{
  "type": "URL",
  "indicator": "https://hevea.projects.az/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://hevea.projects.az/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4090326991,
      "indicator": "https://hevea.projects.az/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "68dd9423f9208dcc8701e12e",
          "name": "Maktub Locker TOR Status Check \u2022 Cab \\ Drive by( dbi.com) Malicious pic",
          "description": "After 911 told me I was bounced to the Denver, Co Station 5 , located 45 & Peoria in Denver , Colorado , not even close. \nThe phone number changed, only 911 access. Clue: I saw an Amber alert in n target phone when I powered it on. No all notices always turned off. Made a call\non contact list and screen changed to a plain faced interface. \n\nAfter finding a mother foundry link on targets phone I grew curious about a CEO\u2019s strange story of Palantir\u2019s Karp Theil roommate situation in Law School but I could only find one picture on of them on a campus in their late 40\u2019s. He\u2019s African American mixed. The picture of his mother in hacked phone is 215 yo. No information federal oversight as CEO right? Or limited information on crazy hacked device? \n\nClicked on link then OMGness\n\n#whatIfind #onhackeddevice #targeting",
          "modified": "2025-10-31T19:03:21.338000",
          "created": "2025-10-01T20:50:43.002000",
          "tags": [
            "iocs",
            "logo",
            "passive dns",
            "related tags",
            "none google",
            "ipv4",
            "gogle",
            "twitter",
            "x.com",
            "ransomware",
            "fbi \u2019site\u2019",
            "python",
            "cloud",
            "regopenkeyexw",
            "read c",
            "port",
            "destination",
            "cryptexportkey",
            "count read",
            "tor get",
            "malware",
            "write",
            "format",
            "redacted for",
            "server",
            "privacy tech",
            "privacy admin",
            "country",
            "postal code",
            "organization",
            "date",
            "email",
            "code",
            "aaaa",
            "value a",
            "key identifier",
            "v3 serial",
            "number",
            "cus ogoogle",
            "trust",
            "cnwe1 validity",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "maktub",
            "cnc",
            "python-projekt",
            "x post",
            "link",
            "android",
            "iphone",
            "google",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "ssl certificate",
            "spawns",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "size",
            "mitre att",
            "show technique",
            "ck matrix",
            "title",
            "path",
            "hybrid",
            "general",
            "local",
            "form",
            "click",
            "strings",
            "body"
          ],
          "references": [
            "FBI.GOV - VT I\u2019m looking @ says website is legitimate & not misused - hmm",
            "Entity CLOUD14",
            "CLOUDFLARENET - 104.16.148.244 , 104.19.148.244",
            "https://otx.alienvault.com/indicator/file/ba30376f915afa868763f84299fae5d2",
            "https://hybrid-analysis.com/sample/f2b943e81f1b284cf9dabb4ff156526a02ecca485ac117714867d92b262c8fdd/68dd867e3bc50d9068072c05",
            "Hashtags left on Hybrid Analysis (above) weren\u2019t posted by me",
            "Maktub Locker TOR Status Check \u2022 TOR Consensus Data Requested \u2022 TOR 1.0 Server Key Retrieval",
            "Tor Get Server Request \u2022 TLS Handshake Failure High Priority",
            "Yara Detections: stack_string Alerts: dead_host",
            "Alerts: network_icmp nolookup_communication modifies_proxy_wpad network_cnc_http network_http",
            "Alerts: allocates_rwx creates_hidden_file dropper has_wmi protection_rx antivm_network_adapters",
            "Alerts: packer_entropy queries_programs wmi_antivm checks_debugger generates_crypto_key recon_fingerprint pe_unknown_resource_name raises_exception"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Code Virus Ransomware",
              "display_name": "Code Virus Ransomware",
              "target": null
            },
            {
              "id": "AVAST- Win32:Filecoder-AD\\ [Trj]",
              "display_name": "AVAST- Win32:Filecoder-AD\\ [Trj]",
              "target": null
            },
            {
              "id": "CLAMAV - Win.Malware.Cabby-6803812",
              "display_name": "CLAMAV - Win.Malware.Cabby-6803812",
              "target": null
            },
            {
              "id": "Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn",
              "display_name": "Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn",
              "target": "/malware/Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn"
            }
          ],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 574,
            "domain": 147,
            "FileHash-MD5": 156,
            "FileHash-SHA1": 130,
            "FileHash-SHA256": 539,
            "URL": 982,
            "SSLCertFingerprint": 4,
            "email": 2
          },
          "indicator_count": 2534,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "169 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "689af6a1704fa2745bc8c2a3",
          "name": "Hijacked Twitter / X.com account. Phishing | Abnormal use",
          "description": "Hijacked phishing Twitter/ X.com.\nWin32/Unruy.C Activity\n#phishing #hijacked #intercoms #unruy #trojan #VTflood #malware #attack",
          "modified": "2025-09-11T08:02:36.759000",
          "created": "2025-08-12T08:09:05.642000",
          "tags": [
            "log id",
            "gmtn",
            "secure",
            "tls web",
            "passive dns",
            "urls",
            "path",
            "self",
            "encrypt",
            "ca issuers",
            "false",
            "search",
            "read c",
            "united",
            "entries",
            "show",
            "showing",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "copy",
            "write",
            "suspicious",
            "malware",
            "unknown",
            "process32nextw",
            "shellexecuteexw",
            "medium process",
            "discovery t1057",
            "t1057",
            "discovery",
            "medium",
            "locally unique",
            "identifier",
            "veailmboprd",
            "next associated",
            "ipv4 add",
            "pulse pulses",
            "files",
            "asn as13335",
            "dns resolutions",
            "domains top",
            "smoke loader",
            "trojan",
            "body",
            "learn",
            "ck id",
            "name tactics",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "show process",
            "programfiles",
            "command decode",
            "flag",
            "suricata ipv4",
            "mitre att",
            "show technique",
            "ck matrix",
            "date",
            "comspec",
            "model",
            "twitter",
            "august",
            "hybrid",
            "general",
            "click",
            "strings"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1504,
            "FileHash-SHA256": 1232,
            "SSLCertFingerprint": 14,
            "domain": 245,
            "hostname": 526,
            "FileHash-MD5": 43,
            "FileHash-SHA1": 38
          },
          "indicator_count": 3602,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "220 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6893eee9bf1b30e08d1a6d8e",
          "name": "Ransom:Win32/CVE - Denver \u2022 Community Lifestyle Neighborhood",
          "description": "*Ransom:Win32/CVE - * Win.Dropper.Stone-9856966-0,\nDenver \u2022 Community Lifestyle Neighborhood. \nCorporate & Leasing Office corrupted with spyware. There is a single verified monitored target. All technology devices corrupted, at least 2 phones monitored, YouTube is courtesy of hackers. Several in person and phone investigations, staff change and they know nothing about leasing apartments, townhomes , etiquette, poor communication. Target also investigated. It appears to be harassment, intimidation and monitoring for unspecified reasons. The parking lot is stacked with obvious people sitting in their vehicles for hours. It\u2019s unclear if the staffing change is legitimate or part of an investigation.",
          "modified": "2025-09-05T23:02:52.811000",
          "created": "2025-08-07T00:10:17.696000",
          "tags": [
            "address google",
            "safe browsing",
            "united",
            "typeof",
            "passive dns",
            "body doctype",
            "nreum",
            "date",
            "gmt server",
            "apache x",
            "cnection",
            "content type",
            "span",
            "ok transfer",
            "encoding",
            "x powered",
            "unknown soa",
            "unknown ns",
            "showing",
            "entries",
            "next associated",
            "urls show",
            "body",
            "encrypt",
            "search",
            "ip address",
            "creation date",
            "record value",
            "present jul",
            "present may",
            "present apr",
            "certificate",
            "present aug",
            "present feb",
            "present dec",
            "present nov",
            "error",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "found",
            "development att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "mitre att",
            "show technique",
            "ck matrix",
            "pattern match",
            "ascii text",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "itre att",
            "accept",
            "sha256",
            "size",
            "type data",
            "utf8 text",
            "document file",
            "flag",
            "server",
            "european union",
            "name server",
            "tor analysis",
            "dns requests",
            "domain address",
            "ii llc",
            "windir",
            "openurl c",
            "prefetch2",
            "show process",
            "ogoogle trust",
            "network traffic",
            "organization",
            "elton avundano",
            "object",
            "title object",
            "header http2",
            "returnurl",
            "texas",
            "rsa ov",
            "ssl ca",
            "status",
            "australia",
            "netherlands",
            "urls",
            "gmt path",
            "hostname add",
            "pulse submit",
            "present oct",
            "e safe",
            "results jul",
            "response ip",
            "present jan",
            "name servers",
            "verdict",
            "domain",
            "files ip",
            "address domain",
            "xhr start",
            "xhr load",
            "aaaa",
            "read c",
            "show",
            "port",
            "destination",
            "high",
            "delete",
            "outbound m3",
            "copy",
            "write",
            "persistence",
            "execution",
            "malware",
            "generic",
            "unknown",
            "present mar",
            "dynamicloader",
            "wine emulator",
            "dynamic",
            "medium",
            "read",
            "associated urls",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "dnssec",
            "domain name",
            "solutions",
            "llc status",
            "next passive",
            "dns status",
            "hostname query",
            "files show",
            "date hash",
            "avast avg",
            "overview ip",
            "address",
            "related nids",
            "files location",
            "flag united",
            "hostname",
            "files domain",
            "win32",
            "mtb feb",
            "trojan",
            "susp",
            "trojandropper",
            "msr feb",
            "trojanspy",
            "virtool",
            "win64",
            "defense evasion",
            "t1480 execution",
            "file defense",
            "null",
            "refresh",
            "tools",
            "look",
            "verify",
            "restart",
            "file discovery",
            "utf8",
            "crlf line",
            "a domains",
            "script urls",
            "link",
            "unknown aaaa",
            "meta",
            "atom",
            "results jan",
            "present",
            "present sep",
            "akamai",
            "asn as16625",
            "less whois",
            "registrar",
            "http",
            "france flag",
            "france hostname",
            "files related",
            "url analysis",
            "files",
            "location france",
            "detailed error",
            "sec ch",
            "ch ua",
            "ua full",
            "ua platform",
            "moved",
            "name",
            "perfect privacy",
            "error jul",
            "next related",
            "domains show",
            "domain related",
            "url add",
            "pulse pulses",
            "hosting",
            "reverse dns",
            "france asn",
            "as16276",
            "dns resolutions",
            "datacenter",
            "regopenkeyexa",
            "regsetvalueexa",
            "windows nt",
            "regdword",
            "hostile",
            "service",
            "delphi",
            "next",
            "pulses none",
            "related tags",
            "ua bitness",
            "ua arch",
            "version sec",
            "mobile sec",
            "model sec",
            "review",
            "data upload",
            "extraction",
            "khtml",
            "gecko",
            "olet",
            "cnlet",
            "tlsv1",
            "hacktool",
            "push",
            "ms windows",
            "intel",
            "pe32",
            "users",
            "precreate read",
            "ransom",
            "code",
            "installer",
            "june",
            "media",
            "autorun",
            "next yara",
            "detections name",
            "aspackv2xxx",
            "eu alexey",
            "alerts",
            "pe file",
            "filehash",
            "sha256 add",
            "av detections",
            "ids detections",
            "yara detections",
            "analysis date",
            "april",
            "packing t1045",
            "t1045",
            "t1060",
            "registry run",
            "keys",
            "user execution",
            "icmp traffic"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1091",
              "name": "Replication Through Removable Media",
              "display_name": "T1091 - Replication Through Removable Media"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1132,
            "URL": 6245,
            "hostname": 2264,
            "FileHash-SHA256": 1857,
            "FileHash-SHA1": 491,
            "email": 9,
            "FileHash-MD5": 573,
            "SSLCertFingerprint": 16
          },
          "indicator_count": 12587,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "225 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6892e73b32af18aa302df0dc",
          "name": "Part 1.5",
          "description": "Dark web media \u2022 Political news \u2022 Malvertizing\nlocate \u2022\ntrack [stalk] \u2022 record calls \u2022 control media [youtube , etc] http://t.name?n[++i]=e:this.removeEventListener\t\t\nJeeng &\nPowebox [ accidentally left out in original post pulse]",
          "modified": "2025-09-05T04:03:06.929000",
          "created": "2025-08-06T05:25:15.369000",
          "tags": [
            "chromeua",
            "optout",
            "object",
            "path",
            "value",
            "access type",
            "setval",
            "windir",
            "localappdata",
            "null",
            "win64",
            "error",
            "generator",
            "close",
            "roboto",
            "date",
            "format",
            "light",
            "span",
            "template",
            "void",
            "android",
            "body",
            "trident",
            "mexico",
            "sonic",
            "black",
            "critical",
            "desktop",
            "dark",
            "meta",
            "this",
            "june",
            "hybrid",
            "apache",
            "write",
            "crypto",
            "autodetect",
            "face",
            "courier",
            "gigi",
            "impact",
            "shadow",
            "click",
            "strings",
            "cray",
            "smwg",
            "eret",
            "footer",
            "infinity",
            "window",
            "canvas",
            "legend",
            "nuke",
            "lion",
            "4629",
            "ahav",
            "olsa",
            "false",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "file defense",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "script",
            "mitre att",
            "pattern match",
            "show technique",
            "iframe",
            "refresh",
            "august",
            "general",
            "local",
            "tools",
            "demo",
            "look",
            "verify",
            "restart",
            "url http",
            "small",
            "pulses url",
            "tellyoun",
            "showing",
            "entries",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "cc08",
            "f06a6b",
            "sfurl",
            "filehashsha256",
            "types",
            "indicators show",
            "search",
            "pulses",
            "filehashsha1",
            "adversaries",
            "found",
            "webp image",
            "ascii text",
            "riff",
            "size",
            "encrypt",
            "legacy",
            "filehashmd5",
            "united",
            "flag",
            "server",
            "markmonitor",
            "name server",
            "llc name",
            "overview dns",
            "requests domain",
            "country",
            "win32",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "medium risk",
            "yara",
            "detections",
            "malware",
            "copy",
            "show",
            "icmp traffic",
            "packing t1045",
            "t1045",
            "pdb path",
            "pe resource",
            "extraction",
            "data upload",
            "enter sc",
            "type",
            "extra data",
            "please",
            "failed",
            "review",
            "exclude data",
            "included review",
            "ic data",
            "suggeste",
            "stop",
            "type onow",
            "domain",
            "passive dns",
            "urls",
            "files related",
            "pulses none",
            "related tags",
            "none google",
            "safe browsing",
            "sc data",
            "extr amanuav",
            "review included",
            "manualy",
            "sugges excluded",
            "filehash",
            "md5 add",
            "pulse pulses",
            "url add",
            "http",
            "hostname",
            "files domain",
            "pulses otx",
            "virustotal",
            "hsmi192547107",
            "pulses hostname",
            "r dec",
            "customer dec",
            "iski dec",
            "decision dec",
            "va dec",
            "bitcoin",
            "bitcoin dec",
            "petra",
            "torstatus dec",
            "paul dec",
            "sodesc",
            "planet dec",
            "emilia",
            "heroin dec",
            "difference dec",
            "palantir dec",
            "loraxlive dec",
            "chaturbate dec",
            "sandra",
            "free dec",
            "marvel dec",
            "benjis dec",
            "fresh dec",
            "sodesc dec",
            "srdirport",
            "srhostname",
            "link dec",
            "types of",
            "italy",
            "china",
            "australia",
            "france",
            "turkey",
            "discovery",
            "information",
            "ck ids",
            "t1005",
            "local system",
            "t1007",
            "system service",
            "part",
            "track",
            "locate",
            "political",
            "civil society",
            "news",
            "created",
            "hours ago",
            "report spam",
            "t1555",
            "password",
            "t1560",
            "collected data",
            "t1573",
            "channel",
            "t1574",
            "execution flow",
            "scan",
            "iocs",
            "t1497",
            "u0lhmq",
            "mtawmq",
            "t1480",
            "guardrails",
            "t1486",
            "data encrypted",
            "learn more",
            "unsubscribe aug",
            "protocol",
            "t1074",
            "staged",
            "t1083",
            "t1102",
            "web service",
            "t1105",
            "tool transfer",
            "t1140",
            "data engineer",
            "candidate",
            "tlsv1",
            "odigicert inc",
            "stcalifornia",
            "lsan jose",
            "oadobe systems",
            "incorporated",
            "cndigicert sha2",
            "push",
            "next",
            "high",
            "write c",
            "ireland as16509",
            "delete",
            "dirty",
            "tags",
            "t1012",
            "flow endpoint",
            "security scan",
            "t1106",
            "copyright",
            "levelblue"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1007",
              "name": "System Service Discovery",
              "display_name": "T1007 - System Service Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1074",
              "name": "Data Staged",
              "display_name": "T1074 - Data Staged"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1120",
              "name": "Peripheral Device Discovery",
              "display_name": "T1120 - Peripheral Device Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1486",
              "name": "Data Encrypted for Impact",
              "display_name": "T1486 - Data Encrypted for Impact"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 608,
            "FileHash-SHA1": 433,
            "FileHash-SHA256": 3663,
            "URL": 17104,
            "domain": 1316,
            "email": 39,
            "hostname": 4208,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 27388,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "226 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6882e2a53af80b1af320079d",
          "name": "VirusTotal - Palantir- KrunchyMalPacker | Vflooder",
          "description": "-> Hostname: \u2022 edenglobalpartners.palantirfoundry.com\n\u2022 c.twitterintegration.com\n*Trojan:Win32/Vflooder.E\nIDS Detections:\n- Win32/Flooder.Agent.NAS CnC Domain in DNS Lookup\n\u2022 Virus Total vtapi DOS\n\u2022 Generic HTTP EXE Upload Inbound\n\u2022 Observed Suspicious UA (Mozilla/5.0)\n\u2022 Generic HTTP EXE Upload Outbound || \n*ALF:HSTR:KrunchyMalPacker!MTB\t\n IDS Detections\n-Win32/Vflooder.B Checkin\n\u2022 TLS Handshake Failure\nYara Detections: \nkkrunchy023alpha2\nAlerts:\n\u2022 static_pe_anomaly\n\u2022 suricata_alert\n\u2022 dynamic_function_loading\n\u2022 network_cnc_https_generic\n\u2022 reads_self\n\u2022 network_cnc_http\n\u2022 network_http\n\u2022 packer_unknown_pe_section_name\n\u2022 packer_entropy\n\u2022 injection_rwx ||\n__________\nIP\u2019s Contacted:\n\u2022 34.54.88.138\n\u2022 162.159.140.229\nDomains Contacted\n\u2022 twitter.com (SBKA - Palantir?)\n\u2022 www.virustotal.com\n#botnetresulttesting #virustotal_unsafe #vtflooder #palantir #twitter #gotham foundry #brian_sabey_has_a_new_toy #targeting #tsara_brashears",
          "modified": "2025-08-24T01:04:01.801000",
          "created": "2025-07-25T01:49:25.325000",
          "tags": [
            "windows nt",
            "dynamicloader",
            "contentlength",
            "tls handshake",
            "failure",
            "host",
            "show",
            "medium",
            "search",
            "entries",
            "copy",
            "write",
            "malware",
            "generic http",
            "exe upload",
            "inbound",
            "outbound",
            "domain",
            "trojan",
            "u0019",
            "trojandropper",
            "backdoor",
            "mtb jul",
            "united",
            "passive dns",
            "open ports",
            "win32berbew jul",
            "ipv4 add",
            "present jul",
            "present jun",
            "cname",
            "present aug",
            "present sep",
            "status",
            "certificate",
            "date",
            "twitter",
            "unknown ns",
            "name servers",
            "servers",
            "showing",
            "urls",
            "creation date"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1903,
            "hostname": 806,
            "FileHash-SHA256": 1594,
            "FileHash-MD5": 264,
            "FileHash-SHA1": 297,
            "SSLCertFingerprint": 1,
            "domain": 515,
            "email": 5
          },
          "indicator_count": 5385,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "238 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687b5499d48de6e54f3bff11",
          "name": "213.174.130.70 - Spyware Install  | Emotet via Malware sites",
          "description": "Malicious IP address for multiple malware domains. Very malicious spyware, will hijack network and devices. \n\u2022 Best Targeted sites \nSpyware Install\n\u2022 Garveep POST CnC\nBeacon\n\u2022 Worm.Mydoom\nCheckin\n\n#endgame #emotet #mydoom #malware_domains #install_spyware #monitered_targets",
          "modified": "2025-08-18T08:00:43.712000",
          "created": "2025-07-19T08:17:29.443000",
          "tags": [
            "handle",
            "ripe ncc",
            "ripe network",
            "address range",
            "cidr",
            "allocation type",
            "assigned pa",
            "status",
            "whois server",
            "entity ah36ripe",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "number",
            "cgb stgreater",
            "cnsectigo rsa",
            "secure server",
            "ca validity",
            "date",
            "abuse contact",
            "orgid",
            "orgtechhandle",
            "address",
            "orgabuseref",
            "postalcode",
            "ripe",
            "seen",
            "update date",
            "tech email",
            "admin country",
            "expiration date",
            "dnssec",
            "admin id",
            "mi11255597wp",
            "msie",
            "chrome",
            "passive dns",
            "united",
            "ipv4 add",
            "pulse submit",
            "url analysis",
            "urls",
            "files",
            "hosting",
            "open",
            "body",
            "extraction",
            "data upload",
            "failed",
            "include review",
            "anorexx",
            "video",
            "father sex",
            "ebony riding",
            "ebony",
            "roberta",
            "type win32",
            "exe size",
            "mb first",
            "file name",
            "sentinelone",
            "present jul",
            "present oct",
            "entries http",
            "memcommit",
            "t1055",
            "read c",
            "search",
            "entries",
            "show",
            "medium",
            "showing",
            "high process",
            "injection t1055",
            "copy",
            "write",
            "win32",
            "malware",
            "tsara brashears",
            "tsara",
            "pornhub",
            "porn videos",
            "watch tsara",
            "most relevant",
            "open threat",
            "exchange",
            "public",
            "https",
            "green",
            "daily",
            "brashears",
            "porn",
            "watch",
            "busty xxx",
            "filter tsara",
            "brashears porn",
            "url add",
            "pulse pulses",
            "http",
            "related pulses",
            "none related",
            "tags none",
            "file type",
            "md5 sha256",
            "google safe",
            "browsing",
            "dynamicloader",
            "dynamic",
            "read",
            "delete",
            "mtb apr",
            "trojan",
            "lowfi",
            "virtool",
            "icloader apr",
            "otx telemetry",
            "australia",
            "exploit",
            "cobalt strike",
            "hostile",
            "trojanspy",
            "msil",
            "win64",
            "pulse",
            "alerts",
            "yara rule",
            "named pipe",
            "xe7xf3xf2x14x9d",
            "high",
            "delphi",
            "local",
            "next",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "defense evasion",
            "adversaries",
            "spawns",
            "found",
            "process details",
            "flag",
            "contacted",
            "meta",
            "location united",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "sha1",
            "size",
            "beginstring",
            "null",
            "type data",
            "error",
            "span",
            "hybrid",
            "general",
            "click",
            "strings",
            "refresh",
            "tools",
            "pattern match",
            "show technique",
            "mitre att",
            "ck matrix",
            "ascii text",
            "show process",
            "utf8",
            "crlf line",
            "network traffic",
            "path",
            "included",
            "review",
            "excludea",
            "sugges data",
            "typ url",
            "url url",
            "url hos",
            "hos hos",
            "extraction f",
            "enter so",
            "u extractio",
            "extra data",
            "included review",
            "ic excluded",
            "suggeste",
            "pulses",
            "md5 google",
            "safe browsing",
            "virustotal api",
            "comments",
            "ally s",
            "extraction data",
            "enter soudcfidi",
            "ad temdac",
            "cddad ad",
            "praw type",
            "extr",
            "include u",
            "creation date",
            "record value",
            "gmt content",
            "x adblock",
            "certificate",
            "domain",
            "encrypt",
            "sec ch",
            "ch ua",
            "unknown aaaa",
            "ua full",
            "ua platform",
            "present jun",
            "moved",
            "ip address",
            "doctype html",
            "lander script",
            "head",
            "method",
            "allowed date",
            "arizona",
            "scottsdale",
            "go daddy",
            "authority",
            "next associated",
            "extraction fail",
            "enter soupce",
            "udi ad",
            "trydda dada",
            "panca type",
            "ur extraction",
            "s data",
            "pr extract",
            "servers",
            "hostname",
            "files ip",
            "denmark unknown"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 4,
            "URL": 7528,
            "domain": 1822,
            "hostname": 2015,
            "email": 5,
            "FileHash-MD5": 373,
            "FileHash-SHA1": 363,
            "FileHash-SHA256": 1939
          },
          "indicator_count": 14049,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "244 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68732864356c4353e0b1efe2",
          "name": "Denver Post - Custom Malware | Xord",
          "description": "YARA Detections:\n\u2022 xord_nopsled_in_jquery\ncompromised_site_redirector_fromcharcode\n\u2022 KnownMaliciousObfuscationPattern\n\u2022 WebExploit | \nAlerts:\n\u2022 ransomware_file_modifications\n\u2022 script_created_process\n\u2022 antivm_generic_disk\n\u2022 infostealer_cookies\n\u2022 suspicious_command\n\u2022 dead_host\n\u2022 suspicious_write_exe\n\u2022 network_icmp\n\u2022 modifies_certificates\n\u2022 process_martian\n* Malware IP - \n142.251.215.232",
          "modified": "2025-08-12T03:05:26.037000",
          "created": "2025-07-13T03:30:44.589000",
          "tags": [
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses",
            "entries",
            "url http",
            "domain",
            "ipv4",
            "filehashsha256",
            "hostname",
            "types of",
            "united kingdom",
            "united",
            "germany",
            "france",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "extraction",
            "data upload",
            "failed",
            "se extraction",
            "enter sc",
            "type",
            "extra data",
            "please",
            "include review",
            "exclude sugges",
            "type ol",
            "please sub",
            "langes",
            "include",
            "review data",
            "extrad",
            "manually add",
            "indicator",
            "sc type",
            "included iocs",
            "se extr",
            "review exclude",
            "sugges",
            "extract data",
            "add indicator",
            "domain related",
            "showing",
            "tewdida data",
            "present jul",
            "script urls",
            "a domains",
            "present jun",
            "search",
            "accept encoding",
            "unknown aaaa",
            "present may",
            "date",
            "meta",
            "body",
            "ipv6",
            "role",
            "present jan",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "regexp",
            "typeof e",
            "typeof t",
            "function",
            "width",
            "error",
            "object",
            "x20trnf",
            "pseudo",
            "child",
            "form",
            "class",
            "null",
            "write",
            "this",
            "void",
            "accept",
            "copy",
            "extr please",
            "typ data",
            "indicalok no",
            "gmt max",
            "reverse dns",
            "location united",
            "america flag",
            "ashburn",
            "america asn",
            "dns resolutions",
            "domains top",
            "extri please",
            "review",
            "sugges data",
            "find suxesteu",
            "typ indical",
            "on hos",
            "dynamicloader",
            "medium",
            "show",
            "high",
            "windows",
            "cmd c",
            "delete",
            "next",
            "unknown",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "read c",
            "as15169",
            "execution",
            "dock",
            "persistence",
            "malware",
            "roboto",
            "fwlink",
            "powershell",
            "delete c",
            "guard",
            "win32",
            "passive dns",
            "ransom",
            "trojan",
            "gmt cache",
            "sameorigin",
            "443 ma2592000",
            "pulse",
            "trojandropper",
            "worm",
            "ur extraction",
            "find",
            "types",
            "seard data",
            "source se",
            "url toi",
            "ela fer",
            "iocs",
            "search otx",
            "extr",
            "indicators h",
            "weall",
            "indica",
            "sc data",
            "data u",
            "extre",
            "find s",
            "onv incmde",
            "exclude data",
            "suggested",
            "typ no"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3107,
            "domain": 526,
            "hostname": 940,
            "FileHash-SHA256": 2209,
            "email": 2,
            "FileHash-MD5": 80,
            "FileHash-SHA1": 31,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 6906,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "250 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68732869bad70de69c45c1b3",
          "name": "Denver Post - Custom Malware | Xord",
          "description": "YARA Detections:\n\u2022 xord_nopsled_in_jquery\ncompromised_site_redirector_fromcharcode\n\u2022 KnownMaliciousObfuscationPattern\n\u2022 WebExploit | \nAlerts:\n\u2022 ransomware_file_modifications\n\u2022 script_created_process\n\u2022 antivm_generic_disk\n\u2022 infostealer_cookies\n\u2022 suspicious_command\n\u2022 dead_host\n\u2022 suspicious_write_exe\n\u2022 network_icmp\n\u2022 modifies_certificates\n\u2022 process_martian\n* Malware IP - \n142.251.215.232",
          "modified": "2025-08-12T03:05:26.037000",
          "created": "2025-07-13T03:30:49.347000",
          "tags": [
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses",
            "entries",
            "url http",
            "domain",
            "ipv4",
            "filehashsha256",
            "hostname",
            "types of",
            "united kingdom",
            "united",
            "germany",
            "france",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "extraction",
            "data upload",
            "failed",
            "se extraction",
            "enter sc",
            "type",
            "extra data",
            "please",
            "include review",
            "exclude sugges",
            "type ol",
            "please sub",
            "langes",
            "include",
            "review data",
            "extrad",
            "manually add",
            "indicator",
            "sc type",
            "included iocs",
            "se extr",
            "review exclude",
            "sugges",
            "extract data",
            "add indicator",
            "domain related",
            "showing",
            "tewdida data",
            "present jul",
            "script urls",
            "a domains",
            "present jun",
            "search",
            "accept encoding",
            "unknown aaaa",
            "present may",
            "date",
            "meta",
            "body",
            "ipv6",
            "role",
            "present jan",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "regexp",
            "typeof e",
            "typeof t",
            "function",
            "width",
            "error",
            "object",
            "x20trnf",
            "pseudo",
            "child",
            "form",
            "class",
            "null",
            "write",
            "this",
            "void",
            "accept",
            "copy",
            "extr please",
            "typ data",
            "indicalok no",
            "gmt max",
            "reverse dns",
            "location united",
            "america flag",
            "ashburn",
            "america asn",
            "dns resolutions",
            "domains top",
            "extri please",
            "review",
            "sugges data",
            "find suxesteu",
            "typ indical",
            "on hos",
            "dynamicloader",
            "medium",
            "show",
            "high",
            "windows",
            "cmd c",
            "delete",
            "next",
            "unknown",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "read c",
            "as15169",
            "execution",
            "dock",
            "persistence",
            "malware",
            "roboto",
            "fwlink",
            "powershell",
            "delete c",
            "guard",
            "win32",
            "passive dns",
            "ransom",
            "trojan",
            "gmt cache",
            "sameorigin",
            "443 ma2592000",
            "pulse",
            "trojandropper",
            "worm",
            "ur extraction",
            "find",
            "types",
            "seard data",
            "source se",
            "url toi",
            "ela fer",
            "iocs",
            "search otx",
            "extr",
            "indicators h",
            "weall",
            "indica",
            "sc data",
            "data u",
            "extre",
            "find s",
            "onv incmde",
            "exclude data",
            "suggested",
            "typ no"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3107,
            "domain": 526,
            "hostname": 940,
            "FileHash-SHA256": 2209,
            "email": 2,
            "FileHash-MD5": 80,
            "FileHash-SHA1": 31,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 6906,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "250 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Tor Get Server Request \u2022 TLS Handshake Failure High Priority",
        "Maktub Locker TOR Status Check \u2022 TOR Consensus Data Requested \u2022 TOR 1.0 Server Key Retrieval",
        "https://hybrid-analysis.com/sample/f2b943e81f1b284cf9dabb4ff156526a02ecca485ac117714867d92b262c8fdd/68dd867e3bc50d9068072c05",
        "https://otx.alienvault.com/indicator/file/ba30376f915afa868763f84299fae5d2",
        "Entity CLOUD14",
        "Alerts: allocates_rwx creates_hidden_file dropper has_wmi protection_rx antivm_network_adapters",
        "Alerts: packer_entropy queries_programs wmi_antivm checks_debugger generates_crypto_key recon_fingerprint pe_unknown_resource_name raises_exception",
        "Yara Detections: stack_string Alerts: dead_host",
        "FBI.GOV - VT I\u2019m looking @ says website is legitimate & not misused - hmm",
        "Hashtags left on Hybrid Analysis (above) weren\u2019t posted by me",
        "CLOUDFLARENET - 104.16.148.244 , 104.19.148.244",
        "Alerts: network_icmp nolookup_communication modifies_proxy_wpad network_cnc_http network_http"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Ms defender - trojandownloader:win32/dalexis!rfn!rfn",
            "Avast- win32:filecoder-ad\\ [trj]",
            "Clamav - win.malware.cabby-6803812",
            "Code virus ransomware"
          ],
          "industries": [],
          "unique_indicators": 67658
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/projects.az",
    "whois": "http://whois.domaintools.com/projects.az",
    "domain": "projects.az",
    "hostname": "hevea.projects.az"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "68dd9423f9208dcc8701e12e",
      "name": "Maktub Locker TOR Status Check \u2022 Cab \\ Drive by( dbi.com) Malicious pic",
      "description": "After 911 told me I was bounced to the Denver, Co Station 5 , located 45 & Peoria in Denver , Colorado , not even close. \nThe phone number changed, only 911 access. Clue: I saw an Amber alert in n target phone when I powered it on. No all notices always turned off. Made a call\non contact list and screen changed to a plain faced interface. \n\nAfter finding a mother foundry link on targets phone I grew curious about a CEO\u2019s strange story of Palantir\u2019s Karp Theil roommate situation in Law School but I could only find one picture on of them on a campus in their late 40\u2019s. He\u2019s African American mixed. The picture of his mother in hacked phone is 215 yo. No information federal oversight as CEO right? Or limited information on crazy hacked device? \n\nClicked on link then OMGness\n\n#whatIfind #onhackeddevice #targeting",
      "modified": "2025-10-31T19:03:21.338000",
      "created": "2025-10-01T20:50:43.002000",
      "tags": [
        "iocs",
        "logo",
        "passive dns",
        "related tags",
        "none google",
        "ipv4",
        "gogle",
        "twitter",
        "x.com",
        "ransomware",
        "fbi \u2019site\u2019",
        "python",
        "cloud",
        "regopenkeyexw",
        "read c",
        "port",
        "destination",
        "cryptexportkey",
        "count read",
        "tor get",
        "malware",
        "write",
        "format",
        "redacted for",
        "server",
        "privacy tech",
        "privacy admin",
        "country",
        "postal code",
        "organization",
        "date",
        "email",
        "code",
        "aaaa",
        "value a",
        "key identifier",
        "v3 serial",
        "number",
        "cus ogoogle",
        "trust",
        "cnwe1 validity",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "maktub",
        "cnc",
        "python-projekt",
        "x post",
        "link",
        "android",
        "iphone",
        "google",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "ssl certificate",
        "spawns",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "size",
        "mitre att",
        "show technique",
        "ck matrix",
        "title",
        "path",
        "hybrid",
        "general",
        "local",
        "form",
        "click",
        "strings",
        "body"
      ],
      "references": [
        "FBI.GOV - VT I\u2019m looking @ says website is legitimate & not misused - hmm",
        "Entity CLOUD14",
        "CLOUDFLARENET - 104.16.148.244 , 104.19.148.244",
        "https://otx.alienvault.com/indicator/file/ba30376f915afa868763f84299fae5d2",
        "https://hybrid-analysis.com/sample/f2b943e81f1b284cf9dabb4ff156526a02ecca485ac117714867d92b262c8fdd/68dd867e3bc50d9068072c05",
        "Hashtags left on Hybrid Analysis (above) weren\u2019t posted by me",
        "Maktub Locker TOR Status Check \u2022 TOR Consensus Data Requested \u2022 TOR 1.0 Server Key Retrieval",
        "Tor Get Server Request \u2022 TLS Handshake Failure High Priority",
        "Yara Detections: stack_string Alerts: dead_host",
        "Alerts: network_icmp nolookup_communication modifies_proxy_wpad network_cnc_http network_http",
        "Alerts: allocates_rwx creates_hidden_file dropper has_wmi protection_rx antivm_network_adapters",
        "Alerts: packer_entropy queries_programs wmi_antivm checks_debugger generates_crypto_key recon_fingerprint pe_unknown_resource_name raises_exception"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Code Virus Ransomware",
          "display_name": "Code Virus Ransomware",
          "target": null
        },
        {
          "id": "AVAST- Win32:Filecoder-AD\\ [Trj]",
          "display_name": "AVAST- Win32:Filecoder-AD\\ [Trj]",
          "target": null
        },
        {
          "id": "CLAMAV - Win.Malware.Cabby-6803812",
          "display_name": "CLAMAV - Win.Malware.Cabby-6803812",
          "target": null
        },
        {
          "id": "Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn",
          "display_name": "Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn",
          "target": "/malware/Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn"
        }
      ],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 574,
        "domain": 147,
        "FileHash-MD5": 156,
        "FileHash-SHA1": 130,
        "FileHash-SHA256": 539,
        "URL": 982,
        "SSLCertFingerprint": 4,
        "email": 2
      },
      "indicator_count": 2534,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "169 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "689af6a1704fa2745bc8c2a3",
      "name": "Hijacked Twitter / X.com account. Phishing | Abnormal use",
      "description": "Hijacked phishing Twitter/ X.com.\nWin32/Unruy.C Activity\n#phishing #hijacked #intercoms #unruy #trojan #VTflood #malware #attack",
      "modified": "2025-09-11T08:02:36.759000",
      "created": "2025-08-12T08:09:05.642000",
      "tags": [
        "log id",
        "gmtn",
        "secure",
        "tls web",
        "passive dns",
        "urls",
        "path",
        "self",
        "encrypt",
        "ca issuers",
        "false",
        "search",
        "read c",
        "united",
        "entries",
        "show",
        "showing",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "copy",
        "write",
        "suspicious",
        "malware",
        "unknown",
        "process32nextw",
        "shellexecuteexw",
        "medium process",
        "discovery t1057",
        "t1057",
        "discovery",
        "medium",
        "locally unique",
        "identifier",
        "veailmboprd",
        "next associated",
        "ipv4 add",
        "pulse pulses",
        "files",
        "asn as13335",
        "dns resolutions",
        "domains top",
        "smoke loader",
        "trojan",
        "body",
        "learn",
        "ck id",
        "name tactics",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "show process",
        "programfiles",
        "command decode",
        "flag",
        "suricata ipv4",
        "mitre att",
        "show technique",
        "ck matrix",
        "date",
        "comspec",
        "model",
        "twitter",
        "august",
        "hybrid",
        "general",
        "click",
        "strings"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1504,
        "FileHash-SHA256": 1232,
        "SSLCertFingerprint": 14,
        "domain": 245,
        "hostname": 526,
        "FileHash-MD5": 43,
        "FileHash-SHA1": 38
      },
      "indicator_count": 3602,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "220 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6893eee9bf1b30e08d1a6d8e",
      "name": "Ransom:Win32/CVE - Denver \u2022 Community Lifestyle Neighborhood",
      "description": "*Ransom:Win32/CVE - * Win.Dropper.Stone-9856966-0,\nDenver \u2022 Community Lifestyle Neighborhood. \nCorporate & Leasing Office corrupted with spyware. There is a single verified monitored target. All technology devices corrupted, at least 2 phones monitored, YouTube is courtesy of hackers. Several in person and phone investigations, staff change and they know nothing about leasing apartments, townhomes , etiquette, poor communication. Target also investigated. It appears to be harassment, intimidation and monitoring for unspecified reasons. The parking lot is stacked with obvious people sitting in their vehicles for hours. It\u2019s unclear if the staffing change is legitimate or part of an investigation.",
      "modified": "2025-09-05T23:02:52.811000",
      "created": "2025-08-07T00:10:17.696000",
      "tags": [
        "address google",
        "safe browsing",
        "united",
        "typeof",
        "passive dns",
        "body doctype",
        "nreum",
        "date",
        "gmt server",
        "apache x",
        "cnection",
        "content type",
        "span",
        "ok transfer",
        "encoding",
        "x powered",
        "unknown soa",
        "unknown ns",
        "showing",
        "entries",
        "next associated",
        "urls show",
        "body",
        "encrypt",
        "search",
        "ip address",
        "creation date",
        "record value",
        "present jul",
        "present may",
        "present apr",
        "certificate",
        "present aug",
        "present feb",
        "present dec",
        "present nov",
        "error",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "found",
        "development att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "mitre att",
        "show technique",
        "ck matrix",
        "pattern match",
        "ascii text",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "itre att",
        "accept",
        "sha256",
        "size",
        "type data",
        "utf8 text",
        "document file",
        "flag",
        "server",
        "european union",
        "name server",
        "tor analysis",
        "dns requests",
        "domain address",
        "ii llc",
        "windir",
        "openurl c",
        "prefetch2",
        "show process",
        "ogoogle trust",
        "network traffic",
        "organization",
        "elton avundano",
        "object",
        "title object",
        "header http2",
        "returnurl",
        "texas",
        "rsa ov",
        "ssl ca",
        "status",
        "australia",
        "netherlands",
        "urls",
        "gmt path",
        "hostname add",
        "pulse submit",
        "present oct",
        "e safe",
        "results jul",
        "response ip",
        "present jan",
        "name servers",
        "verdict",
        "domain",
        "files ip",
        "address domain",
        "xhr start",
        "xhr load",
        "aaaa",
        "read c",
        "show",
        "port",
        "destination",
        "high",
        "delete",
        "outbound m3",
        "copy",
        "write",
        "persistence",
        "execution",
        "malware",
        "generic",
        "unknown",
        "present mar",
        "dynamicloader",
        "wine emulator",
        "dynamic",
        "medium",
        "read",
        "associated urls",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "dnssec",
        "domain name",
        "solutions",
        "llc status",
        "next passive",
        "dns status",
        "hostname query",
        "files show",
        "date hash",
        "avast avg",
        "overview ip",
        "address",
        "related nids",
        "files location",
        "flag united",
        "hostname",
        "files domain",
        "win32",
        "mtb feb",
        "trojan",
        "susp",
        "trojandropper",
        "msr feb",
        "trojanspy",
        "virtool",
        "win64",
        "defense evasion",
        "t1480 execution",
        "file defense",
        "null",
        "refresh",
        "tools",
        "look",
        "verify",
        "restart",
        "file discovery",
        "utf8",
        "crlf line",
        "a domains",
        "script urls",
        "link",
        "unknown aaaa",
        "meta",
        "atom",
        "results jan",
        "present",
        "present sep",
        "akamai",
        "asn as16625",
        "less whois",
        "registrar",
        "http",
        "france flag",
        "france hostname",
        "files related",
        "url analysis",
        "files",
        "location france",
        "detailed error",
        "sec ch",
        "ch ua",
        "ua full",
        "ua platform",
        "moved",
        "name",
        "perfect privacy",
        "error jul",
        "next related",
        "domains show",
        "domain related",
        "url add",
        "pulse pulses",
        "hosting",
        "reverse dns",
        "france asn",
        "as16276",
        "dns resolutions",
        "datacenter",
        "regopenkeyexa",
        "regsetvalueexa",
        "windows nt",
        "regdword",
        "hostile",
        "service",
        "delphi",
        "next",
        "pulses none",
        "related tags",
        "ua bitness",
        "ua arch",
        "version sec",
        "mobile sec",
        "model sec",
        "review",
        "data upload",
        "extraction",
        "khtml",
        "gecko",
        "olet",
        "cnlet",
        "tlsv1",
        "hacktool",
        "push",
        "ms windows",
        "intel",
        "pe32",
        "users",
        "precreate read",
        "ransom",
        "code",
        "installer",
        "june",
        "media",
        "autorun",
        "next yara",
        "detections name",
        "aspackv2xxx",
        "eu alexey",
        "alerts",
        "pe file",
        "filehash",
        "sha256 add",
        "av detections",
        "ids detections",
        "yara detections",
        "analysis date",
        "april",
        "packing t1045",
        "t1045",
        "t1060",
        "registry run",
        "keys",
        "user execution",
        "icmp traffic"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1091",
          "name": "Replication Through Removable Media",
          "display_name": "T1091 - Replication Through Removable Media"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1132,
        "URL": 6245,
        "hostname": 2264,
        "FileHash-SHA256": 1857,
        "FileHash-SHA1": 491,
        "email": 9,
        "FileHash-MD5": 573,
        "SSLCertFingerprint": 16
      },
      "indicator_count": 12587,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "225 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6892e73b32af18aa302df0dc",
      "name": "Part 1.5",
      "description": "Dark web media \u2022 Political news \u2022 Malvertizing\nlocate \u2022\ntrack [stalk] \u2022 record calls \u2022 control media [youtube , etc] http://t.name?n[++i]=e:this.removeEventListener\t\t\nJeeng &\nPowebox [ accidentally left out in original post pulse]",
      "modified": "2025-09-05T04:03:06.929000",
      "created": "2025-08-06T05:25:15.369000",
      "tags": [
        "chromeua",
        "optout",
        "object",
        "path",
        "value",
        "access type",
        "setval",
        "windir",
        "localappdata",
        "null",
        "win64",
        "error",
        "generator",
        "close",
        "roboto",
        "date",
        "format",
        "light",
        "span",
        "template",
        "void",
        "android",
        "body",
        "trident",
        "mexico",
        "sonic",
        "black",
        "critical",
        "desktop",
        "dark",
        "meta",
        "this",
        "june",
        "hybrid",
        "apache",
        "write",
        "crypto",
        "autodetect",
        "face",
        "courier",
        "gigi",
        "impact",
        "shadow",
        "click",
        "strings",
        "cray",
        "smwg",
        "eret",
        "footer",
        "infinity",
        "window",
        "canvas",
        "legend",
        "nuke",
        "lion",
        "4629",
        "ahav",
        "olsa",
        "false",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "file defense",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "script",
        "mitre att",
        "pattern match",
        "show technique",
        "iframe",
        "refresh",
        "august",
        "general",
        "local",
        "tools",
        "demo",
        "look",
        "verify",
        "restart",
        "url http",
        "small",
        "pulses url",
        "tellyoun",
        "showing",
        "entries",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "cc08",
        "f06a6b",
        "sfurl",
        "filehashsha256",
        "types",
        "indicators show",
        "search",
        "pulses",
        "filehashsha1",
        "adversaries",
        "found",
        "webp image",
        "ascii text",
        "riff",
        "size",
        "encrypt",
        "legacy",
        "filehashmd5",
        "united",
        "flag",
        "server",
        "markmonitor",
        "name server",
        "llc name",
        "overview dns",
        "requests domain",
        "country",
        "win32",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "medium risk",
        "yara",
        "detections",
        "malware",
        "copy",
        "show",
        "icmp traffic",
        "packing t1045",
        "t1045",
        "pdb path",
        "pe resource",
        "extraction",
        "data upload",
        "enter sc",
        "type",
        "extra data",
        "please",
        "failed",
        "review",
        "exclude data",
        "included review",
        "ic data",
        "suggeste",
        "stop",
        "type onow",
        "domain",
        "passive dns",
        "urls",
        "files related",
        "pulses none",
        "related tags",
        "none google",
        "safe browsing",
        "sc data",
        "extr amanuav",
        "review included",
        "manualy",
        "sugges excluded",
        "filehash",
        "md5 add",
        "pulse pulses",
        "url add",
        "http",
        "hostname",
        "files domain",
        "pulses otx",
        "virustotal",
        "hsmi192547107",
        "pulses hostname",
        "r dec",
        "customer dec",
        "iski dec",
        "decision dec",
        "va dec",
        "bitcoin",
        "bitcoin dec",
        "petra",
        "torstatus dec",
        "paul dec",
        "sodesc",
        "planet dec",
        "emilia",
        "heroin dec",
        "difference dec",
        "palantir dec",
        "loraxlive dec",
        "chaturbate dec",
        "sandra",
        "free dec",
        "marvel dec",
        "benjis dec",
        "fresh dec",
        "sodesc dec",
        "srdirport",
        "srhostname",
        "link dec",
        "types of",
        "italy",
        "china",
        "australia",
        "france",
        "turkey",
        "discovery",
        "information",
        "ck ids",
        "t1005",
        "local system",
        "t1007",
        "system service",
        "part",
        "track",
        "locate",
        "political",
        "civil society",
        "news",
        "created",
        "hours ago",
        "report spam",
        "t1555",
        "password",
        "t1560",
        "collected data",
        "t1573",
        "channel",
        "t1574",
        "execution flow",
        "scan",
        "iocs",
        "t1497",
        "u0lhmq",
        "mtawmq",
        "t1480",
        "guardrails",
        "t1486",
        "data encrypted",
        "learn more",
        "unsubscribe aug",
        "protocol",
        "t1074",
        "staged",
        "t1083",
        "t1102",
        "web service",
        "t1105",
        "tool transfer",
        "t1140",
        "data engineer",
        "candidate",
        "tlsv1",
        "odigicert inc",
        "stcalifornia",
        "lsan jose",
        "oadobe systems",
        "incorporated",
        "cndigicert sha2",
        "push",
        "next",
        "high",
        "write c",
        "ireland as16509",
        "delete",
        "dirty",
        "tags",
        "t1012",
        "flow endpoint",
        "security scan",
        "t1106",
        "copyright",
        "levelblue"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1007",
          "name": "System Service Discovery",
          "display_name": "T1007 - System Service Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1074",
          "name": "Data Staged",
          "display_name": "T1074 - Data Staged"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1120",
          "name": "Peripheral Device Discovery",
          "display_name": "T1120 - Peripheral Device Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1486",
          "name": "Data Encrypted for Impact",
          "display_name": "T1486 - Data Encrypted for Impact"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 608,
        "FileHash-SHA1": 433,
        "FileHash-SHA256": 3663,
        "URL": 17104,
        "domain": 1316,
        "email": 39,
        "hostname": 4208,
        "SSLCertFingerprint": 17
      },
      "indicator_count": 27388,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "226 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6882e2a53af80b1af320079d",
      "name": "VirusTotal - Palantir- KrunchyMalPacker | Vflooder",
      "description": "-> Hostname: \u2022 edenglobalpartners.palantirfoundry.com\n\u2022 c.twitterintegration.com\n*Trojan:Win32/Vflooder.E\nIDS Detections:\n- Win32/Flooder.Agent.NAS CnC Domain in DNS Lookup\n\u2022 Virus Total vtapi DOS\n\u2022 Generic HTTP EXE Upload Inbound\n\u2022 Observed Suspicious UA (Mozilla/5.0)\n\u2022 Generic HTTP EXE Upload Outbound || \n*ALF:HSTR:KrunchyMalPacker!MTB\t\n IDS Detections\n-Win32/Vflooder.B Checkin\n\u2022 TLS Handshake Failure\nYara Detections: \nkkrunchy023alpha2\nAlerts:\n\u2022 static_pe_anomaly\n\u2022 suricata_alert\n\u2022 dynamic_function_loading\n\u2022 network_cnc_https_generic\n\u2022 reads_self\n\u2022 network_cnc_http\n\u2022 network_http\n\u2022 packer_unknown_pe_section_name\n\u2022 packer_entropy\n\u2022 injection_rwx ||\n__________\nIP\u2019s Contacted:\n\u2022 34.54.88.138\n\u2022 162.159.140.229\nDomains Contacted\n\u2022 twitter.com (SBKA - Palantir?)\n\u2022 www.virustotal.com\n#botnetresulttesting #virustotal_unsafe #vtflooder #palantir #twitter #gotham foundry #brian_sabey_has_a_new_toy #targeting #tsara_brashears",
      "modified": "2025-08-24T01:04:01.801000",
      "created": "2025-07-25T01:49:25.325000",
      "tags": [
        "windows nt",
        "dynamicloader",
        "contentlength",
        "tls handshake",
        "failure",
        "host",
        "show",
        "medium",
        "search",
        "entries",
        "copy",
        "write",
        "malware",
        "generic http",
        "exe upload",
        "inbound",
        "outbound",
        "domain",
        "trojan",
        "u0019",
        "trojandropper",
        "backdoor",
        "mtb jul",
        "united",
        "passive dns",
        "open ports",
        "win32berbew jul",
        "ipv4 add",
        "present jul",
        "present jun",
        "cname",
        "present aug",
        "present sep",
        "status",
        "certificate",
        "date",
        "twitter",
        "unknown ns",
        "name servers",
        "servers",
        "showing",
        "urls",
        "creation date"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1903,
        "hostname": 806,
        "FileHash-SHA256": 1594,
        "FileHash-MD5": 264,
        "FileHash-SHA1": 297,
        "SSLCertFingerprint": 1,
        "domain": 515,
        "email": 5
      },
      "indicator_count": 5385,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "238 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687b5499d48de6e54f3bff11",
      "name": "213.174.130.70 - Spyware Install  | Emotet via Malware sites",
      "description": "Malicious IP address for multiple malware domains. Very malicious spyware, will hijack network and devices. \n\u2022 Best Targeted sites \nSpyware Install\n\u2022 Garveep POST CnC\nBeacon\n\u2022 Worm.Mydoom\nCheckin\n\n#endgame #emotet #mydoom #malware_domains #install_spyware #monitered_targets",
      "modified": "2025-08-18T08:00:43.712000",
      "created": "2025-07-19T08:17:29.443000",
      "tags": [
        "handle",
        "ripe ncc",
        "ripe network",
        "address range",
        "cidr",
        "allocation type",
        "assigned pa",
        "status",
        "whois server",
        "entity ah36ripe",
        "algorithm",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "number",
        "cgb stgreater",
        "cnsectigo rsa",
        "secure server",
        "ca validity",
        "date",
        "abuse contact",
        "orgid",
        "orgtechhandle",
        "address",
        "orgabuseref",
        "postalcode",
        "ripe",
        "seen",
        "update date",
        "tech email",
        "admin country",
        "expiration date",
        "dnssec",
        "admin id",
        "mi11255597wp",
        "msie",
        "chrome",
        "passive dns",
        "united",
        "ipv4 add",
        "pulse submit",
        "url analysis",
        "urls",
        "files",
        "hosting",
        "open",
        "body",
        "extraction",
        "data upload",
        "failed",
        "include review",
        "anorexx",
        "video",
        "father sex",
        "ebony riding",
        "ebony",
        "roberta",
        "type win32",
        "exe size",
        "mb first",
        "file name",
        "sentinelone",
        "present jul",
        "present oct",
        "entries http",
        "memcommit",
        "t1055",
        "read c",
        "search",
        "entries",
        "show",
        "medium",
        "showing",
        "high process",
        "injection t1055",
        "copy",
        "write",
        "win32",
        "malware",
        "tsara brashears",
        "tsara",
        "pornhub",
        "porn videos",
        "watch tsara",
        "most relevant",
        "open threat",
        "exchange",
        "public",
        "https",
        "green",
        "daily",
        "brashears",
        "porn",
        "watch",
        "busty xxx",
        "filter tsara",
        "brashears porn",
        "url add",
        "pulse pulses",
        "http",
        "related pulses",
        "none related",
        "tags none",
        "file type",
        "md5 sha256",
        "google safe",
        "browsing",
        "dynamicloader",
        "dynamic",
        "read",
        "delete",
        "mtb apr",
        "trojan",
        "lowfi",
        "virtool",
        "icloader apr",
        "otx telemetry",
        "australia",
        "exploit",
        "cobalt strike",
        "hostile",
        "trojanspy",
        "msil",
        "win64",
        "pulse",
        "alerts",
        "yara rule",
        "named pipe",
        "xe7xf3xf2x14x9d",
        "high",
        "delphi",
        "local",
        "next",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "defense evasion",
        "adversaries",
        "spawns",
        "found",
        "process details",
        "flag",
        "contacted",
        "meta",
        "location united",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "sha1",
        "size",
        "beginstring",
        "null",
        "type data",
        "error",
        "span",
        "hybrid",
        "general",
        "click",
        "strings",
        "refresh",
        "tools",
        "pattern match",
        "show technique",
        "mitre att",
        "ck matrix",
        "ascii text",
        "show process",
        "utf8",
        "crlf line",
        "network traffic",
        "path",
        "included",
        "review",
        "excludea",
        "sugges data",
        "typ url",
        "url url",
        "url hos",
        "hos hos",
        "extraction f",
        "enter so",
        "u extractio",
        "extra data",
        "included review",
        "ic excluded",
        "suggeste",
        "pulses",
        "md5 google",
        "safe browsing",
        "virustotal api",
        "comments",
        "ally s",
        "extraction data",
        "enter soudcfidi",
        "ad temdac",
        "cddad ad",
        "praw type",
        "extr",
        "include u",
        "creation date",
        "record value",
        "gmt content",
        "x adblock",
        "certificate",
        "domain",
        "encrypt",
        "sec ch",
        "ch ua",
        "unknown aaaa",
        "ua full",
        "ua platform",
        "present jun",
        "moved",
        "ip address",
        "doctype html",
        "lander script",
        "head",
        "method",
        "allowed date",
        "arizona",
        "scottsdale",
        "go daddy",
        "authority",
        "next associated",
        "extraction fail",
        "enter soupce",
        "udi ad",
        "trydda dada",
        "panca type",
        "ur extraction",
        "s data",
        "pr extract",
        "servers",
        "hostname",
        "files ip",
        "denmark unknown"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 4,
        "URL": 7528,
        "domain": 1822,
        "hostname": 2015,
        "email": 5,
        "FileHash-MD5": 373,
        "FileHash-SHA1": 363,
        "FileHash-SHA256": 1939
      },
      "indicator_count": 14049,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "244 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68732864356c4353e0b1efe2",
      "name": "Denver Post - Custom Malware | Xord",
      "description": "YARA Detections:\n\u2022 xord_nopsled_in_jquery\ncompromised_site_redirector_fromcharcode\n\u2022 KnownMaliciousObfuscationPattern\n\u2022 WebExploit | \nAlerts:\n\u2022 ransomware_file_modifications\n\u2022 script_created_process\n\u2022 antivm_generic_disk\n\u2022 infostealer_cookies\n\u2022 suspicious_command\n\u2022 dead_host\n\u2022 suspicious_write_exe\n\u2022 network_icmp\n\u2022 modifies_certificates\n\u2022 process_martian\n* Malware IP - \n142.251.215.232",
      "modified": "2025-08-12T03:05:26.037000",
      "created": "2025-07-13T03:30:44.589000",
      "tags": [
        "url https",
        "indicator role",
        "title added",
        "active related",
        "pulses",
        "entries",
        "url http",
        "domain",
        "ipv4",
        "filehashsha256",
        "hostname",
        "types of",
        "united kingdom",
        "united",
        "germany",
        "france",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "extraction",
        "data upload",
        "failed",
        "se extraction",
        "enter sc",
        "type",
        "extra data",
        "please",
        "include review",
        "exclude sugges",
        "type ol",
        "please sub",
        "langes",
        "include",
        "review data",
        "extrad",
        "manually add",
        "indicator",
        "sc type",
        "included iocs",
        "se extr",
        "review exclude",
        "sugges",
        "extract data",
        "add indicator",
        "domain related",
        "showing",
        "tewdida data",
        "present jul",
        "script urls",
        "a domains",
        "present jun",
        "search",
        "accept encoding",
        "unknown aaaa",
        "present may",
        "date",
        "meta",
        "body",
        "ipv6",
        "role",
        "present jan",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "regexp",
        "typeof e",
        "typeof t",
        "function",
        "width",
        "error",
        "object",
        "x20trnf",
        "pseudo",
        "child",
        "form",
        "class",
        "null",
        "write",
        "this",
        "void",
        "accept",
        "copy",
        "extr please",
        "typ data",
        "indicalok no",
        "gmt max",
        "reverse dns",
        "location united",
        "america flag",
        "ashburn",
        "america asn",
        "dns resolutions",
        "domains top",
        "extri please",
        "review",
        "sugges data",
        "find suxesteu",
        "typ indical",
        "on hos",
        "dynamicloader",
        "medium",
        "show",
        "high",
        "windows",
        "cmd c",
        "delete",
        "next",
        "unknown",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "read c",
        "as15169",
        "execution",
        "dock",
        "persistence",
        "malware",
        "roboto",
        "fwlink",
        "powershell",
        "delete c",
        "guard",
        "win32",
        "passive dns",
        "ransom",
        "trojan",
        "gmt cache",
        "sameorigin",
        "443 ma2592000",
        "pulse",
        "trojandropper",
        "worm",
        "ur extraction",
        "find",
        "types",
        "seard data",
        "source se",
        "url toi",
        "ela fer",
        "iocs",
        "search otx",
        "extr",
        "indicators h",
        "weall",
        "indica",
        "sc data",
        "data u",
        "extre",
        "find s",
        "onv incmde",
        "exclude data",
        "suggested",
        "typ no"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3107,
        "domain": 526,
        "hostname": 940,
        "FileHash-SHA256": 2209,
        "email": 2,
        "FileHash-MD5": 80,
        "FileHash-SHA1": 31,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 6906,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "250 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68732869bad70de69c45c1b3",
      "name": "Denver Post - Custom Malware | Xord",
      "description": "YARA Detections:\n\u2022 xord_nopsled_in_jquery\ncompromised_site_redirector_fromcharcode\n\u2022 KnownMaliciousObfuscationPattern\n\u2022 WebExploit | \nAlerts:\n\u2022 ransomware_file_modifications\n\u2022 script_created_process\n\u2022 antivm_generic_disk\n\u2022 infostealer_cookies\n\u2022 suspicious_command\n\u2022 dead_host\n\u2022 suspicious_write_exe\n\u2022 network_icmp\n\u2022 modifies_certificates\n\u2022 process_martian\n* Malware IP - \n142.251.215.232",
      "modified": "2025-08-12T03:05:26.037000",
      "created": "2025-07-13T03:30:49.347000",
      "tags": [
        "url https",
        "indicator role",
        "title added",
        "active related",
        "pulses",
        "entries",
        "url http",
        "domain",
        "ipv4",
        "filehashsha256",
        "hostname",
        "types of",
        "united kingdom",
        "united",
        "germany",
        "france",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "extraction",
        "data upload",
        "failed",
        "se extraction",
        "enter sc",
        "type",
        "extra data",
        "please",
        "include review",
        "exclude sugges",
        "type ol",
        "please sub",
        "langes",
        "include",
        "review data",
        "extrad",
        "manually add",
        "indicator",
        "sc type",
        "included iocs",
        "se extr",
        "review exclude",
        "sugges",
        "extract data",
        "add indicator",
        "domain related",
        "showing",
        "tewdida data",
        "present jul",
        "script urls",
        "a domains",
        "present jun",
        "search",
        "accept encoding",
        "unknown aaaa",
        "present may",
        "date",
        "meta",
        "body",
        "ipv6",
        "role",
        "present jan",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "regexp",
        "typeof e",
        "typeof t",
        "function",
        "width",
        "error",
        "object",
        "x20trnf",
        "pseudo",
        "child",
        "form",
        "class",
        "null",
        "write",
        "this",
        "void",
        "accept",
        "copy",
        "extr please",
        "typ data",
        "indicalok no",
        "gmt max",
        "reverse dns",
        "location united",
        "america flag",
        "ashburn",
        "america asn",
        "dns resolutions",
        "domains top",
        "extri please",
        "review",
        "sugges data",
        "find suxesteu",
        "typ indical",
        "on hos",
        "dynamicloader",
        "medium",
        "show",
        "high",
        "windows",
        "cmd c",
        "delete",
        "next",
        "unknown",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "read c",
        "as15169",
        "execution",
        "dock",
        "persistence",
        "malware",
        "roboto",
        "fwlink",
        "powershell",
        "delete c",
        "guard",
        "win32",
        "passive dns",
        "ransom",
        "trojan",
        "gmt cache",
        "sameorigin",
        "443 ma2592000",
        "pulse",
        "trojandropper",
        "worm",
        "ur extraction",
        "find",
        "types",
        "seard data",
        "source se",
        "url toi",
        "ela fer",
        "iocs",
        "search otx",
        "extr",
        "indicators h",
        "weall",
        "indica",
        "sc data",
        "data u",
        "extre",
        "find s",
        "onv incmde",
        "exclude data",
        "suggested",
        "typ no"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3107,
        "domain": 526,
        "hostname": 940,
        "FileHash-SHA256": 2209,
        "email": 2,
        "FileHash-MD5": 80,
        "FileHash-SHA1": 31,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 6906,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "250 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://hevea.projects.az/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://hevea.projects.az/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776620820.3101218
}