{
  "type": "URL",
  "indicator": "https://mon.systemautoupdater.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://mon.systemautoupdater.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4330576480,
      "indicator": "https://mon.systemautoupdater.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "69eea032b44c822fa321c040",
          "name": "vxCube \u2014 Report",
          "description": "[Researchers have identified the first \"pulses\" to be created on a single domain, the GoDaddy.com, and the second to have been identified by its owner, a US company.] Date - 2024-12-10 11:15:23 UTC for [017076655d1d5d05656azcb!z] [exe parent of>] and [4ca5bc812211957dc963d03fc773d01d9b6643c4d99d31a9f9032fcbed39cf9c, 2025-06-02 05:00:56 UTC]",
          "modified": "2026-05-26T23:51:32.486000",
          "created": "2026-04-26T23:30:58.043000",
          "tags": [
            "passive dns",
            "status",
            "urls",
            "creation date",
            "date",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "address",
            "expiry date",
            "name",
            "query time",
            "code signing",
            "zlatin stamatov",
            "issuer certum",
            "ca valid",
            "from",
            "valid",
            "valid usage",
            "algorithm",
            "serial number",
            "certum code",
            "signing",
            "ca status",
            "valid issuer",
            "certum trusted",
            "network ca",
            "valid from",
            "status valid",
            "trusted network",
            "all algorithm",
            "client auth",
            "e7 ff",
            "thumbprint md5",
            "fa cd",
            "tags size",
            "mb format",
            "exe sha1",
            "body length",
            "b body",
            "sha256",
            "pe32",
            "intel",
            "ms windows",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "os2 executable",
            "pe32 compiler",
            "exe32",
            "compiler"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 21,
            "FileHash-SHA1": 13,
            "FileHash-SHA256": 92,
            "URL": 63,
            "domain": 54,
            "hostname": 27,
            "email": 1,
            "CVE": 3
          },
          "indicator_count": 274,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "4 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69eea032c0007ec10cd71b6a",
          "name": "vxCube \u2014 Report",
          "description": "[Researchers have identified the first \"pulses\" to be created on a single domain, the GoDaddy.com, and the second to have been identified by its owner, a US company.] Date - 2024-12-10 11:15:23 UTC for [017076655d1d5d05656azcb!z] [exe parent of>] and [4ca5bc812211957dc963d03fc773d01d9b6643c4d99d31a9f9032fcbed39cf9c, 2025-06-02 05:00:56 UTC]",
          "modified": "2026-05-26T23:51:32.486000",
          "created": "2026-04-26T23:30:58.642000",
          "tags": [
            "passive dns",
            "status",
            "urls",
            "creation date",
            "date",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "address",
            "expiry date",
            "name",
            "query time",
            "code signing",
            "zlatin stamatov",
            "issuer certum",
            "ca valid",
            "from",
            "valid",
            "valid usage",
            "algorithm",
            "serial number",
            "certum code",
            "signing",
            "ca status",
            "valid issuer",
            "certum trusted",
            "network ca",
            "valid from",
            "status valid",
            "trusted network",
            "all algorithm",
            "client auth",
            "e7 ff",
            "thumbprint md5",
            "fa cd",
            "tags size",
            "mb format",
            "exe sha1",
            "body length",
            "b body",
            "sha256",
            "pe32",
            "intel",
            "ms windows",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "os2 executable",
            "pe32 compiler",
            "exe32",
            "compiler"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 20,
            "FileHash-SHA1": 12,
            "FileHash-SHA256": 91,
            "URL": 58,
            "domain": 54,
            "hostname": 25,
            "email": 1,
            "CVE": 3
          },
          "indicator_count": 264,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "4 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69eea03311228a15d06a2b2a",
          "name": "vxCube \u2014 Report",
          "description": "[Researchers have identified the first \"pulses\" to be created on a single domain, the GoDaddy.com, and the second to have been identified by its owner, a US company.] Date - 2024-12-10 11:15:23 UTC for [017076655d1d5d05656azcb!z] [exe parent of>] and [4ca5bc812211957dc963d03fc773d01d9b6643c4d99d31a9f9032fcbed39cf9c, 2025-06-02 05:00:56 UTC]",
          "modified": "2026-05-26T23:51:32.486000",
          "created": "2026-04-26T23:30:59.313000",
          "tags": [
            "passive dns",
            "status",
            "urls",
            "creation date",
            "date",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "address",
            "expiry date",
            "name",
            "query time",
            "code signing",
            "zlatin stamatov",
            "issuer certum",
            "ca valid",
            "from",
            "valid",
            "valid usage",
            "algorithm",
            "serial number",
            "certum code",
            "signing",
            "ca status",
            "valid issuer",
            "certum trusted",
            "network ca",
            "valid from",
            "status valid",
            "trusted network",
            "all algorithm",
            "client auth",
            "e7 ff",
            "thumbprint md5",
            "fa cd",
            "tags size",
            "mb format",
            "exe sha1",
            "body length",
            "b body",
            "sha256",
            "pe32",
            "intel",
            "ms windows",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "os2 executable",
            "pe32 compiler",
            "exe32",
            "compiler"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 20,
            "FileHash-SHA1": 12,
            "FileHash-SHA256": 91,
            "URL": 58,
            "domain": 54,
            "hostname": 25,
            "email": 1,
            "CVE": 3
          },
          "indicator_count": 264,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "4 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69eea0339cc87532959cb616",
          "name": "vxCube \u2014 Report",
          "description": "[Researchers have identified the first \"pulses\" to be created on a single domain, the GoDaddy.com, and the second to have been identified by its owner, a US company.] Date - 2024-12-10 11:15:23 UTC for [017076655d1d5d05656azcb!z] [exe parent of>] and [4ca5bc812211957dc963d03fc773d01d9b6643c4d99d31a9f9032fcbed39cf9c, 2025-06-02 05:00:56 UTC]",
          "modified": "2026-05-26T23:51:32.486000",
          "created": "2026-04-26T23:30:59.950000",
          "tags": [
            "passive dns",
            "status",
            "urls",
            "creation date",
            "date",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "address",
            "expiry date",
            "name",
            "query time",
            "code signing",
            "zlatin stamatov",
            "issuer certum",
            "ca valid",
            "from",
            "valid",
            "valid usage",
            "algorithm",
            "serial number",
            "certum code",
            "signing",
            "ca status",
            "valid issuer",
            "certum trusted",
            "network ca",
            "valid from",
            "status valid",
            "trusted network",
            "all algorithm",
            "client auth",
            "e7 ff",
            "thumbprint md5",
            "fa cd",
            "tags size",
            "mb format",
            "exe sha1",
            "body length",
            "b body",
            "sha256",
            "pe32",
            "intel",
            "ms windows",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "os2 executable",
            "pe32 compiler",
            "exe32",
            "compiler"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 20,
            "FileHash-SHA1": 12,
            "FileHash-SHA256": 91,
            "URL": 58,
            "domain": 54,
            "hostname": 25,
            "email": 1,
            "CVE": 3
          },
          "indicator_count": 264,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "4 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 283
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/systemautoupdater.com",
    "whois": "http://whois.domaintools.com/systemautoupdater.com",
    "domain": "systemautoupdater.com",
    "hostname": "mon.systemautoupdater.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "69eea032b44c822fa321c040",
      "name": "vxCube \u2014 Report",
      "description": "[Researchers have identified the first \"pulses\" to be created on a single domain, the GoDaddy.com, and the second to have been identified by its owner, a US company.] Date - 2024-12-10 11:15:23 UTC for [017076655d1d5d05656azcb!z] [exe parent of>] and [4ca5bc812211957dc963d03fc773d01d9b6643c4d99d31a9f9032fcbed39cf9c, 2025-06-02 05:00:56 UTC]",
      "modified": "2026-05-26T23:51:32.486000",
      "created": "2026-04-26T23:30:58.043000",
      "tags": [
        "passive dns",
        "status",
        "urls",
        "creation date",
        "date",
        "pulse pulses",
        "files",
        "domain",
        "files ip",
        "address",
        "expiry date",
        "name",
        "query time",
        "code signing",
        "zlatin stamatov",
        "issuer certum",
        "ca valid",
        "from",
        "valid",
        "valid usage",
        "algorithm",
        "serial number",
        "certum code",
        "signing",
        "ca status",
        "valid issuer",
        "certum trusted",
        "network ca",
        "valid from",
        "status valid",
        "trusted network",
        "all algorithm",
        "client auth",
        "e7 ff",
        "thumbprint md5",
        "fa cd",
        "tags size",
        "mb format",
        "exe sha1",
        "body length",
        "b body",
        "sha256",
        "pe32",
        "intel",
        "ms windows",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "os2 executable",
        "pe32 compiler",
        "exe32",
        "compiler"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 21,
        "FileHash-SHA1": 13,
        "FileHash-SHA256": 92,
        "URL": 63,
        "domain": 54,
        "hostname": 27,
        "email": 1,
        "CVE": 3
      },
      "indicator_count": 274,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "4 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69eea032c0007ec10cd71b6a",
      "name": "vxCube \u2014 Report",
      "description": "[Researchers have identified the first \"pulses\" to be created on a single domain, the GoDaddy.com, and the second to have been identified by its owner, a US company.] Date - 2024-12-10 11:15:23 UTC for [017076655d1d5d05656azcb!z] [exe parent of>] and [4ca5bc812211957dc963d03fc773d01d9b6643c4d99d31a9f9032fcbed39cf9c, 2025-06-02 05:00:56 UTC]",
      "modified": "2026-05-26T23:51:32.486000",
      "created": "2026-04-26T23:30:58.642000",
      "tags": [
        "passive dns",
        "status",
        "urls",
        "creation date",
        "date",
        "pulse pulses",
        "files",
        "domain",
        "files ip",
        "address",
        "expiry date",
        "name",
        "query time",
        "code signing",
        "zlatin stamatov",
        "issuer certum",
        "ca valid",
        "from",
        "valid",
        "valid usage",
        "algorithm",
        "serial number",
        "certum code",
        "signing",
        "ca status",
        "valid issuer",
        "certum trusted",
        "network ca",
        "valid from",
        "status valid",
        "trusted network",
        "all algorithm",
        "client auth",
        "e7 ff",
        "thumbprint md5",
        "fa cd",
        "tags size",
        "mb format",
        "exe sha1",
        "body length",
        "b body",
        "sha256",
        "pe32",
        "intel",
        "ms windows",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "os2 executable",
        "pe32 compiler",
        "exe32",
        "compiler"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 20,
        "FileHash-SHA1": 12,
        "FileHash-SHA256": 91,
        "URL": 58,
        "domain": 54,
        "hostname": 25,
        "email": 1,
        "CVE": 3
      },
      "indicator_count": 264,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "4 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69eea03311228a15d06a2b2a",
      "name": "vxCube \u2014 Report",
      "description": "[Researchers have identified the first \"pulses\" to be created on a single domain, the GoDaddy.com, and the second to have been identified by its owner, a US company.] Date - 2024-12-10 11:15:23 UTC for [017076655d1d5d05656azcb!z] [exe parent of>] and [4ca5bc812211957dc963d03fc773d01d9b6643c4d99d31a9f9032fcbed39cf9c, 2025-06-02 05:00:56 UTC]",
      "modified": "2026-05-26T23:51:32.486000",
      "created": "2026-04-26T23:30:59.313000",
      "tags": [
        "passive dns",
        "status",
        "urls",
        "creation date",
        "date",
        "pulse pulses",
        "files",
        "domain",
        "files ip",
        "address",
        "expiry date",
        "name",
        "query time",
        "code signing",
        "zlatin stamatov",
        "issuer certum",
        "ca valid",
        "from",
        "valid",
        "valid usage",
        "algorithm",
        "serial number",
        "certum code",
        "signing",
        "ca status",
        "valid issuer",
        "certum trusted",
        "network ca",
        "valid from",
        "status valid",
        "trusted network",
        "all algorithm",
        "client auth",
        "e7 ff",
        "thumbprint md5",
        "fa cd",
        "tags size",
        "mb format",
        "exe sha1",
        "body length",
        "b body",
        "sha256",
        "pe32",
        "intel",
        "ms windows",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "os2 executable",
        "pe32 compiler",
        "exe32",
        "compiler"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 20,
        "FileHash-SHA1": 12,
        "FileHash-SHA256": 91,
        "URL": 58,
        "domain": 54,
        "hostname": 25,
        "email": 1,
        "CVE": 3
      },
      "indicator_count": 264,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "4 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69eea0339cc87532959cb616",
      "name": "vxCube \u2014 Report",
      "description": "[Researchers have identified the first \"pulses\" to be created on a single domain, the GoDaddy.com, and the second to have been identified by its owner, a US company.] Date - 2024-12-10 11:15:23 UTC for [017076655d1d5d05656azcb!z] [exe parent of>] and [4ca5bc812211957dc963d03fc773d01d9b6643c4d99d31a9f9032fcbed39cf9c, 2025-06-02 05:00:56 UTC]",
      "modified": "2026-05-26T23:51:32.486000",
      "created": "2026-04-26T23:30:59.950000",
      "tags": [
        "passive dns",
        "status",
        "urls",
        "creation date",
        "date",
        "pulse pulses",
        "files",
        "domain",
        "files ip",
        "address",
        "expiry date",
        "name",
        "query time",
        "code signing",
        "zlatin stamatov",
        "issuer certum",
        "ca valid",
        "from",
        "valid",
        "valid usage",
        "algorithm",
        "serial number",
        "certum code",
        "signing",
        "ca status",
        "valid issuer",
        "certum trusted",
        "network ca",
        "valid from",
        "status valid",
        "trusted network",
        "all algorithm",
        "client auth",
        "e7 ff",
        "thumbprint md5",
        "fa cd",
        "tags size",
        "mb format",
        "exe sha1",
        "body length",
        "b body",
        "sha256",
        "pe32",
        "intel",
        "ms windows",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "os2 executable",
        "pe32 compiler",
        "exe32",
        "compiler"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 20,
        "FileHash-SHA1": 12,
        "FileHash-SHA256": 91,
        "URL": 58,
        "domain": 54,
        "hostname": 25,
        "email": 1,
        "CVE": 3
      },
      "indicator_count": 264,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "4 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://mon.systemautoupdater.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://mon.systemautoupdater.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780206490.0605574
}