{
  "type": "URL",
  "indicator": "https://frog.smtper.co/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://frog.smtper.co/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4122634274,
      "indicator": "https://frog.smtper.co/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "693148dc0eb85adc8edfe1a2",
          "name": "BeeLineRouter.Net \u2022 Isolated / Apple Baxkdoor",
          "description": "",
          "modified": "2026-01-03T07:00:45.529000",
          "created": "2025-12-04T08:39:56.180000",
          "tags": [
            "mitre att",
            "network traffic",
            "ck id",
            "show technique",
            "ck matrix",
            "threat score",
            "december",
            "default browser",
            "guest system",
            "united",
            "dynadot inc",
            "name server",
            "contacted hosts",
            "process details",
            "windir",
            "openurl c",
            "prefetch2",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "access att",
            "t1566 phishing",
            "ascii text",
            "pattern match",
            "show process",
            "t1071",
            "general",
            "local",
            "path",
            "click",
            "beelinerouter",
            "access",
            "router",
            "apple",
            "regopenkeyexw",
            "regsz",
            "process32nextw",
            "english",
            "post http",
            "search",
            "observed dns",
            "query",
            "sinkhole cookie",
            "malware",
            "possible",
            "win32",
            "updater",
            "write",
            "next",
            "found",
            "ip address",
            "domain",
            "name servers",
            "unknown ns",
            "ip whois",
            "registrar",
            "cloudflare",
            "title",
            "passive dns",
            "urls",
            "files",
            "location united",
            "asn as14618",
            "bq dec",
            "virtool",
            "backdoor",
            "checkin",
            "ipv4 add",
            "trojan",
            "dynamicloader",
            "msie",
            "windows nt",
            "slcc2",
            "media center",
            "unknown",
            "show",
            "internal",
            "encrypt",
            "veailmboprd",
            "dns query",
            "wow64",
            "gecko http",
            "entries",
            "medium",
            "ransom",
            "khtml",
            "gecko",
            "delete",
            "installer",
            "win32cve may",
            "america flag",
            "overview ip",
            "asn as20940",
            "expiration",
            "url https",
            "no expiration",
            "url http",
            "pulse show",
            "type indicator",
            "role title",
            "related pulses",
            "record value",
            "domain xn"
          ],
          "references": [
            "HTTPS://BeeLineRouter.Net",
            "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com",
            "https://appleid.xn--appe-70a.com/",
            "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://vgt.pl/r.n%20-",
            "8-25-220-162-static.reverse.queryfoundry.net",
            "queryfoundry.net",
            "http://81-26-68-38-static.reverse.queryfoundry.net/",
            "http://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://81-26-68-38-static.reverse.queryfoundry.net/",
            "http://68-178-128-104-static.reverse.queryfoundry.net/",
            "0-209-98-172-static.reverse.queryfoundry.net",
            "154-143-182-107-static.reverse.queryfoundry.net",
            "http://51-235-245-104-static.reverse.queryfoundry.net/",
            "167-16-68-38-static.reverse.queryfoundry.net",
            "http://49-116-251-162-static.reverse.queryfoundry./net/",
            "177-231-69-38-static.reverse.queryfoundry.net",
            "http://36-243-60-103-static.reverse.queryfoundry.net/",
            "http://237-189-251-104-static.reverse.queryfoundry.net/",
            "http://227-98-248-162-static.reverse.queryfoundry.net/",
            "237-189-251-104-static.reverse.queryfoundry.net",
            "http://207-214-98-172-static.reverse.queryfoundry.net/",
            "181-135-182-107-static.reverse.queryfoundry.net",
            "http://201-191-251-104-static.reverse.queryfoundry.net/",
            "67-228-69-38-static.reverse.queryfoundry.net",
            "http://0-209-98-172-static.reverse.queryfoundry.net/",
            "http://10-241-60-103-static.reverse.queryfoundry.net/",
            "http://142-232-245-104-static.reverse.queryfoundry.net/",
            "http://154-143-182-107-static.reverse.queryfoundry.net/",
            "http://167-16-68-38-static.reverse.queryfoundry.net/",
            "http://177-231-69-38-static.reverse.queryfoundry.net/",
            "http://181-135-182-107-static.reverse.queryfoundry.net/",
            "http://195-214-98-172-static.reverse.queryfoundry.net/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Simda",
              "display_name": "Simda",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            },
            {
              "id": "GandCrab Ransomware",
              "display_name": "GandCrab Ransomware",
              "target": null
            },
            {
              "id": "Win.Virus.Expiro",
              "display_name": "Win.Virus.Expiro",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "#VirTool:Win32/Obfuscator.ADB",
              "display_name": "#VirTool:Win32/Obfuscator.ADB",
              "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
            }
          ],
          "attack_ids": [
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1049,
            "URL": 5839,
            "hostname": 1944,
            "FileHash-SHA256": 3634,
            "FileHash-MD5": 310,
            "FileHash-SHA1": 295,
            "CVE": 2,
            "email": 15,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 13090,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "106 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69314920e287845f6b36a265",
          "name": "BeeLineRouter.Net  \u2022 Apple Access",
          "description": "",
          "modified": "2026-01-03T07:00:45.529000",
          "created": "2025-12-04T08:41:04.190000",
          "tags": [
            "mitre att",
            "network traffic",
            "ck id",
            "show technique",
            "ck matrix",
            "threat score",
            "december",
            "default browser",
            "guest system",
            "united",
            "dynadot inc",
            "name server",
            "contacted hosts",
            "process details",
            "windir",
            "openurl c",
            "prefetch2",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "access att",
            "t1566 phishing",
            "ascii text",
            "pattern match",
            "show process",
            "t1071",
            "general",
            "local",
            "path",
            "click",
            "beelinerouter",
            "access",
            "router",
            "apple",
            "regopenkeyexw",
            "regsz",
            "process32nextw",
            "english",
            "post http",
            "search",
            "observed dns",
            "query",
            "sinkhole cookie",
            "malware",
            "possible",
            "win32",
            "updater",
            "write",
            "next",
            "found",
            "ip address",
            "domain",
            "name servers",
            "unknown ns",
            "ip whois",
            "registrar",
            "cloudflare",
            "title",
            "passive dns",
            "urls",
            "files",
            "location united",
            "asn as14618",
            "bq dec",
            "virtool",
            "backdoor",
            "checkin",
            "ipv4 add",
            "trojan",
            "dynamicloader",
            "msie",
            "windows nt",
            "slcc2",
            "media center",
            "unknown",
            "show",
            "internal",
            "encrypt",
            "veailmboprd",
            "dns query",
            "wow64",
            "gecko http",
            "entries",
            "medium",
            "ransom",
            "khtml",
            "gecko",
            "delete",
            "installer",
            "win32cve may",
            "america flag",
            "overview ip",
            "asn as20940",
            "expiration",
            "url https",
            "no expiration",
            "url http",
            "pulse show",
            "type indicator",
            "role title",
            "related pulses",
            "record value",
            "domain xn"
          ],
          "references": [
            "HTTPS://BeeLineRouter.Net",
            "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com",
            "https://appleid.xn--appe-70a.com/",
            "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://vgt.pl/r.n%20-",
            "8-25-220-162-static.reverse.queryfoundry.net",
            "queryfoundry.net",
            "http://81-26-68-38-static.reverse.queryfoundry.net/",
            "http://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://81-26-68-38-static.reverse.queryfoundry.net/",
            "http://68-178-128-104-static.reverse.queryfoundry.net/",
            "0-209-98-172-static.reverse.queryfoundry.net",
            "154-143-182-107-static.reverse.queryfoundry.net",
            "http://51-235-245-104-static.reverse.queryfoundry.net/",
            "167-16-68-38-static.reverse.queryfoundry.net",
            "http://49-116-251-162-static.reverse.queryfoundry./net/",
            "177-231-69-38-static.reverse.queryfoundry.net",
            "http://36-243-60-103-static.reverse.queryfoundry.net/",
            "http://237-189-251-104-static.reverse.queryfoundry.net/",
            "http://227-98-248-162-static.reverse.queryfoundry.net/",
            "237-189-251-104-static.reverse.queryfoundry.net",
            "http://207-214-98-172-static.reverse.queryfoundry.net/",
            "181-135-182-107-static.reverse.queryfoundry.net",
            "http://201-191-251-104-static.reverse.queryfoundry.net/",
            "67-228-69-38-static.reverse.queryfoundry.net",
            "http://0-209-98-172-static.reverse.queryfoundry.net/",
            "http://10-241-60-103-static.reverse.queryfoundry.net/",
            "http://142-232-245-104-static.reverse.queryfoundry.net/",
            "http://154-143-182-107-static.reverse.queryfoundry.net/",
            "http://167-16-68-38-static.reverse.queryfoundry.net/",
            "http://177-231-69-38-static.reverse.queryfoundry.net/",
            "http://181-135-182-107-static.reverse.queryfoundry.net/",
            "http://195-214-98-172-static.reverse.queryfoundry.net/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Simda",
              "display_name": "Simda",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            },
            {
              "id": "GandCrab Ransomware",
              "display_name": "GandCrab Ransomware",
              "target": null
            },
            {
              "id": "Win.Virus.Expiro",
              "display_name": "Win.Virus.Expiro",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "#VirTool:Win32/Obfuscator.ADB",
              "display_name": "#VirTool:Win32/Obfuscator.ADB",
              "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
            }
          ],
          "attack_ids": [
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 310,
            "FileHash-SHA1": 295,
            "FileHash-SHA256": 3634,
            "URL": 5839,
            "CVE": 2,
            "domain": 1048,
            "email": 15,
            "hostname": 1944,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 13089,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "106 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69314926519256e3ef0a9358",
          "name": "BeeLineRouter.Net  \u2022 Apple Access",
          "description": "",
          "modified": "2026-01-03T07:00:45.529000",
          "created": "2025-12-04T08:41:06.657000",
          "tags": [
            "mitre att",
            "network traffic",
            "ck id",
            "show technique",
            "ck matrix",
            "threat score",
            "december",
            "default browser",
            "guest system",
            "united",
            "dynadot inc",
            "name server",
            "contacted hosts",
            "process details",
            "windir",
            "openurl c",
            "prefetch2",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "access att",
            "t1566 phishing",
            "ascii text",
            "pattern match",
            "show process",
            "t1071",
            "general",
            "local",
            "path",
            "click",
            "beelinerouter",
            "access",
            "router",
            "apple",
            "regopenkeyexw",
            "regsz",
            "process32nextw",
            "english",
            "post http",
            "search",
            "observed dns",
            "query",
            "sinkhole cookie",
            "malware",
            "possible",
            "win32",
            "updater",
            "write",
            "next",
            "found",
            "ip address",
            "domain",
            "name servers",
            "unknown ns",
            "ip whois",
            "registrar",
            "cloudflare",
            "title",
            "passive dns",
            "urls",
            "files",
            "location united",
            "asn as14618",
            "bq dec",
            "virtool",
            "backdoor",
            "checkin",
            "ipv4 add",
            "trojan",
            "dynamicloader",
            "msie",
            "windows nt",
            "slcc2",
            "media center",
            "unknown",
            "show",
            "internal",
            "encrypt",
            "veailmboprd",
            "dns query",
            "wow64",
            "gecko http",
            "entries",
            "medium",
            "ransom",
            "khtml",
            "gecko",
            "delete",
            "installer",
            "win32cve may",
            "america flag",
            "overview ip",
            "asn as20940",
            "expiration",
            "url https",
            "no expiration",
            "url http",
            "pulse show",
            "type indicator",
            "role title",
            "related pulses",
            "record value",
            "domain xn"
          ],
          "references": [
            "HTTPS://BeeLineRouter.Net",
            "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com",
            "https://appleid.xn--appe-70a.com/",
            "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://vgt.pl/r.n%20-",
            "8-25-220-162-static.reverse.queryfoundry.net",
            "queryfoundry.net",
            "http://81-26-68-38-static.reverse.queryfoundry.net/",
            "http://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://81-26-68-38-static.reverse.queryfoundry.net/",
            "http://68-178-128-104-static.reverse.queryfoundry.net/",
            "0-209-98-172-static.reverse.queryfoundry.net",
            "154-143-182-107-static.reverse.queryfoundry.net",
            "http://51-235-245-104-static.reverse.queryfoundry.net/",
            "167-16-68-38-static.reverse.queryfoundry.net",
            "http://49-116-251-162-static.reverse.queryfoundry./net/",
            "177-231-69-38-static.reverse.queryfoundry.net",
            "http://36-243-60-103-static.reverse.queryfoundry.net/",
            "http://237-189-251-104-static.reverse.queryfoundry.net/",
            "http://227-98-248-162-static.reverse.queryfoundry.net/",
            "237-189-251-104-static.reverse.queryfoundry.net",
            "http://207-214-98-172-static.reverse.queryfoundry.net/",
            "181-135-182-107-static.reverse.queryfoundry.net",
            "http://201-191-251-104-static.reverse.queryfoundry.net/",
            "67-228-69-38-static.reverse.queryfoundry.net",
            "http://0-209-98-172-static.reverse.queryfoundry.net/",
            "http://10-241-60-103-static.reverse.queryfoundry.net/",
            "http://142-232-245-104-static.reverse.queryfoundry.net/",
            "http://154-143-182-107-static.reverse.queryfoundry.net/",
            "http://167-16-68-38-static.reverse.queryfoundry.net/",
            "http://177-231-69-38-static.reverse.queryfoundry.net/",
            "http://181-135-182-107-static.reverse.queryfoundry.net/",
            "http://195-214-98-172-static.reverse.queryfoundry.net/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Simda",
              "display_name": "Simda",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            },
            {
              "id": "GandCrab Ransomware",
              "display_name": "GandCrab Ransomware",
              "target": null
            },
            {
              "id": "Win.Virus.Expiro",
              "display_name": "Win.Virus.Expiro",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "#VirTool:Win32/Obfuscator.ADB",
              "display_name": "#VirTool:Win32/Obfuscator.ADB",
              "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
            }
          ],
          "attack_ids": [
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 310,
            "FileHash-SHA1": 295,
            "FileHash-SHA256": 3634,
            "URL": 5839,
            "CVE": 2,
            "domain": 1048,
            "email": 15,
            "hostname": 1944,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 13089,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 146,
          "modified_text": "106 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6905d40f781d7d58d4021a20",
          "name": "Treece Alfrey Musat P.C., Chris P. Ahmann  Colorado State \u2022 Tam Legal Special Cousel for egregious acts by PT.",
          "description": "- with a primary focus on criminal defense. In both positions, he successfully defended his clients against claims running the gamut of the criminal justice system, from DUI\nand misdemeanors to felony indictments. In his criminal practice, Mr. Ahmann defends clients charged with both misdemeanor and felony cases. Mr. Ahmann continues his criminal practice as he believes that his clients deserve someone on their side to assure their voice is heard in the criminal process as well. He is dedicated to each of his clients and is always\nstriving for the best possible outcome in their individual cases. Mr. Ahmann also specializes in defense of employers in workers' compensation claims. He also assists TAM clients whose liability defense touches criminal prosecution, regularly providing effective criminal counsel in catastrophic injury common carrier matters, as well as criminal prosecution stemming from\nemployment and official acts.",
          "modified": "2025-12-20T06:00:23.758000",
          "created": "2025-11-01T09:34:07.323000",
          "tags": [
            "public tlp",
            "trojandropper",
            "other",
            "references add",
            "show",
            "provide",
            "remote",
            "t1457",
            "media content",
            "t1480",
            "subvert trust",
            "controls t1562",
            "modify tools",
            "command history",
            "ck t1027",
            "t1057",
            "discovery t1069",
            "t1071",
            "protocol t1105",
            "tool transfer",
            "t1113",
            "logging t1568",
            "t1574",
            "execution flow",
            "dll sideloading",
            "t1583",
            "ta0003",
            "ck id",
            "america",
            "att",
            "t1045",
            "capture t1140",
            "ipv4",
            "active related",
            "contact",
            "adversary",
            "tam legal",
            "qshell",
            "colorado state",
            "ahmann special",
            "counsel",
            "download",
            "ahmann",
            "university",
            "history",
            "john marshall",
            "law school",
            "special counsel",
            "christopher ahmann",
            "defense",
            "url http",
            "create new",
            "pulse provide",
            "white",
            "adversary tags",
            "add tag",
            "groups add",
            "countries add",
            "country malware",
            "trojan",
            "script urls",
            "treece alfrey",
            "meta",
            "function",
            "for privacy",
            "germany unknown",
            "united",
            "script",
            "ip address",
            "creation date",
            "date",
            "tracker",
            "null",
            "window",
            "general full",
            "reverse dns",
            "server",
            "philadelphia",
            "asn8560",
            "ionosas",
            "ionos",
            "fasthosts",
            "media",
            "telecom",
            "apache",
            "main",
            "gtagtracker",
            "gatracker",
            "brian  sabey",
            "hall render",
            "fastly error",
            "palantir",
            "special counsel",
            "gravity rat"
          ],
          "references": [
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "http://45.159.189.105/bot/regex \u2022\u2019 Fake Pinterest \u2022https://pin.it/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Tsara never knew defense attorney fought & closed her worker\u2019s compensation claim",
            "Traceback- Man with signal jammer/ deauther working around her today.",
            "Absolutely zero regard for the victims who facilitate your luxury lifestyle.",
            "Do you slap luxury cologne on your undeserving face paid for by money workers suffered for?",
            "You\u2019d kill to have someone else\u2019s lifestyle? May God take you out!",
            "This God smacked penguin ordered a settlement hearing with less than 24 hours notice for claimant.",
            "He began a smear campaign immediately and is directly linked to Hall Render and Palantir",
            "Doing any evil thing for mone does not compute for me.",
            "I\u2019ve looked through the settlement docs,  injuries caused by Jeffrey Scott Reiner DPT omitted.",
            "He must be very scary like Peter Theil because every attorney took case then backed off.",
            "Patiently waiting to see what God is going to do to all of you. You take lives for $",
            "Stop! A woman was assaulted carved up, lived with a swollen brain , maltreatment , stalkers , hitmen?",
            "So you can order food at fine restaurants , go to the finest places and get the best seats?  No. I am earnestly praying Jehovah Sabaoth takes your last breath from all of you with  Yawehs mightiest angels leading the way with a changing of guard for every  tattle you will lose",
            "On same block with HalkRender. Has close working relationship. All Palantir legal enities"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Other",
              "display_name": "Other",
              "target": null
            },
            {
              "id": "Win.Malware.Unsafe",
              "display_name": "Win.Malware.Unsafe",
              "target": null
            },
            {
              "id": "Juko",
              "display_name": "Juko",
              "target": null
            },
            {
              "id": "Expiro",
              "display_name": "Expiro",
              "target": null
            },
            {
              "id": "Trojan:Win32/Generic",
              "display_name": "Trojan:Win32/Generic",
              "target": "/malware/Trojan:Win32/Generic"
            },
            {
              "id": "Win.Malware.Qshell-9875653-0",
              "display_name": "Win.Malware.Qshell-9875653-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [
            "Legal",
            "Government",
            "Healthcare",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8332,
            "domain": 4819,
            "hostname": 2165,
            "FileHash-SHA256": 7369,
            "FileHash-MD5": 474,
            "FileHash-SHA1": 470,
            "CVE": 4,
            "email": 4
          },
          "indicator_count": 23637,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "120 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6906c12b1dd6a64ab1beaa55",
          "name": "SpyNoon \u2022Chris P. Ahmann Colorado State \u2022 Tam Legal Special Cousel for egregious",
          "description": "",
          "modified": "2025-12-01T09:02:26.881000",
          "created": "2025-11-02T02:25:47.431000",
          "tags": [
            "public tlp",
            "trojandropper",
            "other",
            "references add",
            "show",
            "provide",
            "remote",
            "t1457",
            "media content",
            "t1480",
            "subvert trust",
            "controls t1562",
            "modify tools",
            "command history",
            "ck t1027",
            "t1057",
            "discovery t1069",
            "t1071",
            "protocol t1105",
            "tool transfer",
            "t1113",
            "logging t1568",
            "t1574",
            "execution flow",
            "dll sideloading",
            "t1583",
            "ta0003",
            "ck id",
            "america",
            "att",
            "t1045",
            "capture t1140",
            "ipv4",
            "active related",
            "contact",
            "adversary",
            "tam legal",
            "qshell",
            "colorado state",
            "ahmann special",
            "counsel",
            "download",
            "ahmann",
            "university",
            "history",
            "john marshall",
            "law school",
            "special counsel",
            "christopher ahmann",
            "defense",
            "url http",
            "create new",
            "pulse provide",
            "white",
            "adversary tags",
            "add tag",
            "groups add",
            "countries add",
            "country malware",
            "trojan",
            "script urls",
            "treece alfrey",
            "meta",
            "function",
            "for privacy",
            "germany unknown",
            "united",
            "script",
            "ip address",
            "creation date",
            "date",
            "tracker",
            "null",
            "window",
            "general full",
            "reverse dns",
            "server",
            "philadelphia",
            "asn8560",
            "ionosas",
            "ionos",
            "fasthosts",
            "media",
            "telecom",
            "apache",
            "main",
            "gtagtracker",
            "gatracker",
            "brian  sabey",
            "hall render",
            "fastly error",
            "palantir",
            "special counsel",
            "gravity rat"
          ],
          "references": [
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "http://45.159.189.105/bot/regex \u2022\u2019 Fake Pinterest \u2022https://pin.it/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Tsara never knew defense attorney fought & closed her worker\u2019s compensation claim",
            "Traceback- Man with signal jammer/ deauther working around her today.",
            "Absolutely zero regard for the victims who facilitate your luxury lifestyle.",
            "Do you slap luxury cologne on your undeserving face paid for by money workers suffered for?",
            "You\u2019d kill to have someone else\u2019s lifestyle? May God take you out!",
            "This God smacked penguin ordered a settlement hearing with less than 24 hours notice for claimant.",
            "He began a smear campaign immediately and is directly linked to Hall Render and Palantir",
            "Doing any evil thing for mone does not compute for me.",
            "I\u2019ve looked through the settlement docs,  injuries caused by Jeffrey Scott Reiner DPT omitted.",
            "He must be very scary like Peter Theil because every attorney took case then backed off.",
            "Patiently waiting to see what God is going to do to all of you. You take lives for $",
            "Stop! A woman was assaulted carved up, lived with a swollen brain , maltreatment , stalkers , hitmen?",
            "So you can order food at fine restaurants , go to the finest places and get the best seats?  No. I am earnestly praying Jehovah Sabaoth takes your last breath from all of you with  Yawehs mightiest angels leading the way with a changing of guard for every  tattle you will lose",
            "On same block with HalkRender. Has close working relationship. All Palantir legal enities"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Other",
              "display_name": "Other",
              "target": null
            },
            {
              "id": "Win.Malware.Unsafe",
              "display_name": "Win.Malware.Unsafe",
              "target": null
            },
            {
              "id": "Juko",
              "display_name": "Juko",
              "target": null
            },
            {
              "id": "Expiro",
              "display_name": "Expiro",
              "target": null
            },
            {
              "id": "Trojan:Win32/Generic",
              "display_name": "Trojan:Win32/Generic",
              "target": "/malware/Trojan:Win32/Generic"
            },
            {
              "id": "Win.Malware.Qshell-9875653-0",
              "display_name": "Win.Malware.Qshell-9875653-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [
            "Legal",
            "Government",
            "Healthcare",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": "6905d40f781d7d58d4021a20",
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7556,
            "domain": 4779,
            "hostname": 2053,
            "FileHash-SHA256": 7233,
            "FileHash-MD5": 474,
            "FileHash-SHA1": 470,
            "CVE": 4,
            "email": 4
          },
          "indicator_count": 22573,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "139 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69137ee5d76d486d65396af0",
          "name": "Chris P. Ahmann Colorado State \u2022 Tam Legal Special Cousel for egregious acts committed by Jeffrey S. Reimer DPT \u2022 Treece Alfrey Musat P.C., ",
          "description": "",
          "modified": "2025-12-01T09:02:26.881000",
          "created": "2025-11-11T18:22:29.976000",
          "tags": [
            "public tlp",
            "trojandropper",
            "other",
            "references add",
            "show",
            "provide",
            "remote",
            "t1457",
            "media content",
            "t1480",
            "subvert trust",
            "controls t1562",
            "modify tools",
            "command history",
            "ck t1027",
            "t1057",
            "discovery t1069",
            "t1071",
            "protocol t1105",
            "tool transfer",
            "t1113",
            "logging t1568",
            "t1574",
            "execution flow",
            "dll sideloading",
            "t1583",
            "ta0003",
            "ck id",
            "america",
            "att",
            "t1045",
            "capture t1140",
            "ipv4",
            "active related",
            "contact",
            "adversary",
            "tam legal",
            "qshell",
            "colorado state",
            "ahmann special",
            "counsel",
            "download",
            "ahmann",
            "university",
            "history",
            "john marshall",
            "law school",
            "special counsel",
            "christopher ahmann",
            "defense",
            "url http",
            "create new",
            "pulse provide",
            "white",
            "adversary tags",
            "add tag",
            "groups add",
            "countries add",
            "country malware",
            "trojan",
            "script urls",
            "treece alfrey",
            "meta",
            "function",
            "for privacy",
            "germany unknown",
            "united",
            "script",
            "ip address",
            "creation date",
            "date",
            "tracker",
            "null",
            "window",
            "general full",
            "reverse dns",
            "server",
            "philadelphia",
            "asn8560",
            "ionosas",
            "ionos",
            "fasthosts",
            "media",
            "telecom",
            "apache",
            "main",
            "gtagtracker",
            "gatracker",
            "brian  sabey",
            "hall render",
            "fastly error",
            "palantir",
            "special counsel",
            "gravity rat"
          ],
          "references": [
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "http://45.159.189.105/bot/regex \u2022\u2019 Fake Pinterest \u2022https://pin.it/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Tsara never knew defense attorney fought & closed her worker\u2019s compensation claim",
            "Traceback- Man with signal jammer/ deauther working around her today.",
            "Absolutely zero regard for the victims who facilitate your luxury lifestyle.",
            "Do you slap luxury cologne on your undeserving face paid for by money workers suffered for?",
            "You\u2019d kill to have someone else\u2019s lifestyle? May God take you out!",
            "This God smacked penguin ordered a settlement hearing with less than 24 hours notice for claimant.",
            "He began a smear campaign immediately and is directly linked to Hall Render and Palantir",
            "Doing any evil thing for mone does not compute for me.",
            "I\u2019ve looked through the settlement docs,  injuries caused by Jeffrey Scott Reiner DPT omitted.",
            "He must be very scary like Peter Theil because every attorney took case then backed off.",
            "Patiently waiting to see what God is going to do to all of you. You take lives for $",
            "Stop! A woman was assaulted carved up, lived with a swollen brain , maltreatment , stalkers , hitmen?",
            "So you can order food at fine restaurants , go to the finest places and get the best seats?  No. I am earnestly praying Jehovah Sabaoth takes your last breath from all of you with  Yawehs mightiest angels leading the way with a changing of guard for every  tattle you will lose",
            "On same block with HalkRender. Has close working relationship. All Palantir legal enities"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Other",
              "display_name": "Other",
              "target": null
            },
            {
              "id": "Win.Malware.Unsafe",
              "display_name": "Win.Malware.Unsafe",
              "target": null
            },
            {
              "id": "Juko",
              "display_name": "Juko",
              "target": null
            },
            {
              "id": "Expiro",
              "display_name": "Expiro",
              "target": null
            },
            {
              "id": "Trojan:Win32/Generic",
              "display_name": "Trojan:Win32/Generic",
              "target": "/malware/Trojan:Win32/Generic"
            },
            {
              "id": "Win.Malware.Qshell-9875653-0",
              "display_name": "Win.Malware.Qshell-9875653-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [
            "Legal",
            "Government",
            "Healthcare",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": "6905d40f781d7d58d4021a20",
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7556,
            "domain": 4779,
            "hostname": 2053,
            "FileHash-SHA256": 7233,
            "FileHash-MD5": 474,
            "FileHash-SHA1": 470,
            "CVE": 4,
            "email": 4
          },
          "indicator_count": 22573,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "139 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://227-98-248-162-static.reverse.queryfoundry.net/",
        "Do you slap luxury cologne on your undeserving face paid for by money workers suffered for?",
        "http://237-189-251-104-static.reverse.queryfoundry.net/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "queryfoundry.net",
        "http://vgt.pl/r.n%20-",
        "http://154-143-182-107-static.reverse.queryfoundry.net/",
        "He began a smear campaign immediately and is directly linked to Hall Render and Palantir",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png",
        "http://68-178-128-104-static.reverse.queryfoundry.net/",
        "154-143-182-107-static.reverse.queryfoundry.net",
        "http://207-214-98-172-static.reverse.queryfoundry.net/",
        "67-228-69-38-static.reverse.queryfoundry.net",
        "Doing any evil thing for mone does not compute for me.",
        "http://167-16-68-38-static.reverse.queryfoundry.net/",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "http://195-214-98-172-static.reverse.queryfoundry.net/",
        "http://45.159.189.105/bot/regex \u2022\u2019 Fake Pinterest \u2022https://pin.it/",
        "Patiently waiting to see what God is going to do to all of you. You take lives for $",
        "So you can order food at fine restaurants , go to the finest places and get the best seats?  No. I am earnestly praying Jehovah Sabaoth takes your last breath from all of you with  Yawehs mightiest angels leading the way with a changing of guard for every  tattle you will lose",
        "237-189-251-104-static.reverse.queryfoundry.net",
        "181-135-182-107-static.reverse.queryfoundry.net",
        "http://51-235-245-104-static.reverse.queryfoundry.net/",
        "Traceback- Man with signal jammer/ deauther working around her today.",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "He must be very scary like Peter Theil because every attorney took case then backed off.",
        "Stop! A woman was assaulted carved up, lived with a swollen brain , maltreatment , stalkers , hitmen?",
        "On same block with HalkRender. Has close working relationship. All Palantir legal enities",
        "Absolutely zero regard for the victims who facilitate your luxury lifestyle.",
        "0-209-98-172-static.reverse.queryfoundry.net",
        "http://201-191-251-104-static.reverse.queryfoundry.net/",
        "http://36-243-60-103-static.reverse.queryfoundry.net/",
        "http://181-135-182-107-static.reverse.queryfoundry.net/",
        "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com",
        "http://0-209-98-172-static.reverse.queryfoundry.net/",
        "I\u2019ve looked through the settlement docs,  injuries caused by Jeffrey Scott Reiner DPT omitted.",
        "https://appleid.xn--appe-70a.com/",
        "http://49-116-251-162-static.reverse.queryfoundry./net/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://117-114-251-162-static.reverse.queryfoundry.net/",
        "Tsara never knew defense attorney fought & closed her worker\u2019s compensation claim",
        "http://142-232-245-104-static.reverse.queryfoundry.net/",
        "177-231-69-38-static.reverse.queryfoundry.net",
        "http://10-241-60-103-static.reverse.queryfoundry.net/",
        "This God smacked penguin ordered a settlement hearing with less than 24 hours notice for claimant.",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "You\u2019d kill to have someone else\u2019s lifestyle? May God take you out!",
        "https://www.sweetheartvideo.com/tsara-brashears",
        "HTTPS://BeeLineRouter.Net",
        "167-16-68-38-static.reverse.queryfoundry.net",
        "http://177-231-69-38-static.reverse.queryfoundry.net/",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://81-26-68-38-static.reverse.queryfoundry.net/",
        "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069",
        "8-25-220-162-static.reverse.queryfoundry.net"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win.virus.expiro",
            "Win.malware.qshell-9875653-0",
            "Mydoom",
            "Simda",
            "Other malware",
            "Trojan:win32/generic",
            "Other",
            "#virtool:win32/obfuscator.adb",
            "Juko",
            "Trojan:win32/qshell",
            "Expiro",
            "Gandcrab ransomware",
            "Win.malware.unsafe"
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Technology",
            "Telecommunications",
            "Government"
          ],
          "unique_indicators": 35811
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/smtper.co",
    "whois": "http://whois.domaintools.com/smtper.co",
    "domain": "smtper.co",
    "hostname": "frog.smtper.co"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "693148dc0eb85adc8edfe1a2",
      "name": "BeeLineRouter.Net \u2022 Isolated / Apple Baxkdoor",
      "description": "",
      "modified": "2026-01-03T07:00:45.529000",
      "created": "2025-12-04T08:39:56.180000",
      "tags": [
        "mitre att",
        "network traffic",
        "ck id",
        "show technique",
        "ck matrix",
        "threat score",
        "december",
        "default browser",
        "guest system",
        "united",
        "dynadot inc",
        "name server",
        "contacted hosts",
        "process details",
        "windir",
        "openurl c",
        "prefetch2",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "access att",
        "t1566 phishing",
        "ascii text",
        "pattern match",
        "show process",
        "t1071",
        "general",
        "local",
        "path",
        "click",
        "beelinerouter",
        "access",
        "router",
        "apple",
        "regopenkeyexw",
        "regsz",
        "process32nextw",
        "english",
        "post http",
        "search",
        "observed dns",
        "query",
        "sinkhole cookie",
        "malware",
        "possible",
        "win32",
        "updater",
        "write",
        "next",
        "found",
        "ip address",
        "domain",
        "name servers",
        "unknown ns",
        "ip whois",
        "registrar",
        "cloudflare",
        "title",
        "passive dns",
        "urls",
        "files",
        "location united",
        "asn as14618",
        "bq dec",
        "virtool",
        "backdoor",
        "checkin",
        "ipv4 add",
        "trojan",
        "dynamicloader",
        "msie",
        "windows nt",
        "slcc2",
        "media center",
        "unknown",
        "show",
        "internal",
        "encrypt",
        "veailmboprd",
        "dns query",
        "wow64",
        "gecko http",
        "entries",
        "medium",
        "ransom",
        "khtml",
        "gecko",
        "delete",
        "installer",
        "win32cve may",
        "america flag",
        "overview ip",
        "asn as20940",
        "expiration",
        "url https",
        "no expiration",
        "url http",
        "pulse show",
        "type indicator",
        "role title",
        "related pulses",
        "record value",
        "domain xn"
      ],
      "references": [
        "HTTPS://BeeLineRouter.Net",
        "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com",
        "https://appleid.xn--appe-70a.com/",
        "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://vgt.pl/r.n%20-",
        "8-25-220-162-static.reverse.queryfoundry.net",
        "queryfoundry.net",
        "http://81-26-68-38-static.reverse.queryfoundry.net/",
        "http://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://81-26-68-38-static.reverse.queryfoundry.net/",
        "http://68-178-128-104-static.reverse.queryfoundry.net/",
        "0-209-98-172-static.reverse.queryfoundry.net",
        "154-143-182-107-static.reverse.queryfoundry.net",
        "http://51-235-245-104-static.reverse.queryfoundry.net/",
        "167-16-68-38-static.reverse.queryfoundry.net",
        "http://49-116-251-162-static.reverse.queryfoundry./net/",
        "177-231-69-38-static.reverse.queryfoundry.net",
        "http://36-243-60-103-static.reverse.queryfoundry.net/",
        "http://237-189-251-104-static.reverse.queryfoundry.net/",
        "http://227-98-248-162-static.reverse.queryfoundry.net/",
        "237-189-251-104-static.reverse.queryfoundry.net",
        "http://207-214-98-172-static.reverse.queryfoundry.net/",
        "181-135-182-107-static.reverse.queryfoundry.net",
        "http://201-191-251-104-static.reverse.queryfoundry.net/",
        "67-228-69-38-static.reverse.queryfoundry.net",
        "http://0-209-98-172-static.reverse.queryfoundry.net/",
        "http://10-241-60-103-static.reverse.queryfoundry.net/",
        "http://142-232-245-104-static.reverse.queryfoundry.net/",
        "http://154-143-182-107-static.reverse.queryfoundry.net/",
        "http://167-16-68-38-static.reverse.queryfoundry.net/",
        "http://177-231-69-38-static.reverse.queryfoundry.net/",
        "http://181-135-182-107-static.reverse.queryfoundry.net/",
        "http://195-214-98-172-static.reverse.queryfoundry.net/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Simda",
          "display_name": "Simda",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        },
        {
          "id": "GandCrab Ransomware",
          "display_name": "GandCrab Ransomware",
          "target": null
        },
        {
          "id": "Win.Virus.Expiro",
          "display_name": "Win.Virus.Expiro",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "#VirTool:Win32/Obfuscator.ADB",
          "display_name": "#VirTool:Win32/Obfuscator.ADB",
          "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
        }
      ],
      "attack_ids": [
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1049,
        "URL": 5839,
        "hostname": 1944,
        "FileHash-SHA256": 3634,
        "FileHash-MD5": 310,
        "FileHash-SHA1": 295,
        "CVE": 2,
        "email": 15,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 13090,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "106 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69314920e287845f6b36a265",
      "name": "BeeLineRouter.Net  \u2022 Apple Access",
      "description": "",
      "modified": "2026-01-03T07:00:45.529000",
      "created": "2025-12-04T08:41:04.190000",
      "tags": [
        "mitre att",
        "network traffic",
        "ck id",
        "show technique",
        "ck matrix",
        "threat score",
        "december",
        "default browser",
        "guest system",
        "united",
        "dynadot inc",
        "name server",
        "contacted hosts",
        "process details",
        "windir",
        "openurl c",
        "prefetch2",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "access att",
        "t1566 phishing",
        "ascii text",
        "pattern match",
        "show process",
        "t1071",
        "general",
        "local",
        "path",
        "click",
        "beelinerouter",
        "access",
        "router",
        "apple",
        "regopenkeyexw",
        "regsz",
        "process32nextw",
        "english",
        "post http",
        "search",
        "observed dns",
        "query",
        "sinkhole cookie",
        "malware",
        "possible",
        "win32",
        "updater",
        "write",
        "next",
        "found",
        "ip address",
        "domain",
        "name servers",
        "unknown ns",
        "ip whois",
        "registrar",
        "cloudflare",
        "title",
        "passive dns",
        "urls",
        "files",
        "location united",
        "asn as14618",
        "bq dec",
        "virtool",
        "backdoor",
        "checkin",
        "ipv4 add",
        "trojan",
        "dynamicloader",
        "msie",
        "windows nt",
        "slcc2",
        "media center",
        "unknown",
        "show",
        "internal",
        "encrypt",
        "veailmboprd",
        "dns query",
        "wow64",
        "gecko http",
        "entries",
        "medium",
        "ransom",
        "khtml",
        "gecko",
        "delete",
        "installer",
        "win32cve may",
        "america flag",
        "overview ip",
        "asn as20940",
        "expiration",
        "url https",
        "no expiration",
        "url http",
        "pulse show",
        "type indicator",
        "role title",
        "related pulses",
        "record value",
        "domain xn"
      ],
      "references": [
        "HTTPS://BeeLineRouter.Net",
        "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com",
        "https://appleid.xn--appe-70a.com/",
        "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://vgt.pl/r.n%20-",
        "8-25-220-162-static.reverse.queryfoundry.net",
        "queryfoundry.net",
        "http://81-26-68-38-static.reverse.queryfoundry.net/",
        "http://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://81-26-68-38-static.reverse.queryfoundry.net/",
        "http://68-178-128-104-static.reverse.queryfoundry.net/",
        "0-209-98-172-static.reverse.queryfoundry.net",
        "154-143-182-107-static.reverse.queryfoundry.net",
        "http://51-235-245-104-static.reverse.queryfoundry.net/",
        "167-16-68-38-static.reverse.queryfoundry.net",
        "http://49-116-251-162-static.reverse.queryfoundry./net/",
        "177-231-69-38-static.reverse.queryfoundry.net",
        "http://36-243-60-103-static.reverse.queryfoundry.net/",
        "http://237-189-251-104-static.reverse.queryfoundry.net/",
        "http://227-98-248-162-static.reverse.queryfoundry.net/",
        "237-189-251-104-static.reverse.queryfoundry.net",
        "http://207-214-98-172-static.reverse.queryfoundry.net/",
        "181-135-182-107-static.reverse.queryfoundry.net",
        "http://201-191-251-104-static.reverse.queryfoundry.net/",
        "67-228-69-38-static.reverse.queryfoundry.net",
        "http://0-209-98-172-static.reverse.queryfoundry.net/",
        "http://10-241-60-103-static.reverse.queryfoundry.net/",
        "http://142-232-245-104-static.reverse.queryfoundry.net/",
        "http://154-143-182-107-static.reverse.queryfoundry.net/",
        "http://167-16-68-38-static.reverse.queryfoundry.net/",
        "http://177-231-69-38-static.reverse.queryfoundry.net/",
        "http://181-135-182-107-static.reverse.queryfoundry.net/",
        "http://195-214-98-172-static.reverse.queryfoundry.net/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Simda",
          "display_name": "Simda",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        },
        {
          "id": "GandCrab Ransomware",
          "display_name": "GandCrab Ransomware",
          "target": null
        },
        {
          "id": "Win.Virus.Expiro",
          "display_name": "Win.Virus.Expiro",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "#VirTool:Win32/Obfuscator.ADB",
          "display_name": "#VirTool:Win32/Obfuscator.ADB",
          "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
        }
      ],
      "attack_ids": [
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 310,
        "FileHash-SHA1": 295,
        "FileHash-SHA256": 3634,
        "URL": 5839,
        "CVE": 2,
        "domain": 1048,
        "email": 15,
        "hostname": 1944,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 13089,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "106 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69314926519256e3ef0a9358",
      "name": "BeeLineRouter.Net  \u2022 Apple Access",
      "description": "",
      "modified": "2026-01-03T07:00:45.529000",
      "created": "2025-12-04T08:41:06.657000",
      "tags": [
        "mitre att",
        "network traffic",
        "ck id",
        "show technique",
        "ck matrix",
        "threat score",
        "december",
        "default browser",
        "guest system",
        "united",
        "dynadot inc",
        "name server",
        "contacted hosts",
        "process details",
        "windir",
        "openurl c",
        "prefetch2",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "access att",
        "t1566 phishing",
        "ascii text",
        "pattern match",
        "show process",
        "t1071",
        "general",
        "local",
        "path",
        "click",
        "beelinerouter",
        "access",
        "router",
        "apple",
        "regopenkeyexw",
        "regsz",
        "process32nextw",
        "english",
        "post http",
        "search",
        "observed dns",
        "query",
        "sinkhole cookie",
        "malware",
        "possible",
        "win32",
        "updater",
        "write",
        "next",
        "found",
        "ip address",
        "domain",
        "name servers",
        "unknown ns",
        "ip whois",
        "registrar",
        "cloudflare",
        "title",
        "passive dns",
        "urls",
        "files",
        "location united",
        "asn as14618",
        "bq dec",
        "virtool",
        "backdoor",
        "checkin",
        "ipv4 add",
        "trojan",
        "dynamicloader",
        "msie",
        "windows nt",
        "slcc2",
        "media center",
        "unknown",
        "show",
        "internal",
        "encrypt",
        "veailmboprd",
        "dns query",
        "wow64",
        "gecko http",
        "entries",
        "medium",
        "ransom",
        "khtml",
        "gecko",
        "delete",
        "installer",
        "win32cve may",
        "america flag",
        "overview ip",
        "asn as20940",
        "expiration",
        "url https",
        "no expiration",
        "url http",
        "pulse show",
        "type indicator",
        "role title",
        "related pulses",
        "record value",
        "domain xn"
      ],
      "references": [
        "HTTPS://BeeLineRouter.Net",
        "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com",
        "https://appleid.xn--appe-70a.com/",
        "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://vgt.pl/r.n%20-",
        "8-25-220-162-static.reverse.queryfoundry.net",
        "queryfoundry.net",
        "http://81-26-68-38-static.reverse.queryfoundry.net/",
        "http://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://81-26-68-38-static.reverse.queryfoundry.net/",
        "http://68-178-128-104-static.reverse.queryfoundry.net/",
        "0-209-98-172-static.reverse.queryfoundry.net",
        "154-143-182-107-static.reverse.queryfoundry.net",
        "http://51-235-245-104-static.reverse.queryfoundry.net/",
        "167-16-68-38-static.reverse.queryfoundry.net",
        "http://49-116-251-162-static.reverse.queryfoundry./net/",
        "177-231-69-38-static.reverse.queryfoundry.net",
        "http://36-243-60-103-static.reverse.queryfoundry.net/",
        "http://237-189-251-104-static.reverse.queryfoundry.net/",
        "http://227-98-248-162-static.reverse.queryfoundry.net/",
        "237-189-251-104-static.reverse.queryfoundry.net",
        "http://207-214-98-172-static.reverse.queryfoundry.net/",
        "181-135-182-107-static.reverse.queryfoundry.net",
        "http://201-191-251-104-static.reverse.queryfoundry.net/",
        "67-228-69-38-static.reverse.queryfoundry.net",
        "http://0-209-98-172-static.reverse.queryfoundry.net/",
        "http://10-241-60-103-static.reverse.queryfoundry.net/",
        "http://142-232-245-104-static.reverse.queryfoundry.net/",
        "http://154-143-182-107-static.reverse.queryfoundry.net/",
        "http://167-16-68-38-static.reverse.queryfoundry.net/",
        "http://177-231-69-38-static.reverse.queryfoundry.net/",
        "http://181-135-182-107-static.reverse.queryfoundry.net/",
        "http://195-214-98-172-static.reverse.queryfoundry.net/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Simda",
          "display_name": "Simda",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        },
        {
          "id": "GandCrab Ransomware",
          "display_name": "GandCrab Ransomware",
          "target": null
        },
        {
          "id": "Win.Virus.Expiro",
          "display_name": "Win.Virus.Expiro",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "#VirTool:Win32/Obfuscator.ADB",
          "display_name": "#VirTool:Win32/Obfuscator.ADB",
          "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
        }
      ],
      "attack_ids": [
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 310,
        "FileHash-SHA1": 295,
        "FileHash-SHA256": 3634,
        "URL": 5839,
        "CVE": 2,
        "domain": 1048,
        "email": 15,
        "hostname": 1944,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 13089,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 146,
      "modified_text": "106 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6905d40f781d7d58d4021a20",
      "name": "Treece Alfrey Musat P.C., Chris P. Ahmann  Colorado State \u2022 Tam Legal Special Cousel for egregious acts by PT.",
      "description": "- with a primary focus on criminal defense. In both positions, he successfully defended his clients against claims running the gamut of the criminal justice system, from DUI\nand misdemeanors to felony indictments. In his criminal practice, Mr. Ahmann defends clients charged with both misdemeanor and felony cases. Mr. Ahmann continues his criminal practice as he believes that his clients deserve someone on their side to assure their voice is heard in the criminal process as well. He is dedicated to each of his clients and is always\nstriving for the best possible outcome in their individual cases. Mr. Ahmann also specializes in defense of employers in workers' compensation claims. He also assists TAM clients whose liability defense touches criminal prosecution, regularly providing effective criminal counsel in catastrophic injury common carrier matters, as well as criminal prosecution stemming from\nemployment and official acts.",
      "modified": "2025-12-20T06:00:23.758000",
      "created": "2025-11-01T09:34:07.323000",
      "tags": [
        "public tlp",
        "trojandropper",
        "other",
        "references add",
        "show",
        "provide",
        "remote",
        "t1457",
        "media content",
        "t1480",
        "subvert trust",
        "controls t1562",
        "modify tools",
        "command history",
        "ck t1027",
        "t1057",
        "discovery t1069",
        "t1071",
        "protocol t1105",
        "tool transfer",
        "t1113",
        "logging t1568",
        "t1574",
        "execution flow",
        "dll sideloading",
        "t1583",
        "ta0003",
        "ck id",
        "america",
        "att",
        "t1045",
        "capture t1140",
        "ipv4",
        "active related",
        "contact",
        "adversary",
        "tam legal",
        "qshell",
        "colorado state",
        "ahmann special",
        "counsel",
        "download",
        "ahmann",
        "university",
        "history",
        "john marshall",
        "law school",
        "special counsel",
        "christopher ahmann",
        "defense",
        "url http",
        "create new",
        "pulse provide",
        "white",
        "adversary tags",
        "add tag",
        "groups add",
        "countries add",
        "country malware",
        "trojan",
        "script urls",
        "treece alfrey",
        "meta",
        "function",
        "for privacy",
        "germany unknown",
        "united",
        "script",
        "ip address",
        "creation date",
        "date",
        "tracker",
        "null",
        "window",
        "general full",
        "reverse dns",
        "server",
        "philadelphia",
        "asn8560",
        "ionosas",
        "ionos",
        "fasthosts",
        "media",
        "telecom",
        "apache",
        "main",
        "gtagtracker",
        "gatracker",
        "brian  sabey",
        "hall render",
        "fastly error",
        "palantir",
        "special counsel",
        "gravity rat"
      ],
      "references": [
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://45.159.189.105/bot/regex \u2022\u2019 Fake Pinterest \u2022https://pin.it/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Tsara never knew defense attorney fought & closed her worker\u2019s compensation claim",
        "Traceback- Man with signal jammer/ deauther working around her today.",
        "Absolutely zero regard for the victims who facilitate your luxury lifestyle.",
        "Do you slap luxury cologne on your undeserving face paid for by money workers suffered for?",
        "You\u2019d kill to have someone else\u2019s lifestyle? May God take you out!",
        "This God smacked penguin ordered a settlement hearing with less than 24 hours notice for claimant.",
        "He began a smear campaign immediately and is directly linked to Hall Render and Palantir",
        "Doing any evil thing for mone does not compute for me.",
        "I\u2019ve looked through the settlement docs,  injuries caused by Jeffrey Scott Reiner DPT omitted.",
        "He must be very scary like Peter Theil because every attorney took case then backed off.",
        "Patiently waiting to see what God is going to do to all of you. You take lives for $",
        "Stop! A woman was assaulted carved up, lived with a swollen brain , maltreatment , stalkers , hitmen?",
        "So you can order food at fine restaurants , go to the finest places and get the best seats?  No. I am earnestly praying Jehovah Sabaoth takes your last breath from all of you with  Yawehs mightiest angels leading the way with a changing of guard for every  tattle you will lose",
        "On same block with HalkRender. Has close working relationship. All Palantir legal enities"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Other",
          "display_name": "Other",
          "target": null
        },
        {
          "id": "Win.Malware.Unsafe",
          "display_name": "Win.Malware.Unsafe",
          "target": null
        },
        {
          "id": "Juko",
          "display_name": "Juko",
          "target": null
        },
        {
          "id": "Expiro",
          "display_name": "Expiro",
          "target": null
        },
        {
          "id": "Trojan:Win32/Generic",
          "display_name": "Trojan:Win32/Generic",
          "target": "/malware/Trojan:Win32/Generic"
        },
        {
          "id": "Win.Malware.Qshell-9875653-0",
          "display_name": "Win.Malware.Qshell-9875653-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [
        "Legal",
        "Government",
        "Healthcare",
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8332,
        "domain": 4819,
        "hostname": 2165,
        "FileHash-SHA256": 7369,
        "FileHash-MD5": 474,
        "FileHash-SHA1": 470,
        "CVE": 4,
        "email": 4
      },
      "indicator_count": 23637,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "120 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6906c12b1dd6a64ab1beaa55",
      "name": "SpyNoon \u2022Chris P. Ahmann Colorado State \u2022 Tam Legal Special Cousel for egregious",
      "description": "",
      "modified": "2025-12-01T09:02:26.881000",
      "created": "2025-11-02T02:25:47.431000",
      "tags": [
        "public tlp",
        "trojandropper",
        "other",
        "references add",
        "show",
        "provide",
        "remote",
        "t1457",
        "media content",
        "t1480",
        "subvert trust",
        "controls t1562",
        "modify tools",
        "command history",
        "ck t1027",
        "t1057",
        "discovery t1069",
        "t1071",
        "protocol t1105",
        "tool transfer",
        "t1113",
        "logging t1568",
        "t1574",
        "execution flow",
        "dll sideloading",
        "t1583",
        "ta0003",
        "ck id",
        "america",
        "att",
        "t1045",
        "capture t1140",
        "ipv4",
        "active related",
        "contact",
        "adversary",
        "tam legal",
        "qshell",
        "colorado state",
        "ahmann special",
        "counsel",
        "download",
        "ahmann",
        "university",
        "history",
        "john marshall",
        "law school",
        "special counsel",
        "christopher ahmann",
        "defense",
        "url http",
        "create new",
        "pulse provide",
        "white",
        "adversary tags",
        "add tag",
        "groups add",
        "countries add",
        "country malware",
        "trojan",
        "script urls",
        "treece alfrey",
        "meta",
        "function",
        "for privacy",
        "germany unknown",
        "united",
        "script",
        "ip address",
        "creation date",
        "date",
        "tracker",
        "null",
        "window",
        "general full",
        "reverse dns",
        "server",
        "philadelphia",
        "asn8560",
        "ionosas",
        "ionos",
        "fasthosts",
        "media",
        "telecom",
        "apache",
        "main",
        "gtagtracker",
        "gatracker",
        "brian  sabey",
        "hall render",
        "fastly error",
        "palantir",
        "special counsel",
        "gravity rat"
      ],
      "references": [
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://45.159.189.105/bot/regex \u2022\u2019 Fake Pinterest \u2022https://pin.it/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Tsara never knew defense attorney fought & closed her worker\u2019s compensation claim",
        "Traceback- Man with signal jammer/ deauther working around her today.",
        "Absolutely zero regard for the victims who facilitate your luxury lifestyle.",
        "Do you slap luxury cologne on your undeserving face paid for by money workers suffered for?",
        "You\u2019d kill to have someone else\u2019s lifestyle? May God take you out!",
        "This God smacked penguin ordered a settlement hearing with less than 24 hours notice for claimant.",
        "He began a smear campaign immediately and is directly linked to Hall Render and Palantir",
        "Doing any evil thing for mone does not compute for me.",
        "I\u2019ve looked through the settlement docs,  injuries caused by Jeffrey Scott Reiner DPT omitted.",
        "He must be very scary like Peter Theil because every attorney took case then backed off.",
        "Patiently waiting to see what God is going to do to all of you. You take lives for $",
        "Stop! A woman was assaulted carved up, lived with a swollen brain , maltreatment , stalkers , hitmen?",
        "So you can order food at fine restaurants , go to the finest places and get the best seats?  No. I am earnestly praying Jehovah Sabaoth takes your last breath from all of you with  Yawehs mightiest angels leading the way with a changing of guard for every  tattle you will lose",
        "On same block with HalkRender. Has close working relationship. All Palantir legal enities"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Other",
          "display_name": "Other",
          "target": null
        },
        {
          "id": "Win.Malware.Unsafe",
          "display_name": "Win.Malware.Unsafe",
          "target": null
        },
        {
          "id": "Juko",
          "display_name": "Juko",
          "target": null
        },
        {
          "id": "Expiro",
          "display_name": "Expiro",
          "target": null
        },
        {
          "id": "Trojan:Win32/Generic",
          "display_name": "Trojan:Win32/Generic",
          "target": "/malware/Trojan:Win32/Generic"
        },
        {
          "id": "Win.Malware.Qshell-9875653-0",
          "display_name": "Win.Malware.Qshell-9875653-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [
        "Legal",
        "Government",
        "Healthcare",
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": "6905d40f781d7d58d4021a20",
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 7556,
        "domain": 4779,
        "hostname": 2053,
        "FileHash-SHA256": 7233,
        "FileHash-MD5": 474,
        "FileHash-SHA1": 470,
        "CVE": 4,
        "email": 4
      },
      "indicator_count": 22573,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "139 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69137ee5d76d486d65396af0",
      "name": "Chris P. Ahmann Colorado State \u2022 Tam Legal Special Cousel for egregious acts committed by Jeffrey S. Reimer DPT \u2022 Treece Alfrey Musat P.C., ",
      "description": "",
      "modified": "2025-12-01T09:02:26.881000",
      "created": "2025-11-11T18:22:29.976000",
      "tags": [
        "public tlp",
        "trojandropper",
        "other",
        "references add",
        "show",
        "provide",
        "remote",
        "t1457",
        "media content",
        "t1480",
        "subvert trust",
        "controls t1562",
        "modify tools",
        "command history",
        "ck t1027",
        "t1057",
        "discovery t1069",
        "t1071",
        "protocol t1105",
        "tool transfer",
        "t1113",
        "logging t1568",
        "t1574",
        "execution flow",
        "dll sideloading",
        "t1583",
        "ta0003",
        "ck id",
        "america",
        "att",
        "t1045",
        "capture t1140",
        "ipv4",
        "active related",
        "contact",
        "adversary",
        "tam legal",
        "qshell",
        "colorado state",
        "ahmann special",
        "counsel",
        "download",
        "ahmann",
        "university",
        "history",
        "john marshall",
        "law school",
        "special counsel",
        "christopher ahmann",
        "defense",
        "url http",
        "create new",
        "pulse provide",
        "white",
        "adversary tags",
        "add tag",
        "groups add",
        "countries add",
        "country malware",
        "trojan",
        "script urls",
        "treece alfrey",
        "meta",
        "function",
        "for privacy",
        "germany unknown",
        "united",
        "script",
        "ip address",
        "creation date",
        "date",
        "tracker",
        "null",
        "window",
        "general full",
        "reverse dns",
        "server",
        "philadelphia",
        "asn8560",
        "ionosas",
        "ionos",
        "fasthosts",
        "media",
        "telecom",
        "apache",
        "main",
        "gtagtracker",
        "gatracker",
        "brian  sabey",
        "hall render",
        "fastly error",
        "palantir",
        "special counsel",
        "gravity rat"
      ],
      "references": [
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://45.159.189.105/bot/regex \u2022\u2019 Fake Pinterest \u2022https://pin.it/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Tsara never knew defense attorney fought & closed her worker\u2019s compensation claim",
        "Traceback- Man with signal jammer/ deauther working around her today.",
        "Absolutely zero regard for the victims who facilitate your luxury lifestyle.",
        "Do you slap luxury cologne on your undeserving face paid for by money workers suffered for?",
        "You\u2019d kill to have someone else\u2019s lifestyle? May God take you out!",
        "This God smacked penguin ordered a settlement hearing with less than 24 hours notice for claimant.",
        "He began a smear campaign immediately and is directly linked to Hall Render and Palantir",
        "Doing any evil thing for mone does not compute for me.",
        "I\u2019ve looked through the settlement docs,  injuries caused by Jeffrey Scott Reiner DPT omitted.",
        "He must be very scary like Peter Theil because every attorney took case then backed off.",
        "Patiently waiting to see what God is going to do to all of you. You take lives for $",
        "Stop! A woman was assaulted carved up, lived with a swollen brain , maltreatment , stalkers , hitmen?",
        "So you can order food at fine restaurants , go to the finest places and get the best seats?  No. I am earnestly praying Jehovah Sabaoth takes your last breath from all of you with  Yawehs mightiest angels leading the way with a changing of guard for every  tattle you will lose",
        "On same block with HalkRender. Has close working relationship. All Palantir legal enities"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Other",
          "display_name": "Other",
          "target": null
        },
        {
          "id": "Win.Malware.Unsafe",
          "display_name": "Win.Malware.Unsafe",
          "target": null
        },
        {
          "id": "Juko",
          "display_name": "Juko",
          "target": null
        },
        {
          "id": "Expiro",
          "display_name": "Expiro",
          "target": null
        },
        {
          "id": "Trojan:Win32/Generic",
          "display_name": "Trojan:Win32/Generic",
          "target": "/malware/Trojan:Win32/Generic"
        },
        {
          "id": "Win.Malware.Qshell-9875653-0",
          "display_name": "Win.Malware.Qshell-9875653-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [
        "Legal",
        "Government",
        "Healthcare",
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": "6905d40f781d7d58d4021a20",
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 7556,
        "domain": 4779,
        "hostname": 2053,
        "FileHash-SHA256": 7233,
        "FileHash-MD5": 474,
        "FileHash-SHA1": 470,
        "CVE": 4,
        "email": 4
      },
      "indicator_count": 22573,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "139 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://frog.smtper.co/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://frog.smtper.co/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776607172.578958
}