{ "type": "URL", "indicator": "https://kingtm.ru", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://kingtm.ru", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4345569488, "indicator": "https://kingtm.ru", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 11, "pulses": [ { "id": "6a13d458f27a51876d7949f5", "name": "NOW BOARDING: DARK-ZERO Sheep Tracker * CAPE Sandbox", "description": "Modern threat intelligence requires moving from passive observation to active intervention. In the context of targeted tracking implants, defending civil rights means engineering systems that protect user autonomy against unauthorized data extraction. Architectural Protections:\n0-Trust Telemetry: Designing operating systems where the user owns the cryptographic root of trust.\nHardware-Enforced Isolation: Utilizing Secure Enclaves to process cryptographic keys outside the reach of a compromised kernel.\nExploit Mitigation: Implementing advanced PAC+ Memory Tagging Extensions (MTE) to stop zero-day memory corruption bugs. The holiday serves as a reminder for SOCs to uphold high ethical standards, ensuring defensive tools are never repurposed for unauthorized surveillance. Respect to all.", "modified": "2026-05-27T17:19:19.635000", "created": "2026-05-25T04:47:20.503000", "tags": [ "win32 exe", "mozilla firefox", "zip adobe", "photoshop cc", "rar adobe", "air sdk", "adobe air", "lassa2", "default", "shell folders", "inprocserver32", "parent pid", "full path", "command line", "cname", "folders", "file size", "mwdb", "accept", "shutdown", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "file", "operations", "process open", "write delete", "move time", "file type", "json", "ascii", "utf8", "sqlite version", "found", "pe file", "intel", "pe32", "ms windows", "installer", "defense evasion", "window", "title", "template", "next", "united", "performs dns", "grabber honest", "layer protocol", "attack network", "info processes", "extra info", "zenbox macos", "verdict", "guest system", "ascii text", "sigma", "creates", "t1055 process", "info dropped", "malicious", "p2404", "p11718783889", "p4de83ek69hqsh4", "p11718784848", "bazaar", "sha3384", "ssdeep", "checker", "themida", "guard", "property", "adobe device", "property name", "productname", "displayname", "destination", "root", "totalsize", "langpack", "swedish", "win32", "windows sandbox", "calls clear", "sha256", "sha1", "crc32", "size", "flash", "june", "drops pe", "crlf line", "sample", "persistence", "win64", "hook", "instructor", "kids goldadobe", "errstr", "cultureneutral", "license", "error", "code", "service", "vmprotect", "february", "back", "number", "mitre attack", "network info", "processes extra", "fri dec", "database", "initial access", "program", "overview", "overview zenbox", "ultimate file", "info file", "Nullworld", "value", "value lang", "buildinfo", "productinfo", "addremoveinfo", "displayversion", "screnshots", "United", "Swedishvpncarrierenrollment", "calls process", "writes", "png image", "rgba", "guloader", "fraud", "phishing", "install", "pdapp", "urihandler", "us tcp", "product install", "gamma", "updater", "Now boarding", "DarkZero", "Sheep Tracker" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/036d1a174e3ef9a15c8075248958c4f36d8817573ef3f6f12c62850976b32737_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681399&Signature=o4EIDa%2Bu5q7UzJoKBZ3SHIdTRWKGT7HIZyLxFZSLdRJV2Ng655y2X8OLnU2siFeopgWPI6Gd8nE9F9LFBFgwM%2F0ZN0FWsDls8m78y46TmhjHhykfch6G%2Buw3LPxmfbz999yBfELXQDUCNWIiGUPv%2B23aUdHnc0c5jI4Mvlz2HGA%2BHlIMjc1w1S%2BWm%2FI6ftHJdyIAh0SqMbPXqAy%2BIonExlGkoEmMBCJl3r3pfMcYzy4ai0", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681421&Signature=oUYsIo6y2ldihmETch4oPYw5nb4sHZhKRik2zGuv2h9rqu30GcV1xZHlIO9ttFa625EXOlrrILZtAhfM%2FamkTDjXZUTqn2%2BTKmgnxqOOfJU6KrJHPLE9Do7l7MEaPxX4cs8z8tWd0%2FY8sBv8sjGAIdWrT5OPv202LNN%2FiVe6mEIUMkmNr%2BG1S3Pgs6LRTjo%2BgqhEcNXT0MFUgs3I2e4AQ0TQ4FOs%2BVRY", "https://vtbehaviour.commondatastorage.googleapis.com/036d1a174e3ef9a15c8075248958c4f36d8817573ef3f6f12c62850976b32737_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681469&Signature=VGjB%2F%2BCQwDtsenSFWX7YNKbe9s%2Fgcpg%2FotVlxRZ6FXuE9VXITP76QQq6L2vlSM7pfQHSnBv%2BUdwMtN3QhCxjF7Zv2PV%2FkWLnwwA3hJciWMAKiLSeKTanNshzLWnmBjN04FASFwNf6kAq4PcunHkHh2PSOGl03eem41DHA6YOIRAjI1C6hAdDvKoAqJJXuGKM%2F5Z5vzfeTaXNgCRutOhVDB4%2FcAcV9zZaRcX9Ii0IFRAZo%2Bzk7rvI", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681490&Signature=bIUDLY2jLaPa0t0OyOiuRlKjk8VM9IFdVTwzJhuTKfuV%2BhwtwcYghSy4186P0qsGEebShI2xNNVBPSd3uQdeXMuYRDJWcyo18c12pLwgcLgaBot06%2Bfys%2BlGp%2FV%2FSCDBvdo3iLaAOesoSo8vbCLNsWAzGM5sztLl%2Beyq9%2F1oSuAvU692EiARhcufOCMFqXCn6MNuSp18gSQwkFRBadsMvHSjfHW645FvLUfiP5Egu1WuMVP2", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681535&Signature=K%2BM%2FPuLQI5kqDYLWjQMD%2BgPbchxwp2sWPPUtfDZYFn5H9w%2BqFPRxh7iZqH4FOPAnwlC0%2BN5TKTqrEuhABL3gWMqHySyweiNPNkJ1MlX29xZdE482pqQSn8rzkPs7CZD63ts4ZRPrK%2Bl06RV13mZf4TUzAD9Sx0m6%2FWhetQETuu6StpVmyzhie%2Fn%2FUdsdFN0SW%2BtLpQE74IVNfszCgKVhF9oNeBiifytanSbIG0SnLff9sXffjS", "https://vtbehaviour.commondatastorage.googleapis.com/087975d5f3c874a6fe9cbfe9d7ee77fb0af138e3c36a6f75e3d000699afc571d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681569&Signature=C286Cg30s1QDg1lkY0jtTLfia8Fs4B%2FdqNMfidFUYXpd2si4N25G7RBqy8LODkWqBQca8rpYyZ7FIYHuRDc0wBLk%2B1rPiEXJckZIdmkyhDkFJ2jrxfNV135BZTTeF6DkLrRfWPgnxciVK%2FJrkueYnjlYhYW08OZkTu9plzgmfR2IocW5ENVaqHbcPAdm2QDCC6VVrNQp%2FP%2FjV6%2Fkm37tinRyXhg1vKSf0TVFMzL1jpYkiS5PIc", "https://vtbehaviour.commondatastorage.googleapis.com/07f5960476ab34754f3e04143caf2d4899cb09e6b271bfd27ef1f1c8977ca050_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681591&Signature=uoP10og17YxXUe0yZ8kll3N15RJJ%2Bf5pJFzW0MUe4fdvXaLlcOfCxs%2B6EyW23FSqTj%2FbNedtUC6z7Y0dgMPBtJC%2F9gOhXEZj5%2BKKwnQbCBe7GuFtEsVMMkQRdiDQxJYZipAId1MwoBChhx%2BSr%2FrboVkDq%2F%2FbNLvWS6keRMn4fa8GX%2BF0lIJepJ98sjwXs48DXBch8974olbyd38VGGp1bLMl7mycstrQ2hIy2MFXWD", "https://vtbehaviour.commondatastorage.googleapis.com/0da371854ec2c04bbee9680dbdabb67a4e4a84add40e5e1877425790f2dfef02_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682005&Signature=SyLSFT5xdlAZ5lwNyaeDpqsMTuwGywWruel4fBOIdsyiZ%2FvtOZYr7f%2B%2BIuBmqFMAwMI4L7kB6jRtv8mVn8lmU5MUJBAG6GJdVsEp2SoexU5Yl2kTksey03ZsjBloxlJqDzf8PULDlwjfD1Ydv%2B5QFPoY3%2Fk8TKMlmmpTIw7%2FYcR24%2FHYHw78XVF2cV%2Bnb3GoDaHw%2FnpxLrDwgfZP9dWvP8V264o5l2dDfxQtF0", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682086&Signature=yzXoWEcsMl9wlTGgMQfBKEZWwnDzmua%2FR2suwDMBSqPLhunpHELcj0SzY3czM%2F9HQG9QuvYzhQRVUxR1iDaFz1BQ4YHkXJih3zm%2BcNlDcfXsOZzyYzWUhaPsbSti%2FWbFoL4E14bnS7tIuG9s9R96LkGyGpWIsT%2BPeCNhsCzD7vFRU0cPMr6vNblu%2BBiO3Ki99QSrkF4hzBxkQ7DFgba3qi7kOfal%2F2K8hC1ikcZntmn5IESW", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682105&Signature=DkIw2nRg0%2BHKmd2TpyMzcgrB%2F4s6sIVIpOEEVMqz3Csoj6PPmSGNer%2Bt5X5oYKPZQgJETAHcCRs0mh3Lfa85XEPdYk6PjMimJmKQdBstqdULgs6q7wyZEjHDhQn41ri7eQ16g7pAo9ojfhLUNp4uW2xuYvdBwYhYBsZP3EO1BKz2f3dYxSg%2Bgsn2AnC2%2BDRTIX0Xxd%2Bt44%2BkXfiY32mvDHDNDCcuT5ZDFNrHwDp3HKuuJYy7lRHm8AlK", "https://vtbehaviour.commondatastorage.googleapis.com/1f1db73659fa2fe7a944d20bb4e9a867513a50ee9b51be89dfec30c73f6ed622_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682177&Signature=yjgeq7TPzf6M6Pn8mPFgBmhHQbfgGlaadZNsSsDUKq0Da4%2Bb25WhNl6nDIyUDmRBtABod6Itj2EUlbe%2B4U0QYLuJR00aQqsO%2F9pXU4AWeIFUEZhCrwgZ5WuNPpYbdVbOYcVX6oyDXpSjv1QEGmJ1NVVr%2F1esshl3tugyHxp6LFYa9%2BQeoiqsBikKLglNB52vsap%2BkwVPKyXg%2FjduMqTQd%2FhNMM41261XiBOTtUqjpzIm67", "https://vtbehaviour.commondatastorage.googleapis.com/492dc39e7752dccfd15f588054991277e6548b794b28a03f42b9cee132eebd2e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682206&Signature=iCbR7BcpXhfqHIoxTRE%2BvhCqRoHYALCXll0hXveh8IQOJPjxw%2BlLNas6nIvp035t6sdMg9KdOY751XfThil%2FE2mLrvir%2FwKjheK2382r5bhEQFEsa6etlla3TDjlvttEFZDUN7SSLpGao8u7uVNwrPRb0BuwYDemKKVJK6DACPbUZEHk3DZ%2Bi8SxXIdELiXG%2Bozy7oC8Dcj0HqHGYuliXpjT1mV7OsCjFXvmjZPcFH06EzZS5L", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682251&Signature=z6Lrdrr5u6YZdzJaR%2B2Qab%2F%2FVA6%2FL6JaNA4%2BVxLe9wEjL%2B2ARzGBhQdq6RTX5ez3SDTWWmc%2BrOypKxxCsLeXUbjYRoIgcsSzYIxWQWoEl35tFARLVKf%2FVf%2B696U6PYQ%2F1BNWxSfuNOeUVNK2pIiMYCUjLnikvUyj9Ip3MrgKOaV9v9SShCLay93Y7b3GbAUZ2Jzy18PEYf%2FLuk4fDrqITmP2upsysOJq1MhZcJ%2", "https://vtbehaviour.commondatastorage.googleapis.com/105f31af20fdb87d442f81aad0c3a54030b7e214c4796cf2a069bae6aa89dc65_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682395&Signature=oVg82i1yTG%2BGfhoL5FyBdK%2BZKa6wi2iWMpwHyA77jBFtAOZxw%2Bs6z6So26GWDthH7UMEzwZwQC6ENF1TLBEqXukldXMdMg%2FvNylvy7vCdDKDsw53Ibc7vKnu5T0lNumnv%2FD5vnV14QZrzAE8PG3J0S0rtheY8mNCkM6t1w52XYYm5mfnGJXsnjyMEvgURuPhzOIq9%2B%2FG7XUWFK0vK%2BlzKmZU627%2FKYkT9EWHOI8Nyx%2FJUqad%2", "https://vtbehaviour.commondatastorage.googleapis.com/002150c786ae1e04ab2981bf5593d926987b60b9ac699f431ed4568084dd854b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682457&Signature=eWipoH1g7AQ8zq2pd%2BpyAKrKscAY%2FebCATbHE%2FMwdvIfIy%2F4i3OFy%2FKlfaNCXDLDU0OM6JaEF73FAqGhLEb8ZcxTuEfMeU%2F6WxjpgS2SqLZ0xOjAPgPWOOor3uCcdIEZRCcpJe%2BAzPY8jEZJ0aIf49RU85lkIx9yCiXcFnee1pNHHBFwpsBK4FNuTB%2FyDe61M5Htw4fjlf43GTnXFxj0%2Fjc%2Fe32Q7EpVkuSc0I%2F3zTrY0UkC", "https://vtbehaviour.commondatastorage.googleapis.com/492dc39e7752dccfd15f588054991277e6548b794b28a03f42b9cee132eebd2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682486&Signature=ucigAmI%2BTWYWnZuZjQb7cvSnhC1f6r93NM1kh5fCHjjcUodx6ltePV2QSdyXCnhrdH8ODLugh37CFZxsAmtiMMefuyuh6T8mtuxe7znGqLiJre5YFfSQLkzmz0Ksqekcg0sp1bUaKykXguy%2BKwv6Tg12CIM7xzaDB%2BGcjw6KkBLiD0A1sB6Z9gk9np%2FNtUBHdW7E0eBfvTWOK8F99R1lQdmQab2Vha55GLH6JRBksZ7AbBEdVS8DMtkaZCS9sV", "https://vtbehaviour.commondatastorage.googleapis.com/049c8db974d1830f931d605f6918184d8928c46c74f4152dfde3dc7bdffbf5d5_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682585&Signature=z2IzO8oruo5%2BmP%2BuhsnAbNLmy7QRAemblZDUm1KEgUCliIqrtWVkruuMg2tcIokmH12yIvRumIVlk5OcGjVxI%2Bb%2B3Va9LgSnD%2Bwjbe5pAs%2BDuUGTY52XSe7V9xdcRN38UeNFYy2jTLa2KYspIZ0NzHMsL0BzU5pqOWw0bAShHYc9sNx0S7a%2BSD7PiY%2BDR%2Br%2BQll9wUT%2B4EjhHrYYmmdRCa6vbIyTLcHmdw4JzmHHsLy%2Bjf", "https://vtbehaviour.commondatastorage.googleapis.com/27086c4185aa32bbc6674267b947e3f6610554188ac694ce2dbc1191a9525339_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683188&Signature=o0pfi%2Bqzc6KRiLra5kzATI2ROhjWVPHqZ7tOokv%2B9i4HwxX3m%2BpcqtYKMIFJMVk1qNFDyYwnCDfkeiva50iZyrha2F3bacitBdmnSwCEQE5xMG73RGPjQAvPps3tKMm1MDH8Rzpy65y9bdKpTSCL9%2Bt2xAk4%2BXx13XPz2GlU%2BG8Q%2FSPkCW96%2BX6c5xzWpIH%2FlXn7%2Bgl2G9QMGbrbnwD%2FfR58%2FrXIeIEJ%2F9%2BNt2W3Fr", "https://vtbehaviour.commondatastorage.googleapis.com/2c7002510767deb9bbb0d2ee2d47be98828bf5b6e999d6cd882b1c1a1c908510_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683299&Signature=RMRBhdx9cTLEwBYgOaiBV4x03W8laZvNMUtTq68ykLCh0R5toTaD64MdSiBhgsNAZLaS8z9dPsGmVcfMC8U5sPrXXLzAt9CBPoJjT2jV40HyYrW58xs3wjf65936U00bQy9DGFrlU7xInrhEocKiXuD17i5A%2F7tdPgx74I6xY906Ua8hyOe3f5zVmaxE6zpNAonyZtoHtHmnuDLG71DTPwYyiKcGPff7glIXoNalw4ST3jQr3Ma%2Fv1Q3De", "https://vtbehaviour.commondatastorage.googleapis.com/2c98a3b3752939b7c2db76682607e3918dee0edd81998279cb4528cc6c67f715_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683469&Signature=oE7hEU%2FccffwWPye7wmTWT154zCmhX2wBLLWErX6yptBjSn9YXSMLMohlpsjw%2BxO5VxqobuYkMh302JzsMTg4fXVD76S9F6aOL1vRPwZx8fTGOeMoKRTMO7B0xwvo2HQCra8ds7NMqXBpbNxN%2Bi7Ez6ZOyX%2FQUyixg1Ya1G7%2FkF8sEaT8z%2B4QHLhghEUdy4%2FMYbGVFzAKhSDW9Yg%2BcPfxQLt%2BViZ", "https://vtbehaviour.commondatastorage.googleapis.com/5f87d5cb5921df99f335e1a8f044db15187f88aea04ecc073b310a4b9649a5e1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683851&Signature=oDNiEuOved3Q5at8LARyePhpQE3%2FjmEYRIWg4Vzp0yzifSrnwMGaujbhYJWqc8BadzAh1AhmrfOaNLGJfe8IO2Izje4ofsfex0DAAfgHm5l1vDeQWFDfgypa9%2F8sHOOgBiUlbdSDYrVdZ2Z9f8MGr8OaswhQwykG5mL3UcUwRD4heOIda%2FFZGhfCLn%2B7ksTMcuD2%2BjT%2F7IuP8kYOTQ0ZqwnDZGNQwopAFpNNouIAx0LKAjPDIO", "https://vtbehaviour.commondatastorage.googleapis.com/5f9b9db4e9200b4576d6e8bc2888d6e7ab28a04e66083366bcde57915eed5078_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683897&Signature=A1uHov9N8mIMBn6lVPETST7i%2F%2F3lKCkTSifHpWYQ8lqnGw3%2FwBD1QhGr1tH%2BYzg4xJYZR1vHPxcGC2biWNZtPF89Sx8FKf%2F18O4PHYJb1n7YfdP24JbV%2BkekQpomFKe66pKsf0gWQQx1zTJDWvam9HuvVTyCV9h22TLG%2FmBDvK4SftnNssRv0EkzKP9dNqTfjJdMh0Y0rIEyQdNLLo%2BLsWQbrx2yxJo6kZD%2FJC", "https://vtbehaviour.commondatastorage.googleapis.com/727dc58bb6aaf24fd82f54a11560f26e38ee0ca6bb823ea70bad33fd7c9378ef_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683965&Signature=tYhGClprbVOZuxQF%2F%2BLWEx6LfO%2Fz4pigFaLvSPYRY%2Fqg92dL8%2BWlaAyT%2FJueBiXJFPkqBYoXk0DmZNj2UfqQiv4Jy9bhRG562tGCoadI7qFVHMBOyAmGj0uMVS%2FoyY00p8UkiUah%2BiG2lZaGt6eVnE1yrGqEIpnAnUxdyxti%2BDm0vFgP5Ust7yR%2F1SAtswsFyfntj2GSgBc5z1NbueSA2uSfZsxWtxmYAm9dk%2FrUPQ47Nb5Q", "https://vtbehaviour.commondatastorage.googleapis.com/7111bb197f77eecf518b22f7a6f269647abc17eda4aaed9ba50212462b9848ed_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779684045&Signature=g5SPZe7A95%2FqyMCV3ihh6MGTnXRMjhKIGP6dBCJ3OB%2FCOBrSRTz%2BpnCcdIwsJk%2Fc74E6s1DRbKJn3SszGoP7h%2FNJwXl3BIBK6KeI0zYJeOibOT%2BeU9CnCcwY%2F3bx99X3LvHRwg0Fkdg%2BJoRI620jziRVAW%2FiC1wpzeMqmJNUOHn4NsTYiMD7H8cuBnRzAZQvK2lRO5asaddU11mHkkQ963f3YOOv", "https://vtbehaviour.commondatastorage.googleapis.com/8b10c7238761ba1c98b713c673c452437c4a56794ff0e3d657cff148056c9cf1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779684153&Signature=MfmLhMZdg4gtuEoE1eB%2FroqyUo2QXTJ8L6oAmpYIvTmU8BmwS6hwF0opRe4GV3ox8yxCzd2O9fsm4T7dwrkSk8fJBlqrPHibaMNPNs4QpeMOraU4O6Au5EDLlJTtDwp43nz%2FK5tqLXzJpfqCvDEnQOghFLah5YCBj8qdFtGrKfHbvyMGL70BlhpaZsmAn3Jgu6zNXCQGqz3c%2BkATkQ3XNm%2F8FiNTOFzO5TUxHqPE3NUMFglmxAJhEo" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1074", "name": "Data Staged", "display_name": "T1074 - Data Staged" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2266, "IPv4": 326, "domain": 179, "hostname": 381, "FileHash-MD5": 811, "FileHash-SHA1": 835, "URL": 815, "email": 2 }, "indicator_count": 5615, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "3 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a13d450d1c0f6a31e71cef1", "name": "NOW BOARDING: DARK-ZERO Sheep Tracker * CAPE Sandbox", "description": "Modern threat intelligence requires moving from passive observation to active intervention. In the context of targeted tracking implants, defending civil rights means engineering systems that protect user autonomy against unauthorized data extraction. Architectural Protections:\n0-Trust Telemetry: Designing operating systems where the user owns the cryptographic root of trust.\nHardware-Enforced Isolation: Utilizing Secure Enclaves to process cryptographic keys outside the reach of a compromised kernel.\nExploit Mitigation: Implementing advanced PAC+ Memory Tagging Extensions (MTE) to stop zero-day memory corruption bugs. The holiday serves as a reminder for SOCs to uphold high ethical standards, ensuring defensive tools are never repurposed for unauthorized surveillance. Respect to all.", "modified": "2026-05-27T16:31:09.918000", "created": "2026-05-25T04:47:12.640000", "tags": [ "win32 exe", "mozilla firefox", "zip adobe", "photoshop cc", "rar adobe", "air sdk", "adobe air", "lassa2", "default", "shell folders", "inprocserver32", "parent pid", "full path", "command line", "cname", "folders", "file size", "mwdb", "accept", "shutdown", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "file", "operations", "process open", "write delete", "move time", "file type", "json", "ascii", "utf8", "sqlite version", "found", "pe file", "intel", "pe32", "ms windows", "installer", "defense evasion", "window", "title", "template", "next", "united", "performs dns", "grabber honest", "layer protocol", "attack network", "info processes", "extra info", "zenbox macos", "verdict", "guest system", "ascii text", "sigma", "creates", "t1055 process", "info dropped", "malicious", "p2404", "p11718783889", "p4de83ek69hqsh4", "p11718784848", "bazaar", "sha3384", "ssdeep", "checker", "themida", "guard", "property", "adobe device", "property name", "productname", "displayname", "destination", "root", "totalsize", "langpack", "swedish", "win32", "windows sandbox", "calls clear", "sha256", "sha1", "crc32", "size", "flash", "june", "drops pe", "crlf line", "sample", "persistence", "win64", "hook", "instructor", "kids goldadobe", "errstr", "cultureneutral", "license", "error", "code", "service", "vmprotect", "february", "back", "number", "mitre attack", "network info", "processes extra", "fri dec", "database", "initial access", "program", "overview", "overview zenbox", "ultimate file", "info file", "Nullworld", "value", "value lang", "buildinfo", "productinfo", "addremoveinfo", "displayversion", "screnshots", "United", "Swedishvpncarrierenrollment", "calls process", "writes", "png image", "rgba", "guloader", "fraud", "phishing", "install", "pdapp", "urihandler", "us tcp", "product install", "gamma", "updater", "Now boarding", "DarkZero", "Sheep Tracker" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/036d1a174e3ef9a15c8075248958c4f36d8817573ef3f6f12c62850976b32737_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681399&Signature=o4EIDa%2Bu5q7UzJoKBZ3SHIdTRWKGT7HIZyLxFZSLdRJV2Ng655y2X8OLnU2siFeopgWPI6Gd8nE9F9LFBFgwM%2F0ZN0FWsDls8m78y46TmhjHhykfch6G%2Buw3LPxmfbz999yBfELXQDUCNWIiGUPv%2B23aUdHnc0c5jI4Mvlz2HGA%2BHlIMjc1w1S%2BWm%2FI6ftHJdyIAh0SqMbPXqAy%2BIonExlGkoEmMBCJl3r3pfMcYzy4ai0", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681421&Signature=oUYsIo6y2ldihmETch4oPYw5nb4sHZhKRik2zGuv2h9rqu30GcV1xZHlIO9ttFa625EXOlrrILZtAhfM%2FamkTDjXZUTqn2%2BTKmgnxqOOfJU6KrJHPLE9Do7l7MEaPxX4cs8z8tWd0%2FY8sBv8sjGAIdWrT5OPv202LNN%2FiVe6mEIUMkmNr%2BG1S3Pgs6LRTjo%2BgqhEcNXT0MFUgs3I2e4AQ0TQ4FOs%2BVRY", "https://vtbehaviour.commondatastorage.googleapis.com/036d1a174e3ef9a15c8075248958c4f36d8817573ef3f6f12c62850976b32737_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681469&Signature=VGjB%2F%2BCQwDtsenSFWX7YNKbe9s%2Fgcpg%2FotVlxRZ6FXuE9VXITP76QQq6L2vlSM7pfQHSnBv%2BUdwMtN3QhCxjF7Zv2PV%2FkWLnwwA3hJciWMAKiLSeKTanNshzLWnmBjN04FASFwNf6kAq4PcunHkHh2PSOGl03eem41DHA6YOIRAjI1C6hAdDvKoAqJJXuGKM%2F5Z5vzfeTaXNgCRutOhVDB4%2FcAcV9zZaRcX9Ii0IFRAZo%2Bzk7rvI", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681490&Signature=bIUDLY2jLaPa0t0OyOiuRlKjk8VM9IFdVTwzJhuTKfuV%2BhwtwcYghSy4186P0qsGEebShI2xNNVBPSd3uQdeXMuYRDJWcyo18c12pLwgcLgaBot06%2Bfys%2BlGp%2FV%2FSCDBvdo3iLaAOesoSo8vbCLNsWAzGM5sztLl%2Beyq9%2F1oSuAvU692EiARhcufOCMFqXCn6MNuSp18gSQwkFRBadsMvHSjfHW645FvLUfiP5Egu1WuMVP2", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681535&Signature=K%2BM%2FPuLQI5kqDYLWjQMD%2BgPbchxwp2sWPPUtfDZYFn5H9w%2BqFPRxh7iZqH4FOPAnwlC0%2BN5TKTqrEuhABL3gWMqHySyweiNPNkJ1MlX29xZdE482pqQSn8rzkPs7CZD63ts4ZRPrK%2Bl06RV13mZf4TUzAD9Sx0m6%2FWhetQETuu6StpVmyzhie%2Fn%2FUdsdFN0SW%2BtLpQE74IVNfszCgKVhF9oNeBiifytanSbIG0SnLff9sXffjS", "https://vtbehaviour.commondatastorage.googleapis.com/087975d5f3c874a6fe9cbfe9d7ee77fb0af138e3c36a6f75e3d000699afc571d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681569&Signature=C286Cg30s1QDg1lkY0jtTLfia8Fs4B%2FdqNMfidFUYXpd2si4N25G7RBqy8LODkWqBQca8rpYyZ7FIYHuRDc0wBLk%2B1rPiEXJckZIdmkyhDkFJ2jrxfNV135BZTTeF6DkLrRfWPgnxciVK%2FJrkueYnjlYhYW08OZkTu9plzgmfR2IocW5ENVaqHbcPAdm2QDCC6VVrNQp%2FP%2FjV6%2Fkm37tinRyXhg1vKSf0TVFMzL1jpYkiS5PIc", "https://vtbehaviour.commondatastorage.googleapis.com/07f5960476ab34754f3e04143caf2d4899cb09e6b271bfd27ef1f1c8977ca050_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681591&Signature=uoP10og17YxXUe0yZ8kll3N15RJJ%2Bf5pJFzW0MUe4fdvXaLlcOfCxs%2B6EyW23FSqTj%2FbNedtUC6z7Y0dgMPBtJC%2F9gOhXEZj5%2BKKwnQbCBe7GuFtEsVMMkQRdiDQxJYZipAId1MwoBChhx%2BSr%2FrboVkDq%2F%2FbNLvWS6keRMn4fa8GX%2BF0lIJepJ98sjwXs48DXBch8974olbyd38VGGp1bLMl7mycstrQ2hIy2MFXWD", "https://vtbehaviour.commondatastorage.googleapis.com/0da371854ec2c04bbee9680dbdabb67a4e4a84add40e5e1877425790f2dfef02_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682005&Signature=SyLSFT5xdlAZ5lwNyaeDpqsMTuwGywWruel4fBOIdsyiZ%2FvtOZYr7f%2B%2BIuBmqFMAwMI4L7kB6jRtv8mVn8lmU5MUJBAG6GJdVsEp2SoexU5Yl2kTksey03ZsjBloxlJqDzf8PULDlwjfD1Ydv%2B5QFPoY3%2Fk8TKMlmmpTIw7%2FYcR24%2FHYHw78XVF2cV%2Bnb3GoDaHw%2FnpxLrDwgfZP9dWvP8V264o5l2dDfxQtF0", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682086&Signature=yzXoWEcsMl9wlTGgMQfBKEZWwnDzmua%2FR2suwDMBSqPLhunpHELcj0SzY3czM%2F9HQG9QuvYzhQRVUxR1iDaFz1BQ4YHkXJih3zm%2BcNlDcfXsOZzyYzWUhaPsbSti%2FWbFoL4E14bnS7tIuG9s9R96LkGyGpWIsT%2BPeCNhsCzD7vFRU0cPMr6vNblu%2BBiO3Ki99QSrkF4hzBxkQ7DFgba3qi7kOfal%2F2K8hC1ikcZntmn5IESW", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682105&Signature=DkIw2nRg0%2BHKmd2TpyMzcgrB%2F4s6sIVIpOEEVMqz3Csoj6PPmSGNer%2Bt5X5oYKPZQgJETAHcCRs0mh3Lfa85XEPdYk6PjMimJmKQdBstqdULgs6q7wyZEjHDhQn41ri7eQ16g7pAo9ojfhLUNp4uW2xuYvdBwYhYBsZP3EO1BKz2f3dYxSg%2Bgsn2AnC2%2BDRTIX0Xxd%2Bt44%2BkXfiY32mvDHDNDCcuT5ZDFNrHwDp3HKuuJYy7lRHm8AlK", "https://vtbehaviour.commondatastorage.googleapis.com/1f1db73659fa2fe7a944d20bb4e9a867513a50ee9b51be89dfec30c73f6ed622_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682177&Signature=yjgeq7TPzf6M6Pn8mPFgBmhHQbfgGlaadZNsSsDUKq0Da4%2Bb25WhNl6nDIyUDmRBtABod6Itj2EUlbe%2B4U0QYLuJR00aQqsO%2F9pXU4AWeIFUEZhCrwgZ5WuNPpYbdVbOYcVX6oyDXpSjv1QEGmJ1NVVr%2F1esshl3tugyHxp6LFYa9%2BQeoiqsBikKLglNB52vsap%2BkwVPKyXg%2FjduMqTQd%2FhNMM41261XiBOTtUqjpzIm67", "https://vtbehaviour.commondatastorage.googleapis.com/492dc39e7752dccfd15f588054991277e6548b794b28a03f42b9cee132eebd2e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682206&Signature=iCbR7BcpXhfqHIoxTRE%2BvhCqRoHYALCXll0hXveh8IQOJPjxw%2BlLNas6nIvp035t6sdMg9KdOY751XfThil%2FE2mLrvir%2FwKjheK2382r5bhEQFEsa6etlla3TDjlvttEFZDUN7SSLpGao8u7uVNwrPRb0BuwYDemKKVJK6DACPbUZEHk3DZ%2Bi8SxXIdELiXG%2Bozy7oC8Dcj0HqHGYuliXpjT1mV7OsCjFXvmjZPcFH06EzZS5L", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682251&Signature=z6Lrdrr5u6YZdzJaR%2B2Qab%2F%2FVA6%2FL6JaNA4%2BVxLe9wEjL%2B2ARzGBhQdq6RTX5ez3SDTWWmc%2BrOypKxxCsLeXUbjYRoIgcsSzYIxWQWoEl35tFARLVKf%2FVf%2B696U6PYQ%2F1BNWxSfuNOeUVNK2pIiMYCUjLnikvUyj9Ip3MrgKOaV9v9SShCLay93Y7b3GbAUZ2Jzy18PEYf%2FLuk4fDrqITmP2upsysOJq1MhZcJ%2", "https://vtbehaviour.commondatastorage.googleapis.com/105f31af20fdb87d442f81aad0c3a54030b7e214c4796cf2a069bae6aa89dc65_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682395&Signature=oVg82i1yTG%2BGfhoL5FyBdK%2BZKa6wi2iWMpwHyA77jBFtAOZxw%2Bs6z6So26GWDthH7UMEzwZwQC6ENF1TLBEqXukldXMdMg%2FvNylvy7vCdDKDsw53Ibc7vKnu5T0lNumnv%2FD5vnV14QZrzAE8PG3J0S0rtheY8mNCkM6t1w52XYYm5mfnGJXsnjyMEvgURuPhzOIq9%2B%2FG7XUWFK0vK%2BlzKmZU627%2FKYkT9EWHOI8Nyx%2FJUqad%2", "https://vtbehaviour.commondatastorage.googleapis.com/002150c786ae1e04ab2981bf5593d926987b60b9ac699f431ed4568084dd854b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682457&Signature=eWipoH1g7AQ8zq2pd%2BpyAKrKscAY%2FebCATbHE%2FMwdvIfIy%2F4i3OFy%2FKlfaNCXDLDU0OM6JaEF73FAqGhLEb8ZcxTuEfMeU%2F6WxjpgS2SqLZ0xOjAPgPWOOor3uCcdIEZRCcpJe%2BAzPY8jEZJ0aIf49RU85lkIx9yCiXcFnee1pNHHBFwpsBK4FNuTB%2FyDe61M5Htw4fjlf43GTnXFxj0%2Fjc%2Fe32Q7EpVkuSc0I%2F3zTrY0UkC", "https://vtbehaviour.commondatastorage.googleapis.com/492dc39e7752dccfd15f588054991277e6548b794b28a03f42b9cee132eebd2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682486&Signature=ucigAmI%2BTWYWnZuZjQb7cvSnhC1f6r93NM1kh5fCHjjcUodx6ltePV2QSdyXCnhrdH8ODLugh37CFZxsAmtiMMefuyuh6T8mtuxe7znGqLiJre5YFfSQLkzmz0Ksqekcg0sp1bUaKykXguy%2BKwv6Tg12CIM7xzaDB%2BGcjw6KkBLiD0A1sB6Z9gk9np%2FNtUBHdW7E0eBfvTWOK8F99R1lQdmQab2Vha55GLH6JRBksZ7AbBEdVS8DMtkaZCS9sV", "https://vtbehaviour.commondatastorage.googleapis.com/049c8db974d1830f931d605f6918184d8928c46c74f4152dfde3dc7bdffbf5d5_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682585&Signature=z2IzO8oruo5%2BmP%2BuhsnAbNLmy7QRAemblZDUm1KEgUCliIqrtWVkruuMg2tcIokmH12yIvRumIVlk5OcGjVxI%2Bb%2B3Va9LgSnD%2Bwjbe5pAs%2BDuUGTY52XSe7V9xdcRN38UeNFYy2jTLa2KYspIZ0NzHMsL0BzU5pqOWw0bAShHYc9sNx0S7a%2BSD7PiY%2BDR%2Br%2BQll9wUT%2B4EjhHrYYmmdRCa6vbIyTLcHmdw4JzmHHsLy%2Bjf", "https://vtbehaviour.commondatastorage.googleapis.com/27086c4185aa32bbc6674267b947e3f6610554188ac694ce2dbc1191a9525339_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683188&Signature=o0pfi%2Bqzc6KRiLra5kzATI2ROhjWVPHqZ7tOokv%2B9i4HwxX3m%2BpcqtYKMIFJMVk1qNFDyYwnCDfkeiva50iZyrha2F3bacitBdmnSwCEQE5xMG73RGPjQAvPps3tKMm1MDH8Rzpy65y9bdKpTSCL9%2Bt2xAk4%2BXx13XPz2GlU%2BG8Q%2FSPkCW96%2BX6c5xzWpIH%2FlXn7%2Bgl2G9QMGbrbnwD%2FfR58%2FrXIeIEJ%2F9%2BNt2W3Fr", "https://vtbehaviour.commondatastorage.googleapis.com/2c7002510767deb9bbb0d2ee2d47be98828bf5b6e999d6cd882b1c1a1c908510_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683299&Signature=RMRBhdx9cTLEwBYgOaiBV4x03W8laZvNMUtTq68ykLCh0R5toTaD64MdSiBhgsNAZLaS8z9dPsGmVcfMC8U5sPrXXLzAt9CBPoJjT2jV40HyYrW58xs3wjf65936U00bQy9DGFrlU7xInrhEocKiXuD17i5A%2F7tdPgx74I6xY906Ua8hyOe3f5zVmaxE6zpNAonyZtoHtHmnuDLG71DTPwYyiKcGPff7glIXoNalw4ST3jQr3Ma%2Fv1Q3De", "https://vtbehaviour.commondatastorage.googleapis.com/2c98a3b3752939b7c2db76682607e3918dee0edd81998279cb4528cc6c67f715_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683469&Signature=oE7hEU%2FccffwWPye7wmTWT154zCmhX2wBLLWErX6yptBjSn9YXSMLMohlpsjw%2BxO5VxqobuYkMh302JzsMTg4fXVD76S9F6aOL1vRPwZx8fTGOeMoKRTMO7B0xwvo2HQCra8ds7NMqXBpbNxN%2Bi7Ez6ZOyX%2FQUyixg1Ya1G7%2FkF8sEaT8z%2B4QHLhghEUdy4%2FMYbGVFzAKhSDW9Yg%2BcPfxQLt%2BViZ", "https://vtbehaviour.commondatastorage.googleapis.com/5f87d5cb5921df99f335e1a8f044db15187f88aea04ecc073b310a4b9649a5e1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683851&Signature=oDNiEuOved3Q5at8LARyePhpQE3%2FjmEYRIWg4Vzp0yzifSrnwMGaujbhYJWqc8BadzAh1AhmrfOaNLGJfe8IO2Izje4ofsfex0DAAfgHm5l1vDeQWFDfgypa9%2F8sHOOgBiUlbdSDYrVdZ2Z9f8MGr8OaswhQwykG5mL3UcUwRD4heOIda%2FFZGhfCLn%2B7ksTMcuD2%2BjT%2F7IuP8kYOTQ0ZqwnDZGNQwopAFpNNouIAx0LKAjPDIO", "https://vtbehaviour.commondatastorage.googleapis.com/5f9b9db4e9200b4576d6e8bc2888d6e7ab28a04e66083366bcde57915eed5078_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683897&Signature=A1uHov9N8mIMBn6lVPETST7i%2F%2F3lKCkTSifHpWYQ8lqnGw3%2FwBD1QhGr1tH%2BYzg4xJYZR1vHPxcGC2biWNZtPF89Sx8FKf%2F18O4PHYJb1n7YfdP24JbV%2BkekQpomFKe66pKsf0gWQQx1zTJDWvam9HuvVTyCV9h22TLG%2FmBDvK4SftnNssRv0EkzKP9dNqTfjJdMh0Y0rIEyQdNLLo%2BLsWQbrx2yxJo6kZD%2FJC", "https://vtbehaviour.commondatastorage.googleapis.com/727dc58bb6aaf24fd82f54a11560f26e38ee0ca6bb823ea70bad33fd7c9378ef_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683965&Signature=tYhGClprbVOZuxQF%2F%2BLWEx6LfO%2Fz4pigFaLvSPYRY%2Fqg92dL8%2BWlaAyT%2FJueBiXJFPkqBYoXk0DmZNj2UfqQiv4Jy9bhRG562tGCoadI7qFVHMBOyAmGj0uMVS%2FoyY00p8UkiUah%2BiG2lZaGt6eVnE1yrGqEIpnAnUxdyxti%2BDm0vFgP5Ust7yR%2F1SAtswsFyfntj2GSgBc5z1NbueSA2uSfZsxWtxmYAm9dk%2FrUPQ47Nb5Q", "https://vtbehaviour.commondatastorage.googleapis.com/7111bb197f77eecf518b22f7a6f269647abc17eda4aaed9ba50212462b9848ed_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779684045&Signature=g5SPZe7A95%2FqyMCV3ihh6MGTnXRMjhKIGP6dBCJ3OB%2FCOBrSRTz%2BpnCcdIwsJk%2Fc74E6s1DRbKJn3SszGoP7h%2FNJwXl3BIBK6KeI0zYJeOibOT%2BeU9CnCcwY%2F3bx99X3LvHRwg0Fkdg%2BJoRI620jziRVAW%2FiC1wpzeMqmJNUOHn4NsTYiMD7H8cuBnRzAZQvK2lRO5asaddU11mHkkQ963f3YOOv", "https://vtbehaviour.commondatastorage.googleapis.com/8b10c7238761ba1c98b713c673c452437c4a56794ff0e3d657cff148056c9cf1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779684153&Signature=MfmLhMZdg4gtuEoE1eB%2FroqyUo2QXTJ8L6oAmpYIvTmU8BmwS6hwF0opRe4GV3ox8yxCzd2O9fsm4T7dwrkSk8fJBlqrPHibaMNPNs4QpeMOraU4O6Au5EDLlJTtDwp43nz%2FK5tqLXzJpfqCvDEnQOghFLah5YCBj8qdFtGrKfHbvyMGL70BlhpaZsmAn3Jgu6zNXCQGqz3c%2BkATkQ3XNm%2F8FiNTOFzO5TUxHqPE3NUMFglmxAJhEo" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1074", "name": "Data Staged", "display_name": "T1074 - Data Staged" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2266, "IPv4": 327, "domain": 178, "hostname": 372, "FileHash-MD5": 805, "FileHash-SHA1": 833, "URL": 812, "email": 2 }, "indicator_count": 5595, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "3 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a13d455f52a1c3acb3904b6", "name": "NOW BOARDING: DARK-ZERO Sheep Tracker * CAPE Sandbox", "description": "Modern threat intelligence requires moving from passive observation to active intervention. In the context of targeted tracking implants, defending civil rights means engineering systems that protect user autonomy against unauthorized data extraction. Architectural Protections:\n0-Trust Telemetry: Designing operating systems where the user owns the cryptographic root of trust.\nHardware-Enforced Isolation: Utilizing Secure Enclaves to process cryptographic keys outside the reach of a compromised kernel.\nExploit Mitigation: Implementing advanced PAC+ Memory Tagging Extensions (MTE) to stop zero-day memory corruption bugs. The holiday serves as a reminder for SOCs to uphold high ethical standards, ensuring defensive tools are never repurposed for unauthorized surveillance. Respect to all.", "modified": "2026-05-27T16:29:42.941000", "created": "2026-05-25T04:47:17.194000", "tags": [ "win32 exe", "mozilla firefox", "zip adobe", "photoshop cc", "rar adobe", "air sdk", "adobe air", "lassa2", "default", "shell folders", "inprocserver32", "parent pid", "full path", "command line", "cname", "folders", "file size", "mwdb", "accept", "shutdown", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "file", "operations", "process open", "write delete", "move time", "file type", "json", "ascii", "utf8", "sqlite version", "found", "pe file", "intel", "pe32", "ms windows", "installer", "defense evasion", "window", "title", "template", "next", "united", "performs dns", "grabber honest", "layer protocol", "attack network", "info processes", "extra info", "zenbox macos", "verdict", "guest system", "ascii text", "sigma", "creates", "t1055 process", "info dropped", "malicious", "p2404", "p11718783889", "p4de83ek69hqsh4", "p11718784848", "bazaar", "sha3384", "ssdeep", "checker", "themida", "guard", "property", "adobe device", "property name", "productname", "displayname", "destination", "root", "totalsize", "langpack", "swedish", "win32", "windows sandbox", "calls clear", "sha256", "sha1", "crc32", "size", "flash", "june", "drops pe", "crlf line", "sample", "persistence", "win64", "hook", "instructor", "kids goldadobe", "errstr", "cultureneutral", "license", "error", "code", "service", "vmprotect", "february", "back", "number", "mitre attack", "network info", "processes extra", "fri dec", "database", "initial access", "program", "overview", "overview zenbox", "ultimate file", "info file", "Nullworld", "value", "value lang", "buildinfo", "productinfo", "addremoveinfo", "displayversion", "screnshots", "United", "Swedishvpncarrierenrollment", "calls process", "writes", "png image", "rgba", "guloader", "fraud", "phishing", "install", "pdapp", "urihandler", "us tcp", "product install", "gamma", "updater", "Now boarding", "DarkZero", "Sheep Tracker" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/036d1a174e3ef9a15c8075248958c4f36d8817573ef3f6f12c62850976b32737_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681399&Signature=o4EIDa%2Bu5q7UzJoKBZ3SHIdTRWKGT7HIZyLxFZSLdRJV2Ng655y2X8OLnU2siFeopgWPI6Gd8nE9F9LFBFgwM%2F0ZN0FWsDls8m78y46TmhjHhykfch6G%2Buw3LPxmfbz999yBfELXQDUCNWIiGUPv%2B23aUdHnc0c5jI4Mvlz2HGA%2BHlIMjc1w1S%2BWm%2FI6ftHJdyIAh0SqMbPXqAy%2BIonExlGkoEmMBCJl3r3pfMcYzy4ai0", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681421&Signature=oUYsIo6y2ldihmETch4oPYw5nb4sHZhKRik2zGuv2h9rqu30GcV1xZHlIO9ttFa625EXOlrrILZtAhfM%2FamkTDjXZUTqn2%2BTKmgnxqOOfJU6KrJHPLE9Do7l7MEaPxX4cs8z8tWd0%2FY8sBv8sjGAIdWrT5OPv202LNN%2FiVe6mEIUMkmNr%2BG1S3Pgs6LRTjo%2BgqhEcNXT0MFUgs3I2e4AQ0TQ4FOs%2BVRY", "https://vtbehaviour.commondatastorage.googleapis.com/036d1a174e3ef9a15c8075248958c4f36d8817573ef3f6f12c62850976b32737_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681469&Signature=VGjB%2F%2BCQwDtsenSFWX7YNKbe9s%2Fgcpg%2FotVlxRZ6FXuE9VXITP76QQq6L2vlSM7pfQHSnBv%2BUdwMtN3QhCxjF7Zv2PV%2FkWLnwwA3hJciWMAKiLSeKTanNshzLWnmBjN04FASFwNf6kAq4PcunHkHh2PSOGl03eem41DHA6YOIRAjI1C6hAdDvKoAqJJXuGKM%2F5Z5vzfeTaXNgCRutOhVDB4%2FcAcV9zZaRcX9Ii0IFRAZo%2Bzk7rvI", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681490&Signature=bIUDLY2jLaPa0t0OyOiuRlKjk8VM9IFdVTwzJhuTKfuV%2BhwtwcYghSy4186P0qsGEebShI2xNNVBPSd3uQdeXMuYRDJWcyo18c12pLwgcLgaBot06%2Bfys%2BlGp%2FV%2FSCDBvdo3iLaAOesoSo8vbCLNsWAzGM5sztLl%2Beyq9%2F1oSuAvU692EiARhcufOCMFqXCn6MNuSp18gSQwkFRBadsMvHSjfHW645FvLUfiP5Egu1WuMVP2", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681535&Signature=K%2BM%2FPuLQI5kqDYLWjQMD%2BgPbchxwp2sWPPUtfDZYFn5H9w%2BqFPRxh7iZqH4FOPAnwlC0%2BN5TKTqrEuhABL3gWMqHySyweiNPNkJ1MlX29xZdE482pqQSn8rzkPs7CZD63ts4ZRPrK%2Bl06RV13mZf4TUzAD9Sx0m6%2FWhetQETuu6StpVmyzhie%2Fn%2FUdsdFN0SW%2BtLpQE74IVNfszCgKVhF9oNeBiifytanSbIG0SnLff9sXffjS", "https://vtbehaviour.commondatastorage.googleapis.com/087975d5f3c874a6fe9cbfe9d7ee77fb0af138e3c36a6f75e3d000699afc571d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681569&Signature=C286Cg30s1QDg1lkY0jtTLfia8Fs4B%2FdqNMfidFUYXpd2si4N25G7RBqy8LODkWqBQca8rpYyZ7FIYHuRDc0wBLk%2B1rPiEXJckZIdmkyhDkFJ2jrxfNV135BZTTeF6DkLrRfWPgnxciVK%2FJrkueYnjlYhYW08OZkTu9plzgmfR2IocW5ENVaqHbcPAdm2QDCC6VVrNQp%2FP%2FjV6%2Fkm37tinRyXhg1vKSf0TVFMzL1jpYkiS5PIc", "https://vtbehaviour.commondatastorage.googleapis.com/07f5960476ab34754f3e04143caf2d4899cb09e6b271bfd27ef1f1c8977ca050_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681591&Signature=uoP10og17YxXUe0yZ8kll3N15RJJ%2Bf5pJFzW0MUe4fdvXaLlcOfCxs%2B6EyW23FSqTj%2FbNedtUC6z7Y0dgMPBtJC%2F9gOhXEZj5%2BKKwnQbCBe7GuFtEsVMMkQRdiDQxJYZipAId1MwoBChhx%2BSr%2FrboVkDq%2F%2FbNLvWS6keRMn4fa8GX%2BF0lIJepJ98sjwXs48DXBch8974olbyd38VGGp1bLMl7mycstrQ2hIy2MFXWD", "https://vtbehaviour.commondatastorage.googleapis.com/0da371854ec2c04bbee9680dbdabb67a4e4a84add40e5e1877425790f2dfef02_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682005&Signature=SyLSFT5xdlAZ5lwNyaeDpqsMTuwGywWruel4fBOIdsyiZ%2FvtOZYr7f%2B%2BIuBmqFMAwMI4L7kB6jRtv8mVn8lmU5MUJBAG6GJdVsEp2SoexU5Yl2kTksey03ZsjBloxlJqDzf8PULDlwjfD1Ydv%2B5QFPoY3%2Fk8TKMlmmpTIw7%2FYcR24%2FHYHw78XVF2cV%2Bnb3GoDaHw%2FnpxLrDwgfZP9dWvP8V264o5l2dDfxQtF0", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682086&Signature=yzXoWEcsMl9wlTGgMQfBKEZWwnDzmua%2FR2suwDMBSqPLhunpHELcj0SzY3czM%2F9HQG9QuvYzhQRVUxR1iDaFz1BQ4YHkXJih3zm%2BcNlDcfXsOZzyYzWUhaPsbSti%2FWbFoL4E14bnS7tIuG9s9R96LkGyGpWIsT%2BPeCNhsCzD7vFRU0cPMr6vNblu%2BBiO3Ki99QSrkF4hzBxkQ7DFgba3qi7kOfal%2F2K8hC1ikcZntmn5IESW", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682105&Signature=DkIw2nRg0%2BHKmd2TpyMzcgrB%2F4s6sIVIpOEEVMqz3Csoj6PPmSGNer%2Bt5X5oYKPZQgJETAHcCRs0mh3Lfa85XEPdYk6PjMimJmKQdBstqdULgs6q7wyZEjHDhQn41ri7eQ16g7pAo9ojfhLUNp4uW2xuYvdBwYhYBsZP3EO1BKz2f3dYxSg%2Bgsn2AnC2%2BDRTIX0Xxd%2Bt44%2BkXfiY32mvDHDNDCcuT5ZDFNrHwDp3HKuuJYy7lRHm8AlK", "https://vtbehaviour.commondatastorage.googleapis.com/1f1db73659fa2fe7a944d20bb4e9a867513a50ee9b51be89dfec30c73f6ed622_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682177&Signature=yjgeq7TPzf6M6Pn8mPFgBmhHQbfgGlaadZNsSsDUKq0Da4%2Bb25WhNl6nDIyUDmRBtABod6Itj2EUlbe%2B4U0QYLuJR00aQqsO%2F9pXU4AWeIFUEZhCrwgZ5WuNPpYbdVbOYcVX6oyDXpSjv1QEGmJ1NVVr%2F1esshl3tugyHxp6LFYa9%2BQeoiqsBikKLglNB52vsap%2BkwVPKyXg%2FjduMqTQd%2FhNMM41261XiBOTtUqjpzIm67", "https://vtbehaviour.commondatastorage.googleapis.com/492dc39e7752dccfd15f588054991277e6548b794b28a03f42b9cee132eebd2e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682206&Signature=iCbR7BcpXhfqHIoxTRE%2BvhCqRoHYALCXll0hXveh8IQOJPjxw%2BlLNas6nIvp035t6sdMg9KdOY751XfThil%2FE2mLrvir%2FwKjheK2382r5bhEQFEsa6etlla3TDjlvttEFZDUN7SSLpGao8u7uVNwrPRb0BuwYDemKKVJK6DACPbUZEHk3DZ%2Bi8SxXIdELiXG%2Bozy7oC8Dcj0HqHGYuliXpjT1mV7OsCjFXvmjZPcFH06EzZS5L", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682251&Signature=z6Lrdrr5u6YZdzJaR%2B2Qab%2F%2FVA6%2FL6JaNA4%2BVxLe9wEjL%2B2ARzGBhQdq6RTX5ez3SDTWWmc%2BrOypKxxCsLeXUbjYRoIgcsSzYIxWQWoEl35tFARLVKf%2FVf%2B696U6PYQ%2F1BNWxSfuNOeUVNK2pIiMYCUjLnikvUyj9Ip3MrgKOaV9v9SShCLay93Y7b3GbAUZ2Jzy18PEYf%2FLuk4fDrqITmP2upsysOJq1MhZcJ%2", "https://vtbehaviour.commondatastorage.googleapis.com/105f31af20fdb87d442f81aad0c3a54030b7e214c4796cf2a069bae6aa89dc65_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682395&Signature=oVg82i1yTG%2BGfhoL5FyBdK%2BZKa6wi2iWMpwHyA77jBFtAOZxw%2Bs6z6So26GWDthH7UMEzwZwQC6ENF1TLBEqXukldXMdMg%2FvNylvy7vCdDKDsw53Ibc7vKnu5T0lNumnv%2FD5vnV14QZrzAE8PG3J0S0rtheY8mNCkM6t1w52XYYm5mfnGJXsnjyMEvgURuPhzOIq9%2B%2FG7XUWFK0vK%2BlzKmZU627%2FKYkT9EWHOI8Nyx%2FJUqad%2", "https://vtbehaviour.commondatastorage.googleapis.com/002150c786ae1e04ab2981bf5593d926987b60b9ac699f431ed4568084dd854b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682457&Signature=eWipoH1g7AQ8zq2pd%2BpyAKrKscAY%2FebCATbHE%2FMwdvIfIy%2F4i3OFy%2FKlfaNCXDLDU0OM6JaEF73FAqGhLEb8ZcxTuEfMeU%2F6WxjpgS2SqLZ0xOjAPgPWOOor3uCcdIEZRCcpJe%2BAzPY8jEZJ0aIf49RU85lkIx9yCiXcFnee1pNHHBFwpsBK4FNuTB%2FyDe61M5Htw4fjlf43GTnXFxj0%2Fjc%2Fe32Q7EpVkuSc0I%2F3zTrY0UkC", "https://vtbehaviour.commondatastorage.googleapis.com/492dc39e7752dccfd15f588054991277e6548b794b28a03f42b9cee132eebd2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682486&Signature=ucigAmI%2BTWYWnZuZjQb7cvSnhC1f6r93NM1kh5fCHjjcUodx6ltePV2QSdyXCnhrdH8ODLugh37CFZxsAmtiMMefuyuh6T8mtuxe7znGqLiJre5YFfSQLkzmz0Ksqekcg0sp1bUaKykXguy%2BKwv6Tg12CIM7xzaDB%2BGcjw6KkBLiD0A1sB6Z9gk9np%2FNtUBHdW7E0eBfvTWOK8F99R1lQdmQab2Vha55GLH6JRBksZ7AbBEdVS8DMtkaZCS9sV", "https://vtbehaviour.commondatastorage.googleapis.com/049c8db974d1830f931d605f6918184d8928c46c74f4152dfde3dc7bdffbf5d5_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682585&Signature=z2IzO8oruo5%2BmP%2BuhsnAbNLmy7QRAemblZDUm1KEgUCliIqrtWVkruuMg2tcIokmH12yIvRumIVlk5OcGjVxI%2Bb%2B3Va9LgSnD%2Bwjbe5pAs%2BDuUGTY52XSe7V9xdcRN38UeNFYy2jTLa2KYspIZ0NzHMsL0BzU5pqOWw0bAShHYc9sNx0S7a%2BSD7PiY%2BDR%2Br%2BQll9wUT%2B4EjhHrYYmmdRCa6vbIyTLcHmdw4JzmHHsLy%2Bjf", "https://vtbehaviour.commondatastorage.googleapis.com/27086c4185aa32bbc6674267b947e3f6610554188ac694ce2dbc1191a9525339_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683188&Signature=o0pfi%2Bqzc6KRiLra5kzATI2ROhjWVPHqZ7tOokv%2B9i4HwxX3m%2BpcqtYKMIFJMVk1qNFDyYwnCDfkeiva50iZyrha2F3bacitBdmnSwCEQE5xMG73RGPjQAvPps3tKMm1MDH8Rzpy65y9bdKpTSCL9%2Bt2xAk4%2BXx13XPz2GlU%2BG8Q%2FSPkCW96%2BX6c5xzWpIH%2FlXn7%2Bgl2G9QMGbrbnwD%2FfR58%2FrXIeIEJ%2F9%2BNt2W3Fr", "https://vtbehaviour.commondatastorage.googleapis.com/2c7002510767deb9bbb0d2ee2d47be98828bf5b6e999d6cd882b1c1a1c908510_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683299&Signature=RMRBhdx9cTLEwBYgOaiBV4x03W8laZvNMUtTq68ykLCh0R5toTaD64MdSiBhgsNAZLaS8z9dPsGmVcfMC8U5sPrXXLzAt9CBPoJjT2jV40HyYrW58xs3wjf65936U00bQy9DGFrlU7xInrhEocKiXuD17i5A%2F7tdPgx74I6xY906Ua8hyOe3f5zVmaxE6zpNAonyZtoHtHmnuDLG71DTPwYyiKcGPff7glIXoNalw4ST3jQr3Ma%2Fv1Q3De", "https://vtbehaviour.commondatastorage.googleapis.com/2c98a3b3752939b7c2db76682607e3918dee0edd81998279cb4528cc6c67f715_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683469&Signature=oE7hEU%2FccffwWPye7wmTWT154zCmhX2wBLLWErX6yptBjSn9YXSMLMohlpsjw%2BxO5VxqobuYkMh302JzsMTg4fXVD76S9F6aOL1vRPwZx8fTGOeMoKRTMO7B0xwvo2HQCra8ds7NMqXBpbNxN%2Bi7Ez6ZOyX%2FQUyixg1Ya1G7%2FkF8sEaT8z%2B4QHLhghEUdy4%2FMYbGVFzAKhSDW9Yg%2BcPfxQLt%2BViZ", "https://vtbehaviour.commondatastorage.googleapis.com/5f87d5cb5921df99f335e1a8f044db15187f88aea04ecc073b310a4b9649a5e1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683851&Signature=oDNiEuOved3Q5at8LARyePhpQE3%2FjmEYRIWg4Vzp0yzifSrnwMGaujbhYJWqc8BadzAh1AhmrfOaNLGJfe8IO2Izje4ofsfex0DAAfgHm5l1vDeQWFDfgypa9%2F8sHOOgBiUlbdSDYrVdZ2Z9f8MGr8OaswhQwykG5mL3UcUwRD4heOIda%2FFZGhfCLn%2B7ksTMcuD2%2BjT%2F7IuP8kYOTQ0ZqwnDZGNQwopAFpNNouIAx0LKAjPDIO", "https://vtbehaviour.commondatastorage.googleapis.com/5f9b9db4e9200b4576d6e8bc2888d6e7ab28a04e66083366bcde57915eed5078_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683897&Signature=A1uHov9N8mIMBn6lVPETST7i%2F%2F3lKCkTSifHpWYQ8lqnGw3%2FwBD1QhGr1tH%2BYzg4xJYZR1vHPxcGC2biWNZtPF89Sx8FKf%2F18O4PHYJb1n7YfdP24JbV%2BkekQpomFKe66pKsf0gWQQx1zTJDWvam9HuvVTyCV9h22TLG%2FmBDvK4SftnNssRv0EkzKP9dNqTfjJdMh0Y0rIEyQdNLLo%2BLsWQbrx2yxJo6kZD%2FJC", "https://vtbehaviour.commondatastorage.googleapis.com/727dc58bb6aaf24fd82f54a11560f26e38ee0ca6bb823ea70bad33fd7c9378ef_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683965&Signature=tYhGClprbVOZuxQF%2F%2BLWEx6LfO%2Fz4pigFaLvSPYRY%2Fqg92dL8%2BWlaAyT%2FJueBiXJFPkqBYoXk0DmZNj2UfqQiv4Jy9bhRG562tGCoadI7qFVHMBOyAmGj0uMVS%2FoyY00p8UkiUah%2BiG2lZaGt6eVnE1yrGqEIpnAnUxdyxti%2BDm0vFgP5Ust7yR%2F1SAtswsFyfntj2GSgBc5z1NbueSA2uSfZsxWtxmYAm9dk%2FrUPQ47Nb5Q", "https://vtbehaviour.commondatastorage.googleapis.com/7111bb197f77eecf518b22f7a6f269647abc17eda4aaed9ba50212462b9848ed_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779684045&Signature=g5SPZe7A95%2FqyMCV3ihh6MGTnXRMjhKIGP6dBCJ3OB%2FCOBrSRTz%2BpnCcdIwsJk%2Fc74E6s1DRbKJn3SszGoP7h%2FNJwXl3BIBK6KeI0zYJeOibOT%2BeU9CnCcwY%2F3bx99X3LvHRwg0Fkdg%2BJoRI620jziRVAW%2FiC1wpzeMqmJNUOHn4NsTYiMD7H8cuBnRzAZQvK2lRO5asaddU11mHkkQ963f3YOOv", "https://vtbehaviour.commondatastorage.googleapis.com/8b10c7238761ba1c98b713c673c452437c4a56794ff0e3d657cff148056c9cf1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779684153&Signature=MfmLhMZdg4gtuEoE1eB%2FroqyUo2QXTJ8L6oAmpYIvTmU8BmwS6hwF0opRe4GV3ox8yxCzd2O9fsm4T7dwrkSk8fJBlqrPHibaMNPNs4QpeMOraU4O6Au5EDLlJTtDwp43nz%2FK5tqLXzJpfqCvDEnQOghFLah5YCBj8qdFtGrKfHbvyMGL70BlhpaZsmAn3Jgu6zNXCQGqz3c%2BkATkQ3XNm%2F8FiNTOFzO5TUxHqPE3NUMFglmxAJhEo" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1074", "name": "Data Staged", "display_name": "T1074 - Data Staged" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2266, "IPv4": 327, "domain": 178, "hostname": 382, "FileHash-MD5": 805, "FileHash-SHA1": 833, "URL": 816, "email": 2 }, "indicator_count": 5609, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "3 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a0e80601f3040ce2765f408", "name": "applespell VirusTotal Box of Apples Sandbox report", "description": "[full report on the Visual Studio Code.app.com malware, published on 19 January, 2024 and published online by the University of South Wales (USA) in the United States.]", "modified": "2026-05-21T04:05:48.166000", "created": "2026-05-21T03:47:44.044000", "tags": [ "applespell", "gx installer", "opera gx", "installer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "updater", "mitre attack", "file type", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive", "persistence", "malicious", "next" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00000be919bbf39d160bc68a67b09b51ad7f246c662c990841908f20fcf12715_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779335150&Signature=uDtc71sxnnFjUynOWL3%2BEfCWBdV5z5ySup%2Bc1zR2wZ6As7QGYwmEfhjw5Q7oU8ejTyM2hzc8A%2BNiG%2FLVKKlNfMvIhjiD1eeMdbMD9ZlBtmDb%2BWt2QmG%2B5nva1h0WfWoacQwywV6%2FluInYutfcA56BrWxyle6SDogMg0FYhPC0N313lpykH5TB%2FnQKDWeG9dnagRdUJZLwEgU4i9fniVZcnrzGT8Lh9", "https://vtbehaviour.commondatastorage.googleapis.com/000033bb30ef26261f53f933a0f21cf4eed370bd987e081e0679898b3a6bddda_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779335270&Signature=HD1tv4%2BfbWxkeiy0n49jYf0bWSIQZGoTXEbGtzILXBy9ABXvdNKR8TYp3JjubOUUsjKIza8dV0WnN53Ye2ZuwtdkwPuYQ5cdWV3hQ4DDGC02om6I44vDnC7twPKfenv1Foxe2Xq11CjgLk6Mdg49WD6DWXvzpdgafbdvdrjLLk%2FEc6IlEf%2F5hUBfcXH6I%2FwxHQownjqPhfo5D%2BN2k6kKw6WKCoupY8pC3Riz%2F%2F5ZUDVqHvjc" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 4, "FileHash-SHA256": 58, "IPv4": 47, "domain": 16, "hostname": 61, "URL": 105, "FileHash-MD5": 1, "Mutex": 2 }, "indicator_count": 294, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "10 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a0e805ea0647270dfa7bba7", "name": "applespell VirusTotal Box of Apples Sandbox report", "description": "[full report on the Visual Studio Code.app.com malware, published on 19 January, 2024 and published online by the University of South Wales (USA) in the United States.]", "modified": "2026-05-21T03:47:42.242000", "created": "2026-05-21T03:47:42.242000", "tags": [ "applespell", "gx installer", "opera gx", "installer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "updater", "mitre attack", "file type", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive", "persistence", "malicious", "next" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00000be919bbf39d160bc68a67b09b51ad7f246c662c990841908f20fcf12715_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779335150&Signature=uDtc71sxnnFjUynOWL3%2BEfCWBdV5z5ySup%2Bc1zR2wZ6As7QGYwmEfhjw5Q7oU8ejTyM2hzc8A%2BNiG%2FLVKKlNfMvIhjiD1eeMdbMD9ZlBtmDb%2BWt2QmG%2B5nva1h0WfWoacQwywV6%2FluInYutfcA56BrWxyle6SDogMg0FYhPC0N313lpykH5TB%2FnQKDWeG9dnagRdUJZLwEgU4i9fniVZcnrzGT8Lh9", "https://vtbehaviour.commondatastorage.googleapis.com/000033bb30ef26261f53f933a0f21cf4eed370bd987e081e0679898b3a6bddda_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779335270&Signature=HD1tv4%2BfbWxkeiy0n49jYf0bWSIQZGoTXEbGtzILXBy9ABXvdNKR8TYp3JjubOUUsjKIza8dV0WnN53Ye2ZuwtdkwPuYQ5cdWV3hQ4DDGC02om6I44vDnC7twPKfenv1Foxe2Xq11CjgLk6Mdg49WD6DWXvzpdgafbdvdrjLLk%2FEc6IlEf%2F5hUBfcXH6I%2FwxHQownjqPhfo5D%2BN2k6kKw6WKCoupY8pC3Riz%2F%2F5ZUDVqHvjc" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 4, "FileHash-SHA256": 58, "IPv4": 47, "domain": 14, "hostname": 33, "URL": 54, "FileHash-MD5": 1 }, "indicator_count": 211, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "10 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fb3d6585753bfdc08890a4", "name": "vxCube \u2014 Report + other sandboxes- Firmware Nuetral", "description": "[sample of malicious software from the Firefox operating system has been analysed by Microsoft's security team, the Office of the President, and the Microsoft Research Research Centre (MSR) in the US.]", "modified": "2026-05-06T13:54:34.222000", "created": "2026-05-06T13:08:53.749000", "tags": [ "port", "protocol level", "application", "next connection", "previous", "address", "full path", "behavior", "programfiles", "system32", "dump", "malicious", "path", "nethandle", "net108", "net1080000", "mcics", "orgid", "mcics address", "loudoun county", "pkwy city", "postalcode", "orgtechhandle", "services", "city", "stateprov", "rabuseref", "rabusehandle", "brockdorff", "c source", "utf8 unicode", "c program", "crlf", "lf line", "united", "https", "mitre attack", "network info", "processes extra", "tls version", "overview", "overview os", "x sandbox", "verdict", "next", "parent pid", "command line", "default", "nothing", "registry keys", "openasrundll c", "shell folders", "file execution", "k netsvcs", "ascii text", "categories", "settings", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "inprocserver32", "file type", "accept", "shutdown", "stream", "template", "cname", "value a", "first counter", "bearer", "mbisslshort", "bridge", "info", "date", "agent", "root", "mutexes nothing", "files c", "read files", "read registry", "keys nothing", "ipmgmt", "orgtechref", "orgabusehandle", "orgabuseref", "win1", "acrongl integ", "adc4240758", "heuristic match", "pattern match", "x2dax2da", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "angsana new", "back", "style", "cohasset police", "department", "doctype html", "head", "link", "cohasset", "title", "noscript", "meta", "performs dns", "urls", "downloads", "found", "http", "phishing" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/3a84ea97f8bfafb4a3ad6afa252315fa2c3529a732cad9070f045696dea0095e_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070092&Signature=yQBUKJDn%2FE85%2Bvl5P67ywdjBoRJ9GZj%2F%2BePT2hJjEffamM3aO%2BQVSWq3TEsVfnNMCrMPcAsJaRu64RPZJxztS%2BgQtOpCjQFUv%2FtAUou8ougQPOunxMuuX1m3PjxBDqourRIeENFZO77MUSjWuVCFEtG882utsoMv2%2FovTPqG8LU0NxjlfwMovVpkkg94Dl1tZ6O0VYlnipdZBtM6Web8IAlNUAyR4CvJrv%2BM1IR67fi", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070807&Signature=3Dm7s%2FWRPcwn5VP1fZqDViARRLpzpU7PhwwfHx%2BqMe02mkhGSmislwkS8ckH3N1K1YNVxQfqnYu89FHUKpUwC%2BOyk62pASZINgeaGaCbiysNZvDGs%2F2bN6sqg3bmKDPeVDLF34BlRrnunSY9pW0x1yITnVIRn%2FuSz9QZWFDonZBEPgt35JYofh7f9yIlA748rsPLmeMPA3RByc2n0aof5W3ghVdeTr90wlQAPidcpmEWNRXCEYPH", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070947&Signature=Pkvb9Ml3f67kATtPQnKDPoRC9hQFahD3ukXAX89sLQoBuLuyPnKpZAOIOnSPYjdPv4WWamTA32WSWfVjVswMo%2FxhdtvqyQ3BysNGqKOT35gQ1YGZkZE2%2Bx6lA0XHfdv7ZLkCTVyTUd5O2WzXo1zqFBiyh3PORdPcyikZvKrywiURORR5HeHZ1KRu5Mc%2Fy5u%2FVhA4hHTzRLJiNgzC0LCacu5aimzZ%2F5uWpy6xypNiXN5HwM4hrXNW", "https://vtbehaviour.commondatastorage.googleapis.com/da7e7a13944b0bf0f34215c4dd57810f470a43940141f9799841bce91c42b40e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071428&Signature=jg4VsRqc9AHseQKbSiN9X3N19v33%2B77cUjnoREoq3%2FAmob%2FK3l8KEZhhL1wGCFaOtjmj50aTom8QTJxDGPm9rawrO8J1V%2B8zF%2FRlfppMMiuQBSmfbpNhkJREFuRAjCvwHAxsrsixKwbxYtOMD%2FU5QrBSrkg%2B8xV3PpeZdM0J5dM8Ay%2Be1ZBCPy36ntYzbevszIsncCdUaH0Xy9WnsHV7Ps09g%2F1Z7z9rGZWdCZrPqZi3", "https://vtbehaviour.commondatastorage.googleapis.com/d3913c5d8f77fff5191b43bd32dbd8178958891bd1d90efe7a7d969ef4ab602d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071932&Signature=j2umSLl4iyhp%2FxLzsH2vZYAyU%2Fx8ki4zCfuDcXx4UgkjsO5DPIByYk043fTjoRkyd542Vqqz%2F22PYnjwhhjRJ7lXaJCPCcmtSfsWP1zGllMKIgDV57e%2FmtN%2FAzQ%2BNlqIVxXmL9peGu%2B75w6x0YaGUTBYw17iOlL87DRfZhl8Li6xlA7cX4eSHodT%2BO2B7k3D6bzQend61z62Mq76xqXV5zkXIyZCOU9a4KnKZ53nXkwnqm", "https://vtbehaviour.commondatastorage.googleapis.com/3d1c4ea329813f1aec4d7de630dc13acb95bd7b767338efe5b533fca04ff48d8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072001&Signature=gIJuOyCvRHsKP79iVyX27BLkKoVj4d7bKoB84FCSGxlJ9zsLuc7J3OmaluxaiqoJu4T2o7aeANdkYMz6d8wD3%2BFD0dQQU5%2FOhhMAbYBXp73p39CyDndq1e9LD3eNxfnr0uIrt3RccUEfgo2LF8ktZh%2BPm82SICNgJeTwVv3L2YifDZTr0lPeII2WWqpPYd4Y7qWgyUEjXmipc0SPAWZhVHXPY0DJmHbFkv%2F%2FeObiESxFAH%2BCZn", "https://vtbehaviour.commondatastorage.googleapis.com/1e5907b4cc44209637af8273555449b066fe9ce01179cd74c792e4a355a7aa4a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072217&Signature=gM91SnakBbk714%2BMza0mWtlxTRy66cB0QyotuErcCDzM8yQYmu6%2Bcy7Z1y970ywZpR05P6F4GhC8w%2Fhcd9kx0fAodkFhb3wHR6C%2F2yqPY1UMuIAOAjc6gmmrRk7%2F4M7m4MVTtnOGppQBfs9YQbqQ0ngyL5CES9vxGqIcyOOgLBRwVYQJ9PRdr5QHxDsJ8oQnGTKtuy4SKZnWfNJC7dAJhebDBsgHJRkYO9oUnFoY5uBh%2FFcveZ", "https://hybrid-analysis.com/sample/96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7", "https://hybrid-analysis.com/file-collection/674d072894a867c6c2076c5d", "https://hybrid-analysis.com/file-collection/655e17cc95592e2d640f556e", "https://vtbehaviour.commondatastorage.googleapis.com/e1280a3b44c48db6234162ad01131ca61f7e8733d78e2e192a53c34a460c6614_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072860&Signature=7lMnvE%2BOZ3HyFUJ9u4mf%2BszccaSI9tFlLU%2FfFNImL7UJfki9ecs6q%2B1ctALN1bsjGkAAmR9EemyHqlljLWn0e%2BoroBznqlwJhGInZW%2FonsioPQgc1Py97%2BpBefHrTJQoW%2FKPNt%2FOfifRY5PeC%2BIrYsr3NTQFk0GbjkyYzcYUA1VVNk6Tl7INGc5cfzN0o8cHk0Vu6pfai%2FBIw7tHSKEtOwq%2BiUFz6sY9KjZ%2B", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072961&Signature=Q1ToAg2fEJbCycZPLTn9XcCcTr7hbVsPvcEd3FyzA%2Fy30S%2F3Fjcr97ZWpo7uFwPWCJ%2B%2FXnWhv108WKa4cKTtueHRihldYXzmlbuKcEHzLgws%2FhCjFy3I8vkwV5Kism8%2FmeFsjp4y9wjLnXq51zsKHczGeUoYWTb7iko%2FVsiD6A%2B5n3ypJ5NcOp6xfCO0P7ty6%2FSLA5htYnTAkWzzC%2FI%2B0hD5Bp2BpWg1BIB7xyVB", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072988&Signature=1hSTk5zfAHok3rOeIvCrcVDNrMwVfu7yBxcOq5aYmB3x%2BN3QpW%2BDwvNCBsO4Jf8zXhfzvs%2BYQ8xMFx4Fh%2Bpq1Fijdl5Yewxpj61VU5lf2R3Tb9n3hOu6QgbLTSllehitudG4Z8qG33j6gu0t2wdMCNtMu46i%2B9Onj8DH5ZU5PgueMIAXDPYPD6u5GS4OjmmjihyNDlkuv2HdmzrGlVMWKpTOa7tUNtpbJkhQ8IivcOfOe3nNtEx94wExAEVO" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 204, "IPv4": 246, "URL": 662, "hostname": 421, "FileHash-SHA256": 532, "domain": 137, "FileHash-MD5": 473, "CIDR": 4, "email": 7, "CVE": 1 }, "indicator_count": 2687, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fb3d632800402652054b73", "name": "vxCube \u2014 Report + other sandboxes- Firmware Nuetral", "description": "[sample of malicious software from the Firefox operating system has been analysed by Microsoft's security team, the Office of the President, and the Microsoft Research Research Centre (MSR) in the US.]", "modified": "2026-05-06T13:08:51.417000", "created": "2026-05-06T13:08:51.417000", "tags": [ "port", "protocol level", "application", "next connection", "previous", "address", "full path", "behavior", "programfiles", "system32", "dump", "malicious", "path", "nethandle", "net108", "net1080000", "mcics", "orgid", "mcics address", "loudoun county", "pkwy city", "postalcode", "orgtechhandle", "services", "city", "stateprov", "rabuseref", "rabusehandle", "brockdorff", "c source", "utf8 unicode", "c program", "crlf", "lf line", "united", "https", "mitre attack", "network info", "processes extra", "tls version", "overview", "overview os", "x sandbox", "verdict", "next", "parent pid", "command line", "default", "nothing", "registry keys", "openasrundll c", "shell folders", "file execution", "k netsvcs", "ascii text", "categories", "settings", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "inprocserver32", "file type", "accept", "shutdown", "stream", "template", "cname", "value a", "first counter", "bearer", "mbisslshort", "bridge", "info", "date", "agent", "root", "mutexes nothing", "files c", "read files", "read registry", "keys nothing", "ipmgmt", "orgtechref", "orgabusehandle", "orgabuseref", "win1", "acrongl integ", "adc4240758", "heuristic match", "pattern match", "x2dax2da", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "angsana new", "back", "style", "cohasset police", "department", "doctype html", "head", "link", "cohasset", "title", "noscript", "meta", "performs dns", "urls", "downloads", "found", "http", "phishing" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/3a84ea97f8bfafb4a3ad6afa252315fa2c3529a732cad9070f045696dea0095e_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070092&Signature=yQBUKJDn%2FE85%2Bvl5P67ywdjBoRJ9GZj%2F%2BePT2hJjEffamM3aO%2BQVSWq3TEsVfnNMCrMPcAsJaRu64RPZJxztS%2BgQtOpCjQFUv%2FtAUou8ougQPOunxMuuX1m3PjxBDqourRIeENFZO77MUSjWuVCFEtG882utsoMv2%2FovTPqG8LU0NxjlfwMovVpkkg94Dl1tZ6O0VYlnipdZBtM6Web8IAlNUAyR4CvJrv%2BM1IR67fi", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070807&Signature=3Dm7s%2FWRPcwn5VP1fZqDViARRLpzpU7PhwwfHx%2BqMe02mkhGSmislwkS8ckH3N1K1YNVxQfqnYu89FHUKpUwC%2BOyk62pASZINgeaGaCbiysNZvDGs%2F2bN6sqg3bmKDPeVDLF34BlRrnunSY9pW0x1yITnVIRn%2FuSz9QZWFDonZBEPgt35JYofh7f9yIlA748rsPLmeMPA3RByc2n0aof5W3ghVdeTr90wlQAPidcpmEWNRXCEYPH", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070947&Signature=Pkvb9Ml3f67kATtPQnKDPoRC9hQFahD3ukXAX89sLQoBuLuyPnKpZAOIOnSPYjdPv4WWamTA32WSWfVjVswMo%2FxhdtvqyQ3BysNGqKOT35gQ1YGZkZE2%2Bx6lA0XHfdv7ZLkCTVyTUd5O2WzXo1zqFBiyh3PORdPcyikZvKrywiURORR5HeHZ1KRu5Mc%2Fy5u%2FVhA4hHTzRLJiNgzC0LCacu5aimzZ%2F5uWpy6xypNiXN5HwM4hrXNW", "https://vtbehaviour.commondatastorage.googleapis.com/da7e7a13944b0bf0f34215c4dd57810f470a43940141f9799841bce91c42b40e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071428&Signature=jg4VsRqc9AHseQKbSiN9X3N19v33%2B77cUjnoREoq3%2FAmob%2FK3l8KEZhhL1wGCFaOtjmj50aTom8QTJxDGPm9rawrO8J1V%2B8zF%2FRlfppMMiuQBSmfbpNhkJREFuRAjCvwHAxsrsixKwbxYtOMD%2FU5QrBSrkg%2B8xV3PpeZdM0J5dM8Ay%2Be1ZBCPy36ntYzbevszIsncCdUaH0Xy9WnsHV7Ps09g%2F1Z7z9rGZWdCZrPqZi3", "https://vtbehaviour.commondatastorage.googleapis.com/d3913c5d8f77fff5191b43bd32dbd8178958891bd1d90efe7a7d969ef4ab602d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071932&Signature=j2umSLl4iyhp%2FxLzsH2vZYAyU%2Fx8ki4zCfuDcXx4UgkjsO5DPIByYk043fTjoRkyd542Vqqz%2F22PYnjwhhjRJ7lXaJCPCcmtSfsWP1zGllMKIgDV57e%2FmtN%2FAzQ%2BNlqIVxXmL9peGu%2B75w6x0YaGUTBYw17iOlL87DRfZhl8Li6xlA7cX4eSHodT%2BO2B7k3D6bzQend61z62Mq76xqXV5zkXIyZCOU9a4KnKZ53nXkwnqm", "https://vtbehaviour.commondatastorage.googleapis.com/3d1c4ea329813f1aec4d7de630dc13acb95bd7b767338efe5b533fca04ff48d8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072001&Signature=gIJuOyCvRHsKP79iVyX27BLkKoVj4d7bKoB84FCSGxlJ9zsLuc7J3OmaluxaiqoJu4T2o7aeANdkYMz6d8wD3%2BFD0dQQU5%2FOhhMAbYBXp73p39CyDndq1e9LD3eNxfnr0uIrt3RccUEfgo2LF8ktZh%2BPm82SICNgJeTwVv3L2YifDZTr0lPeII2WWqpPYd4Y7qWgyUEjXmipc0SPAWZhVHXPY0DJmHbFkv%2F%2FeObiESxFAH%2BCZn", "https://vtbehaviour.commondatastorage.googleapis.com/1e5907b4cc44209637af8273555449b066fe9ce01179cd74c792e4a355a7aa4a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072217&Signature=gM91SnakBbk714%2BMza0mWtlxTRy66cB0QyotuErcCDzM8yQYmu6%2Bcy7Z1y970ywZpR05P6F4GhC8w%2Fhcd9kx0fAodkFhb3wHR6C%2F2yqPY1UMuIAOAjc6gmmrRk7%2F4M7m4MVTtnOGppQBfs9YQbqQ0ngyL5CES9vxGqIcyOOgLBRwVYQJ9PRdr5QHxDsJ8oQnGTKtuy4SKZnWfNJC7dAJhebDBsgHJRkYO9oUnFoY5uBh%2FFcveZ", "https://hybrid-analysis.com/sample/96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7", "https://hybrid-analysis.com/file-collection/674d072894a867c6c2076c5d", "https://hybrid-analysis.com/file-collection/655e17cc95592e2d640f556e", "https://vtbehaviour.commondatastorage.googleapis.com/e1280a3b44c48db6234162ad01131ca61f7e8733d78e2e192a53c34a460c6614_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072860&Signature=7lMnvE%2BOZ3HyFUJ9u4mf%2BszccaSI9tFlLU%2FfFNImL7UJfki9ecs6q%2B1ctALN1bsjGkAAmR9EemyHqlljLWn0e%2BoroBznqlwJhGInZW%2FonsioPQgc1Py97%2BpBefHrTJQoW%2FKPNt%2FOfifRY5PeC%2BIrYsr3NTQFk0GbjkyYzcYUA1VVNk6Tl7INGc5cfzN0o8cHk0Vu6pfai%2FBIw7tHSKEtOwq%2BiUFz6sY9KjZ%2B", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072961&Signature=Q1ToAg2fEJbCycZPLTn9XcCcTr7hbVsPvcEd3FyzA%2Fy30S%2F3Fjcr97ZWpo7uFwPWCJ%2B%2FXnWhv108WKa4cKTtueHRihldYXzmlbuKcEHzLgws%2FhCjFy3I8vkwV5Kism8%2FmeFsjp4y9wjLnXq51zsKHczGeUoYWTb7iko%2FVsiD6A%2B5n3ypJ5NcOp6xfCO0P7ty6%2FSLA5htYnTAkWzzC%2FI%2B0hD5Bp2BpWg1BIB7xyVB", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072988&Signature=1hSTk5zfAHok3rOeIvCrcVDNrMwVfu7yBxcOq5aYmB3x%2BN3QpW%2BDwvNCBsO4Jf8zXhfzvs%2BYQ8xMFx4Fh%2Bpq1Fijdl5Yewxpj61VU5lf2R3Tb9n3hOu6QgbLTSllehitudG4Z8qG33j6gu0t2wdMCNtMu46i%2B9Onj8DH5ZU5PgueMIAXDPYPD6u5GS4OjmmjihyNDlkuv2HdmzrGlVMWKpTOa7tUNtpbJkhQ8IivcOfOe3nNtEx94wExAEVO" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 204, "IPv4": 246, "URL": 661, "hostname": 421, "FileHash-SHA256": 532, "domain": 137, "FileHash-MD5": 473, "CIDR": 4, "email": 7 }, "indicator_count": 2685, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fb3d628de55fd4fef0e2bc", "name": "vxCube \u2014 Report + other sandboxes- Firmware Nuetral", "description": "[sample of malicious software from the Firefox operating system has been analysed by Microsoft's security team, the Office of the President, and the Microsoft Research Research Centre (MSR) in the US.]", "modified": "2026-05-06T13:08:50.546000", "created": "2026-05-06T13:08:50.546000", "tags": [ "port", "protocol level", "application", "next connection", "previous", "address", "full path", "behavior", "programfiles", "system32", "dump", "malicious", "path", "nethandle", "net108", "net1080000", "mcics", "orgid", "mcics address", "loudoun county", "pkwy city", "postalcode", "orgtechhandle", "services", "city", "stateprov", "rabuseref", "rabusehandle", "brockdorff", "c source", "utf8 unicode", "c program", "crlf", "lf line", "united", "https", "mitre attack", "network info", "processes extra", "tls version", "overview", "overview os", "x sandbox", "verdict", "next", "parent pid", "command line", "default", "nothing", "registry keys", "openasrundll c", "shell folders", "file execution", "k netsvcs", "ascii text", "categories", "settings", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "inprocserver32", "file type", "accept", "shutdown", "stream", "template", "cname", "value a", "first counter", "bearer", "mbisslshort", "bridge", "info", "date", "agent", "root", "mutexes nothing", "files c", "read files", "read registry", "keys nothing", "ipmgmt", "orgtechref", "orgabusehandle", "orgabuseref", "win1", "acrongl integ", "adc4240758", "heuristic match", "pattern match", "x2dax2da", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "angsana new", "back", "style", "cohasset police", "department", "doctype html", "head", "link", "cohasset", "title", "noscript", "meta", "performs dns", "urls", "downloads", "found", "http", "phishing" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/3a84ea97f8bfafb4a3ad6afa252315fa2c3529a732cad9070f045696dea0095e_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070092&Signature=yQBUKJDn%2FE85%2Bvl5P67ywdjBoRJ9GZj%2F%2BePT2hJjEffamM3aO%2BQVSWq3TEsVfnNMCrMPcAsJaRu64RPZJxztS%2BgQtOpCjQFUv%2FtAUou8ougQPOunxMuuX1m3PjxBDqourRIeENFZO77MUSjWuVCFEtG882utsoMv2%2FovTPqG8LU0NxjlfwMovVpkkg94Dl1tZ6O0VYlnipdZBtM6Web8IAlNUAyR4CvJrv%2BM1IR67fi", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070807&Signature=3Dm7s%2FWRPcwn5VP1fZqDViARRLpzpU7PhwwfHx%2BqMe02mkhGSmislwkS8ckH3N1K1YNVxQfqnYu89FHUKpUwC%2BOyk62pASZINgeaGaCbiysNZvDGs%2F2bN6sqg3bmKDPeVDLF34BlRrnunSY9pW0x1yITnVIRn%2FuSz9QZWFDonZBEPgt35JYofh7f9yIlA748rsPLmeMPA3RByc2n0aof5W3ghVdeTr90wlQAPidcpmEWNRXCEYPH", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070947&Signature=Pkvb9Ml3f67kATtPQnKDPoRC9hQFahD3ukXAX89sLQoBuLuyPnKpZAOIOnSPYjdPv4WWamTA32WSWfVjVswMo%2FxhdtvqyQ3BysNGqKOT35gQ1YGZkZE2%2Bx6lA0XHfdv7ZLkCTVyTUd5O2WzXo1zqFBiyh3PORdPcyikZvKrywiURORR5HeHZ1KRu5Mc%2Fy5u%2FVhA4hHTzRLJiNgzC0LCacu5aimzZ%2F5uWpy6xypNiXN5HwM4hrXNW", "https://vtbehaviour.commondatastorage.googleapis.com/da7e7a13944b0bf0f34215c4dd57810f470a43940141f9799841bce91c42b40e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071428&Signature=jg4VsRqc9AHseQKbSiN9X3N19v33%2B77cUjnoREoq3%2FAmob%2FK3l8KEZhhL1wGCFaOtjmj50aTom8QTJxDGPm9rawrO8J1V%2B8zF%2FRlfppMMiuQBSmfbpNhkJREFuRAjCvwHAxsrsixKwbxYtOMD%2FU5QrBSrkg%2B8xV3PpeZdM0J5dM8Ay%2Be1ZBCPy36ntYzbevszIsncCdUaH0Xy9WnsHV7Ps09g%2F1Z7z9rGZWdCZrPqZi3", "https://vtbehaviour.commondatastorage.googleapis.com/d3913c5d8f77fff5191b43bd32dbd8178958891bd1d90efe7a7d969ef4ab602d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071932&Signature=j2umSLl4iyhp%2FxLzsH2vZYAyU%2Fx8ki4zCfuDcXx4UgkjsO5DPIByYk043fTjoRkyd542Vqqz%2F22PYnjwhhjRJ7lXaJCPCcmtSfsWP1zGllMKIgDV57e%2FmtN%2FAzQ%2BNlqIVxXmL9peGu%2B75w6x0YaGUTBYw17iOlL87DRfZhl8Li6xlA7cX4eSHodT%2BO2B7k3D6bzQend61z62Mq76xqXV5zkXIyZCOU9a4KnKZ53nXkwnqm", "https://vtbehaviour.commondatastorage.googleapis.com/3d1c4ea329813f1aec4d7de630dc13acb95bd7b767338efe5b533fca04ff48d8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072001&Signature=gIJuOyCvRHsKP79iVyX27BLkKoVj4d7bKoB84FCSGxlJ9zsLuc7J3OmaluxaiqoJu4T2o7aeANdkYMz6d8wD3%2BFD0dQQU5%2FOhhMAbYBXp73p39CyDndq1e9LD3eNxfnr0uIrt3RccUEfgo2LF8ktZh%2BPm82SICNgJeTwVv3L2YifDZTr0lPeII2WWqpPYd4Y7qWgyUEjXmipc0SPAWZhVHXPY0DJmHbFkv%2F%2FeObiESxFAH%2BCZn", "https://vtbehaviour.commondatastorage.googleapis.com/1e5907b4cc44209637af8273555449b066fe9ce01179cd74c792e4a355a7aa4a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072217&Signature=gM91SnakBbk714%2BMza0mWtlxTRy66cB0QyotuErcCDzM8yQYmu6%2Bcy7Z1y970ywZpR05P6F4GhC8w%2Fhcd9kx0fAodkFhb3wHR6C%2F2yqPY1UMuIAOAjc6gmmrRk7%2F4M7m4MVTtnOGppQBfs9YQbqQ0ngyL5CES9vxGqIcyOOgLBRwVYQJ9PRdr5QHxDsJ8oQnGTKtuy4SKZnWfNJC7dAJhebDBsgHJRkYO9oUnFoY5uBh%2FFcveZ", "https://hybrid-analysis.com/sample/96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7", "https://hybrid-analysis.com/file-collection/674d072894a867c6c2076c5d", "https://hybrid-analysis.com/file-collection/655e17cc95592e2d640f556e", "https://vtbehaviour.commondatastorage.googleapis.com/e1280a3b44c48db6234162ad01131ca61f7e8733d78e2e192a53c34a460c6614_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072860&Signature=7lMnvE%2BOZ3HyFUJ9u4mf%2BszccaSI9tFlLU%2FfFNImL7UJfki9ecs6q%2B1ctALN1bsjGkAAmR9EemyHqlljLWn0e%2BoroBznqlwJhGInZW%2FonsioPQgc1Py97%2BpBefHrTJQoW%2FKPNt%2FOfifRY5PeC%2BIrYsr3NTQFk0GbjkyYzcYUA1VVNk6Tl7INGc5cfzN0o8cHk0Vu6pfai%2FBIw7tHSKEtOwq%2BiUFz6sY9KjZ%2B", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072961&Signature=Q1ToAg2fEJbCycZPLTn9XcCcTr7hbVsPvcEd3FyzA%2Fy30S%2F3Fjcr97ZWpo7uFwPWCJ%2B%2FXnWhv108WKa4cKTtueHRihldYXzmlbuKcEHzLgws%2FhCjFy3I8vkwV5Kism8%2FmeFsjp4y9wjLnXq51zsKHczGeUoYWTb7iko%2FVsiD6A%2B5n3ypJ5NcOp6xfCO0P7ty6%2FSLA5htYnTAkWzzC%2FI%2B0hD5Bp2BpWg1BIB7xyVB", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072988&Signature=1hSTk5zfAHok3rOeIvCrcVDNrMwVfu7yBxcOq5aYmB3x%2BN3QpW%2BDwvNCBsO4Jf8zXhfzvs%2BYQ8xMFx4Fh%2Bpq1Fijdl5Yewxpj61VU5lf2R3Tb9n3hOu6QgbLTSllehitudG4Z8qG33j6gu0t2wdMCNtMu46i%2B9Onj8DH5ZU5PgueMIAXDPYPD6u5GS4OjmmjihyNDlkuv2HdmzrGlVMWKpTOa7tUNtpbJkhQ8IivcOfOe3nNtEx94wExAEVO" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 204, "IPv4": 246, "URL": 661, "hostname": 421, "FileHash-SHA256": 532, "domain": 137, "FileHash-MD5": 473, "CIDR": 4, "email": 7 }, "indicator_count": 2685, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fb3d5b5642ffb183d38fa8", "name": "vxCube \u2014 Report + other sandboxes- Firmware Nuetral", "description": "[sample of malicious software from the Firefox operating system has been analysed by Microsoft's security team, the Office of the President, and the Microsoft Research Research Centre (MSR) in the US.]", "modified": "2026-05-06T13:08:43.093000", "created": "2026-05-06T13:08:43.093000", "tags": [ "port", "protocol level", "application", "next connection", "previous", "address", "full path", "behavior", "programfiles", "system32", "dump", "malicious", "path", "nethandle", "net108", "net1080000", "mcics", "orgid", "mcics address", "loudoun county", "pkwy city", "postalcode", "orgtechhandle", "services", "city", "stateprov", "rabuseref", "rabusehandle", "brockdorff", "c source", "utf8 unicode", "c program", "crlf", "lf line", "united", "https", "mitre attack", "network info", "processes extra", "tls version", "overview", "overview os", "x sandbox", "verdict", "next", "parent pid", "command line", "default", "nothing", "registry keys", "openasrundll c", "shell folders", "file execution", "k netsvcs", "ascii text", "categories", "settings", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "inprocserver32", "file type", "accept", "shutdown", "stream", "template", "cname", "value a", "first counter", "bearer", "mbisslshort", "bridge", "info", "date", "agent", "root", "mutexes nothing", "files c", "read files", "read registry", "keys nothing", "ipmgmt", "orgtechref", "orgabusehandle", "orgabuseref", "win1", "acrongl integ", "adc4240758", "heuristic match", "pattern match", "x2dax2da", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "angsana new", "back", "style", "cohasset police", "department", "doctype html", "head", "link", "cohasset", "title", "noscript", "meta", "performs dns", "urls", "downloads", "found", "http", "phishing" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/3a84ea97f8bfafb4a3ad6afa252315fa2c3529a732cad9070f045696dea0095e_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070092&Signature=yQBUKJDn%2FE85%2Bvl5P67ywdjBoRJ9GZj%2F%2BePT2hJjEffamM3aO%2BQVSWq3TEsVfnNMCrMPcAsJaRu64RPZJxztS%2BgQtOpCjQFUv%2FtAUou8ougQPOunxMuuX1m3PjxBDqourRIeENFZO77MUSjWuVCFEtG882utsoMv2%2FovTPqG8LU0NxjlfwMovVpkkg94Dl1tZ6O0VYlnipdZBtM6Web8IAlNUAyR4CvJrv%2BM1IR67fi", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070807&Signature=3Dm7s%2FWRPcwn5VP1fZqDViARRLpzpU7PhwwfHx%2BqMe02mkhGSmislwkS8ckH3N1K1YNVxQfqnYu89FHUKpUwC%2BOyk62pASZINgeaGaCbiysNZvDGs%2F2bN6sqg3bmKDPeVDLF34BlRrnunSY9pW0x1yITnVIRn%2FuSz9QZWFDonZBEPgt35JYofh7f9yIlA748rsPLmeMPA3RByc2n0aof5W3ghVdeTr90wlQAPidcpmEWNRXCEYPH", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070947&Signature=Pkvb9Ml3f67kATtPQnKDPoRC9hQFahD3ukXAX89sLQoBuLuyPnKpZAOIOnSPYjdPv4WWamTA32WSWfVjVswMo%2FxhdtvqyQ3BysNGqKOT35gQ1YGZkZE2%2Bx6lA0XHfdv7ZLkCTVyTUd5O2WzXo1zqFBiyh3PORdPcyikZvKrywiURORR5HeHZ1KRu5Mc%2Fy5u%2FVhA4hHTzRLJiNgzC0LCacu5aimzZ%2F5uWpy6xypNiXN5HwM4hrXNW", "https://vtbehaviour.commondatastorage.googleapis.com/da7e7a13944b0bf0f34215c4dd57810f470a43940141f9799841bce91c42b40e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071428&Signature=jg4VsRqc9AHseQKbSiN9X3N19v33%2B77cUjnoREoq3%2FAmob%2FK3l8KEZhhL1wGCFaOtjmj50aTom8QTJxDGPm9rawrO8J1V%2B8zF%2FRlfppMMiuQBSmfbpNhkJREFuRAjCvwHAxsrsixKwbxYtOMD%2FU5QrBSrkg%2B8xV3PpeZdM0J5dM8Ay%2Be1ZBCPy36ntYzbevszIsncCdUaH0Xy9WnsHV7Ps09g%2F1Z7z9rGZWdCZrPqZi3", "https://vtbehaviour.commondatastorage.googleapis.com/d3913c5d8f77fff5191b43bd32dbd8178958891bd1d90efe7a7d969ef4ab602d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071932&Signature=j2umSLl4iyhp%2FxLzsH2vZYAyU%2Fx8ki4zCfuDcXx4UgkjsO5DPIByYk043fTjoRkyd542Vqqz%2F22PYnjwhhjRJ7lXaJCPCcmtSfsWP1zGllMKIgDV57e%2FmtN%2FAzQ%2BNlqIVxXmL9peGu%2B75w6x0YaGUTBYw17iOlL87DRfZhl8Li6xlA7cX4eSHodT%2BO2B7k3D6bzQend61z62Mq76xqXV5zkXIyZCOU9a4KnKZ53nXkwnqm", "https://vtbehaviour.commondatastorage.googleapis.com/3d1c4ea329813f1aec4d7de630dc13acb95bd7b767338efe5b533fca04ff48d8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072001&Signature=gIJuOyCvRHsKP79iVyX27BLkKoVj4d7bKoB84FCSGxlJ9zsLuc7J3OmaluxaiqoJu4T2o7aeANdkYMz6d8wD3%2BFD0dQQU5%2FOhhMAbYBXp73p39CyDndq1e9LD3eNxfnr0uIrt3RccUEfgo2LF8ktZh%2BPm82SICNgJeTwVv3L2YifDZTr0lPeII2WWqpPYd4Y7qWgyUEjXmipc0SPAWZhVHXPY0DJmHbFkv%2F%2FeObiESxFAH%2BCZn", "https://vtbehaviour.commondatastorage.googleapis.com/1e5907b4cc44209637af8273555449b066fe9ce01179cd74c792e4a355a7aa4a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072217&Signature=gM91SnakBbk714%2BMza0mWtlxTRy66cB0QyotuErcCDzM8yQYmu6%2Bcy7Z1y970ywZpR05P6F4GhC8w%2Fhcd9kx0fAodkFhb3wHR6C%2F2yqPY1UMuIAOAjc6gmmrRk7%2F4M7m4MVTtnOGppQBfs9YQbqQ0ngyL5CES9vxGqIcyOOgLBRwVYQJ9PRdr5QHxDsJ8oQnGTKtuy4SKZnWfNJC7dAJhebDBsgHJRkYO9oUnFoY5uBh%2FFcveZ", "https://hybrid-analysis.com/sample/96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7", "https://hybrid-analysis.com/file-collection/674d072894a867c6c2076c5d", "https://hybrid-analysis.com/file-collection/655e17cc95592e2d640f556e", "https://vtbehaviour.commondatastorage.googleapis.com/e1280a3b44c48db6234162ad01131ca61f7e8733d78e2e192a53c34a460c6614_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072860&Signature=7lMnvE%2BOZ3HyFUJ9u4mf%2BszccaSI9tFlLU%2FfFNImL7UJfki9ecs6q%2B1ctALN1bsjGkAAmR9EemyHqlljLWn0e%2BoroBznqlwJhGInZW%2FonsioPQgc1Py97%2BpBefHrTJQoW%2FKPNt%2FOfifRY5PeC%2BIrYsr3NTQFk0GbjkyYzcYUA1VVNk6Tl7INGc5cfzN0o8cHk0Vu6pfai%2FBIw7tHSKEtOwq%2BiUFz6sY9KjZ%2B", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072961&Signature=Q1ToAg2fEJbCycZPLTn9XcCcTr7hbVsPvcEd3FyzA%2Fy30S%2F3Fjcr97ZWpo7uFwPWCJ%2B%2FXnWhv108WKa4cKTtueHRihldYXzmlbuKcEHzLgws%2FhCjFy3I8vkwV5Kism8%2FmeFsjp4y9wjLnXq51zsKHczGeUoYWTb7iko%2FVsiD6A%2B5n3ypJ5NcOp6xfCO0P7ty6%2FSLA5htYnTAkWzzC%2FI%2B0hD5Bp2BpWg1BIB7xyVB", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072988&Signature=1hSTk5zfAHok3rOeIvCrcVDNrMwVfu7yBxcOq5aYmB3x%2BN3QpW%2BDwvNCBsO4Jf8zXhfzvs%2BYQ8xMFx4Fh%2Bpq1Fijdl5Yewxpj61VU5lf2R3Tb9n3hOu6QgbLTSllehitudG4Z8qG33j6gu0t2wdMCNtMu46i%2B9Onj8DH5ZU5PgueMIAXDPYPD6u5GS4OjmmjihyNDlkuv2HdmzrGlVMWKpTOa7tUNtpbJkhQ8IivcOfOe3nNtEx94wExAEVO" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 204, "IPv4": 246, "URL": 661, "hostname": 421, "FileHash-SHA256": 532, "domain": 137, "FileHash-MD5": 473, "CIDR": 4, "email": 7 }, "indicator_count": 2685, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fb3d58494c7b444832ea5b", "name": "vxCube \u2014 Report + other sandboxes- Firmware Nuetral", "description": "[sample of malicious software from the Firefox operating system has been analysed by Microsoft's security team, the Office of the President, and the Microsoft Research Research Centre (MSR) in the US.]", "modified": "2026-05-06T13:08:40.248000", "created": "2026-05-06T13:08:40.248000", "tags": [ "port", "protocol level", "application", "next connection", "previous", "address", "full path", "behavior", "programfiles", "system32", "dump", "malicious", "path", "nethandle", "net108", "net1080000", "mcics", "orgid", "mcics address", "loudoun county", "pkwy city", "postalcode", "orgtechhandle", "services", "city", "stateprov", "rabuseref", "rabusehandle", "brockdorff", "c source", "utf8 unicode", "c program", "crlf", "lf line", "united", "https", "mitre attack", "network info", "processes extra", "tls version", "overview", "overview os", "x sandbox", "verdict", "next", "parent pid", "command line", "default", "nothing", "registry keys", "openasrundll c", "shell folders", "file execution", "k netsvcs", "ascii text", "categories", "settings", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "inprocserver32", "file type", "accept", "shutdown", "stream", "template", "cname", "value a", "first counter", "bearer", "mbisslshort", "bridge", "info", "date", "agent", "root", "mutexes nothing", "files c", "read files", "read registry", "keys nothing", "ipmgmt", "orgtechref", "orgabusehandle", "orgabuseref", "win1", "acrongl integ", "adc4240758", "heuristic match", "pattern match", "x2dax2da", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "angsana new", "back", "style", "cohasset police", "department", "doctype html", "head", "link", "cohasset", "title", "noscript", "meta", "performs dns", "urls", "downloads", "found", "http", "phishing" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/3a84ea97f8bfafb4a3ad6afa252315fa2c3529a732cad9070f045696dea0095e_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070092&Signature=yQBUKJDn%2FE85%2Bvl5P67ywdjBoRJ9GZj%2F%2BePT2hJjEffamM3aO%2BQVSWq3TEsVfnNMCrMPcAsJaRu64RPZJxztS%2BgQtOpCjQFUv%2FtAUou8ougQPOunxMuuX1m3PjxBDqourRIeENFZO77MUSjWuVCFEtG882utsoMv2%2FovTPqG8LU0NxjlfwMovVpkkg94Dl1tZ6O0VYlnipdZBtM6Web8IAlNUAyR4CvJrv%2BM1IR67fi", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070807&Signature=3Dm7s%2FWRPcwn5VP1fZqDViARRLpzpU7PhwwfHx%2BqMe02mkhGSmislwkS8ckH3N1K1YNVxQfqnYu89FHUKpUwC%2BOyk62pASZINgeaGaCbiysNZvDGs%2F2bN6sqg3bmKDPeVDLF34BlRrnunSY9pW0x1yITnVIRn%2FuSz9QZWFDonZBEPgt35JYofh7f9yIlA748rsPLmeMPA3RByc2n0aof5W3ghVdeTr90wlQAPidcpmEWNRXCEYPH", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070947&Signature=Pkvb9Ml3f67kATtPQnKDPoRC9hQFahD3ukXAX89sLQoBuLuyPnKpZAOIOnSPYjdPv4WWamTA32WSWfVjVswMo%2FxhdtvqyQ3BysNGqKOT35gQ1YGZkZE2%2Bx6lA0XHfdv7ZLkCTVyTUd5O2WzXo1zqFBiyh3PORdPcyikZvKrywiURORR5HeHZ1KRu5Mc%2Fy5u%2FVhA4hHTzRLJiNgzC0LCacu5aimzZ%2F5uWpy6xypNiXN5HwM4hrXNW", "https://vtbehaviour.commondatastorage.googleapis.com/da7e7a13944b0bf0f34215c4dd57810f470a43940141f9799841bce91c42b40e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071428&Signature=jg4VsRqc9AHseQKbSiN9X3N19v33%2B77cUjnoREoq3%2FAmob%2FK3l8KEZhhL1wGCFaOtjmj50aTom8QTJxDGPm9rawrO8J1V%2B8zF%2FRlfppMMiuQBSmfbpNhkJREFuRAjCvwHAxsrsixKwbxYtOMD%2FU5QrBSrkg%2B8xV3PpeZdM0J5dM8Ay%2Be1ZBCPy36ntYzbevszIsncCdUaH0Xy9WnsHV7Ps09g%2F1Z7z9rGZWdCZrPqZi3", "https://vtbehaviour.commondatastorage.googleapis.com/d3913c5d8f77fff5191b43bd32dbd8178958891bd1d90efe7a7d969ef4ab602d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071932&Signature=j2umSLl4iyhp%2FxLzsH2vZYAyU%2Fx8ki4zCfuDcXx4UgkjsO5DPIByYk043fTjoRkyd542Vqqz%2F22PYnjwhhjRJ7lXaJCPCcmtSfsWP1zGllMKIgDV57e%2FmtN%2FAzQ%2BNlqIVxXmL9peGu%2B75w6x0YaGUTBYw17iOlL87DRfZhl8Li6xlA7cX4eSHodT%2BO2B7k3D6bzQend61z62Mq76xqXV5zkXIyZCOU9a4KnKZ53nXkwnqm", "https://vtbehaviour.commondatastorage.googleapis.com/3d1c4ea329813f1aec4d7de630dc13acb95bd7b767338efe5b533fca04ff48d8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072001&Signature=gIJuOyCvRHsKP79iVyX27BLkKoVj4d7bKoB84FCSGxlJ9zsLuc7J3OmaluxaiqoJu4T2o7aeANdkYMz6d8wD3%2BFD0dQQU5%2FOhhMAbYBXp73p39CyDndq1e9LD3eNxfnr0uIrt3RccUEfgo2LF8ktZh%2BPm82SICNgJeTwVv3L2YifDZTr0lPeII2WWqpPYd4Y7qWgyUEjXmipc0SPAWZhVHXPY0DJmHbFkv%2F%2FeObiESxFAH%2BCZn", "https://vtbehaviour.commondatastorage.googleapis.com/1e5907b4cc44209637af8273555449b066fe9ce01179cd74c792e4a355a7aa4a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072217&Signature=gM91SnakBbk714%2BMza0mWtlxTRy66cB0QyotuErcCDzM8yQYmu6%2Bcy7Z1y970ywZpR05P6F4GhC8w%2Fhcd9kx0fAodkFhb3wHR6C%2F2yqPY1UMuIAOAjc6gmmrRk7%2F4M7m4MVTtnOGppQBfs9YQbqQ0ngyL5CES9vxGqIcyOOgLBRwVYQJ9PRdr5QHxDsJ8oQnGTKtuy4SKZnWfNJC7dAJhebDBsgHJRkYO9oUnFoY5uBh%2FFcveZ", "https://hybrid-analysis.com/sample/96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7", "https://hybrid-analysis.com/file-collection/674d072894a867c6c2076c5d", "https://hybrid-analysis.com/file-collection/655e17cc95592e2d640f556e", "https://vtbehaviour.commondatastorage.googleapis.com/e1280a3b44c48db6234162ad01131ca61f7e8733d78e2e192a53c34a460c6614_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072860&Signature=7lMnvE%2BOZ3HyFUJ9u4mf%2BszccaSI9tFlLU%2FfFNImL7UJfki9ecs6q%2B1ctALN1bsjGkAAmR9EemyHqlljLWn0e%2BoroBznqlwJhGInZW%2FonsioPQgc1Py97%2BpBefHrTJQoW%2FKPNt%2FOfifRY5PeC%2BIrYsr3NTQFk0GbjkyYzcYUA1VVNk6Tl7INGc5cfzN0o8cHk0Vu6pfai%2FBIw7tHSKEtOwq%2BiUFz6sY9KjZ%2B", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072961&Signature=Q1ToAg2fEJbCycZPLTn9XcCcTr7hbVsPvcEd3FyzA%2Fy30S%2F3Fjcr97ZWpo7uFwPWCJ%2B%2FXnWhv108WKa4cKTtueHRihldYXzmlbuKcEHzLgws%2FhCjFy3I8vkwV5Kism8%2FmeFsjp4y9wjLnXq51zsKHczGeUoYWTb7iko%2FVsiD6A%2B5n3ypJ5NcOp6xfCO0P7ty6%2FSLA5htYnTAkWzzC%2FI%2B0hD5Bp2BpWg1BIB7xyVB", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072988&Signature=1hSTk5zfAHok3rOeIvCrcVDNrMwVfu7yBxcOq5aYmB3x%2BN3QpW%2BDwvNCBsO4Jf8zXhfzvs%2BYQ8xMFx4Fh%2Bpq1Fijdl5Yewxpj61VU5lf2R3Tb9n3hOu6QgbLTSllehitudG4Z8qG33j6gu0t2wdMCNtMu46i%2B9Onj8DH5ZU5PgueMIAXDPYPD6u5GS4OjmmjihyNDlkuv2HdmzrGlVMWKpTOa7tUNtpbJkhQ8IivcOfOe3nNtEx94wExAEVO" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 204, "IPv4": 246, "URL": 661, "hostname": 421, "FileHash-SHA256": 532, "domain": 137, "FileHash-MD5": 473, "CIDR": 4, "email": 7 }, "indicator_count": 2685, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fb3d5596fa1ad26e3f4319", "name": "vxCube \u2014 Report + other sandboxes- Firmware Nuetral", "description": "[sample of malicious software from the Firefox operating system has been analysed by Microsoft's security team, the Office of the President, and the Microsoft Research Research Centre (MSR) in the US.]", "modified": "2026-05-06T13:08:37.416000", "created": "2026-05-06T13:08:37.416000", "tags": [ "port", "protocol level", "application", "next connection", "previous", "address", "full path", "behavior", "programfiles", "system32", "dump", "malicious", "path", "nethandle", "net108", "net1080000", "mcics", "orgid", "mcics address", "loudoun county", "pkwy city", "postalcode", "orgtechhandle", "services", "city", "stateprov", "rabuseref", "rabusehandle", "brockdorff", "c source", "utf8 unicode", "c program", "crlf", "lf line", "united", "https", "mitre attack", "network info", "processes extra", "tls version", "overview", "overview os", "x sandbox", "verdict", "next", "parent pid", "command line", "default", "nothing", "registry keys", "openasrundll c", "shell folders", "file execution", "k netsvcs", "ascii text", "categories", "settings", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "inprocserver32", "file type", "accept", "shutdown", "stream", "template", "cname", "value a", "first counter", "bearer", "mbisslshort", "bridge", "info", "date", "agent", "root", "mutexes nothing", "files c", "read files", "read registry", "keys nothing", "ipmgmt", "orgtechref", "orgabusehandle", "orgabuseref", "win1", "acrongl integ", "adc4240758", "heuristic match", "pattern match", "x2dax2da", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "angsana new", "back", "style", "cohasset police", "department", "doctype html", "head", "link", "cohasset", "title", "noscript", "meta", "performs dns", "urls", "downloads", "found", "http", "phishing" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/3a84ea97f8bfafb4a3ad6afa252315fa2c3529a732cad9070f045696dea0095e_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070092&Signature=yQBUKJDn%2FE85%2Bvl5P67ywdjBoRJ9GZj%2F%2BePT2hJjEffamM3aO%2BQVSWq3TEsVfnNMCrMPcAsJaRu64RPZJxztS%2BgQtOpCjQFUv%2FtAUou8ougQPOunxMuuX1m3PjxBDqourRIeENFZO77MUSjWuVCFEtG882utsoMv2%2FovTPqG8LU0NxjlfwMovVpkkg94Dl1tZ6O0VYlnipdZBtM6Web8IAlNUAyR4CvJrv%2BM1IR67fi", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070807&Signature=3Dm7s%2FWRPcwn5VP1fZqDViARRLpzpU7PhwwfHx%2BqMe02mkhGSmislwkS8ckH3N1K1YNVxQfqnYu89FHUKpUwC%2BOyk62pASZINgeaGaCbiysNZvDGs%2F2bN6sqg3bmKDPeVDLF34BlRrnunSY9pW0x1yITnVIRn%2FuSz9QZWFDonZBEPgt35JYofh7f9yIlA748rsPLmeMPA3RByc2n0aof5W3ghVdeTr90wlQAPidcpmEWNRXCEYPH", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070947&Signature=Pkvb9Ml3f67kATtPQnKDPoRC9hQFahD3ukXAX89sLQoBuLuyPnKpZAOIOnSPYjdPv4WWamTA32WSWfVjVswMo%2FxhdtvqyQ3BysNGqKOT35gQ1YGZkZE2%2Bx6lA0XHfdv7ZLkCTVyTUd5O2WzXo1zqFBiyh3PORdPcyikZvKrywiURORR5HeHZ1KRu5Mc%2Fy5u%2FVhA4hHTzRLJiNgzC0LCacu5aimzZ%2F5uWpy6xypNiXN5HwM4hrXNW", "https://vtbehaviour.commondatastorage.googleapis.com/da7e7a13944b0bf0f34215c4dd57810f470a43940141f9799841bce91c42b40e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071428&Signature=jg4VsRqc9AHseQKbSiN9X3N19v33%2B77cUjnoREoq3%2FAmob%2FK3l8KEZhhL1wGCFaOtjmj50aTom8QTJxDGPm9rawrO8J1V%2B8zF%2FRlfppMMiuQBSmfbpNhkJREFuRAjCvwHAxsrsixKwbxYtOMD%2FU5QrBSrkg%2B8xV3PpeZdM0J5dM8Ay%2Be1ZBCPy36ntYzbevszIsncCdUaH0Xy9WnsHV7Ps09g%2F1Z7z9rGZWdCZrPqZi3", "https://vtbehaviour.commondatastorage.googleapis.com/d3913c5d8f77fff5191b43bd32dbd8178958891bd1d90efe7a7d969ef4ab602d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071932&Signature=j2umSLl4iyhp%2FxLzsH2vZYAyU%2Fx8ki4zCfuDcXx4UgkjsO5DPIByYk043fTjoRkyd542Vqqz%2F22PYnjwhhjRJ7lXaJCPCcmtSfsWP1zGllMKIgDV57e%2FmtN%2FAzQ%2BNlqIVxXmL9peGu%2B75w6x0YaGUTBYw17iOlL87DRfZhl8Li6xlA7cX4eSHodT%2BO2B7k3D6bzQend61z62Mq76xqXV5zkXIyZCOU9a4KnKZ53nXkwnqm", "https://vtbehaviour.commondatastorage.googleapis.com/3d1c4ea329813f1aec4d7de630dc13acb95bd7b767338efe5b533fca04ff48d8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072001&Signature=gIJuOyCvRHsKP79iVyX27BLkKoVj4d7bKoB84FCSGxlJ9zsLuc7J3OmaluxaiqoJu4T2o7aeANdkYMz6d8wD3%2BFD0dQQU5%2FOhhMAbYBXp73p39CyDndq1e9LD3eNxfnr0uIrt3RccUEfgo2LF8ktZh%2BPm82SICNgJeTwVv3L2YifDZTr0lPeII2WWqpPYd4Y7qWgyUEjXmipc0SPAWZhVHXPY0DJmHbFkv%2F%2FeObiESxFAH%2BCZn", "https://vtbehaviour.commondatastorage.googleapis.com/1e5907b4cc44209637af8273555449b066fe9ce01179cd74c792e4a355a7aa4a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072217&Signature=gM91SnakBbk714%2BMza0mWtlxTRy66cB0QyotuErcCDzM8yQYmu6%2Bcy7Z1y970ywZpR05P6F4GhC8w%2Fhcd9kx0fAodkFhb3wHR6C%2F2yqPY1UMuIAOAjc6gmmrRk7%2F4M7m4MVTtnOGppQBfs9YQbqQ0ngyL5CES9vxGqIcyOOgLBRwVYQJ9PRdr5QHxDsJ8oQnGTKtuy4SKZnWfNJC7dAJhebDBsgHJRkYO9oUnFoY5uBh%2FFcveZ", "https://hybrid-analysis.com/sample/96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7", "https://hybrid-analysis.com/file-collection/674d072894a867c6c2076c5d", "https://hybrid-analysis.com/file-collection/655e17cc95592e2d640f556e", "https://vtbehaviour.commondatastorage.googleapis.com/e1280a3b44c48db6234162ad01131ca61f7e8733d78e2e192a53c34a460c6614_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072860&Signature=7lMnvE%2BOZ3HyFUJ9u4mf%2BszccaSI9tFlLU%2FfFNImL7UJfki9ecs6q%2B1ctALN1bsjGkAAmR9EemyHqlljLWn0e%2BoroBznqlwJhGInZW%2FonsioPQgc1Py97%2BpBefHrTJQoW%2FKPNt%2FOfifRY5PeC%2BIrYsr3NTQFk0GbjkyYzcYUA1VVNk6Tl7INGc5cfzN0o8cHk0Vu6pfai%2FBIw7tHSKEtOwq%2BiUFz6sY9KjZ%2B", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072961&Signature=Q1ToAg2fEJbCycZPLTn9XcCcTr7hbVsPvcEd3FyzA%2Fy30S%2F3Fjcr97ZWpo7uFwPWCJ%2B%2FXnWhv108WKa4cKTtueHRihldYXzmlbuKcEHzLgws%2FhCjFy3I8vkwV5Kism8%2FmeFsjp4y9wjLnXq51zsKHczGeUoYWTb7iko%2FVsiD6A%2B5n3ypJ5NcOp6xfCO0P7ty6%2FSLA5htYnTAkWzzC%2FI%2B0hD5Bp2BpWg1BIB7xyVB", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072988&Signature=1hSTk5zfAHok3rOeIvCrcVDNrMwVfu7yBxcOq5aYmB3x%2BN3QpW%2BDwvNCBsO4Jf8zXhfzvs%2BYQ8xMFx4Fh%2Bpq1Fijdl5Yewxpj61VU5lf2R3Tb9n3hOu6QgbLTSllehitudG4Z8qG33j6gu0t2wdMCNtMu46i%2B9Onj8DH5ZU5PgueMIAXDPYPD6u5GS4OjmmjihyNDlkuv2HdmzrGlVMWKpTOa7tUNtpbJkhQ8IivcOfOe3nNtEx94wExAEVO" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 204, "IPv4": 246, "URL": 661, "hostname": 421, "FileHash-SHA256": 532, "domain": 137, "FileHash-MD5": 473, "CIDR": 4, "email": 7 }, "indicator_count": 2685, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/da7e7a13944b0bf0f34215c4dd57810f470a43940141f9799841bce91c42b40e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071428&Signature=jg4VsRqc9AHseQKbSiN9X3N19v33%2B77cUjnoREoq3%2FAmob%2FK3l8KEZhhL1wGCFaOtjmj50aTom8QTJxDGPm9rawrO8J1V%2B8zF%2FRlfppMMiuQBSmfbpNhkJREFuRAjCvwHAxsrsixKwbxYtOMD%2FU5QrBSrkg%2B8xV3PpeZdM0J5dM8Ay%2Be1ZBCPy36ntYzbevszIsncCdUaH0Xy9WnsHV7Ps09g%2F1Z7z9rGZWdCZrPqZi3", "https://vtbehaviour.commondatastorage.googleapis.com/2c7002510767deb9bbb0d2ee2d47be98828bf5b6e999d6cd882b1c1a1c908510_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683299&Signature=RMRBhdx9cTLEwBYgOaiBV4x03W8laZvNMUtTq68ykLCh0R5toTaD64MdSiBhgsNAZLaS8z9dPsGmVcfMC8U5sPrXXLzAt9CBPoJjT2jV40HyYrW58xs3wjf65936U00bQy9DGFrlU7xInrhEocKiXuD17i5A%2F7tdPgx74I6xY906Ua8hyOe3f5zVmaxE6zpNAonyZtoHtHmnuDLG71DTPwYyiKcGPff7glIXoNalw4ST3jQr3Ma%2Fv1Q3De", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070807&Signature=3Dm7s%2FWRPcwn5VP1fZqDViARRLpzpU7PhwwfHx%2BqMe02mkhGSmislwkS8ckH3N1K1YNVxQfqnYu89FHUKpUwC%2BOyk62pASZINgeaGaCbiysNZvDGs%2F2bN6sqg3bmKDPeVDLF34BlRrnunSY9pW0x1yITnVIRn%2FuSz9QZWFDonZBEPgt35JYofh7f9yIlA748rsPLmeMPA3RByc2n0aof5W3ghVdeTr90wlQAPidcpmEWNRXCEYPH", "https://vtbehaviour.commondatastorage.googleapis.com/492dc39e7752dccfd15f588054991277e6548b794b28a03f42b9cee132eebd2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682486&Signature=ucigAmI%2BTWYWnZuZjQb7cvSnhC1f6r93NM1kh5fCHjjcUodx6ltePV2QSdyXCnhrdH8ODLugh37CFZxsAmtiMMefuyuh6T8mtuxe7znGqLiJre5YFfSQLkzmz0Ksqekcg0sp1bUaKykXguy%2BKwv6Tg12CIM7xzaDB%2BGcjw6KkBLiD0A1sB6Z9gk9np%2FNtUBHdW7E0eBfvTWOK8F99R1lQdmQab2Vha55GLH6JRBksZ7AbBEdVS8DMtkaZCS9sV", "https://vtbehaviour.commondatastorage.googleapis.com/0da371854ec2c04bbee9680dbdabb67a4e4a84add40e5e1877425790f2dfef02_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682005&Signature=SyLSFT5xdlAZ5lwNyaeDpqsMTuwGywWruel4fBOIdsyiZ%2FvtOZYr7f%2B%2BIuBmqFMAwMI4L7kB6jRtv8mVn8lmU5MUJBAG6GJdVsEp2SoexU5Yl2kTksey03ZsjBloxlJqDzf8PULDlwjfD1Ydv%2B5QFPoY3%2Fk8TKMlmmpTIw7%2FYcR24%2FHYHw78XVF2cV%2Bnb3GoDaHw%2FnpxLrDwgfZP9dWvP8V264o5l2dDfxQtF0", "https://vtbehaviour.commondatastorage.googleapis.com/002150c786ae1e04ab2981bf5593d926987b60b9ac699f431ed4568084dd854b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682457&Signature=eWipoH1g7AQ8zq2pd%2BpyAKrKscAY%2FebCATbHE%2FMwdvIfIy%2F4i3OFy%2FKlfaNCXDLDU0OM6JaEF73FAqGhLEb8ZcxTuEfMeU%2F6WxjpgS2SqLZ0xOjAPgPWOOor3uCcdIEZRCcpJe%2BAzPY8jEZJ0aIf49RU85lkIx9yCiXcFnee1pNHHBFwpsBK4FNuTB%2FyDe61M5Htw4fjlf43GTnXFxj0%2Fjc%2Fe32Q7EpVkuSc0I%2F3zTrY0UkC", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681490&Signature=bIUDLY2jLaPa0t0OyOiuRlKjk8VM9IFdVTwzJhuTKfuV%2BhwtwcYghSy4186P0qsGEebShI2xNNVBPSd3uQdeXMuYRDJWcyo18c12pLwgcLgaBot06%2Bfys%2BlGp%2FV%2FSCDBvdo3iLaAOesoSo8vbCLNsWAzGM5sztLl%2Beyq9%2F1oSuAvU692EiARhcufOCMFqXCn6MNuSp18gSQwkFRBadsMvHSjfHW645FvLUfiP5Egu1WuMVP2", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682105&Signature=DkIw2nRg0%2BHKmd2TpyMzcgrB%2F4s6sIVIpOEEVMqz3Csoj6PPmSGNer%2Bt5X5oYKPZQgJETAHcCRs0mh3Lfa85XEPdYk6PjMimJmKQdBstqdULgs6q7wyZEjHDhQn41ri7eQ16g7pAo9ojfhLUNp4uW2xuYvdBwYhYBsZP3EO1BKz2f3dYxSg%2Bgsn2AnC2%2BDRTIX0Xxd%2Bt44%2BkXfiY32mvDHDNDCcuT5ZDFNrHwDp3HKuuJYy7lRHm8AlK", "https://vtbehaviour.commondatastorage.googleapis.com/1e5907b4cc44209637af8273555449b066fe9ce01179cd74c792e4a355a7aa4a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072217&Signature=gM91SnakBbk714%2BMza0mWtlxTRy66cB0QyotuErcCDzM8yQYmu6%2Bcy7Z1y970ywZpR05P6F4GhC8w%2Fhcd9kx0fAodkFhb3wHR6C%2F2yqPY1UMuIAOAjc6gmmrRk7%2F4M7m4MVTtnOGppQBfs9YQbqQ0ngyL5CES9vxGqIcyOOgLBRwVYQJ9PRdr5QHxDsJ8oQnGTKtuy4SKZnWfNJC7dAJhebDBsgHJRkYO9oUnFoY5uBh%2FFcveZ", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072961&Signature=Q1ToAg2fEJbCycZPLTn9XcCcTr7hbVsPvcEd3FyzA%2Fy30S%2F3Fjcr97ZWpo7uFwPWCJ%2B%2FXnWhv108WKa4cKTtueHRihldYXzmlbuKcEHzLgws%2FhCjFy3I8vkwV5Kism8%2FmeFsjp4y9wjLnXq51zsKHczGeUoYWTb7iko%2FVsiD6A%2B5n3ypJ5NcOp6xfCO0P7ty6%2FSLA5htYnTAkWzzC%2FI%2B0hD5Bp2BpWg1BIB7xyVB", "https://vtbehaviour.commondatastorage.googleapis.com/036d1a174e3ef9a15c8075248958c4f36d8817573ef3f6f12c62850976b32737_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681469&Signature=VGjB%2F%2BCQwDtsenSFWX7YNKbe9s%2Fgcpg%2FotVlxRZ6FXuE9VXITP76QQq6L2vlSM7pfQHSnBv%2BUdwMtN3QhCxjF7Zv2PV%2FkWLnwwA3hJciWMAKiLSeKTanNshzLWnmBjN04FASFwNf6kAq4PcunHkHh2PSOGl03eem41DHA6YOIRAjI1C6hAdDvKoAqJJXuGKM%2F5Z5vzfeTaXNgCRutOhVDB4%2FcAcV9zZaRcX9Ii0IFRAZo%2Bzk7rvI", "https://vtbehaviour.commondatastorage.googleapis.com/5f9b9db4e9200b4576d6e8bc2888d6e7ab28a04e66083366bcde57915eed5078_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683897&Signature=A1uHov9N8mIMBn6lVPETST7i%2F%2F3lKCkTSifHpWYQ8lqnGw3%2FwBD1QhGr1tH%2BYzg4xJYZR1vHPxcGC2biWNZtPF89Sx8FKf%2F18O4PHYJb1n7YfdP24JbV%2BkekQpomFKe66pKsf0gWQQx1zTJDWvam9HuvVTyCV9h22TLG%2FmBDvK4SftnNssRv0EkzKP9dNqTfjJdMh0Y0rIEyQdNLLo%2BLsWQbrx2yxJo6kZD%2FJC", "https://vtbehaviour.commondatastorage.googleapis.com/27086c4185aa32bbc6674267b947e3f6610554188ac694ce2dbc1191a9525339_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683188&Signature=o0pfi%2Bqzc6KRiLra5kzATI2ROhjWVPHqZ7tOokv%2B9i4HwxX3m%2BpcqtYKMIFJMVk1qNFDyYwnCDfkeiva50iZyrha2F3bacitBdmnSwCEQE5xMG73RGPjQAvPps3tKMm1MDH8Rzpy65y9bdKpTSCL9%2Bt2xAk4%2BXx13XPz2GlU%2BG8Q%2FSPkCW96%2BX6c5xzWpIH%2FlXn7%2Bgl2G9QMGbrbnwD%2FfR58%2FrXIeIEJ%2F9%2BNt2W3Fr", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681535&Signature=K%2BM%2FPuLQI5kqDYLWjQMD%2BgPbchxwp2sWPPUtfDZYFn5H9w%2BqFPRxh7iZqH4FOPAnwlC0%2BN5TKTqrEuhABL3gWMqHySyweiNPNkJ1MlX29xZdE482pqQSn8rzkPs7CZD63ts4ZRPrK%2Bl06RV13mZf4TUzAD9Sx0m6%2FWhetQETuu6StpVmyzhie%2Fn%2FUdsdFN0SW%2BtLpQE74IVNfszCgKVhF9oNeBiifytanSbIG0SnLff9sXffjS", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072988&Signature=1hSTk5zfAHok3rOeIvCrcVDNrMwVfu7yBxcOq5aYmB3x%2BN3QpW%2BDwvNCBsO4Jf8zXhfzvs%2BYQ8xMFx4Fh%2Bpq1Fijdl5Yewxpj61VU5lf2R3Tb9n3hOu6QgbLTSllehitudG4Z8qG33j6gu0t2wdMCNtMu46i%2B9Onj8DH5ZU5PgueMIAXDPYPD6u5GS4OjmmjihyNDlkuv2HdmzrGlVMWKpTOa7tUNtpbJkhQ8IivcOfOe3nNtEx94wExAEVO", "https://vtbehaviour.commondatastorage.googleapis.com/3a84ea97f8bfafb4a3ad6afa252315fa2c3529a732cad9070f045696dea0095e_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070092&Signature=yQBUKJDn%2FE85%2Bvl5P67ywdjBoRJ9GZj%2F%2BePT2hJjEffamM3aO%2BQVSWq3TEsVfnNMCrMPcAsJaRu64RPZJxztS%2BgQtOpCjQFUv%2FtAUou8ougQPOunxMuuX1m3PjxBDqourRIeENFZO77MUSjWuVCFEtG882utsoMv2%2FovTPqG8LU0NxjlfwMovVpkkg94Dl1tZ6O0VYlnipdZBtM6Web8IAlNUAyR4CvJrv%2BM1IR67fi", "https://vtbehaviour.commondatastorage.googleapis.com/00000be919bbf39d160bc68a67b09b51ad7f246c662c990841908f20fcf12715_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779335150&Signature=uDtc71sxnnFjUynOWL3%2BEfCWBdV5z5ySup%2Bc1zR2wZ6As7QGYwmEfhjw5Q7oU8ejTyM2hzc8A%2BNiG%2FLVKKlNfMvIhjiD1eeMdbMD9ZlBtmDb%2BWt2QmG%2B5nva1h0WfWoacQwywV6%2FluInYutfcA56BrWxyle6SDogMg0FYhPC0N313lpykH5TB%2FnQKDWeG9dnagRdUJZLwEgU4i9fniVZcnrzGT8Lh9", "https://hybrid-analysis.com/file-collection/674d072894a867c6c2076c5d", "https://vtbehaviour.commondatastorage.googleapis.com/049c8db974d1830f931d605f6918184d8928c46c74f4152dfde3dc7bdffbf5d5_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682585&Signature=z2IzO8oruo5%2BmP%2BuhsnAbNLmy7QRAemblZDUm1KEgUCliIqrtWVkruuMg2tcIokmH12yIvRumIVlk5OcGjVxI%2Bb%2B3Va9LgSnD%2Bwjbe5pAs%2BDuUGTY52XSe7V9xdcRN38UeNFYy2jTLa2KYspIZ0NzHMsL0BzU5pqOWw0bAShHYc9sNx0S7a%2BSD7PiY%2BDR%2Br%2BQll9wUT%2B4EjhHrYYmmdRCa6vbIyTLcHmdw4JzmHHsLy%2Bjf", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070947&Signature=Pkvb9Ml3f67kATtPQnKDPoRC9hQFahD3ukXAX89sLQoBuLuyPnKpZAOIOnSPYjdPv4WWamTA32WSWfVjVswMo%2FxhdtvqyQ3BysNGqKOT35gQ1YGZkZE2%2Bx6lA0XHfdv7ZLkCTVyTUd5O2WzXo1zqFBiyh3PORdPcyikZvKrywiURORR5HeHZ1KRu5Mc%2Fy5u%2FVhA4hHTzRLJiNgzC0LCacu5aimzZ%2F5uWpy6xypNiXN5HwM4hrXNW", "https://vtbehaviour.commondatastorage.googleapis.com/5f87d5cb5921df99f335e1a8f044db15187f88aea04ecc073b310a4b9649a5e1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683851&Signature=oDNiEuOved3Q5at8LARyePhpQE3%2FjmEYRIWg4Vzp0yzifSrnwMGaujbhYJWqc8BadzAh1AhmrfOaNLGJfe8IO2Izje4ofsfex0DAAfgHm5l1vDeQWFDfgypa9%2F8sHOOgBiUlbdSDYrVdZ2Z9f8MGr8OaswhQwykG5mL3UcUwRD4heOIda%2FFZGhfCLn%2B7ksTMcuD2%2BjT%2F7IuP8kYOTQ0ZqwnDZGNQwopAFpNNouIAx0LKAjPDIO", "https://vtbehaviour.commondatastorage.googleapis.com/07f5960476ab34754f3e04143caf2d4899cb09e6b271bfd27ef1f1c8977ca050_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681591&Signature=uoP10og17YxXUe0yZ8kll3N15RJJ%2Bf5pJFzW0MUe4fdvXaLlcOfCxs%2B6EyW23FSqTj%2FbNedtUC6z7Y0dgMPBtJC%2F9gOhXEZj5%2BKKwnQbCBe7GuFtEsVMMkQRdiDQxJYZipAId1MwoBChhx%2BSr%2FrboVkDq%2F%2FbNLvWS6keRMn4fa8GX%2BF0lIJepJ98sjwXs48DXBch8974olbyd38VGGp1bLMl7mycstrQ2hIy2MFXWD", "https://vtbehaviour.commondatastorage.googleapis.com/8b10c7238761ba1c98b713c673c452437c4a56794ff0e3d657cff148056c9cf1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779684153&Signature=MfmLhMZdg4gtuEoE1eB%2FroqyUo2QXTJ8L6oAmpYIvTmU8BmwS6hwF0opRe4GV3ox8yxCzd2O9fsm4T7dwrkSk8fJBlqrPHibaMNPNs4QpeMOraU4O6Au5EDLlJTtDwp43nz%2FK5tqLXzJpfqCvDEnQOghFLah5YCBj8qdFtGrKfHbvyMGL70BlhpaZsmAn3Jgu6zNXCQGqz3c%2BkATkQ3XNm%2F8FiNTOFzO5TUxHqPE3NUMFglmxAJhEo", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682086&Signature=yzXoWEcsMl9wlTGgMQfBKEZWwnDzmua%2FR2suwDMBSqPLhunpHELcj0SzY3czM%2F9HQG9QuvYzhQRVUxR1iDaFz1BQ4YHkXJih3zm%2BcNlDcfXsOZzyYzWUhaPsbSti%2FWbFoL4E14bnS7tIuG9s9R96LkGyGpWIsT%2BPeCNhsCzD7vFRU0cPMr6vNblu%2BBiO3Ki99QSrkF4hzBxkQ7DFgba3qi7kOfal%2F2K8hC1ikcZntmn5IESW", "https://vtbehaviour.commondatastorage.googleapis.com/727dc58bb6aaf24fd82f54a11560f26e38ee0ca6bb823ea70bad33fd7c9378ef_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683965&Signature=tYhGClprbVOZuxQF%2F%2BLWEx6LfO%2Fz4pigFaLvSPYRY%2Fqg92dL8%2BWlaAyT%2FJueBiXJFPkqBYoXk0DmZNj2UfqQiv4Jy9bhRG562tGCoadI7qFVHMBOyAmGj0uMVS%2FoyY00p8UkiUah%2BiG2lZaGt6eVnE1yrGqEIpnAnUxdyxti%2BDm0vFgP5Ust7yR%2F1SAtswsFyfntj2GSgBc5z1NbueSA2uSfZsxWtxmYAm9dk%2FrUPQ47Nb5Q", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681421&Signature=oUYsIo6y2ldihmETch4oPYw5nb4sHZhKRik2zGuv2h9rqu30GcV1xZHlIO9ttFa625EXOlrrILZtAhfM%2FamkTDjXZUTqn2%2BTKmgnxqOOfJU6KrJHPLE9Do7l7MEaPxX4cs8z8tWd0%2FY8sBv8sjGAIdWrT5OPv202LNN%2FiVe6mEIUMkmNr%2BG1S3Pgs6LRTjo%2BgqhEcNXT0MFUgs3I2e4AQ0TQ4FOs%2BVRY", "https://vtbehaviour.commondatastorage.googleapis.com/492dc39e7752dccfd15f588054991277e6548b794b28a03f42b9cee132eebd2e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682206&Signature=iCbR7BcpXhfqHIoxTRE%2BvhCqRoHYALCXll0hXveh8IQOJPjxw%2BlLNas6nIvp035t6sdMg9KdOY751XfThil%2FE2mLrvir%2FwKjheK2382r5bhEQFEsa6etlla3TDjlvttEFZDUN7SSLpGao8u7uVNwrPRb0BuwYDemKKVJK6DACPbUZEHk3DZ%2Bi8SxXIdELiXG%2Bozy7oC8Dcj0HqHGYuliXpjT1mV7OsCjFXvmjZPcFH06EzZS5L", "https://vtbehaviour.commondatastorage.googleapis.com/000033bb30ef26261f53f933a0f21cf4eed370bd987e081e0679898b3a6bddda_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779335270&Signature=HD1tv4%2BfbWxkeiy0n49jYf0bWSIQZGoTXEbGtzILXBy9ABXvdNKR8TYp3JjubOUUsjKIza8dV0WnN53Ye2ZuwtdkwPuYQ5cdWV3hQ4DDGC02om6I44vDnC7twPKfenv1Foxe2Xq11CjgLk6Mdg49WD6DWXvzpdgafbdvdrjLLk%2FEc6IlEf%2F5hUBfcXH6I%2FwxHQownjqPhfo5D%2BN2k6kKw6WKCoupY8pC3Riz%2F%2F5ZUDVqHvjc", "https://vtbehaviour.commondatastorage.googleapis.com/087975d5f3c874a6fe9cbfe9d7ee77fb0af138e3c36a6f75e3d000699afc571d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681569&Signature=C286Cg30s1QDg1lkY0jtTLfia8Fs4B%2FdqNMfidFUYXpd2si4N25G7RBqy8LODkWqBQca8rpYyZ7FIYHuRDc0wBLk%2B1rPiEXJckZIdmkyhDkFJ2jrxfNV135BZTTeF6DkLrRfWPgnxciVK%2FJrkueYnjlYhYW08OZkTu9plzgmfR2IocW5ENVaqHbcPAdm2QDCC6VVrNQp%2FP%2FjV6%2Fkm37tinRyXhg1vKSf0TVFMzL1jpYkiS5PIc", "https://vtbehaviour.commondatastorage.googleapis.com/e1280a3b44c48db6234162ad01131ca61f7e8733d78e2e192a53c34a460c6614_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072860&Signature=7lMnvE%2BOZ3HyFUJ9u4mf%2BszccaSI9tFlLU%2FfFNImL7UJfki9ecs6q%2B1ctALN1bsjGkAAmR9EemyHqlljLWn0e%2BoroBznqlwJhGInZW%2FonsioPQgc1Py97%2BpBefHrTJQoW%2FKPNt%2FOfifRY5PeC%2BIrYsr3NTQFk0GbjkyYzcYUA1VVNk6Tl7INGc5cfzN0o8cHk0Vu6pfai%2FBIw7tHSKEtOwq%2BiUFz6sY9KjZ%2B", "https://vtbehaviour.commondatastorage.googleapis.com/7111bb197f77eecf518b22f7a6f269647abc17eda4aaed9ba50212462b9848ed_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779684045&Signature=g5SPZe7A95%2FqyMCV3ihh6MGTnXRMjhKIGP6dBCJ3OB%2FCOBrSRTz%2BpnCcdIwsJk%2Fc74E6s1DRbKJn3SszGoP7h%2FNJwXl3BIBK6KeI0zYJeOibOT%2BeU9CnCcwY%2F3bx99X3LvHRwg0Fkdg%2BJoRI620jziRVAW%2FiC1wpzeMqmJNUOHn4NsTYiMD7H8cuBnRzAZQvK2lRO5asaddU11mHkkQ963f3YOOv", "https://vtbehaviour.commondatastorage.googleapis.com/2c98a3b3752939b7c2db76682607e3918dee0edd81998279cb4528cc6c67f715_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683469&Signature=oE7hEU%2FccffwWPye7wmTWT154zCmhX2wBLLWErX6yptBjSn9YXSMLMohlpsjw%2BxO5VxqobuYkMh302JzsMTg4fXVD76S9F6aOL1vRPwZx8fTGOeMoKRTMO7B0xwvo2HQCra8ds7NMqXBpbNxN%2Bi7Ez6ZOyX%2FQUyixg1Ya1G7%2FkF8sEaT8z%2B4QHLhghEUdy4%2FMYbGVFzAKhSDW9Yg%2BcPfxQLt%2BViZ", "https://vtbehaviour.commondatastorage.googleapis.com/3d1c4ea329813f1aec4d7de630dc13acb95bd7b767338efe5b533fca04ff48d8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072001&Signature=gIJuOyCvRHsKP79iVyX27BLkKoVj4d7bKoB84FCSGxlJ9zsLuc7J3OmaluxaiqoJu4T2o7aeANdkYMz6d8wD3%2BFD0dQQU5%2FOhhMAbYBXp73p39CyDndq1e9LD3eNxfnr0uIrt3RccUEfgo2LF8ktZh%2BPm82SICNgJeTwVv3L2YifDZTr0lPeII2WWqpPYd4Y7qWgyUEjXmipc0SPAWZhVHXPY0DJmHbFkv%2F%2FeObiESxFAH%2BCZn", "https://hybrid-analysis.com/file-collection/655e17cc95592e2d640f556e", "https://vtbehaviour.commondatastorage.googleapis.com/d3913c5d8f77fff5191b43bd32dbd8178958891bd1d90efe7a7d969ef4ab602d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071932&Signature=j2umSLl4iyhp%2FxLzsH2vZYAyU%2Fx8ki4zCfuDcXx4UgkjsO5DPIByYk043fTjoRkyd542Vqqz%2F22PYnjwhhjRJ7lXaJCPCcmtSfsWP1zGllMKIgDV57e%2FmtN%2FAzQ%2BNlqIVxXmL9peGu%2B75w6x0YaGUTBYw17iOlL87DRfZhl8Li6xlA7cX4eSHodT%2BO2B7k3D6bzQend61z62Mq76xqXV5zkXIyZCOU9a4KnKZ53nXkwnqm", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682251&Signature=z6Lrdrr5u6YZdzJaR%2B2Qab%2F%2FVA6%2FL6JaNA4%2BVxLe9wEjL%2B2ARzGBhQdq6RTX5ez3SDTWWmc%2BrOypKxxCsLeXUbjYRoIgcsSzYIxWQWoEl35tFARLVKf%2FVf%2B696U6PYQ%2F1BNWxSfuNOeUVNK2pIiMYCUjLnikvUyj9Ip3MrgKOaV9v9SShCLay93Y7b3GbAUZ2Jzy18PEYf%2FLuk4fDrqITmP2upsysOJq1MhZcJ%2", "https://vtbehaviour.commondatastorage.googleapis.com/1f1db73659fa2fe7a944d20bb4e9a867513a50ee9b51be89dfec30c73f6ed622_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682177&Signature=yjgeq7TPzf6M6Pn8mPFgBmhHQbfgGlaadZNsSsDUKq0Da4%2Bb25WhNl6nDIyUDmRBtABod6Itj2EUlbe%2B4U0QYLuJR00aQqsO%2F9pXU4AWeIFUEZhCrwgZ5WuNPpYbdVbOYcVX6oyDXpSjv1QEGmJ1NVVr%2F1esshl3tugyHxp6LFYa9%2BQeoiqsBikKLglNB52vsap%2BkwVPKyXg%2FjduMqTQd%2FhNMM41261XiBOTtUqjpzIm67", "https://vtbehaviour.commondatastorage.googleapis.com/105f31af20fdb87d442f81aad0c3a54030b7e214c4796cf2a069bae6aa89dc65_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682395&Signature=oVg82i1yTG%2BGfhoL5FyBdK%2BZKa6wi2iWMpwHyA77jBFtAOZxw%2Bs6z6So26GWDthH7UMEzwZwQC6ENF1TLBEqXukldXMdMg%2FvNylvy7vCdDKDsw53Ibc7vKnu5T0lNumnv%2FD5vnV14QZrzAE8PG3J0S0rtheY8mNCkM6t1w52XYYm5mfnGJXsnjyMEvgURuPhzOIq9%2B%2FG7XUWFK0vK%2BlzKmZU627%2FKYkT9EWHOI8Nyx%2FJUqad%2", "https://vtbehaviour.commondatastorage.googleapis.com/036d1a174e3ef9a15c8075248958c4f36d8817573ef3f6f12c62850976b32737_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681399&Signature=o4EIDa%2Bu5q7UzJoKBZ3SHIdTRWKGT7HIZyLxFZSLdRJV2Ng655y2X8OLnU2siFeopgWPI6Gd8nE9F9LFBFgwM%2F0ZN0FWsDls8m78y46TmhjHhykfch6G%2Buw3LPxmfbz999yBfELXQDUCNWIiGUPv%2B23aUdHnc0c5jI4Mvlz2HGA%2BHlIMjc1w1S%2BWm%2FI6ftHJdyIAh0SqMbPXqAy%2BIonExlGkoEmMBCJl3r3pfMcYzy4ai0", "https://hybrid-analysis.com/sample/96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 8347 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/kingtm.ru", "whois": "http://whois.domaintools.com/kingtm.ru", "domain": "kingtm.ru", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 11, "pulses": [ { "id": "6a13d458f27a51876d7949f5", "name": "NOW BOARDING: DARK-ZERO Sheep Tracker * CAPE Sandbox", "description": "Modern threat intelligence requires moving from passive observation to active intervention. In the context of targeted tracking implants, defending civil rights means engineering systems that protect user autonomy against unauthorized data extraction. Architectural Protections:\n0-Trust Telemetry: Designing operating systems where the user owns the cryptographic root of trust.\nHardware-Enforced Isolation: Utilizing Secure Enclaves to process cryptographic keys outside the reach of a compromised kernel.\nExploit Mitigation: Implementing advanced PAC+ Memory Tagging Extensions (MTE) to stop zero-day memory corruption bugs. The holiday serves as a reminder for SOCs to uphold high ethical standards, ensuring defensive tools are never repurposed for unauthorized surveillance. Respect to all.", "modified": "2026-05-27T17:19:19.635000", "created": "2026-05-25T04:47:20.503000", "tags": [ "win32 exe", "mozilla firefox", "zip adobe", "photoshop cc", "rar adobe", "air sdk", "adobe air", "lassa2", "default", "shell folders", "inprocserver32", "parent pid", "full path", "command line", "cname", "folders", "file size", "mwdb", "accept", "shutdown", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "file", "operations", "process open", "write delete", "move time", "file type", "json", "ascii", "utf8", "sqlite version", "found", "pe file", "intel", "pe32", "ms windows", "installer", "defense evasion", "window", "title", "template", "next", "united", "performs dns", "grabber honest", "layer protocol", "attack network", "info processes", "extra info", "zenbox macos", "verdict", "guest system", "ascii text", "sigma", "creates", "t1055 process", "info dropped", "malicious", "p2404", "p11718783889", "p4de83ek69hqsh4", "p11718784848", "bazaar", "sha3384", "ssdeep", "checker", "themida", "guard", "property", "adobe device", "property name", "productname", "displayname", "destination", "root", "totalsize", "langpack", "swedish", "win32", "windows sandbox", "calls clear", "sha256", "sha1", "crc32", "size", "flash", "june", "drops pe", "crlf line", "sample", "persistence", "win64", "hook", "instructor", "kids goldadobe", "errstr", "cultureneutral", "license", "error", "code", "service", "vmprotect", "february", "back", "number", "mitre attack", "network info", "processes extra", "fri dec", "database", "initial access", "program", "overview", "overview zenbox", "ultimate file", "info file", "Nullworld", "value", "value lang", "buildinfo", "productinfo", "addremoveinfo", "displayversion", "screnshots", "United", "Swedishvpncarrierenrollment", "calls process", "writes", "png image", "rgba", "guloader", "fraud", "phishing", "install", "pdapp", "urihandler", "us tcp", "product install", "gamma", "updater", "Now boarding", "DarkZero", "Sheep Tracker" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/036d1a174e3ef9a15c8075248958c4f36d8817573ef3f6f12c62850976b32737_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681399&Signature=o4EIDa%2Bu5q7UzJoKBZ3SHIdTRWKGT7HIZyLxFZSLdRJV2Ng655y2X8OLnU2siFeopgWPI6Gd8nE9F9LFBFgwM%2F0ZN0FWsDls8m78y46TmhjHhykfch6G%2Buw3LPxmfbz999yBfELXQDUCNWIiGUPv%2B23aUdHnc0c5jI4Mvlz2HGA%2BHlIMjc1w1S%2BWm%2FI6ftHJdyIAh0SqMbPXqAy%2BIonExlGkoEmMBCJl3r3pfMcYzy4ai0", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681421&Signature=oUYsIo6y2ldihmETch4oPYw5nb4sHZhKRik2zGuv2h9rqu30GcV1xZHlIO9ttFa625EXOlrrILZtAhfM%2FamkTDjXZUTqn2%2BTKmgnxqOOfJU6KrJHPLE9Do7l7MEaPxX4cs8z8tWd0%2FY8sBv8sjGAIdWrT5OPv202LNN%2FiVe6mEIUMkmNr%2BG1S3Pgs6LRTjo%2BgqhEcNXT0MFUgs3I2e4AQ0TQ4FOs%2BVRY", "https://vtbehaviour.commondatastorage.googleapis.com/036d1a174e3ef9a15c8075248958c4f36d8817573ef3f6f12c62850976b32737_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681469&Signature=VGjB%2F%2BCQwDtsenSFWX7YNKbe9s%2Fgcpg%2FotVlxRZ6FXuE9VXITP76QQq6L2vlSM7pfQHSnBv%2BUdwMtN3QhCxjF7Zv2PV%2FkWLnwwA3hJciWMAKiLSeKTanNshzLWnmBjN04FASFwNf6kAq4PcunHkHh2PSOGl03eem41DHA6YOIRAjI1C6hAdDvKoAqJJXuGKM%2F5Z5vzfeTaXNgCRutOhVDB4%2FcAcV9zZaRcX9Ii0IFRAZo%2Bzk7rvI", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681490&Signature=bIUDLY2jLaPa0t0OyOiuRlKjk8VM9IFdVTwzJhuTKfuV%2BhwtwcYghSy4186P0qsGEebShI2xNNVBPSd3uQdeXMuYRDJWcyo18c12pLwgcLgaBot06%2Bfys%2BlGp%2FV%2FSCDBvdo3iLaAOesoSo8vbCLNsWAzGM5sztLl%2Beyq9%2F1oSuAvU692EiARhcufOCMFqXCn6MNuSp18gSQwkFRBadsMvHSjfHW645FvLUfiP5Egu1WuMVP2", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681535&Signature=K%2BM%2FPuLQI5kqDYLWjQMD%2BgPbchxwp2sWPPUtfDZYFn5H9w%2BqFPRxh7iZqH4FOPAnwlC0%2BN5TKTqrEuhABL3gWMqHySyweiNPNkJ1MlX29xZdE482pqQSn8rzkPs7CZD63ts4ZRPrK%2Bl06RV13mZf4TUzAD9Sx0m6%2FWhetQETuu6StpVmyzhie%2Fn%2FUdsdFN0SW%2BtLpQE74IVNfszCgKVhF9oNeBiifytanSbIG0SnLff9sXffjS", "https://vtbehaviour.commondatastorage.googleapis.com/087975d5f3c874a6fe9cbfe9d7ee77fb0af138e3c36a6f75e3d000699afc571d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681569&Signature=C286Cg30s1QDg1lkY0jtTLfia8Fs4B%2FdqNMfidFUYXpd2si4N25G7RBqy8LODkWqBQca8rpYyZ7FIYHuRDc0wBLk%2B1rPiEXJckZIdmkyhDkFJ2jrxfNV135BZTTeF6DkLrRfWPgnxciVK%2FJrkueYnjlYhYW08OZkTu9plzgmfR2IocW5ENVaqHbcPAdm2QDCC6VVrNQp%2FP%2FjV6%2Fkm37tinRyXhg1vKSf0TVFMzL1jpYkiS5PIc", "https://vtbehaviour.commondatastorage.googleapis.com/07f5960476ab34754f3e04143caf2d4899cb09e6b271bfd27ef1f1c8977ca050_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681591&Signature=uoP10og17YxXUe0yZ8kll3N15RJJ%2Bf5pJFzW0MUe4fdvXaLlcOfCxs%2B6EyW23FSqTj%2FbNedtUC6z7Y0dgMPBtJC%2F9gOhXEZj5%2BKKwnQbCBe7GuFtEsVMMkQRdiDQxJYZipAId1MwoBChhx%2BSr%2FrboVkDq%2F%2FbNLvWS6keRMn4fa8GX%2BF0lIJepJ98sjwXs48DXBch8974olbyd38VGGp1bLMl7mycstrQ2hIy2MFXWD", "https://vtbehaviour.commondatastorage.googleapis.com/0da371854ec2c04bbee9680dbdabb67a4e4a84add40e5e1877425790f2dfef02_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682005&Signature=SyLSFT5xdlAZ5lwNyaeDpqsMTuwGywWruel4fBOIdsyiZ%2FvtOZYr7f%2B%2BIuBmqFMAwMI4L7kB6jRtv8mVn8lmU5MUJBAG6GJdVsEp2SoexU5Yl2kTksey03ZsjBloxlJqDzf8PULDlwjfD1Ydv%2B5QFPoY3%2Fk8TKMlmmpTIw7%2FYcR24%2FHYHw78XVF2cV%2Bnb3GoDaHw%2FnpxLrDwgfZP9dWvP8V264o5l2dDfxQtF0", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682086&Signature=yzXoWEcsMl9wlTGgMQfBKEZWwnDzmua%2FR2suwDMBSqPLhunpHELcj0SzY3czM%2F9HQG9QuvYzhQRVUxR1iDaFz1BQ4YHkXJih3zm%2BcNlDcfXsOZzyYzWUhaPsbSti%2FWbFoL4E14bnS7tIuG9s9R96LkGyGpWIsT%2BPeCNhsCzD7vFRU0cPMr6vNblu%2BBiO3Ki99QSrkF4hzBxkQ7DFgba3qi7kOfal%2F2K8hC1ikcZntmn5IESW", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682105&Signature=DkIw2nRg0%2BHKmd2TpyMzcgrB%2F4s6sIVIpOEEVMqz3Csoj6PPmSGNer%2Bt5X5oYKPZQgJETAHcCRs0mh3Lfa85XEPdYk6PjMimJmKQdBstqdULgs6q7wyZEjHDhQn41ri7eQ16g7pAo9ojfhLUNp4uW2xuYvdBwYhYBsZP3EO1BKz2f3dYxSg%2Bgsn2AnC2%2BDRTIX0Xxd%2Bt44%2BkXfiY32mvDHDNDCcuT5ZDFNrHwDp3HKuuJYy7lRHm8AlK", "https://vtbehaviour.commondatastorage.googleapis.com/1f1db73659fa2fe7a944d20bb4e9a867513a50ee9b51be89dfec30c73f6ed622_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682177&Signature=yjgeq7TPzf6M6Pn8mPFgBmhHQbfgGlaadZNsSsDUKq0Da4%2Bb25WhNl6nDIyUDmRBtABod6Itj2EUlbe%2B4U0QYLuJR00aQqsO%2F9pXU4AWeIFUEZhCrwgZ5WuNPpYbdVbOYcVX6oyDXpSjv1QEGmJ1NVVr%2F1esshl3tugyHxp6LFYa9%2BQeoiqsBikKLglNB52vsap%2BkwVPKyXg%2FjduMqTQd%2FhNMM41261XiBOTtUqjpzIm67", "https://vtbehaviour.commondatastorage.googleapis.com/492dc39e7752dccfd15f588054991277e6548b794b28a03f42b9cee132eebd2e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682206&Signature=iCbR7BcpXhfqHIoxTRE%2BvhCqRoHYALCXll0hXveh8IQOJPjxw%2BlLNas6nIvp035t6sdMg9KdOY751XfThil%2FE2mLrvir%2FwKjheK2382r5bhEQFEsa6etlla3TDjlvttEFZDUN7SSLpGao8u7uVNwrPRb0BuwYDemKKVJK6DACPbUZEHk3DZ%2Bi8SxXIdELiXG%2Bozy7oC8Dcj0HqHGYuliXpjT1mV7OsCjFXvmjZPcFH06EzZS5L", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682251&Signature=z6Lrdrr5u6YZdzJaR%2B2Qab%2F%2FVA6%2FL6JaNA4%2BVxLe9wEjL%2B2ARzGBhQdq6RTX5ez3SDTWWmc%2BrOypKxxCsLeXUbjYRoIgcsSzYIxWQWoEl35tFARLVKf%2FVf%2B696U6PYQ%2F1BNWxSfuNOeUVNK2pIiMYCUjLnikvUyj9Ip3MrgKOaV9v9SShCLay93Y7b3GbAUZ2Jzy18PEYf%2FLuk4fDrqITmP2upsysOJq1MhZcJ%2", "https://vtbehaviour.commondatastorage.googleapis.com/105f31af20fdb87d442f81aad0c3a54030b7e214c4796cf2a069bae6aa89dc65_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682395&Signature=oVg82i1yTG%2BGfhoL5FyBdK%2BZKa6wi2iWMpwHyA77jBFtAOZxw%2Bs6z6So26GWDthH7UMEzwZwQC6ENF1TLBEqXukldXMdMg%2FvNylvy7vCdDKDsw53Ibc7vKnu5T0lNumnv%2FD5vnV14QZrzAE8PG3J0S0rtheY8mNCkM6t1w52XYYm5mfnGJXsnjyMEvgURuPhzOIq9%2B%2FG7XUWFK0vK%2BlzKmZU627%2FKYkT9EWHOI8Nyx%2FJUqad%2", "https://vtbehaviour.commondatastorage.googleapis.com/002150c786ae1e04ab2981bf5593d926987b60b9ac699f431ed4568084dd854b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682457&Signature=eWipoH1g7AQ8zq2pd%2BpyAKrKscAY%2FebCATbHE%2FMwdvIfIy%2F4i3OFy%2FKlfaNCXDLDU0OM6JaEF73FAqGhLEb8ZcxTuEfMeU%2F6WxjpgS2SqLZ0xOjAPgPWOOor3uCcdIEZRCcpJe%2BAzPY8jEZJ0aIf49RU85lkIx9yCiXcFnee1pNHHBFwpsBK4FNuTB%2FyDe61M5Htw4fjlf43GTnXFxj0%2Fjc%2Fe32Q7EpVkuSc0I%2F3zTrY0UkC", "https://vtbehaviour.commondatastorage.googleapis.com/492dc39e7752dccfd15f588054991277e6548b794b28a03f42b9cee132eebd2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682486&Signature=ucigAmI%2BTWYWnZuZjQb7cvSnhC1f6r93NM1kh5fCHjjcUodx6ltePV2QSdyXCnhrdH8ODLugh37CFZxsAmtiMMefuyuh6T8mtuxe7znGqLiJre5YFfSQLkzmz0Ksqekcg0sp1bUaKykXguy%2BKwv6Tg12CIM7xzaDB%2BGcjw6KkBLiD0A1sB6Z9gk9np%2FNtUBHdW7E0eBfvTWOK8F99R1lQdmQab2Vha55GLH6JRBksZ7AbBEdVS8DMtkaZCS9sV", "https://vtbehaviour.commondatastorage.googleapis.com/049c8db974d1830f931d605f6918184d8928c46c74f4152dfde3dc7bdffbf5d5_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682585&Signature=z2IzO8oruo5%2BmP%2BuhsnAbNLmy7QRAemblZDUm1KEgUCliIqrtWVkruuMg2tcIokmH12yIvRumIVlk5OcGjVxI%2Bb%2B3Va9LgSnD%2Bwjbe5pAs%2BDuUGTY52XSe7V9xdcRN38UeNFYy2jTLa2KYspIZ0NzHMsL0BzU5pqOWw0bAShHYc9sNx0S7a%2BSD7PiY%2BDR%2Br%2BQll9wUT%2B4EjhHrYYmmdRCa6vbIyTLcHmdw4JzmHHsLy%2Bjf", "https://vtbehaviour.commondatastorage.googleapis.com/27086c4185aa32bbc6674267b947e3f6610554188ac694ce2dbc1191a9525339_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683188&Signature=o0pfi%2Bqzc6KRiLra5kzATI2ROhjWVPHqZ7tOokv%2B9i4HwxX3m%2BpcqtYKMIFJMVk1qNFDyYwnCDfkeiva50iZyrha2F3bacitBdmnSwCEQE5xMG73RGPjQAvPps3tKMm1MDH8Rzpy65y9bdKpTSCL9%2Bt2xAk4%2BXx13XPz2GlU%2BG8Q%2FSPkCW96%2BX6c5xzWpIH%2FlXn7%2Bgl2G9QMGbrbnwD%2FfR58%2FrXIeIEJ%2F9%2BNt2W3Fr", "https://vtbehaviour.commondatastorage.googleapis.com/2c7002510767deb9bbb0d2ee2d47be98828bf5b6e999d6cd882b1c1a1c908510_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683299&Signature=RMRBhdx9cTLEwBYgOaiBV4x03W8laZvNMUtTq68ykLCh0R5toTaD64MdSiBhgsNAZLaS8z9dPsGmVcfMC8U5sPrXXLzAt9CBPoJjT2jV40HyYrW58xs3wjf65936U00bQy9DGFrlU7xInrhEocKiXuD17i5A%2F7tdPgx74I6xY906Ua8hyOe3f5zVmaxE6zpNAonyZtoHtHmnuDLG71DTPwYyiKcGPff7glIXoNalw4ST3jQr3Ma%2Fv1Q3De", "https://vtbehaviour.commondatastorage.googleapis.com/2c98a3b3752939b7c2db76682607e3918dee0edd81998279cb4528cc6c67f715_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683469&Signature=oE7hEU%2FccffwWPye7wmTWT154zCmhX2wBLLWErX6yptBjSn9YXSMLMohlpsjw%2BxO5VxqobuYkMh302JzsMTg4fXVD76S9F6aOL1vRPwZx8fTGOeMoKRTMO7B0xwvo2HQCra8ds7NMqXBpbNxN%2Bi7Ez6ZOyX%2FQUyixg1Ya1G7%2FkF8sEaT8z%2B4QHLhghEUdy4%2FMYbGVFzAKhSDW9Yg%2BcPfxQLt%2BViZ", "https://vtbehaviour.commondatastorage.googleapis.com/5f87d5cb5921df99f335e1a8f044db15187f88aea04ecc073b310a4b9649a5e1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683851&Signature=oDNiEuOved3Q5at8LARyePhpQE3%2FjmEYRIWg4Vzp0yzifSrnwMGaujbhYJWqc8BadzAh1AhmrfOaNLGJfe8IO2Izje4ofsfex0DAAfgHm5l1vDeQWFDfgypa9%2F8sHOOgBiUlbdSDYrVdZ2Z9f8MGr8OaswhQwykG5mL3UcUwRD4heOIda%2FFZGhfCLn%2B7ksTMcuD2%2BjT%2F7IuP8kYOTQ0ZqwnDZGNQwopAFpNNouIAx0LKAjPDIO", "https://vtbehaviour.commondatastorage.googleapis.com/5f9b9db4e9200b4576d6e8bc2888d6e7ab28a04e66083366bcde57915eed5078_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683897&Signature=A1uHov9N8mIMBn6lVPETST7i%2F%2F3lKCkTSifHpWYQ8lqnGw3%2FwBD1QhGr1tH%2BYzg4xJYZR1vHPxcGC2biWNZtPF89Sx8FKf%2F18O4PHYJb1n7YfdP24JbV%2BkekQpomFKe66pKsf0gWQQx1zTJDWvam9HuvVTyCV9h22TLG%2FmBDvK4SftnNssRv0EkzKP9dNqTfjJdMh0Y0rIEyQdNLLo%2BLsWQbrx2yxJo6kZD%2FJC", "https://vtbehaviour.commondatastorage.googleapis.com/727dc58bb6aaf24fd82f54a11560f26e38ee0ca6bb823ea70bad33fd7c9378ef_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683965&Signature=tYhGClprbVOZuxQF%2F%2BLWEx6LfO%2Fz4pigFaLvSPYRY%2Fqg92dL8%2BWlaAyT%2FJueBiXJFPkqBYoXk0DmZNj2UfqQiv4Jy9bhRG562tGCoadI7qFVHMBOyAmGj0uMVS%2FoyY00p8UkiUah%2BiG2lZaGt6eVnE1yrGqEIpnAnUxdyxti%2BDm0vFgP5Ust7yR%2F1SAtswsFyfntj2GSgBc5z1NbueSA2uSfZsxWtxmYAm9dk%2FrUPQ47Nb5Q", "https://vtbehaviour.commondatastorage.googleapis.com/7111bb197f77eecf518b22f7a6f269647abc17eda4aaed9ba50212462b9848ed_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779684045&Signature=g5SPZe7A95%2FqyMCV3ihh6MGTnXRMjhKIGP6dBCJ3OB%2FCOBrSRTz%2BpnCcdIwsJk%2Fc74E6s1DRbKJn3SszGoP7h%2FNJwXl3BIBK6KeI0zYJeOibOT%2BeU9CnCcwY%2F3bx99X3LvHRwg0Fkdg%2BJoRI620jziRVAW%2FiC1wpzeMqmJNUOHn4NsTYiMD7H8cuBnRzAZQvK2lRO5asaddU11mHkkQ963f3YOOv", "https://vtbehaviour.commondatastorage.googleapis.com/8b10c7238761ba1c98b713c673c452437c4a56794ff0e3d657cff148056c9cf1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779684153&Signature=MfmLhMZdg4gtuEoE1eB%2FroqyUo2QXTJ8L6oAmpYIvTmU8BmwS6hwF0opRe4GV3ox8yxCzd2O9fsm4T7dwrkSk8fJBlqrPHibaMNPNs4QpeMOraU4O6Au5EDLlJTtDwp43nz%2FK5tqLXzJpfqCvDEnQOghFLah5YCBj8qdFtGrKfHbvyMGL70BlhpaZsmAn3Jgu6zNXCQGqz3c%2BkATkQ3XNm%2F8FiNTOFzO5TUxHqPE3NUMFglmxAJhEo" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1074", "name": "Data Staged", "display_name": "T1074 - Data Staged" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2266, "IPv4": 326, "domain": 179, "hostname": 381, "FileHash-MD5": 811, "FileHash-SHA1": 835, "URL": 815, "email": 2 }, "indicator_count": 5615, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "3 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a13d450d1c0f6a31e71cef1", "name": "NOW BOARDING: DARK-ZERO Sheep Tracker * CAPE Sandbox", "description": "Modern threat intelligence requires moving from passive observation to active intervention. In the context of targeted tracking implants, defending civil rights means engineering systems that protect user autonomy against unauthorized data extraction. Architectural Protections:\n0-Trust Telemetry: Designing operating systems where the user owns the cryptographic root of trust.\nHardware-Enforced Isolation: Utilizing Secure Enclaves to process cryptographic keys outside the reach of a compromised kernel.\nExploit Mitigation: Implementing advanced PAC+ Memory Tagging Extensions (MTE) to stop zero-day memory corruption bugs. The holiday serves as a reminder for SOCs to uphold high ethical standards, ensuring defensive tools are never repurposed for unauthorized surveillance. Respect to all.", "modified": "2026-05-27T16:31:09.918000", "created": "2026-05-25T04:47:12.640000", "tags": [ "win32 exe", "mozilla firefox", "zip adobe", "photoshop cc", "rar adobe", "air sdk", "adobe air", "lassa2", "default", "shell folders", "inprocserver32", "parent pid", "full path", "command line", "cname", "folders", "file size", "mwdb", "accept", "shutdown", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "file", "operations", "process open", "write delete", "move time", "file type", "json", "ascii", "utf8", "sqlite version", "found", "pe file", "intel", "pe32", "ms windows", "installer", "defense evasion", "window", "title", "template", "next", "united", "performs dns", "grabber honest", "layer protocol", "attack network", "info processes", "extra info", "zenbox macos", "verdict", "guest system", "ascii text", "sigma", "creates", "t1055 process", "info dropped", "malicious", "p2404", "p11718783889", "p4de83ek69hqsh4", "p11718784848", "bazaar", "sha3384", "ssdeep", "checker", "themida", "guard", "property", "adobe device", "property name", "productname", "displayname", "destination", "root", "totalsize", "langpack", "swedish", "win32", "windows sandbox", "calls clear", "sha256", "sha1", "crc32", "size", "flash", "june", "drops pe", "crlf line", "sample", "persistence", "win64", "hook", "instructor", "kids goldadobe", "errstr", "cultureneutral", "license", "error", "code", "service", "vmprotect", "february", "back", "number", "mitre attack", "network info", "processes extra", "fri dec", "database", "initial access", "program", "overview", "overview zenbox", "ultimate file", "info file", "Nullworld", "value", "value lang", "buildinfo", "productinfo", "addremoveinfo", "displayversion", "screnshots", "United", "Swedishvpncarrierenrollment", "calls process", "writes", "png image", "rgba", "guloader", "fraud", "phishing", "install", "pdapp", "urihandler", "us tcp", "product install", "gamma", "updater", "Now boarding", "DarkZero", "Sheep Tracker" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/036d1a174e3ef9a15c8075248958c4f36d8817573ef3f6f12c62850976b32737_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681399&Signature=o4EIDa%2Bu5q7UzJoKBZ3SHIdTRWKGT7HIZyLxFZSLdRJV2Ng655y2X8OLnU2siFeopgWPI6Gd8nE9F9LFBFgwM%2F0ZN0FWsDls8m78y46TmhjHhykfch6G%2Buw3LPxmfbz999yBfELXQDUCNWIiGUPv%2B23aUdHnc0c5jI4Mvlz2HGA%2BHlIMjc1w1S%2BWm%2FI6ftHJdyIAh0SqMbPXqAy%2BIonExlGkoEmMBCJl3r3pfMcYzy4ai0", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681421&Signature=oUYsIo6y2ldihmETch4oPYw5nb4sHZhKRik2zGuv2h9rqu30GcV1xZHlIO9ttFa625EXOlrrILZtAhfM%2FamkTDjXZUTqn2%2BTKmgnxqOOfJU6KrJHPLE9Do7l7MEaPxX4cs8z8tWd0%2FY8sBv8sjGAIdWrT5OPv202LNN%2FiVe6mEIUMkmNr%2BG1S3Pgs6LRTjo%2BgqhEcNXT0MFUgs3I2e4AQ0TQ4FOs%2BVRY", "https://vtbehaviour.commondatastorage.googleapis.com/036d1a174e3ef9a15c8075248958c4f36d8817573ef3f6f12c62850976b32737_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681469&Signature=VGjB%2F%2BCQwDtsenSFWX7YNKbe9s%2Fgcpg%2FotVlxRZ6FXuE9VXITP76QQq6L2vlSM7pfQHSnBv%2BUdwMtN3QhCxjF7Zv2PV%2FkWLnwwA3hJciWMAKiLSeKTanNshzLWnmBjN04FASFwNf6kAq4PcunHkHh2PSOGl03eem41DHA6YOIRAjI1C6hAdDvKoAqJJXuGKM%2F5Z5vzfeTaXNgCRutOhVDB4%2FcAcV9zZaRcX9Ii0IFRAZo%2Bzk7rvI", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681490&Signature=bIUDLY2jLaPa0t0OyOiuRlKjk8VM9IFdVTwzJhuTKfuV%2BhwtwcYghSy4186P0qsGEebShI2xNNVBPSd3uQdeXMuYRDJWcyo18c12pLwgcLgaBot06%2Bfys%2BlGp%2FV%2FSCDBvdo3iLaAOesoSo8vbCLNsWAzGM5sztLl%2Beyq9%2F1oSuAvU692EiARhcufOCMFqXCn6MNuSp18gSQwkFRBadsMvHSjfHW645FvLUfiP5Egu1WuMVP2", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681535&Signature=K%2BM%2FPuLQI5kqDYLWjQMD%2BgPbchxwp2sWPPUtfDZYFn5H9w%2BqFPRxh7iZqH4FOPAnwlC0%2BN5TKTqrEuhABL3gWMqHySyweiNPNkJ1MlX29xZdE482pqQSn8rzkPs7CZD63ts4ZRPrK%2Bl06RV13mZf4TUzAD9Sx0m6%2FWhetQETuu6StpVmyzhie%2Fn%2FUdsdFN0SW%2BtLpQE74IVNfszCgKVhF9oNeBiifytanSbIG0SnLff9sXffjS", "https://vtbehaviour.commondatastorage.googleapis.com/087975d5f3c874a6fe9cbfe9d7ee77fb0af138e3c36a6f75e3d000699afc571d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681569&Signature=C286Cg30s1QDg1lkY0jtTLfia8Fs4B%2FdqNMfidFUYXpd2si4N25G7RBqy8LODkWqBQca8rpYyZ7FIYHuRDc0wBLk%2B1rPiEXJckZIdmkyhDkFJ2jrxfNV135BZTTeF6DkLrRfWPgnxciVK%2FJrkueYnjlYhYW08OZkTu9plzgmfR2IocW5ENVaqHbcPAdm2QDCC6VVrNQp%2FP%2FjV6%2Fkm37tinRyXhg1vKSf0TVFMzL1jpYkiS5PIc", "https://vtbehaviour.commondatastorage.googleapis.com/07f5960476ab34754f3e04143caf2d4899cb09e6b271bfd27ef1f1c8977ca050_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681591&Signature=uoP10og17YxXUe0yZ8kll3N15RJJ%2Bf5pJFzW0MUe4fdvXaLlcOfCxs%2B6EyW23FSqTj%2FbNedtUC6z7Y0dgMPBtJC%2F9gOhXEZj5%2BKKwnQbCBe7GuFtEsVMMkQRdiDQxJYZipAId1MwoBChhx%2BSr%2FrboVkDq%2F%2FbNLvWS6keRMn4fa8GX%2BF0lIJepJ98sjwXs48DXBch8974olbyd38VGGp1bLMl7mycstrQ2hIy2MFXWD", "https://vtbehaviour.commondatastorage.googleapis.com/0da371854ec2c04bbee9680dbdabb67a4e4a84add40e5e1877425790f2dfef02_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682005&Signature=SyLSFT5xdlAZ5lwNyaeDpqsMTuwGywWruel4fBOIdsyiZ%2FvtOZYr7f%2B%2BIuBmqFMAwMI4L7kB6jRtv8mVn8lmU5MUJBAG6GJdVsEp2SoexU5Yl2kTksey03ZsjBloxlJqDzf8PULDlwjfD1Ydv%2B5QFPoY3%2Fk8TKMlmmpTIw7%2FYcR24%2FHYHw78XVF2cV%2Bnb3GoDaHw%2FnpxLrDwgfZP9dWvP8V264o5l2dDfxQtF0", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682086&Signature=yzXoWEcsMl9wlTGgMQfBKEZWwnDzmua%2FR2suwDMBSqPLhunpHELcj0SzY3czM%2F9HQG9QuvYzhQRVUxR1iDaFz1BQ4YHkXJih3zm%2BcNlDcfXsOZzyYzWUhaPsbSti%2FWbFoL4E14bnS7tIuG9s9R96LkGyGpWIsT%2BPeCNhsCzD7vFRU0cPMr6vNblu%2BBiO3Ki99QSrkF4hzBxkQ7DFgba3qi7kOfal%2F2K8hC1ikcZntmn5IESW", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682105&Signature=DkIw2nRg0%2BHKmd2TpyMzcgrB%2F4s6sIVIpOEEVMqz3Csoj6PPmSGNer%2Bt5X5oYKPZQgJETAHcCRs0mh3Lfa85XEPdYk6PjMimJmKQdBstqdULgs6q7wyZEjHDhQn41ri7eQ16g7pAo9ojfhLUNp4uW2xuYvdBwYhYBsZP3EO1BKz2f3dYxSg%2Bgsn2AnC2%2BDRTIX0Xxd%2Bt44%2BkXfiY32mvDHDNDCcuT5ZDFNrHwDp3HKuuJYy7lRHm8AlK", "https://vtbehaviour.commondatastorage.googleapis.com/1f1db73659fa2fe7a944d20bb4e9a867513a50ee9b51be89dfec30c73f6ed622_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682177&Signature=yjgeq7TPzf6M6Pn8mPFgBmhHQbfgGlaadZNsSsDUKq0Da4%2Bb25WhNl6nDIyUDmRBtABod6Itj2EUlbe%2B4U0QYLuJR00aQqsO%2F9pXU4AWeIFUEZhCrwgZ5WuNPpYbdVbOYcVX6oyDXpSjv1QEGmJ1NVVr%2F1esshl3tugyHxp6LFYa9%2BQeoiqsBikKLglNB52vsap%2BkwVPKyXg%2FjduMqTQd%2FhNMM41261XiBOTtUqjpzIm67", "https://vtbehaviour.commondatastorage.googleapis.com/492dc39e7752dccfd15f588054991277e6548b794b28a03f42b9cee132eebd2e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682206&Signature=iCbR7BcpXhfqHIoxTRE%2BvhCqRoHYALCXll0hXveh8IQOJPjxw%2BlLNas6nIvp035t6sdMg9KdOY751XfThil%2FE2mLrvir%2FwKjheK2382r5bhEQFEsa6etlla3TDjlvttEFZDUN7SSLpGao8u7uVNwrPRb0BuwYDemKKVJK6DACPbUZEHk3DZ%2Bi8SxXIdELiXG%2Bozy7oC8Dcj0HqHGYuliXpjT1mV7OsCjFXvmjZPcFH06EzZS5L", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682251&Signature=z6Lrdrr5u6YZdzJaR%2B2Qab%2F%2FVA6%2FL6JaNA4%2BVxLe9wEjL%2B2ARzGBhQdq6RTX5ez3SDTWWmc%2BrOypKxxCsLeXUbjYRoIgcsSzYIxWQWoEl35tFARLVKf%2FVf%2B696U6PYQ%2F1BNWxSfuNOeUVNK2pIiMYCUjLnikvUyj9Ip3MrgKOaV9v9SShCLay93Y7b3GbAUZ2Jzy18PEYf%2FLuk4fDrqITmP2upsysOJq1MhZcJ%2", "https://vtbehaviour.commondatastorage.googleapis.com/105f31af20fdb87d442f81aad0c3a54030b7e214c4796cf2a069bae6aa89dc65_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682395&Signature=oVg82i1yTG%2BGfhoL5FyBdK%2BZKa6wi2iWMpwHyA77jBFtAOZxw%2Bs6z6So26GWDthH7UMEzwZwQC6ENF1TLBEqXukldXMdMg%2FvNylvy7vCdDKDsw53Ibc7vKnu5T0lNumnv%2FD5vnV14QZrzAE8PG3J0S0rtheY8mNCkM6t1w52XYYm5mfnGJXsnjyMEvgURuPhzOIq9%2B%2FG7XUWFK0vK%2BlzKmZU627%2FKYkT9EWHOI8Nyx%2FJUqad%2", "https://vtbehaviour.commondatastorage.googleapis.com/002150c786ae1e04ab2981bf5593d926987b60b9ac699f431ed4568084dd854b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682457&Signature=eWipoH1g7AQ8zq2pd%2BpyAKrKscAY%2FebCATbHE%2FMwdvIfIy%2F4i3OFy%2FKlfaNCXDLDU0OM6JaEF73FAqGhLEb8ZcxTuEfMeU%2F6WxjpgS2SqLZ0xOjAPgPWOOor3uCcdIEZRCcpJe%2BAzPY8jEZJ0aIf49RU85lkIx9yCiXcFnee1pNHHBFwpsBK4FNuTB%2FyDe61M5Htw4fjlf43GTnXFxj0%2Fjc%2Fe32Q7EpVkuSc0I%2F3zTrY0UkC", "https://vtbehaviour.commondatastorage.googleapis.com/492dc39e7752dccfd15f588054991277e6548b794b28a03f42b9cee132eebd2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682486&Signature=ucigAmI%2BTWYWnZuZjQb7cvSnhC1f6r93NM1kh5fCHjjcUodx6ltePV2QSdyXCnhrdH8ODLugh37CFZxsAmtiMMefuyuh6T8mtuxe7znGqLiJre5YFfSQLkzmz0Ksqekcg0sp1bUaKykXguy%2BKwv6Tg12CIM7xzaDB%2BGcjw6KkBLiD0A1sB6Z9gk9np%2FNtUBHdW7E0eBfvTWOK8F99R1lQdmQab2Vha55GLH6JRBksZ7AbBEdVS8DMtkaZCS9sV", "https://vtbehaviour.commondatastorage.googleapis.com/049c8db974d1830f931d605f6918184d8928c46c74f4152dfde3dc7bdffbf5d5_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682585&Signature=z2IzO8oruo5%2BmP%2BuhsnAbNLmy7QRAemblZDUm1KEgUCliIqrtWVkruuMg2tcIokmH12yIvRumIVlk5OcGjVxI%2Bb%2B3Va9LgSnD%2Bwjbe5pAs%2BDuUGTY52XSe7V9xdcRN38UeNFYy2jTLa2KYspIZ0NzHMsL0BzU5pqOWw0bAShHYc9sNx0S7a%2BSD7PiY%2BDR%2Br%2BQll9wUT%2B4EjhHrYYmmdRCa6vbIyTLcHmdw4JzmHHsLy%2Bjf", "https://vtbehaviour.commondatastorage.googleapis.com/27086c4185aa32bbc6674267b947e3f6610554188ac694ce2dbc1191a9525339_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683188&Signature=o0pfi%2Bqzc6KRiLra5kzATI2ROhjWVPHqZ7tOokv%2B9i4HwxX3m%2BpcqtYKMIFJMVk1qNFDyYwnCDfkeiva50iZyrha2F3bacitBdmnSwCEQE5xMG73RGPjQAvPps3tKMm1MDH8Rzpy65y9bdKpTSCL9%2Bt2xAk4%2BXx13XPz2GlU%2BG8Q%2FSPkCW96%2BX6c5xzWpIH%2FlXn7%2Bgl2G9QMGbrbnwD%2FfR58%2FrXIeIEJ%2F9%2BNt2W3Fr", "https://vtbehaviour.commondatastorage.googleapis.com/2c7002510767deb9bbb0d2ee2d47be98828bf5b6e999d6cd882b1c1a1c908510_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683299&Signature=RMRBhdx9cTLEwBYgOaiBV4x03W8laZvNMUtTq68ykLCh0R5toTaD64MdSiBhgsNAZLaS8z9dPsGmVcfMC8U5sPrXXLzAt9CBPoJjT2jV40HyYrW58xs3wjf65936U00bQy9DGFrlU7xInrhEocKiXuD17i5A%2F7tdPgx74I6xY906Ua8hyOe3f5zVmaxE6zpNAonyZtoHtHmnuDLG71DTPwYyiKcGPff7glIXoNalw4ST3jQr3Ma%2Fv1Q3De", "https://vtbehaviour.commondatastorage.googleapis.com/2c98a3b3752939b7c2db76682607e3918dee0edd81998279cb4528cc6c67f715_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683469&Signature=oE7hEU%2FccffwWPye7wmTWT154zCmhX2wBLLWErX6yptBjSn9YXSMLMohlpsjw%2BxO5VxqobuYkMh302JzsMTg4fXVD76S9F6aOL1vRPwZx8fTGOeMoKRTMO7B0xwvo2HQCra8ds7NMqXBpbNxN%2Bi7Ez6ZOyX%2FQUyixg1Ya1G7%2FkF8sEaT8z%2B4QHLhghEUdy4%2FMYbGVFzAKhSDW9Yg%2BcPfxQLt%2BViZ", "https://vtbehaviour.commondatastorage.googleapis.com/5f87d5cb5921df99f335e1a8f044db15187f88aea04ecc073b310a4b9649a5e1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683851&Signature=oDNiEuOved3Q5at8LARyePhpQE3%2FjmEYRIWg4Vzp0yzifSrnwMGaujbhYJWqc8BadzAh1AhmrfOaNLGJfe8IO2Izje4ofsfex0DAAfgHm5l1vDeQWFDfgypa9%2F8sHOOgBiUlbdSDYrVdZ2Z9f8MGr8OaswhQwykG5mL3UcUwRD4heOIda%2FFZGhfCLn%2B7ksTMcuD2%2BjT%2F7IuP8kYOTQ0ZqwnDZGNQwopAFpNNouIAx0LKAjPDIO", "https://vtbehaviour.commondatastorage.googleapis.com/5f9b9db4e9200b4576d6e8bc2888d6e7ab28a04e66083366bcde57915eed5078_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683897&Signature=A1uHov9N8mIMBn6lVPETST7i%2F%2F3lKCkTSifHpWYQ8lqnGw3%2FwBD1QhGr1tH%2BYzg4xJYZR1vHPxcGC2biWNZtPF89Sx8FKf%2F18O4PHYJb1n7YfdP24JbV%2BkekQpomFKe66pKsf0gWQQx1zTJDWvam9HuvVTyCV9h22TLG%2FmBDvK4SftnNssRv0EkzKP9dNqTfjJdMh0Y0rIEyQdNLLo%2BLsWQbrx2yxJo6kZD%2FJC", "https://vtbehaviour.commondatastorage.googleapis.com/727dc58bb6aaf24fd82f54a11560f26e38ee0ca6bb823ea70bad33fd7c9378ef_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683965&Signature=tYhGClprbVOZuxQF%2F%2BLWEx6LfO%2Fz4pigFaLvSPYRY%2Fqg92dL8%2BWlaAyT%2FJueBiXJFPkqBYoXk0DmZNj2UfqQiv4Jy9bhRG562tGCoadI7qFVHMBOyAmGj0uMVS%2FoyY00p8UkiUah%2BiG2lZaGt6eVnE1yrGqEIpnAnUxdyxti%2BDm0vFgP5Ust7yR%2F1SAtswsFyfntj2GSgBc5z1NbueSA2uSfZsxWtxmYAm9dk%2FrUPQ47Nb5Q", "https://vtbehaviour.commondatastorage.googleapis.com/7111bb197f77eecf518b22f7a6f269647abc17eda4aaed9ba50212462b9848ed_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779684045&Signature=g5SPZe7A95%2FqyMCV3ihh6MGTnXRMjhKIGP6dBCJ3OB%2FCOBrSRTz%2BpnCcdIwsJk%2Fc74E6s1DRbKJn3SszGoP7h%2FNJwXl3BIBK6KeI0zYJeOibOT%2BeU9CnCcwY%2F3bx99X3LvHRwg0Fkdg%2BJoRI620jziRVAW%2FiC1wpzeMqmJNUOHn4NsTYiMD7H8cuBnRzAZQvK2lRO5asaddU11mHkkQ963f3YOOv", "https://vtbehaviour.commondatastorage.googleapis.com/8b10c7238761ba1c98b713c673c452437c4a56794ff0e3d657cff148056c9cf1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779684153&Signature=MfmLhMZdg4gtuEoE1eB%2FroqyUo2QXTJ8L6oAmpYIvTmU8BmwS6hwF0opRe4GV3ox8yxCzd2O9fsm4T7dwrkSk8fJBlqrPHibaMNPNs4QpeMOraU4O6Au5EDLlJTtDwp43nz%2FK5tqLXzJpfqCvDEnQOghFLah5YCBj8qdFtGrKfHbvyMGL70BlhpaZsmAn3Jgu6zNXCQGqz3c%2BkATkQ3XNm%2F8FiNTOFzO5TUxHqPE3NUMFglmxAJhEo" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1074", "name": "Data Staged", "display_name": "T1074 - Data Staged" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2266, "IPv4": 327, "domain": 178, "hostname": 372, "FileHash-MD5": 805, "FileHash-SHA1": 833, "URL": 812, "email": 2 }, "indicator_count": 5595, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "3 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a13d455f52a1c3acb3904b6", "name": "NOW BOARDING: DARK-ZERO Sheep Tracker * CAPE Sandbox", "description": "Modern threat intelligence requires moving from passive observation to active intervention. In the context of targeted tracking implants, defending civil rights means engineering systems that protect user autonomy against unauthorized data extraction. Architectural Protections:\n0-Trust Telemetry: Designing operating systems where the user owns the cryptographic root of trust.\nHardware-Enforced Isolation: Utilizing Secure Enclaves to process cryptographic keys outside the reach of a compromised kernel.\nExploit Mitigation: Implementing advanced PAC+ Memory Tagging Extensions (MTE) to stop zero-day memory corruption bugs. The holiday serves as a reminder for SOCs to uphold high ethical standards, ensuring defensive tools are never repurposed for unauthorized surveillance. Respect to all.", "modified": "2026-05-27T16:29:42.941000", "created": "2026-05-25T04:47:17.194000", "tags": [ "win32 exe", "mozilla firefox", "zip adobe", "photoshop cc", "rar adobe", "air sdk", "adobe air", "lassa2", "default", "shell folders", "inprocserver32", "parent pid", "full path", "command line", "cname", "folders", "file size", "mwdb", "accept", "shutdown", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "file", "operations", "process open", "write delete", "move time", "file type", "json", "ascii", "utf8", "sqlite version", "found", "pe file", "intel", "pe32", "ms windows", "installer", "defense evasion", "window", "title", "template", "next", "united", "performs dns", "grabber honest", "layer protocol", "attack network", "info processes", "extra info", "zenbox macos", "verdict", "guest system", "ascii text", "sigma", "creates", "t1055 process", "info dropped", "malicious", "p2404", "p11718783889", "p4de83ek69hqsh4", "p11718784848", "bazaar", "sha3384", "ssdeep", "checker", "themida", "guard", "property", "adobe device", "property name", "productname", "displayname", "destination", "root", "totalsize", "langpack", "swedish", "win32", "windows sandbox", "calls clear", "sha256", "sha1", "crc32", "size", "flash", "june", "drops pe", "crlf line", "sample", "persistence", "win64", "hook", "instructor", "kids goldadobe", "errstr", "cultureneutral", "license", "error", "code", "service", "vmprotect", "february", "back", "number", "mitre attack", "network info", "processes extra", "fri dec", "database", "initial access", "program", "overview", "overview zenbox", "ultimate file", "info file", "Nullworld", "value", "value lang", "buildinfo", "productinfo", "addremoveinfo", "displayversion", "screnshots", "United", "Swedishvpncarrierenrollment", "calls process", "writes", "png image", "rgba", "guloader", "fraud", "phishing", "install", "pdapp", "urihandler", "us tcp", "product install", "gamma", "updater", "Now boarding", "DarkZero", "Sheep Tracker" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/036d1a174e3ef9a15c8075248958c4f36d8817573ef3f6f12c62850976b32737_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681399&Signature=o4EIDa%2Bu5q7UzJoKBZ3SHIdTRWKGT7HIZyLxFZSLdRJV2Ng655y2X8OLnU2siFeopgWPI6Gd8nE9F9LFBFgwM%2F0ZN0FWsDls8m78y46TmhjHhykfch6G%2Buw3LPxmfbz999yBfELXQDUCNWIiGUPv%2B23aUdHnc0c5jI4Mvlz2HGA%2BHlIMjc1w1S%2BWm%2FI6ftHJdyIAh0SqMbPXqAy%2BIonExlGkoEmMBCJl3r3pfMcYzy4ai0", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681421&Signature=oUYsIo6y2ldihmETch4oPYw5nb4sHZhKRik2zGuv2h9rqu30GcV1xZHlIO9ttFa625EXOlrrILZtAhfM%2FamkTDjXZUTqn2%2BTKmgnxqOOfJU6KrJHPLE9Do7l7MEaPxX4cs8z8tWd0%2FY8sBv8sjGAIdWrT5OPv202LNN%2FiVe6mEIUMkmNr%2BG1S3Pgs6LRTjo%2BgqhEcNXT0MFUgs3I2e4AQ0TQ4FOs%2BVRY", "https://vtbehaviour.commondatastorage.googleapis.com/036d1a174e3ef9a15c8075248958c4f36d8817573ef3f6f12c62850976b32737_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681469&Signature=VGjB%2F%2BCQwDtsenSFWX7YNKbe9s%2Fgcpg%2FotVlxRZ6FXuE9VXITP76QQq6L2vlSM7pfQHSnBv%2BUdwMtN3QhCxjF7Zv2PV%2FkWLnwwA3hJciWMAKiLSeKTanNshzLWnmBjN04FASFwNf6kAq4PcunHkHh2PSOGl03eem41DHA6YOIRAjI1C6hAdDvKoAqJJXuGKM%2F5Z5vzfeTaXNgCRutOhVDB4%2FcAcV9zZaRcX9Ii0IFRAZo%2Bzk7rvI", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681490&Signature=bIUDLY2jLaPa0t0OyOiuRlKjk8VM9IFdVTwzJhuTKfuV%2BhwtwcYghSy4186P0qsGEebShI2xNNVBPSd3uQdeXMuYRDJWcyo18c12pLwgcLgaBot06%2Bfys%2BlGp%2FV%2FSCDBvdo3iLaAOesoSo8vbCLNsWAzGM5sztLl%2Beyq9%2F1oSuAvU692EiARhcufOCMFqXCn6MNuSp18gSQwkFRBadsMvHSjfHW645FvLUfiP5Egu1WuMVP2", "https://vtbehaviour.commondatastorage.googleapis.com/05eff75186e681b14135ce2945d124664260e5a88e0d14f138050d622d82745a_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681535&Signature=K%2BM%2FPuLQI5kqDYLWjQMD%2BgPbchxwp2sWPPUtfDZYFn5H9w%2BqFPRxh7iZqH4FOPAnwlC0%2BN5TKTqrEuhABL3gWMqHySyweiNPNkJ1MlX29xZdE482pqQSn8rzkPs7CZD63ts4ZRPrK%2Bl06RV13mZf4TUzAD9Sx0m6%2FWhetQETuu6StpVmyzhie%2Fn%2FUdsdFN0SW%2BtLpQE74IVNfszCgKVhF9oNeBiifytanSbIG0SnLff9sXffjS", "https://vtbehaviour.commondatastorage.googleapis.com/087975d5f3c874a6fe9cbfe9d7ee77fb0af138e3c36a6f75e3d000699afc571d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681569&Signature=C286Cg30s1QDg1lkY0jtTLfia8Fs4B%2FdqNMfidFUYXpd2si4N25G7RBqy8LODkWqBQca8rpYyZ7FIYHuRDc0wBLk%2B1rPiEXJckZIdmkyhDkFJ2jrxfNV135BZTTeF6DkLrRfWPgnxciVK%2FJrkueYnjlYhYW08OZkTu9plzgmfR2IocW5ENVaqHbcPAdm2QDCC6VVrNQp%2FP%2FjV6%2Fkm37tinRyXhg1vKSf0TVFMzL1jpYkiS5PIc", "https://vtbehaviour.commondatastorage.googleapis.com/07f5960476ab34754f3e04143caf2d4899cb09e6b271bfd27ef1f1c8977ca050_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779681591&Signature=uoP10og17YxXUe0yZ8kll3N15RJJ%2Bf5pJFzW0MUe4fdvXaLlcOfCxs%2B6EyW23FSqTj%2FbNedtUC6z7Y0dgMPBtJC%2F9gOhXEZj5%2BKKwnQbCBe7GuFtEsVMMkQRdiDQxJYZipAId1MwoBChhx%2BSr%2FrboVkDq%2F%2FbNLvWS6keRMn4fa8GX%2BF0lIJepJ98sjwXs48DXBch8974olbyd38VGGp1bLMl7mycstrQ2hIy2MFXWD", "https://vtbehaviour.commondatastorage.googleapis.com/0da371854ec2c04bbee9680dbdabb67a4e4a84add40e5e1877425790f2dfef02_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682005&Signature=SyLSFT5xdlAZ5lwNyaeDpqsMTuwGywWruel4fBOIdsyiZ%2FvtOZYr7f%2B%2BIuBmqFMAwMI4L7kB6jRtv8mVn8lmU5MUJBAG6GJdVsEp2SoexU5Yl2kTksey03ZsjBloxlJqDzf8PULDlwjfD1Ydv%2B5QFPoY3%2Fk8TKMlmmpTIw7%2FYcR24%2FHYHw78XVF2cV%2Bnb3GoDaHw%2FnpxLrDwgfZP9dWvP8V264o5l2dDfxQtF0", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682086&Signature=yzXoWEcsMl9wlTGgMQfBKEZWwnDzmua%2FR2suwDMBSqPLhunpHELcj0SzY3czM%2F9HQG9QuvYzhQRVUxR1iDaFz1BQ4YHkXJih3zm%2BcNlDcfXsOZzyYzWUhaPsbSti%2FWbFoL4E14bnS7tIuG9s9R96LkGyGpWIsT%2BPeCNhsCzD7vFRU0cPMr6vNblu%2BBiO3Ki99QSrkF4hzBxkQ7DFgba3qi7kOfal%2F2K8hC1ikcZntmn5IESW", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682105&Signature=DkIw2nRg0%2BHKmd2TpyMzcgrB%2F4s6sIVIpOEEVMqz3Csoj6PPmSGNer%2Bt5X5oYKPZQgJETAHcCRs0mh3Lfa85XEPdYk6PjMimJmKQdBstqdULgs6q7wyZEjHDhQn41ri7eQ16g7pAo9ojfhLUNp4uW2xuYvdBwYhYBsZP3EO1BKz2f3dYxSg%2Bgsn2AnC2%2BDRTIX0Xxd%2Bt44%2BkXfiY32mvDHDNDCcuT5ZDFNrHwDp3HKuuJYy7lRHm8AlK", "https://vtbehaviour.commondatastorage.googleapis.com/1f1db73659fa2fe7a944d20bb4e9a867513a50ee9b51be89dfec30c73f6ed622_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682177&Signature=yjgeq7TPzf6M6Pn8mPFgBmhHQbfgGlaadZNsSsDUKq0Da4%2Bb25WhNl6nDIyUDmRBtABod6Itj2EUlbe%2B4U0QYLuJR00aQqsO%2F9pXU4AWeIFUEZhCrwgZ5WuNPpYbdVbOYcVX6oyDXpSjv1QEGmJ1NVVr%2F1esshl3tugyHxp6LFYa9%2BQeoiqsBikKLglNB52vsap%2BkwVPKyXg%2FjduMqTQd%2FhNMM41261XiBOTtUqjpzIm67", "https://vtbehaviour.commondatastorage.googleapis.com/492dc39e7752dccfd15f588054991277e6548b794b28a03f42b9cee132eebd2e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682206&Signature=iCbR7BcpXhfqHIoxTRE%2BvhCqRoHYALCXll0hXveh8IQOJPjxw%2BlLNas6nIvp035t6sdMg9KdOY751XfThil%2FE2mLrvir%2FwKjheK2382r5bhEQFEsa6etlla3TDjlvttEFZDUN7SSLpGao8u7uVNwrPRb0BuwYDemKKVJK6DACPbUZEHk3DZ%2Bi8SxXIdELiXG%2Bozy7oC8Dcj0HqHGYuliXpjT1mV7OsCjFXvmjZPcFH06EzZS5L", "https://vtbehaviour.commondatastorage.googleapis.com/17c1908439bc7132f6a7c496c68d39b0c0cee504fe9020c920a2d1d04685fb5b_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682251&Signature=z6Lrdrr5u6YZdzJaR%2B2Qab%2F%2FVA6%2FL6JaNA4%2BVxLe9wEjL%2B2ARzGBhQdq6RTX5ez3SDTWWmc%2BrOypKxxCsLeXUbjYRoIgcsSzYIxWQWoEl35tFARLVKf%2FVf%2B696U6PYQ%2F1BNWxSfuNOeUVNK2pIiMYCUjLnikvUyj9Ip3MrgKOaV9v9SShCLay93Y7b3GbAUZ2Jzy18PEYf%2FLuk4fDrqITmP2upsysOJq1MhZcJ%2", "https://vtbehaviour.commondatastorage.googleapis.com/105f31af20fdb87d442f81aad0c3a54030b7e214c4796cf2a069bae6aa89dc65_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682395&Signature=oVg82i1yTG%2BGfhoL5FyBdK%2BZKa6wi2iWMpwHyA77jBFtAOZxw%2Bs6z6So26GWDthH7UMEzwZwQC6ENF1TLBEqXukldXMdMg%2FvNylvy7vCdDKDsw53Ibc7vKnu5T0lNumnv%2FD5vnV14QZrzAE8PG3J0S0rtheY8mNCkM6t1w52XYYm5mfnGJXsnjyMEvgURuPhzOIq9%2B%2FG7XUWFK0vK%2BlzKmZU627%2FKYkT9EWHOI8Nyx%2FJUqad%2", "https://vtbehaviour.commondatastorage.googleapis.com/002150c786ae1e04ab2981bf5593d926987b60b9ac699f431ed4568084dd854b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682457&Signature=eWipoH1g7AQ8zq2pd%2BpyAKrKscAY%2FebCATbHE%2FMwdvIfIy%2F4i3OFy%2FKlfaNCXDLDU0OM6JaEF73FAqGhLEb8ZcxTuEfMeU%2F6WxjpgS2SqLZ0xOjAPgPWOOor3uCcdIEZRCcpJe%2BAzPY8jEZJ0aIf49RU85lkIx9yCiXcFnee1pNHHBFwpsBK4FNuTB%2FyDe61M5Htw4fjlf43GTnXFxj0%2Fjc%2Fe32Q7EpVkuSc0I%2F3zTrY0UkC", "https://vtbehaviour.commondatastorage.googleapis.com/492dc39e7752dccfd15f588054991277e6548b794b28a03f42b9cee132eebd2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682486&Signature=ucigAmI%2BTWYWnZuZjQb7cvSnhC1f6r93NM1kh5fCHjjcUodx6ltePV2QSdyXCnhrdH8ODLugh37CFZxsAmtiMMefuyuh6T8mtuxe7znGqLiJre5YFfSQLkzmz0Ksqekcg0sp1bUaKykXguy%2BKwv6Tg12CIM7xzaDB%2BGcjw6KkBLiD0A1sB6Z9gk9np%2FNtUBHdW7E0eBfvTWOK8F99R1lQdmQab2Vha55GLH6JRBksZ7AbBEdVS8DMtkaZCS9sV", "https://vtbehaviour.commondatastorage.googleapis.com/049c8db974d1830f931d605f6918184d8928c46c74f4152dfde3dc7bdffbf5d5_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779682585&Signature=z2IzO8oruo5%2BmP%2BuhsnAbNLmy7QRAemblZDUm1KEgUCliIqrtWVkruuMg2tcIokmH12yIvRumIVlk5OcGjVxI%2Bb%2B3Va9LgSnD%2Bwjbe5pAs%2BDuUGTY52XSe7V9xdcRN38UeNFYy2jTLa2KYspIZ0NzHMsL0BzU5pqOWw0bAShHYc9sNx0S7a%2BSD7PiY%2BDR%2Br%2BQll9wUT%2B4EjhHrYYmmdRCa6vbIyTLcHmdw4JzmHHsLy%2Bjf", "https://vtbehaviour.commondatastorage.googleapis.com/27086c4185aa32bbc6674267b947e3f6610554188ac694ce2dbc1191a9525339_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683188&Signature=o0pfi%2Bqzc6KRiLra5kzATI2ROhjWVPHqZ7tOokv%2B9i4HwxX3m%2BpcqtYKMIFJMVk1qNFDyYwnCDfkeiva50iZyrha2F3bacitBdmnSwCEQE5xMG73RGPjQAvPps3tKMm1MDH8Rzpy65y9bdKpTSCL9%2Bt2xAk4%2BXx13XPz2GlU%2BG8Q%2FSPkCW96%2BX6c5xzWpIH%2FlXn7%2Bgl2G9QMGbrbnwD%2FfR58%2FrXIeIEJ%2F9%2BNt2W3Fr", "https://vtbehaviour.commondatastorage.googleapis.com/2c7002510767deb9bbb0d2ee2d47be98828bf5b6e999d6cd882b1c1a1c908510_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683299&Signature=RMRBhdx9cTLEwBYgOaiBV4x03W8laZvNMUtTq68ykLCh0R5toTaD64MdSiBhgsNAZLaS8z9dPsGmVcfMC8U5sPrXXLzAt9CBPoJjT2jV40HyYrW58xs3wjf65936U00bQy9DGFrlU7xInrhEocKiXuD17i5A%2F7tdPgx74I6xY906Ua8hyOe3f5zVmaxE6zpNAonyZtoHtHmnuDLG71DTPwYyiKcGPff7glIXoNalw4ST3jQr3Ma%2Fv1Q3De", "https://vtbehaviour.commondatastorage.googleapis.com/2c98a3b3752939b7c2db76682607e3918dee0edd81998279cb4528cc6c67f715_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683469&Signature=oE7hEU%2FccffwWPye7wmTWT154zCmhX2wBLLWErX6yptBjSn9YXSMLMohlpsjw%2BxO5VxqobuYkMh302JzsMTg4fXVD76S9F6aOL1vRPwZx8fTGOeMoKRTMO7B0xwvo2HQCra8ds7NMqXBpbNxN%2Bi7Ez6ZOyX%2FQUyixg1Ya1G7%2FkF8sEaT8z%2B4QHLhghEUdy4%2FMYbGVFzAKhSDW9Yg%2BcPfxQLt%2BViZ", "https://vtbehaviour.commondatastorage.googleapis.com/5f87d5cb5921df99f335e1a8f044db15187f88aea04ecc073b310a4b9649a5e1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683851&Signature=oDNiEuOved3Q5at8LARyePhpQE3%2FjmEYRIWg4Vzp0yzifSrnwMGaujbhYJWqc8BadzAh1AhmrfOaNLGJfe8IO2Izje4ofsfex0DAAfgHm5l1vDeQWFDfgypa9%2F8sHOOgBiUlbdSDYrVdZ2Z9f8MGr8OaswhQwykG5mL3UcUwRD4heOIda%2FFZGhfCLn%2B7ksTMcuD2%2BjT%2F7IuP8kYOTQ0ZqwnDZGNQwopAFpNNouIAx0LKAjPDIO", "https://vtbehaviour.commondatastorage.googleapis.com/5f9b9db4e9200b4576d6e8bc2888d6e7ab28a04e66083366bcde57915eed5078_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683897&Signature=A1uHov9N8mIMBn6lVPETST7i%2F%2F3lKCkTSifHpWYQ8lqnGw3%2FwBD1QhGr1tH%2BYzg4xJYZR1vHPxcGC2biWNZtPF89Sx8FKf%2F18O4PHYJb1n7YfdP24JbV%2BkekQpomFKe66pKsf0gWQQx1zTJDWvam9HuvVTyCV9h22TLG%2FmBDvK4SftnNssRv0EkzKP9dNqTfjJdMh0Y0rIEyQdNLLo%2BLsWQbrx2yxJo6kZD%2FJC", "https://vtbehaviour.commondatastorage.googleapis.com/727dc58bb6aaf24fd82f54a11560f26e38ee0ca6bb823ea70bad33fd7c9378ef_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779683965&Signature=tYhGClprbVOZuxQF%2F%2BLWEx6LfO%2Fz4pigFaLvSPYRY%2Fqg92dL8%2BWlaAyT%2FJueBiXJFPkqBYoXk0DmZNj2UfqQiv4Jy9bhRG562tGCoadI7qFVHMBOyAmGj0uMVS%2FoyY00p8UkiUah%2BiG2lZaGt6eVnE1yrGqEIpnAnUxdyxti%2BDm0vFgP5Ust7yR%2F1SAtswsFyfntj2GSgBc5z1NbueSA2uSfZsxWtxmYAm9dk%2FrUPQ47Nb5Q", "https://vtbehaviour.commondatastorage.googleapis.com/7111bb197f77eecf518b22f7a6f269647abc17eda4aaed9ba50212462b9848ed_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779684045&Signature=g5SPZe7A95%2FqyMCV3ihh6MGTnXRMjhKIGP6dBCJ3OB%2FCOBrSRTz%2BpnCcdIwsJk%2Fc74E6s1DRbKJn3SszGoP7h%2FNJwXl3BIBK6KeI0zYJeOibOT%2BeU9CnCcwY%2F3bx99X3LvHRwg0Fkdg%2BJoRI620jziRVAW%2FiC1wpzeMqmJNUOHn4NsTYiMD7H8cuBnRzAZQvK2lRO5asaddU11mHkkQ963f3YOOv", "https://vtbehaviour.commondatastorage.googleapis.com/8b10c7238761ba1c98b713c673c452437c4a56794ff0e3d657cff148056c9cf1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779684153&Signature=MfmLhMZdg4gtuEoE1eB%2FroqyUo2QXTJ8L6oAmpYIvTmU8BmwS6hwF0opRe4GV3ox8yxCzd2O9fsm4T7dwrkSk8fJBlqrPHibaMNPNs4QpeMOraU4O6Au5EDLlJTtDwp43nz%2FK5tqLXzJpfqCvDEnQOghFLah5YCBj8qdFtGrKfHbvyMGL70BlhpaZsmAn3Jgu6zNXCQGqz3c%2BkATkQ3XNm%2F8FiNTOFzO5TUxHqPE3NUMFglmxAJhEo" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1074", "name": "Data Staged", "display_name": "T1074 - Data Staged" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2266, "IPv4": 327, "domain": 178, "hostname": 382, "FileHash-MD5": 805, "FileHash-SHA1": 833, "URL": 816, "email": 2 }, "indicator_count": 5609, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "3 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a0e80601f3040ce2765f408", "name": "applespell VirusTotal Box of Apples Sandbox report", "description": "[full report on the Visual Studio Code.app.com malware, published on 19 January, 2024 and published online by the University of South Wales (USA) in the United States.]", "modified": "2026-05-21T04:05:48.166000", "created": "2026-05-21T03:47:44.044000", "tags": [ "applespell", "gx installer", "opera gx", "installer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "updater", "mitre attack", "file type", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive", "persistence", "malicious", "next" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00000be919bbf39d160bc68a67b09b51ad7f246c662c990841908f20fcf12715_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779335150&Signature=uDtc71sxnnFjUynOWL3%2BEfCWBdV5z5ySup%2Bc1zR2wZ6As7QGYwmEfhjw5Q7oU8ejTyM2hzc8A%2BNiG%2FLVKKlNfMvIhjiD1eeMdbMD9ZlBtmDb%2BWt2QmG%2B5nva1h0WfWoacQwywV6%2FluInYutfcA56BrWxyle6SDogMg0FYhPC0N313lpykH5TB%2FnQKDWeG9dnagRdUJZLwEgU4i9fniVZcnrzGT8Lh9", "https://vtbehaviour.commondatastorage.googleapis.com/000033bb30ef26261f53f933a0f21cf4eed370bd987e081e0679898b3a6bddda_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779335270&Signature=HD1tv4%2BfbWxkeiy0n49jYf0bWSIQZGoTXEbGtzILXBy9ABXvdNKR8TYp3JjubOUUsjKIza8dV0WnN53Ye2ZuwtdkwPuYQ5cdWV3hQ4DDGC02om6I44vDnC7twPKfenv1Foxe2Xq11CjgLk6Mdg49WD6DWXvzpdgafbdvdrjLLk%2FEc6IlEf%2F5hUBfcXH6I%2FwxHQownjqPhfo5D%2BN2k6kKw6WKCoupY8pC3Riz%2F%2F5ZUDVqHvjc" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 4, "FileHash-SHA256": 58, "IPv4": 47, "domain": 16, "hostname": 61, "URL": 105, "FileHash-MD5": 1, "Mutex": 2 }, "indicator_count": 294, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "10 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a0e805ea0647270dfa7bba7", "name": "applespell VirusTotal Box of Apples Sandbox report", "description": "[full report on the Visual Studio Code.app.com malware, published on 19 January, 2024 and published online by the University of South Wales (USA) in the United States.]", "modified": "2026-05-21T03:47:42.242000", "created": "2026-05-21T03:47:42.242000", "tags": [ "applespell", "gx installer", "opera gx", "installer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "updater", "mitre attack", "file type", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive", "persistence", "malicious", "next" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00000be919bbf39d160bc68a67b09b51ad7f246c662c990841908f20fcf12715_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779335150&Signature=uDtc71sxnnFjUynOWL3%2BEfCWBdV5z5ySup%2Bc1zR2wZ6As7QGYwmEfhjw5Q7oU8ejTyM2hzc8A%2BNiG%2FLVKKlNfMvIhjiD1eeMdbMD9ZlBtmDb%2BWt2QmG%2B5nva1h0WfWoacQwywV6%2FluInYutfcA56BrWxyle6SDogMg0FYhPC0N313lpykH5TB%2FnQKDWeG9dnagRdUJZLwEgU4i9fniVZcnrzGT8Lh9", "https://vtbehaviour.commondatastorage.googleapis.com/000033bb30ef26261f53f933a0f21cf4eed370bd987e081e0679898b3a6bddda_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779335270&Signature=HD1tv4%2BfbWxkeiy0n49jYf0bWSIQZGoTXEbGtzILXBy9ABXvdNKR8TYp3JjubOUUsjKIza8dV0WnN53Ye2ZuwtdkwPuYQ5cdWV3hQ4DDGC02om6I44vDnC7twPKfenv1Foxe2Xq11CjgLk6Mdg49WD6DWXvzpdgafbdvdrjLLk%2FEc6IlEf%2F5hUBfcXH6I%2FwxHQownjqPhfo5D%2BN2k6kKw6WKCoupY8pC3Riz%2F%2F5ZUDVqHvjc" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 4, "FileHash-SHA256": 58, "IPv4": 47, "domain": 14, "hostname": 33, "URL": 54, "FileHash-MD5": 1 }, "indicator_count": 211, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "10 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fb3d6585753bfdc08890a4", "name": "vxCube \u2014 Report + other sandboxes- Firmware Nuetral", "description": "[sample of malicious software from the Firefox operating system has been analysed by Microsoft's security team, the Office of the President, and the Microsoft Research Research Centre (MSR) in the US.]", "modified": "2026-05-06T13:54:34.222000", "created": "2026-05-06T13:08:53.749000", "tags": [ "port", "protocol level", "application", "next connection", "previous", "address", "full path", "behavior", "programfiles", "system32", "dump", "malicious", "path", "nethandle", "net108", "net1080000", "mcics", "orgid", "mcics address", "loudoun county", "pkwy city", "postalcode", "orgtechhandle", "services", "city", "stateprov", "rabuseref", "rabusehandle", "brockdorff", "c source", "utf8 unicode", "c program", "crlf", "lf line", "united", "https", "mitre attack", "network info", "processes extra", "tls version", "overview", "overview os", "x sandbox", "verdict", "next", "parent pid", "command line", "default", "nothing", "registry keys", "openasrundll c", "shell folders", "file execution", "k netsvcs", "ascii text", "categories", "settings", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "inprocserver32", "file type", "accept", "shutdown", "stream", "template", "cname", "value a", "first counter", "bearer", "mbisslshort", "bridge", "info", "date", "agent", "root", "mutexes nothing", "files c", "read files", "read registry", "keys nothing", "ipmgmt", "orgtechref", "orgabusehandle", "orgabuseref", "win1", "acrongl integ", "adc4240758", "heuristic match", "pattern match", "x2dax2da", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "angsana new", "back", "style", "cohasset police", "department", "doctype html", "head", "link", "cohasset", "title", "noscript", "meta", "performs dns", "urls", "downloads", "found", "http", "phishing" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/3a84ea97f8bfafb4a3ad6afa252315fa2c3529a732cad9070f045696dea0095e_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070092&Signature=yQBUKJDn%2FE85%2Bvl5P67ywdjBoRJ9GZj%2F%2BePT2hJjEffamM3aO%2BQVSWq3TEsVfnNMCrMPcAsJaRu64RPZJxztS%2BgQtOpCjQFUv%2FtAUou8ougQPOunxMuuX1m3PjxBDqourRIeENFZO77MUSjWuVCFEtG882utsoMv2%2FovTPqG8LU0NxjlfwMovVpkkg94Dl1tZ6O0VYlnipdZBtM6Web8IAlNUAyR4CvJrv%2BM1IR67fi", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070807&Signature=3Dm7s%2FWRPcwn5VP1fZqDViARRLpzpU7PhwwfHx%2BqMe02mkhGSmislwkS8ckH3N1K1YNVxQfqnYu89FHUKpUwC%2BOyk62pASZINgeaGaCbiysNZvDGs%2F2bN6sqg3bmKDPeVDLF34BlRrnunSY9pW0x1yITnVIRn%2FuSz9QZWFDonZBEPgt35JYofh7f9yIlA748rsPLmeMPA3RByc2n0aof5W3ghVdeTr90wlQAPidcpmEWNRXCEYPH", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070947&Signature=Pkvb9Ml3f67kATtPQnKDPoRC9hQFahD3ukXAX89sLQoBuLuyPnKpZAOIOnSPYjdPv4WWamTA32WSWfVjVswMo%2FxhdtvqyQ3BysNGqKOT35gQ1YGZkZE2%2Bx6lA0XHfdv7ZLkCTVyTUd5O2WzXo1zqFBiyh3PORdPcyikZvKrywiURORR5HeHZ1KRu5Mc%2Fy5u%2FVhA4hHTzRLJiNgzC0LCacu5aimzZ%2F5uWpy6xypNiXN5HwM4hrXNW", "https://vtbehaviour.commondatastorage.googleapis.com/da7e7a13944b0bf0f34215c4dd57810f470a43940141f9799841bce91c42b40e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071428&Signature=jg4VsRqc9AHseQKbSiN9X3N19v33%2B77cUjnoREoq3%2FAmob%2FK3l8KEZhhL1wGCFaOtjmj50aTom8QTJxDGPm9rawrO8J1V%2B8zF%2FRlfppMMiuQBSmfbpNhkJREFuRAjCvwHAxsrsixKwbxYtOMD%2FU5QrBSrkg%2B8xV3PpeZdM0J5dM8Ay%2Be1ZBCPy36ntYzbevszIsncCdUaH0Xy9WnsHV7Ps09g%2F1Z7z9rGZWdCZrPqZi3", "https://vtbehaviour.commondatastorage.googleapis.com/d3913c5d8f77fff5191b43bd32dbd8178958891bd1d90efe7a7d969ef4ab602d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071932&Signature=j2umSLl4iyhp%2FxLzsH2vZYAyU%2Fx8ki4zCfuDcXx4UgkjsO5DPIByYk043fTjoRkyd542Vqqz%2F22PYnjwhhjRJ7lXaJCPCcmtSfsWP1zGllMKIgDV57e%2FmtN%2FAzQ%2BNlqIVxXmL9peGu%2B75w6x0YaGUTBYw17iOlL87DRfZhl8Li6xlA7cX4eSHodT%2BO2B7k3D6bzQend61z62Mq76xqXV5zkXIyZCOU9a4KnKZ53nXkwnqm", "https://vtbehaviour.commondatastorage.googleapis.com/3d1c4ea329813f1aec4d7de630dc13acb95bd7b767338efe5b533fca04ff48d8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072001&Signature=gIJuOyCvRHsKP79iVyX27BLkKoVj4d7bKoB84FCSGxlJ9zsLuc7J3OmaluxaiqoJu4T2o7aeANdkYMz6d8wD3%2BFD0dQQU5%2FOhhMAbYBXp73p39CyDndq1e9LD3eNxfnr0uIrt3RccUEfgo2LF8ktZh%2BPm82SICNgJeTwVv3L2YifDZTr0lPeII2WWqpPYd4Y7qWgyUEjXmipc0SPAWZhVHXPY0DJmHbFkv%2F%2FeObiESxFAH%2BCZn", "https://vtbehaviour.commondatastorage.googleapis.com/1e5907b4cc44209637af8273555449b066fe9ce01179cd74c792e4a355a7aa4a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072217&Signature=gM91SnakBbk714%2BMza0mWtlxTRy66cB0QyotuErcCDzM8yQYmu6%2Bcy7Z1y970ywZpR05P6F4GhC8w%2Fhcd9kx0fAodkFhb3wHR6C%2F2yqPY1UMuIAOAjc6gmmrRk7%2F4M7m4MVTtnOGppQBfs9YQbqQ0ngyL5CES9vxGqIcyOOgLBRwVYQJ9PRdr5QHxDsJ8oQnGTKtuy4SKZnWfNJC7dAJhebDBsgHJRkYO9oUnFoY5uBh%2FFcveZ", "https://hybrid-analysis.com/sample/96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7", "https://hybrid-analysis.com/file-collection/674d072894a867c6c2076c5d", "https://hybrid-analysis.com/file-collection/655e17cc95592e2d640f556e", "https://vtbehaviour.commondatastorage.googleapis.com/e1280a3b44c48db6234162ad01131ca61f7e8733d78e2e192a53c34a460c6614_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072860&Signature=7lMnvE%2BOZ3HyFUJ9u4mf%2BszccaSI9tFlLU%2FfFNImL7UJfki9ecs6q%2B1ctALN1bsjGkAAmR9EemyHqlljLWn0e%2BoroBznqlwJhGInZW%2FonsioPQgc1Py97%2BpBefHrTJQoW%2FKPNt%2FOfifRY5PeC%2BIrYsr3NTQFk0GbjkyYzcYUA1VVNk6Tl7INGc5cfzN0o8cHk0Vu6pfai%2FBIw7tHSKEtOwq%2BiUFz6sY9KjZ%2B", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072961&Signature=Q1ToAg2fEJbCycZPLTn9XcCcTr7hbVsPvcEd3FyzA%2Fy30S%2F3Fjcr97ZWpo7uFwPWCJ%2B%2FXnWhv108WKa4cKTtueHRihldYXzmlbuKcEHzLgws%2FhCjFy3I8vkwV5Kism8%2FmeFsjp4y9wjLnXq51zsKHczGeUoYWTb7iko%2FVsiD6A%2B5n3ypJ5NcOp6xfCO0P7ty6%2FSLA5htYnTAkWzzC%2FI%2B0hD5Bp2BpWg1BIB7xyVB", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072988&Signature=1hSTk5zfAHok3rOeIvCrcVDNrMwVfu7yBxcOq5aYmB3x%2BN3QpW%2BDwvNCBsO4Jf8zXhfzvs%2BYQ8xMFx4Fh%2Bpq1Fijdl5Yewxpj61VU5lf2R3Tb9n3hOu6QgbLTSllehitudG4Z8qG33j6gu0t2wdMCNtMu46i%2B9Onj8DH5ZU5PgueMIAXDPYPD6u5GS4OjmmjihyNDlkuv2HdmzrGlVMWKpTOa7tUNtpbJkhQ8IivcOfOe3nNtEx94wExAEVO" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 204, "IPv4": 246, "URL": 662, "hostname": 421, "FileHash-SHA256": 532, "domain": 137, "FileHash-MD5": 473, "CIDR": 4, "email": 7, "CVE": 1 }, "indicator_count": 2687, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fb3d632800402652054b73", "name": "vxCube \u2014 Report + other sandboxes- Firmware Nuetral", "description": "[sample of malicious software from the Firefox operating system has been analysed by Microsoft's security team, the Office of the President, and the Microsoft Research Research Centre (MSR) in the US.]", "modified": "2026-05-06T13:08:51.417000", "created": "2026-05-06T13:08:51.417000", "tags": [ "port", "protocol level", "application", "next connection", "previous", "address", "full path", "behavior", "programfiles", "system32", "dump", "malicious", "path", "nethandle", "net108", "net1080000", "mcics", "orgid", "mcics address", "loudoun county", "pkwy city", "postalcode", "orgtechhandle", "services", "city", "stateprov", "rabuseref", "rabusehandle", "brockdorff", "c source", "utf8 unicode", "c program", "crlf", "lf line", "united", "https", "mitre attack", "network info", "processes extra", "tls version", "overview", "overview os", "x sandbox", "verdict", "next", "parent pid", "command line", "default", "nothing", "registry keys", "openasrundll c", "shell folders", "file execution", "k netsvcs", "ascii text", "categories", "settings", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "inprocserver32", "file type", "accept", "shutdown", "stream", "template", "cname", "value a", "first counter", "bearer", "mbisslshort", "bridge", "info", "date", "agent", "root", "mutexes nothing", "files c", "read files", "read registry", "keys nothing", "ipmgmt", "orgtechref", "orgabusehandle", "orgabuseref", "win1", "acrongl integ", "adc4240758", "heuristic match", "pattern match", "x2dax2da", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "angsana new", "back", "style", "cohasset police", "department", "doctype html", "head", "link", "cohasset", "title", "noscript", "meta", "performs dns", "urls", "downloads", "found", "http", "phishing" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/3a84ea97f8bfafb4a3ad6afa252315fa2c3529a732cad9070f045696dea0095e_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070092&Signature=yQBUKJDn%2FE85%2Bvl5P67ywdjBoRJ9GZj%2F%2BePT2hJjEffamM3aO%2BQVSWq3TEsVfnNMCrMPcAsJaRu64RPZJxztS%2BgQtOpCjQFUv%2FtAUou8ougQPOunxMuuX1m3PjxBDqourRIeENFZO77MUSjWuVCFEtG882utsoMv2%2FovTPqG8LU0NxjlfwMovVpkkg94Dl1tZ6O0VYlnipdZBtM6Web8IAlNUAyR4CvJrv%2BM1IR67fi", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070807&Signature=3Dm7s%2FWRPcwn5VP1fZqDViARRLpzpU7PhwwfHx%2BqMe02mkhGSmislwkS8ckH3N1K1YNVxQfqnYu89FHUKpUwC%2BOyk62pASZINgeaGaCbiysNZvDGs%2F2bN6sqg3bmKDPeVDLF34BlRrnunSY9pW0x1yITnVIRn%2FuSz9QZWFDonZBEPgt35JYofh7f9yIlA748rsPLmeMPA3RByc2n0aof5W3ghVdeTr90wlQAPidcpmEWNRXCEYPH", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070947&Signature=Pkvb9Ml3f67kATtPQnKDPoRC9hQFahD3ukXAX89sLQoBuLuyPnKpZAOIOnSPYjdPv4WWamTA32WSWfVjVswMo%2FxhdtvqyQ3BysNGqKOT35gQ1YGZkZE2%2Bx6lA0XHfdv7ZLkCTVyTUd5O2WzXo1zqFBiyh3PORdPcyikZvKrywiURORR5HeHZ1KRu5Mc%2Fy5u%2FVhA4hHTzRLJiNgzC0LCacu5aimzZ%2F5uWpy6xypNiXN5HwM4hrXNW", "https://vtbehaviour.commondatastorage.googleapis.com/da7e7a13944b0bf0f34215c4dd57810f470a43940141f9799841bce91c42b40e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071428&Signature=jg4VsRqc9AHseQKbSiN9X3N19v33%2B77cUjnoREoq3%2FAmob%2FK3l8KEZhhL1wGCFaOtjmj50aTom8QTJxDGPm9rawrO8J1V%2B8zF%2FRlfppMMiuQBSmfbpNhkJREFuRAjCvwHAxsrsixKwbxYtOMD%2FU5QrBSrkg%2B8xV3PpeZdM0J5dM8Ay%2Be1ZBCPy36ntYzbevszIsncCdUaH0Xy9WnsHV7Ps09g%2F1Z7z9rGZWdCZrPqZi3", "https://vtbehaviour.commondatastorage.googleapis.com/d3913c5d8f77fff5191b43bd32dbd8178958891bd1d90efe7a7d969ef4ab602d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071932&Signature=j2umSLl4iyhp%2FxLzsH2vZYAyU%2Fx8ki4zCfuDcXx4UgkjsO5DPIByYk043fTjoRkyd542Vqqz%2F22PYnjwhhjRJ7lXaJCPCcmtSfsWP1zGllMKIgDV57e%2FmtN%2FAzQ%2BNlqIVxXmL9peGu%2B75w6x0YaGUTBYw17iOlL87DRfZhl8Li6xlA7cX4eSHodT%2BO2B7k3D6bzQend61z62Mq76xqXV5zkXIyZCOU9a4KnKZ53nXkwnqm", "https://vtbehaviour.commondatastorage.googleapis.com/3d1c4ea329813f1aec4d7de630dc13acb95bd7b767338efe5b533fca04ff48d8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072001&Signature=gIJuOyCvRHsKP79iVyX27BLkKoVj4d7bKoB84FCSGxlJ9zsLuc7J3OmaluxaiqoJu4T2o7aeANdkYMz6d8wD3%2BFD0dQQU5%2FOhhMAbYBXp73p39CyDndq1e9LD3eNxfnr0uIrt3RccUEfgo2LF8ktZh%2BPm82SICNgJeTwVv3L2YifDZTr0lPeII2WWqpPYd4Y7qWgyUEjXmipc0SPAWZhVHXPY0DJmHbFkv%2F%2FeObiESxFAH%2BCZn", "https://vtbehaviour.commondatastorage.googleapis.com/1e5907b4cc44209637af8273555449b066fe9ce01179cd74c792e4a355a7aa4a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072217&Signature=gM91SnakBbk714%2BMza0mWtlxTRy66cB0QyotuErcCDzM8yQYmu6%2Bcy7Z1y970ywZpR05P6F4GhC8w%2Fhcd9kx0fAodkFhb3wHR6C%2F2yqPY1UMuIAOAjc6gmmrRk7%2F4M7m4MVTtnOGppQBfs9YQbqQ0ngyL5CES9vxGqIcyOOgLBRwVYQJ9PRdr5QHxDsJ8oQnGTKtuy4SKZnWfNJC7dAJhebDBsgHJRkYO9oUnFoY5uBh%2FFcveZ", "https://hybrid-analysis.com/sample/96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7", "https://hybrid-analysis.com/file-collection/674d072894a867c6c2076c5d", "https://hybrid-analysis.com/file-collection/655e17cc95592e2d640f556e", "https://vtbehaviour.commondatastorage.googleapis.com/e1280a3b44c48db6234162ad01131ca61f7e8733d78e2e192a53c34a460c6614_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072860&Signature=7lMnvE%2BOZ3HyFUJ9u4mf%2BszccaSI9tFlLU%2FfFNImL7UJfki9ecs6q%2B1ctALN1bsjGkAAmR9EemyHqlljLWn0e%2BoroBznqlwJhGInZW%2FonsioPQgc1Py97%2BpBefHrTJQoW%2FKPNt%2FOfifRY5PeC%2BIrYsr3NTQFk0GbjkyYzcYUA1VVNk6Tl7INGc5cfzN0o8cHk0Vu6pfai%2FBIw7tHSKEtOwq%2BiUFz6sY9KjZ%2B", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072961&Signature=Q1ToAg2fEJbCycZPLTn9XcCcTr7hbVsPvcEd3FyzA%2Fy30S%2F3Fjcr97ZWpo7uFwPWCJ%2B%2FXnWhv108WKa4cKTtueHRihldYXzmlbuKcEHzLgws%2FhCjFy3I8vkwV5Kism8%2FmeFsjp4y9wjLnXq51zsKHczGeUoYWTb7iko%2FVsiD6A%2B5n3ypJ5NcOp6xfCO0P7ty6%2FSLA5htYnTAkWzzC%2FI%2B0hD5Bp2BpWg1BIB7xyVB", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072988&Signature=1hSTk5zfAHok3rOeIvCrcVDNrMwVfu7yBxcOq5aYmB3x%2BN3QpW%2BDwvNCBsO4Jf8zXhfzvs%2BYQ8xMFx4Fh%2Bpq1Fijdl5Yewxpj61VU5lf2R3Tb9n3hOu6QgbLTSllehitudG4Z8qG33j6gu0t2wdMCNtMu46i%2B9Onj8DH5ZU5PgueMIAXDPYPD6u5GS4OjmmjihyNDlkuv2HdmzrGlVMWKpTOa7tUNtpbJkhQ8IivcOfOe3nNtEx94wExAEVO" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 204, "IPv4": 246, "URL": 661, "hostname": 421, "FileHash-SHA256": 532, "domain": 137, "FileHash-MD5": 473, "CIDR": 4, "email": 7 }, "indicator_count": 2685, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fb3d628de55fd4fef0e2bc", "name": "vxCube \u2014 Report + other sandboxes- Firmware Nuetral", "description": "[sample of malicious software from the Firefox operating system has been analysed by Microsoft's security team, the Office of the President, and the Microsoft Research Research Centre (MSR) in the US.]", "modified": "2026-05-06T13:08:50.546000", "created": "2026-05-06T13:08:50.546000", "tags": [ "port", "protocol level", "application", "next connection", "previous", "address", "full path", "behavior", "programfiles", "system32", "dump", "malicious", "path", "nethandle", "net108", "net1080000", "mcics", "orgid", "mcics address", "loudoun county", "pkwy city", "postalcode", "orgtechhandle", "services", "city", "stateprov", "rabuseref", "rabusehandle", "brockdorff", "c source", "utf8 unicode", "c program", "crlf", "lf line", "united", "https", "mitre attack", "network info", "processes extra", "tls version", "overview", "overview os", "x sandbox", "verdict", "next", "parent pid", "command line", "default", "nothing", "registry keys", "openasrundll c", "shell folders", "file execution", "k netsvcs", "ascii text", "categories", "settings", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "inprocserver32", "file type", "accept", "shutdown", "stream", "template", "cname", "value a", "first counter", "bearer", "mbisslshort", "bridge", "info", "date", "agent", "root", "mutexes nothing", "files c", "read files", "read registry", "keys nothing", "ipmgmt", "orgtechref", "orgabusehandle", "orgabuseref", "win1", "acrongl integ", "adc4240758", "heuristic match", "pattern match", "x2dax2da", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "angsana new", "back", "style", "cohasset police", "department", "doctype html", "head", "link", "cohasset", "title", "noscript", "meta", "performs dns", "urls", "downloads", "found", "http", "phishing" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/3a84ea97f8bfafb4a3ad6afa252315fa2c3529a732cad9070f045696dea0095e_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070092&Signature=yQBUKJDn%2FE85%2Bvl5P67ywdjBoRJ9GZj%2F%2BePT2hJjEffamM3aO%2BQVSWq3TEsVfnNMCrMPcAsJaRu64RPZJxztS%2BgQtOpCjQFUv%2FtAUou8ougQPOunxMuuX1m3PjxBDqourRIeENFZO77MUSjWuVCFEtG882utsoMv2%2FovTPqG8LU0NxjlfwMovVpkkg94Dl1tZ6O0VYlnipdZBtM6Web8IAlNUAyR4CvJrv%2BM1IR67fi", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070807&Signature=3Dm7s%2FWRPcwn5VP1fZqDViARRLpzpU7PhwwfHx%2BqMe02mkhGSmislwkS8ckH3N1K1YNVxQfqnYu89FHUKpUwC%2BOyk62pASZINgeaGaCbiysNZvDGs%2F2bN6sqg3bmKDPeVDLF34BlRrnunSY9pW0x1yITnVIRn%2FuSz9QZWFDonZBEPgt35JYofh7f9yIlA748rsPLmeMPA3RByc2n0aof5W3ghVdeTr90wlQAPidcpmEWNRXCEYPH", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070947&Signature=Pkvb9Ml3f67kATtPQnKDPoRC9hQFahD3ukXAX89sLQoBuLuyPnKpZAOIOnSPYjdPv4WWamTA32WSWfVjVswMo%2FxhdtvqyQ3BysNGqKOT35gQ1YGZkZE2%2Bx6lA0XHfdv7ZLkCTVyTUd5O2WzXo1zqFBiyh3PORdPcyikZvKrywiURORR5HeHZ1KRu5Mc%2Fy5u%2FVhA4hHTzRLJiNgzC0LCacu5aimzZ%2F5uWpy6xypNiXN5HwM4hrXNW", "https://vtbehaviour.commondatastorage.googleapis.com/da7e7a13944b0bf0f34215c4dd57810f470a43940141f9799841bce91c42b40e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071428&Signature=jg4VsRqc9AHseQKbSiN9X3N19v33%2B77cUjnoREoq3%2FAmob%2FK3l8KEZhhL1wGCFaOtjmj50aTom8QTJxDGPm9rawrO8J1V%2B8zF%2FRlfppMMiuQBSmfbpNhkJREFuRAjCvwHAxsrsixKwbxYtOMD%2FU5QrBSrkg%2B8xV3PpeZdM0J5dM8Ay%2Be1ZBCPy36ntYzbevszIsncCdUaH0Xy9WnsHV7Ps09g%2F1Z7z9rGZWdCZrPqZi3", "https://vtbehaviour.commondatastorage.googleapis.com/d3913c5d8f77fff5191b43bd32dbd8178958891bd1d90efe7a7d969ef4ab602d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071932&Signature=j2umSLl4iyhp%2FxLzsH2vZYAyU%2Fx8ki4zCfuDcXx4UgkjsO5DPIByYk043fTjoRkyd542Vqqz%2F22PYnjwhhjRJ7lXaJCPCcmtSfsWP1zGllMKIgDV57e%2FmtN%2FAzQ%2BNlqIVxXmL9peGu%2B75w6x0YaGUTBYw17iOlL87DRfZhl8Li6xlA7cX4eSHodT%2BO2B7k3D6bzQend61z62Mq76xqXV5zkXIyZCOU9a4KnKZ53nXkwnqm", "https://vtbehaviour.commondatastorage.googleapis.com/3d1c4ea329813f1aec4d7de630dc13acb95bd7b767338efe5b533fca04ff48d8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072001&Signature=gIJuOyCvRHsKP79iVyX27BLkKoVj4d7bKoB84FCSGxlJ9zsLuc7J3OmaluxaiqoJu4T2o7aeANdkYMz6d8wD3%2BFD0dQQU5%2FOhhMAbYBXp73p39CyDndq1e9LD3eNxfnr0uIrt3RccUEfgo2LF8ktZh%2BPm82SICNgJeTwVv3L2YifDZTr0lPeII2WWqpPYd4Y7qWgyUEjXmipc0SPAWZhVHXPY0DJmHbFkv%2F%2FeObiESxFAH%2BCZn", "https://vtbehaviour.commondatastorage.googleapis.com/1e5907b4cc44209637af8273555449b066fe9ce01179cd74c792e4a355a7aa4a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072217&Signature=gM91SnakBbk714%2BMza0mWtlxTRy66cB0QyotuErcCDzM8yQYmu6%2Bcy7Z1y970ywZpR05P6F4GhC8w%2Fhcd9kx0fAodkFhb3wHR6C%2F2yqPY1UMuIAOAjc6gmmrRk7%2F4M7m4MVTtnOGppQBfs9YQbqQ0ngyL5CES9vxGqIcyOOgLBRwVYQJ9PRdr5QHxDsJ8oQnGTKtuy4SKZnWfNJC7dAJhebDBsgHJRkYO9oUnFoY5uBh%2FFcveZ", "https://hybrid-analysis.com/sample/96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7", "https://hybrid-analysis.com/file-collection/674d072894a867c6c2076c5d", "https://hybrid-analysis.com/file-collection/655e17cc95592e2d640f556e", "https://vtbehaviour.commondatastorage.googleapis.com/e1280a3b44c48db6234162ad01131ca61f7e8733d78e2e192a53c34a460c6614_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072860&Signature=7lMnvE%2BOZ3HyFUJ9u4mf%2BszccaSI9tFlLU%2FfFNImL7UJfki9ecs6q%2B1ctALN1bsjGkAAmR9EemyHqlljLWn0e%2BoroBznqlwJhGInZW%2FonsioPQgc1Py97%2BpBefHrTJQoW%2FKPNt%2FOfifRY5PeC%2BIrYsr3NTQFk0GbjkyYzcYUA1VVNk6Tl7INGc5cfzN0o8cHk0Vu6pfai%2FBIw7tHSKEtOwq%2BiUFz6sY9KjZ%2B", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072961&Signature=Q1ToAg2fEJbCycZPLTn9XcCcTr7hbVsPvcEd3FyzA%2Fy30S%2F3Fjcr97ZWpo7uFwPWCJ%2B%2FXnWhv108WKa4cKTtueHRihldYXzmlbuKcEHzLgws%2FhCjFy3I8vkwV5Kism8%2FmeFsjp4y9wjLnXq51zsKHczGeUoYWTb7iko%2FVsiD6A%2B5n3ypJ5NcOp6xfCO0P7ty6%2FSLA5htYnTAkWzzC%2FI%2B0hD5Bp2BpWg1BIB7xyVB", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072988&Signature=1hSTk5zfAHok3rOeIvCrcVDNrMwVfu7yBxcOq5aYmB3x%2BN3QpW%2BDwvNCBsO4Jf8zXhfzvs%2BYQ8xMFx4Fh%2Bpq1Fijdl5Yewxpj61VU5lf2R3Tb9n3hOu6QgbLTSllehitudG4Z8qG33j6gu0t2wdMCNtMu46i%2B9Onj8DH5ZU5PgueMIAXDPYPD6u5GS4OjmmjihyNDlkuv2HdmzrGlVMWKpTOa7tUNtpbJkhQ8IivcOfOe3nNtEx94wExAEVO" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 204, "IPv4": 246, "URL": 661, "hostname": 421, "FileHash-SHA256": 532, "domain": 137, "FileHash-MD5": 473, "CIDR": 4, "email": 7 }, "indicator_count": 2685, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fb3d5b5642ffb183d38fa8", "name": "vxCube \u2014 Report + other sandboxes- Firmware Nuetral", "description": "[sample of malicious software from the Firefox operating system has been analysed by Microsoft's security team, the Office of the President, and the Microsoft Research Research Centre (MSR) in the US.]", "modified": "2026-05-06T13:08:43.093000", "created": "2026-05-06T13:08:43.093000", "tags": [ "port", "protocol level", "application", "next connection", "previous", "address", "full path", "behavior", "programfiles", "system32", "dump", "malicious", "path", "nethandle", "net108", "net1080000", "mcics", "orgid", "mcics address", "loudoun county", "pkwy city", "postalcode", "orgtechhandle", "services", "city", "stateprov", "rabuseref", "rabusehandle", "brockdorff", "c source", "utf8 unicode", "c program", "crlf", "lf line", "united", "https", "mitre attack", "network info", "processes extra", "tls version", "overview", "overview os", "x sandbox", "verdict", "next", "parent pid", "command line", "default", "nothing", "registry keys", "openasrundll c", "shell folders", "file execution", "k netsvcs", "ascii text", "categories", "settings", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "inprocserver32", "file type", "accept", "shutdown", "stream", "template", "cname", "value a", "first counter", "bearer", "mbisslshort", "bridge", "info", "date", "agent", "root", "mutexes nothing", "files c", "read files", "read registry", "keys nothing", "ipmgmt", "orgtechref", "orgabusehandle", "orgabuseref", "win1", "acrongl integ", "adc4240758", "heuristic match", "pattern match", "x2dax2da", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "angsana new", "back", "style", "cohasset police", "department", "doctype html", "head", "link", "cohasset", "title", "noscript", "meta", "performs dns", "urls", "downloads", "found", "http", "phishing" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/3a84ea97f8bfafb4a3ad6afa252315fa2c3529a732cad9070f045696dea0095e_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070092&Signature=yQBUKJDn%2FE85%2Bvl5P67ywdjBoRJ9GZj%2F%2BePT2hJjEffamM3aO%2BQVSWq3TEsVfnNMCrMPcAsJaRu64RPZJxztS%2BgQtOpCjQFUv%2FtAUou8ougQPOunxMuuX1m3PjxBDqourRIeENFZO77MUSjWuVCFEtG882utsoMv2%2FovTPqG8LU0NxjlfwMovVpkkg94Dl1tZ6O0VYlnipdZBtM6Web8IAlNUAyR4CvJrv%2BM1IR67fi", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070807&Signature=3Dm7s%2FWRPcwn5VP1fZqDViARRLpzpU7PhwwfHx%2BqMe02mkhGSmislwkS8ckH3N1K1YNVxQfqnYu89FHUKpUwC%2BOyk62pASZINgeaGaCbiysNZvDGs%2F2bN6sqg3bmKDPeVDLF34BlRrnunSY9pW0x1yITnVIRn%2FuSz9QZWFDonZBEPgt35JYofh7f9yIlA748rsPLmeMPA3RByc2n0aof5W3ghVdeTr90wlQAPidcpmEWNRXCEYPH", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070947&Signature=Pkvb9Ml3f67kATtPQnKDPoRC9hQFahD3ukXAX89sLQoBuLuyPnKpZAOIOnSPYjdPv4WWamTA32WSWfVjVswMo%2FxhdtvqyQ3BysNGqKOT35gQ1YGZkZE2%2Bx6lA0XHfdv7ZLkCTVyTUd5O2WzXo1zqFBiyh3PORdPcyikZvKrywiURORR5HeHZ1KRu5Mc%2Fy5u%2FVhA4hHTzRLJiNgzC0LCacu5aimzZ%2F5uWpy6xypNiXN5HwM4hrXNW", "https://vtbehaviour.commondatastorage.googleapis.com/da7e7a13944b0bf0f34215c4dd57810f470a43940141f9799841bce91c42b40e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071428&Signature=jg4VsRqc9AHseQKbSiN9X3N19v33%2B77cUjnoREoq3%2FAmob%2FK3l8KEZhhL1wGCFaOtjmj50aTom8QTJxDGPm9rawrO8J1V%2B8zF%2FRlfppMMiuQBSmfbpNhkJREFuRAjCvwHAxsrsixKwbxYtOMD%2FU5QrBSrkg%2B8xV3PpeZdM0J5dM8Ay%2Be1ZBCPy36ntYzbevszIsncCdUaH0Xy9WnsHV7Ps09g%2F1Z7z9rGZWdCZrPqZi3", "https://vtbehaviour.commondatastorage.googleapis.com/d3913c5d8f77fff5191b43bd32dbd8178958891bd1d90efe7a7d969ef4ab602d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071932&Signature=j2umSLl4iyhp%2FxLzsH2vZYAyU%2Fx8ki4zCfuDcXx4UgkjsO5DPIByYk043fTjoRkyd542Vqqz%2F22PYnjwhhjRJ7lXaJCPCcmtSfsWP1zGllMKIgDV57e%2FmtN%2FAzQ%2BNlqIVxXmL9peGu%2B75w6x0YaGUTBYw17iOlL87DRfZhl8Li6xlA7cX4eSHodT%2BO2B7k3D6bzQend61z62Mq76xqXV5zkXIyZCOU9a4KnKZ53nXkwnqm", "https://vtbehaviour.commondatastorage.googleapis.com/3d1c4ea329813f1aec4d7de630dc13acb95bd7b767338efe5b533fca04ff48d8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072001&Signature=gIJuOyCvRHsKP79iVyX27BLkKoVj4d7bKoB84FCSGxlJ9zsLuc7J3OmaluxaiqoJu4T2o7aeANdkYMz6d8wD3%2BFD0dQQU5%2FOhhMAbYBXp73p39CyDndq1e9LD3eNxfnr0uIrt3RccUEfgo2LF8ktZh%2BPm82SICNgJeTwVv3L2YifDZTr0lPeII2WWqpPYd4Y7qWgyUEjXmipc0SPAWZhVHXPY0DJmHbFkv%2F%2FeObiESxFAH%2BCZn", "https://vtbehaviour.commondatastorage.googleapis.com/1e5907b4cc44209637af8273555449b066fe9ce01179cd74c792e4a355a7aa4a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072217&Signature=gM91SnakBbk714%2BMza0mWtlxTRy66cB0QyotuErcCDzM8yQYmu6%2Bcy7Z1y970ywZpR05P6F4GhC8w%2Fhcd9kx0fAodkFhb3wHR6C%2F2yqPY1UMuIAOAjc6gmmrRk7%2F4M7m4MVTtnOGppQBfs9YQbqQ0ngyL5CES9vxGqIcyOOgLBRwVYQJ9PRdr5QHxDsJ8oQnGTKtuy4SKZnWfNJC7dAJhebDBsgHJRkYO9oUnFoY5uBh%2FFcveZ", "https://hybrid-analysis.com/sample/96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7", "https://hybrid-analysis.com/file-collection/674d072894a867c6c2076c5d", "https://hybrid-analysis.com/file-collection/655e17cc95592e2d640f556e", "https://vtbehaviour.commondatastorage.googleapis.com/e1280a3b44c48db6234162ad01131ca61f7e8733d78e2e192a53c34a460c6614_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072860&Signature=7lMnvE%2BOZ3HyFUJ9u4mf%2BszccaSI9tFlLU%2FfFNImL7UJfki9ecs6q%2B1ctALN1bsjGkAAmR9EemyHqlljLWn0e%2BoroBznqlwJhGInZW%2FonsioPQgc1Py97%2BpBefHrTJQoW%2FKPNt%2FOfifRY5PeC%2BIrYsr3NTQFk0GbjkyYzcYUA1VVNk6Tl7INGc5cfzN0o8cHk0Vu6pfai%2FBIw7tHSKEtOwq%2BiUFz6sY9KjZ%2B", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072961&Signature=Q1ToAg2fEJbCycZPLTn9XcCcTr7hbVsPvcEd3FyzA%2Fy30S%2F3Fjcr97ZWpo7uFwPWCJ%2B%2FXnWhv108WKa4cKTtueHRihldYXzmlbuKcEHzLgws%2FhCjFy3I8vkwV5Kism8%2FmeFsjp4y9wjLnXq51zsKHczGeUoYWTb7iko%2FVsiD6A%2B5n3ypJ5NcOp6xfCO0P7ty6%2FSLA5htYnTAkWzzC%2FI%2B0hD5Bp2BpWg1BIB7xyVB", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072988&Signature=1hSTk5zfAHok3rOeIvCrcVDNrMwVfu7yBxcOq5aYmB3x%2BN3QpW%2BDwvNCBsO4Jf8zXhfzvs%2BYQ8xMFx4Fh%2Bpq1Fijdl5Yewxpj61VU5lf2R3Tb9n3hOu6QgbLTSllehitudG4Z8qG33j6gu0t2wdMCNtMu46i%2B9Onj8DH5ZU5PgueMIAXDPYPD6u5GS4OjmmjihyNDlkuv2HdmzrGlVMWKpTOa7tUNtpbJkhQ8IivcOfOe3nNtEx94wExAEVO" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 204, "IPv4": 246, "URL": 661, "hostname": 421, "FileHash-SHA256": 532, "domain": 137, "FileHash-MD5": 473, "CIDR": 4, "email": 7 }, "indicator_count": 2685, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fb3d58494c7b444832ea5b", "name": "vxCube \u2014 Report + other sandboxes- Firmware Nuetral", "description": "[sample of malicious software from the Firefox operating system has been analysed by Microsoft's security team, the Office of the President, and the Microsoft Research Research Centre (MSR) in the US.]", "modified": "2026-05-06T13:08:40.248000", "created": "2026-05-06T13:08:40.248000", "tags": [ "port", "protocol level", "application", "next connection", "previous", "address", "full path", "behavior", "programfiles", "system32", "dump", "malicious", "path", "nethandle", "net108", "net1080000", "mcics", "orgid", "mcics address", "loudoun county", "pkwy city", "postalcode", "orgtechhandle", "services", "city", "stateprov", "rabuseref", "rabusehandle", "brockdorff", "c source", "utf8 unicode", "c program", "crlf", "lf line", "united", "https", "mitre attack", "network info", "processes extra", "tls version", "overview", "overview os", "x sandbox", "verdict", "next", "parent pid", "command line", "default", "nothing", "registry keys", "openasrundll c", "shell folders", "file execution", "k netsvcs", "ascii text", "categories", "settings", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "inprocserver32", "file type", "accept", "shutdown", "stream", "template", "cname", "value a", "first counter", "bearer", "mbisslshort", "bridge", "info", "date", "agent", "root", "mutexes nothing", "files c", "read files", "read registry", "keys nothing", "ipmgmt", "orgtechref", "orgabusehandle", "orgabuseref", "win1", "acrongl integ", "adc4240758", "heuristic match", "pattern match", "x2dax2da", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "angsana new", "back", "style", "cohasset police", "department", "doctype html", "head", "link", "cohasset", "title", "noscript", "meta", "performs dns", "urls", "downloads", "found", "http", "phishing" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/3a84ea97f8bfafb4a3ad6afa252315fa2c3529a732cad9070f045696dea0095e_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070092&Signature=yQBUKJDn%2FE85%2Bvl5P67ywdjBoRJ9GZj%2F%2BePT2hJjEffamM3aO%2BQVSWq3TEsVfnNMCrMPcAsJaRu64RPZJxztS%2BgQtOpCjQFUv%2FtAUou8ougQPOunxMuuX1m3PjxBDqourRIeENFZO77MUSjWuVCFEtG882utsoMv2%2FovTPqG8LU0NxjlfwMovVpkkg94Dl1tZ6O0VYlnipdZBtM6Web8IAlNUAyR4CvJrv%2BM1IR67fi", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070807&Signature=3Dm7s%2FWRPcwn5VP1fZqDViARRLpzpU7PhwwfHx%2BqMe02mkhGSmislwkS8ckH3N1K1YNVxQfqnYu89FHUKpUwC%2BOyk62pASZINgeaGaCbiysNZvDGs%2F2bN6sqg3bmKDPeVDLF34BlRrnunSY9pW0x1yITnVIRn%2FuSz9QZWFDonZBEPgt35JYofh7f9yIlA748rsPLmeMPA3RByc2n0aof5W3ghVdeTr90wlQAPidcpmEWNRXCEYPH", "https://vtbehaviour.commondatastorage.googleapis.com/076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778070947&Signature=Pkvb9Ml3f67kATtPQnKDPoRC9hQFahD3ukXAX89sLQoBuLuyPnKpZAOIOnSPYjdPv4WWamTA32WSWfVjVswMo%2FxhdtvqyQ3BysNGqKOT35gQ1YGZkZE2%2Bx6lA0XHfdv7ZLkCTVyTUd5O2WzXo1zqFBiyh3PORdPcyikZvKrywiURORR5HeHZ1KRu5Mc%2Fy5u%2FVhA4hHTzRLJiNgzC0LCacu5aimzZ%2F5uWpy6xypNiXN5HwM4hrXNW", "https://vtbehaviour.commondatastorage.googleapis.com/da7e7a13944b0bf0f34215c4dd57810f470a43940141f9799841bce91c42b40e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071428&Signature=jg4VsRqc9AHseQKbSiN9X3N19v33%2B77cUjnoREoq3%2FAmob%2FK3l8KEZhhL1wGCFaOtjmj50aTom8QTJxDGPm9rawrO8J1V%2B8zF%2FRlfppMMiuQBSmfbpNhkJREFuRAjCvwHAxsrsixKwbxYtOMD%2FU5QrBSrkg%2B8xV3PpeZdM0J5dM8Ay%2Be1ZBCPy36ntYzbevszIsncCdUaH0Xy9WnsHV7Ps09g%2F1Z7z9rGZWdCZrPqZi3", "https://vtbehaviour.commondatastorage.googleapis.com/d3913c5d8f77fff5191b43bd32dbd8178958891bd1d90efe7a7d969ef4ab602d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778071932&Signature=j2umSLl4iyhp%2FxLzsH2vZYAyU%2Fx8ki4zCfuDcXx4UgkjsO5DPIByYk043fTjoRkyd542Vqqz%2F22PYnjwhhjRJ7lXaJCPCcmtSfsWP1zGllMKIgDV57e%2FmtN%2FAzQ%2BNlqIVxXmL9peGu%2B75w6x0YaGUTBYw17iOlL87DRfZhl8Li6xlA7cX4eSHodT%2BO2B7k3D6bzQend61z62Mq76xqXV5zkXIyZCOU9a4KnKZ53nXkwnqm", "https://vtbehaviour.commondatastorage.googleapis.com/3d1c4ea329813f1aec4d7de630dc13acb95bd7b767338efe5b533fca04ff48d8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072001&Signature=gIJuOyCvRHsKP79iVyX27BLkKoVj4d7bKoB84FCSGxlJ9zsLuc7J3OmaluxaiqoJu4T2o7aeANdkYMz6d8wD3%2BFD0dQQU5%2FOhhMAbYBXp73p39CyDndq1e9LD3eNxfnr0uIrt3RccUEfgo2LF8ktZh%2BPm82SICNgJeTwVv3L2YifDZTr0lPeII2WWqpPYd4Y7qWgyUEjXmipc0SPAWZhVHXPY0DJmHbFkv%2F%2FeObiESxFAH%2BCZn", "https://vtbehaviour.commondatastorage.googleapis.com/1e5907b4cc44209637af8273555449b066fe9ce01179cd74c792e4a355a7aa4a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072217&Signature=gM91SnakBbk714%2BMza0mWtlxTRy66cB0QyotuErcCDzM8yQYmu6%2Bcy7Z1y970ywZpR05P6F4GhC8w%2Fhcd9kx0fAodkFhb3wHR6C%2F2yqPY1UMuIAOAjc6gmmrRk7%2F4M7m4MVTtnOGppQBfs9YQbqQ0ngyL5CES9vxGqIcyOOgLBRwVYQJ9PRdr5QHxDsJ8oQnGTKtuy4SKZnWfNJC7dAJhebDBsgHJRkYO9oUnFoY5uBh%2FFcveZ", "https://hybrid-analysis.com/sample/96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7", "https://hybrid-analysis.com/file-collection/674d072894a867c6c2076c5d", "https://hybrid-analysis.com/file-collection/655e17cc95592e2d640f556e", "https://vtbehaviour.commondatastorage.googleapis.com/e1280a3b44c48db6234162ad01131ca61f7e8733d78e2e192a53c34a460c6614_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072860&Signature=7lMnvE%2BOZ3HyFUJ9u4mf%2BszccaSI9tFlLU%2FfFNImL7UJfki9ecs6q%2B1ctALN1bsjGkAAmR9EemyHqlljLWn0e%2BoroBznqlwJhGInZW%2FonsioPQgc1Py97%2BpBefHrTJQoW%2FKPNt%2FOfifRY5PeC%2BIrYsr3NTQFk0GbjkyYzcYUA1VVNk6Tl7INGc5cfzN0o8cHk0Vu6pfai%2FBIw7tHSKEtOwq%2BiUFz6sY9KjZ%2B", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072961&Signature=Q1ToAg2fEJbCycZPLTn9XcCcTr7hbVsPvcEd3FyzA%2Fy30S%2F3Fjcr97ZWpo7uFwPWCJ%2B%2FXnWhv108WKa4cKTtueHRihldYXzmlbuKcEHzLgws%2FhCjFy3I8vkwV5Kism8%2FmeFsjp4y9wjLnXq51zsKHczGeUoYWTb7iko%2FVsiD6A%2B5n3ypJ5NcOp6xfCO0P7ty6%2FSLA5htYnTAkWzzC%2FI%2B0hD5Bp2BpWg1BIB7xyVB", "https://vtbehaviour.commondatastorage.googleapis.com/1e50a19bf657ed59e87edf7163629a66006d6c04159f839d0333fea0f208bac2_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1778072988&Signature=1hSTk5zfAHok3rOeIvCrcVDNrMwVfu7yBxcOq5aYmB3x%2BN3QpW%2BDwvNCBsO4Jf8zXhfzvs%2BYQ8xMFx4Fh%2Bpq1Fijdl5Yewxpj61VU5lf2R3Tb9n3hOu6QgbLTSllehitudG4Z8qG33j6gu0t2wdMCNtMu46i%2B9Onj8DH5ZU5PgueMIAXDPYPD6u5GS4OjmmjihyNDlkuv2HdmzrGlVMWKpTOa7tUNtpbJkhQ8IivcOfOe3nNtEx94wExAEVO" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 204, "IPv4": 246, "URL": 661, "hostname": 421, "FileHash-SHA256": 532, "domain": 137, "FileHash-MD5": 473, "CIDR": 4, "email": 7 }, "indicator_count": 2685, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://kingtm.ru", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://kingtm.ru", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780234381.8671098 }