "neutral",
        "data rtcursor",
        "data rtdialog",
        "default",
        "rticon maori",
        "ceidg",
        "informacja o",
        "usugi",
        "z wniosek",
        "sprawd",
        "zarejestruj spk",
        "centralna",
        "ewidencja",
        "strona gwna",
        "formularze i",
        "sha1",
        "pehash",
        "richhash",
        "authentihash",
        "skrt",
        "system",
        "podaj",
        "windows z",
        "kreator",
        "dostawca",
        "wifi",
        "nazwa typ",
        "md5 nazwa",
        "imphasz",
        "kropelka",
        "smyczki",
        "zasb manifestu",
        "neutralny",
        "ikona rt",
        "zawarte zasoby",
        "md5 chi2",
        "ikonagrupyrt",
        "rtmanifest",
        "zawarte",
        "sha256 typ"
      ],
      "references": [
        "https://aplikacja.ceidg.gov.pl/ceidg.cms.engine/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "66d0a996b288ca46ab7e63ae",
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "WayneState",
        "id": "296756",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 4243,
        "URL": 4550,
        "hostname": 1957,
        "domain": 729,
        "FileHash-MD5": 801,
        "FileHash-SHA1": 747,
        "IPv4": 180,
        "email": 3,
        "IPv6": 2
      },
      "indicator_count": 13212,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 4,
      "modified_text": "597 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "665e54dbff4658a62e79cc66",
      "name": "Trojan Dropper | Ransomware | Weaponized Underage Pornography",
      "description": "69.165.78.78 (Command \"target\" 'ty connection') \nFraming\nibiceteena.media\nhttps://www.govolunteerabroad.org/blog/best-teen-and-high-school-volunteer-programs-abroad\n\n\nDomain\ntheteenxxx1.co\nhttps://theteenxxx1.com\nhttp://theteenxxx1.com\nhttp://www.hear-movie.com/wp-content/plugins/gkplugins-for-wordpress/sabeydee/plugins/gkplugins_mthai.swf\t\t\tJun 3, 2024, 11:04:48 PM\t\t6\t\n\nURL\thttp://www.hear-movie.com/wp-content/plugins/gkplugins-for-wordpress/sabeydee/plugins/gkplugins_sendspace.swf\t\t\t\t\t\n (Resources: \nat6800d.exe | https://www.virustotal.com/gui/file/e78282d8d71f0dd9bff906d3ed39d42c08d8e563f2ce36e2ce6e4f20eb14ea97/community)",
      "modified": "2024-07-03T23:02:42.914000",
      "created": "2024-06-03T23:42:19.702000",
      "tags": [
        "historical ssl",
        "june",
        "threat roundup",
        "referrer",
        "unknown win",
        "executable",
        "url http",
        "indicator role",
        "title added",
        "active related",
        "pulses ipv4",
        "filehashmd5",
        "showing",
        "entries",
        "log id",
        "gmtn",
        "passive dns",
        "urls",
        "go daddy",
        "authority",
        "tls web",
        "arizona",
        "scottsdale",
        "ca issuers",
        "false",
        "united",
        "as30148 sucuri",
        "unknown",
        "meta",
        "ransom",
        "sucuri website",
        "sucuri security",
        "a domains",
        "win32",
        "trojandropper",
        "trojan",
        "error",
        "null",
        "back",
        "simda",
        "best targets",
        "sites",
        "amazon 02",
        "metro",
        "malware",
        "formbook",
        "win32 exe",
        "detections type",
        "name",
        "html",
        "summary",
        "submission",
        "ssdeep",
        "file type",
        "html internet",
        "magic ascii",
        "html document",
        "crlf line",
        "file size",
        "history first",
        "analysis"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 35,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 528,
        "domain": 1070,
        "hostname": 1578,
        "URL": 4320,
        "FileHash-MD5": 49,
        "FileHash-SHA1": 46,
        "CVE": 2,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 7595,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "699 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://dmg.dmge.cc",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://dmg.dmge.cc",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780494360.5412867
}