{
  "type": "URL",
  "indicator": "https://ns1.r4ns.net",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ns1.r4ns.net",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3658669493,
      "indicator": "https://ns1.r4ns.net",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "6893eee9bf1b30e08d1a6d8e",
          "name": "Ransom:Win32/CVE - Denver \u2022 Community Lifestyle Neighborhood",
          "description": "*Ransom:Win32/CVE - * Win.Dropper.Stone-9856966-0,\nDenver \u2022 Community Lifestyle Neighborhood. \nCorporate & Leasing Office corrupted with spyware. There is a single verified monitored target. All technology devices corrupted, at least 2 phones monitored, YouTube is courtesy of hackers. Several in person and phone investigations, staff change and they know nothing about leasing apartments, townhomes , etiquette, poor communication. Target also investigated. It appears to be harassment, intimidation and monitoring for unspecified reasons. The parking lot is stacked with obvious people sitting in their vehicles for hours. It\u2019s unclear if the staffing change is legitimate or part of an investigation.",
          "modified": "2025-09-05T23:02:52.811000",
          "created": "2025-08-07T00:10:17.696000",
          "tags": [
            "address google",
            "safe browsing",
            "united",
            "typeof",
            "passive dns",
            "body doctype",
            "nreum",
            "date",
            "gmt server",
            "apache x",
            "cnection",
            "content type",
            "span",
            "ok transfer",
            "encoding",
            "x powered",
            "unknown soa",
            "unknown ns",
            "showing",
            "entries",
            "next associated",
            "urls show",
            "body",
            "encrypt",
            "search",
            "ip address",
            "creation date",
            "record value",
            "present jul",
            "present may",
            "present apr",
            "certificate",
            "present aug",
            "present feb",
            "present dec",
            "present nov",
            "error",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "found",
            "development att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "mitre att",
            "show technique",
            "ck matrix",
            "pattern match",
            "ascii text",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "itre att",
            "accept",
            "sha256",
            "size",
            "type data",
            "utf8 text",
            "document file",
            "flag",
            "server",
            "european union",
            "name server",
            "tor analysis",
            "dns requests",
            "domain address",
            "ii llc",
            "windir",
            "openurl c",
            "prefetch2",
            "show process",
            "ogoogle trust",
            "network traffic",
            "organization",
            "elton avundano",
            "object",
            "title object",
            "header http2",
            "returnurl",
            "texas",
            "rsa ov",
            "ssl ca",
            "status",
            "australia",
            "netherlands",
            "urls",
            "gmt path",
            "hostname add",
            "pulse submit",
            "present oct",
            "e safe",
            "results jul",
            "response ip",
            "present jan",
            "name servers",
            "verdict",
            "domain",
            "files ip",
            "address domain",
            "xhr start",
            "xhr load",
            "aaaa",
            "read c",
            "show",
            "port",
            "destination",
            "high",
            "delete",
            "outbound m3",
            "copy",
            "write",
            "persistence",
            "execution",
            "malware",
            "generic",
            "unknown",
            "present mar",
            "dynamicloader",
            "wine emulator",
            "dynamic",
            "medium",
            "read",
            "associated urls",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "dnssec",
            "domain name",
            "solutions",
            "llc status",
            "next passive",
            "dns status",
            "hostname query",
            "files show",
            "date hash",
            "avast avg",
            "overview ip",
            "address",
            "related nids",
            "files location",
            "flag united",
            "hostname",
            "files domain",
            "win32",
            "mtb feb",
            "trojan",
            "susp",
            "trojandropper",
            "msr feb",
            "trojanspy",
            "virtool",
            "win64",
            "defense evasion",
            "t1480 execution",
            "file defense",
            "null",
            "refresh",
            "tools",
            "look",
            "verify",
            "restart",
            "file discovery",
            "utf8",
            "crlf line",
            "a domains",
            "script urls",
            "link",
            "unknown aaaa",
            "meta",
            "atom",
            "results jan",
            "present",
            "present sep",
            "akamai",
            "asn as16625",
            "less whois",
            "registrar",
            "http",
            "france flag",
            "france hostname",
            "files related",
            "url analysis",
            "files",
            "location france",
            "detailed error",
            "sec ch",
            "ch ua",
            "ua full",
            "ua platform",
            "moved",
            "name",
            "perfect privacy",
            "error jul",
            "next related",
            "domains show",
            "domain related",
            "url add",
            "pulse pulses",
            "hosting",
            "reverse dns",
            "france asn",
            "as16276",
            "dns resolutions",
            "datacenter",
            "regopenkeyexa",
            "regsetvalueexa",
            "windows nt",
            "regdword",
            "hostile",
            "service",
            "delphi",
            "next",
            "pulses none",
            "related tags",
            "ua bitness",
            "ua arch",
            "version sec",
            "mobile sec",
            "model sec",
            "review",
            "data upload",
            "extraction",
            "khtml",
            "gecko",
            "olet",
            "cnlet",
            "tlsv1",
            "hacktool",
            "push",
            "ms windows",
            "intel",
            "pe32",
            "users",
            "precreate read",
            "ransom",
            "code",
            "installer",
            "june",
            "media",
            "autorun",
            "next yara",
            "detections name",
            "aspackv2xxx",
            "eu alexey",
            "alerts",
            "pe file",
            "filehash",
            "sha256 add",
            "av detections",
            "ids detections",
            "yara detections",
            "analysis date",
            "april",
            "packing t1045",
            "t1045",
            "t1060",
            "registry run",
            "keys",
            "user execution",
            "icmp traffic"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1091",
              "name": "Replication Through Removable Media",
              "display_name": "T1091 - Replication Through Removable Media"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1132,
            "URL": 6245,
            "hostname": 2264,
            "FileHash-SHA256": 1857,
            "FileHash-SHA1": 491,
            "email": 9,
            "FileHash-MD5": 573,
            "SSLCertFingerprint": 16
          },
          "indicator_count": 12587,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 146,
          "modified_text": "270 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "642eac06b2963a871b0fdd45",
          "name": "just a bunch of tv's - Oh maybe these tv channels are all neural \ud83e\udd37\u200d\u2640\ufe0f world tv stream infection",
          "description": "The Falcon Sandbox malware analysis service is available to download, download and use any of the Falcon MalQuery tools or information you may have seen on the website. \u00c2\u00a31.5m",
          "modified": "2023-05-06T10:00:48.707000",
          "created": "2023-04-06T11:24:54.313000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "ansi",
            "dropped file",
            "runtime data",
            "chromeua",
            "span",
            "optout",
            "pcap processing",
            "pattern match",
            "script",
            "click",
            "date",
            "middle",
            "null",
            "april",
            "twitter",
            "body",
            "error",
            "jackson",
            "desktop",
            "service",
            "bill",
            "heat",
            "webview",
            "cruise",
            "blank",
            "meta",
            "night",
            "false",
            "contact",
            "suspicious",
            "facebook",
            "close",
            "cannon",
            "mayberry",
            "santana",
            "comment",
            "flex",
            "karma",
            "nightmare",
            "find",
            "spacer",
            "kitty",
            "mike",
            "local",
            "already",
            "soldier",
            "wallpaper",
            "story",
            "generic",
            "tiny",
            "trident",
            "android",
            "hybrid",
            "general",
            "hosts",
            "favorite",
            "homepage",
            "music",
            "code",
            "push",
            "strings",
            "malicious",
            "qakbot",
            "25px",
            "60px",
            "24px",
            "100px",
            "1439px",
            "segoe ui",
            "roboto",
            "path",
            "chat",
            "form",
            "embed",
            "unknown",
            "live",
            "network",
            "unicode",
            "feed",
            "5000",
            "next",
            "fullscreen",
            "iframe",
            "latv",
            "latino voices",
            "localappdata",
            "latino",
            "noscript",
            "pragma",
            "this",
            "hybrid analysis",
            "programfiles",
            "input",
            "wilstaging02",
            "potential ip"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb",
            "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd",
            "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36",
            "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9",
            "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1291,
            "email": 13,
            "domain": 591,
            "URL": 3931,
            "FileHash-SHA256": 431,
            "FileHash-MD5": 92,
            "FileHash-SHA1": 89
          },
          "indicator_count": 6438,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 93,
          "modified_text": "1123 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "64405bb59eb4323cde717b83",
          "name": "ttps://accounts.flybe.com/o3r-app-server/flybe/login - from wallet.bundle.js that i see has not published \ud83d\ude21",
          "description": "",
          "modified": "2023-04-19T21:23:01.734000",
          "created": "2023-04-19T21:23:01.734000",
          "tags": [
            "url https",
            "chromeua",
            "runtime data",
            "optout",
            "ansi",
            "unicode",
            "temp",
            "dropped file",
            "localappdata",
            "drmedgeua",
            "optin",
            "hosts",
            "qakbot"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/62c8b9e6618f124d6103d9cc8bf0b29309e32e250b15f2cf5bdbab7c718c1970/643fc8790148eb4a120d88de"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1087",
              "name": "Account Discovery",
              "display_name": "T1087 - Account Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 150,
            "URL": 1741,
            "hostname": 519,
            "FileHash-SHA256": 73,
            "FileHash-MD5": 69,
            "FileHash-SHA1": 69,
            "IPv4": 2,
            "email": 4
          },
          "indicator_count": 2627,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 90,
          "modified_text": "1140 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "64405bb46b8e08b76da24b14",
          "name": "ttps://accounts.flybe.com/o3r-app-server/flybe/login - from wallet.bundle.js that i see has not published \ud83d\ude21",
          "description": "",
          "modified": "2023-04-19T21:23:00.215000",
          "created": "2023-04-19T21:23:00.215000",
          "tags": [
            "url https",
            "chromeua",
            "runtime data",
            "optout",
            "ansi",
            "unicode",
            "temp",
            "dropped file",
            "localappdata",
            "drmedgeua",
            "optin",
            "hosts",
            "qakbot"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/62c8b9e6618f124d6103d9cc8bf0b29309e32e250b15f2cf5bdbab7c718c1970/643fc8790148eb4a120d88de"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1087",
              "name": "Account Discovery",
              "display_name": "T1087 - Account Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 150,
            "URL": 1741,
            "hostname": 519,
            "FileHash-SHA256": 73,
            "FileHash-MD5": 69,
            "FileHash-SHA1": 69,
            "IPv4": 2,
            "email": 4
          },
          "indicator_count": 2627,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 90,
          "modified_text": "1140 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb",
        "https://hybrid-analysis.com/sample/62c8b9e6618f124d6103d9cc8bf0b29309e32e250b15f2cf5bdbab7c718c1970/643fc8790148eb4a120d88de",
        "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36",
        "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd",
        "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0",
        "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 20039
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/r4ns.net",
    "whois": "http://whois.domaintools.com/r4ns.net",
    "domain": "r4ns.net",
    "hostname": "ns1.r4ns.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "6893eee9bf1b30e08d1a6d8e",
      "name": "Ransom:Win32/CVE - Denver \u2022 Community Lifestyle Neighborhood",
      "description": "*Ransom:Win32/CVE - * Win.Dropper.Stone-9856966-0,\nDenver \u2022 Community Lifestyle Neighborhood. \nCorporate & Leasing Office corrupted with spyware. There is a single verified monitored target. All technology devices corrupted, at least 2 phones monitored, YouTube is courtesy of hackers. Several in person and phone investigations, staff change and they know nothing about leasing apartments, townhomes , etiquette, poor communication. Target also investigated. It appears to be harassment, intimidation and monitoring for unspecified reasons. The parking lot is stacked with obvious people sitting in their vehicles for hours. It\u2019s unclear if the staffing change is legitimate or part of an investigation.",
      "modified": "2025-09-05T23:02:52.811000",
      "created": "2025-08-07T00:10:17.696000",
      "tags": [
        "address google",
        "safe browsing",
        "united",
        "typeof",
        "passive dns",
        "body doctype",
        "nreum",
        "date",
        "gmt server",
        "apache x",
        "cnection",
        "content type",
        "span",
        "ok transfer",
        "encoding",
        "x powered",
        "unknown soa",
        "unknown ns",
        "showing",
        "entries",
        "next associated",
        "urls show",
        "body",
        "encrypt",
        "search",
        "ip address",
        "creation date",
        "record value",
        "present jul",
        "present may",
        "present apr",
        "certificate",
        "present aug",
        "present feb",
        "present dec",
        "present nov",
        "error",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "found",
        "development att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "mitre att",
        "show technique",
        "ck matrix",
        "pattern match",
        "ascii text",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "itre att",
        "accept",
        "sha256",
        "size",
        "type data",
        "utf8 text",
        "document file",
        "flag",
        "server",
        "european union",
        "name server",
        "tor analysis",
        "dns requests",
        "domain address",
        "ii llc",
        "windir",
        "openurl c",
        "prefetch2",
        "show process",
        "ogoogle trust",
        "network traffic",
        "organization",
        "elton avundano",
        "object",
        "title object",
        "header http2",
        "returnurl",
        "texas",
        "rsa ov",
        "ssl ca",
        "status",
        "australia",
        "netherlands",
        "urls",
        "gmt path",
        "hostname add",
        "pulse submit",
        "present oct",
        "e safe",
        "results jul",
        "response ip",
        "present jan",
        "name servers",
        "verdict",
        "domain",
        "files ip",
        "address domain",
        "xhr start",
        "xhr load",
        "aaaa",
        "read c",
        "show",
        "port",
        "destination",
        "high",
        "delete",
        "outbound m3",
        "copy",
        "write",
        "persistence",
        "execution",
        "malware",
        "generic",
        "unknown",
        "present mar",
        "dynamicloader",
        "wine emulator",
        "dynamic",
        "medium",
        "read",
        "associated urls",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "dnssec",
        "domain name",
        "solutions",
        "llc status",
        "next passive",
        "dns status",
        "hostname query",
        "files show",
        "date hash",
        "avast avg",
        "overview ip",
        "address",
        "related nids",
        "files location",
        "flag united",
        "hostname",
        "files domain",
        "win32",
        "mtb feb",
        "trojan",
        "susp",
        "trojandropper",
        "msr feb",
        "trojanspy",
        "virtool",
        "win64",
        "defense evasion",
        "t1480 execution",
        "file defense",
        "null",
        "refresh",
        "tools",
        "look",
        "verify",
        "restart",
        "file discovery",
        "utf8",
        "crlf line",
        "a domains",
        "script urls",
        "link",
        "unknown aaaa",
        "meta",
        "atom",
        "results jan",
        "present",
        "present sep",
        "akamai",
        "asn as16625",
        "less whois",
        "registrar",
        "http",
        "france flag",
        "france hostname",
        "files related",
        "url analysis",
        "files",
        "location france",
        "detailed error",
        "sec ch",
        "ch ua",
        "ua full",
        "ua platform",
        "moved",
        "name",
        "perfect privacy",
        "error jul",
        "next related",
        "domains show",
        "domain related",
        "url add",
        "pulse pulses",
        "hosting",
        "reverse dns",
        "france asn",
        "as16276",
        "dns resolutions",
        "datacenter",
        "regopenkeyexa",
        "regsetvalueexa",
        "windows nt",
        "regdword",
        "hostile",
        "service",
        "delphi",
        "next",
        "pulses none",
        "related tags",
        "ua bitness",
        "ua arch",
        "version sec",
        "mobile sec",
        "model sec",
        "review",
        "data upload",
        "extraction",
        "khtml",
        "gecko",
        "olet",
        "cnlet",
        "tlsv1",
        "hacktool",
        "push",
        "ms windows",
        "intel",
        "pe32",
        "users",
        "precreate read",
        "ransom",
        "code",
        "installer",
        "june",
        "media",
        "autorun",
        "next yara",
        "detections name",
        "aspackv2xxx",
        "eu alexey",
        "alerts",
        "pe file",
        "filehash",
        "sha256 add",
        "av detections",
        "ids detections",
        "yara detections",
        "analysis date",
        "april",
        "packing t1045",
        "t1045",
        "t1060",
        "registry run",
        "keys",
        "user execution",
        "icmp traffic"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1091",
          "name": "Replication Through Removable Media",
          "display_name": "T1091 - Replication Through Removable Media"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1132,
        "URL": 6245,
        "hostname": 2264,
        "FileHash-SHA256": 1857,
        "FileHash-SHA1": 491,
        "email": 9,
        "FileHash-MD5": 573,
        "SSLCertFingerprint": 16
      },
      "indicator_count": 12587,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 146,
      "modified_text": "270 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "642eac06b2963a871b0fdd45",
      "name": "just a bunch of tv's - Oh maybe these tv channels are all neural \ud83e\udd37\u200d\u2640\ufe0f world tv stream infection",
      "description": "The Falcon Sandbox malware analysis service is available to download, download and use any of the Falcon MalQuery tools or information you may have seen on the website. \u00c2\u00a31.5m",
      "modified": "2023-05-06T10:00:48.707000",
      "created": "2023-04-06T11:24:54.313000",
      "tags": [
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "ansi",
        "dropped file",
        "runtime data",
        "chromeua",
        "span",
        "optout",
        "pcap processing",
        "pattern match",
        "script",
        "click",
        "date",
        "middle",
        "null",
        "april",
        "twitter",
        "body",
        "error",
        "jackson",
        "desktop",
        "service",
        "bill",
        "heat",
        "webview",
        "cruise",
        "blank",
        "meta",
        "night",
        "false",
        "contact",
        "suspicious",
        "facebook",
        "close",
        "cannon",
        "mayberry",
        "santana",
        "comment",
        "flex",
        "karma",
        "nightmare",
        "find",
        "spacer",
        "kitty",
        "mike",
        "local",
        "already",
        "soldier",
        "wallpaper",
        "story",
        "generic",
        "tiny",
        "trident",
        "android",
        "hybrid",
        "general",
        "hosts",
        "favorite",
        "homepage",
        "music",
        "code",
        "push",
        "strings",
        "malicious",
        "qakbot",
        "25px",
        "60px",
        "24px",
        "100px",
        "1439px",
        "segoe ui",
        "roboto",
        "path",
        "chat",
        "form",
        "embed",
        "unknown",
        "live",
        "network",
        "unicode",
        "feed",
        "5000",
        "next",
        "fullscreen",
        "iframe",
        "latv",
        "latino voices",
        "localappdata",
        "latino",
        "noscript",
        "pragma",
        "this",
        "hybrid analysis",
        "programfiles",
        "input",
        "wilstaging02",
        "potential ip"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb",
        "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd",
        "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36",
        "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9",
        "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1291,
        "email": 13,
        "domain": 591,
        "URL": 3931,
        "FileHash-SHA256": 431,
        "FileHash-MD5": 92,
        "FileHash-SHA1": 89
      },
      "indicator_count": 6438,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 93,
      "modified_text": "1123 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "64405bb59eb4323cde717b83",
      "name": "ttps://accounts.flybe.com/o3r-app-server/flybe/login - from wallet.bundle.js that i see has not published \ud83d\ude21",
      "description": "",
      "modified": "2023-04-19T21:23:01.734000",
      "created": "2023-04-19T21:23:01.734000",
      "tags": [
        "url https",
        "chromeua",
        "runtime data",
        "optout",
        "ansi",
        "unicode",
        "temp",
        "dropped file",
        "localappdata",
        "drmedgeua",
        "optin",
        "hosts",
        "qakbot"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/62c8b9e6618f124d6103d9cc8bf0b29309e32e250b15f2cf5bdbab7c718c1970/643fc8790148eb4a120d88de"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1087",
          "name": "Account Discovery",
          "display_name": "T1087 - Account Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 150,
        "URL": 1741,
        "hostname": 519,
        "FileHash-SHA256": 73,
        "FileHash-MD5": 69,
        "FileHash-SHA1": 69,
        "IPv4": 2,
        "email": 4
      },
      "indicator_count": 2627,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 90,
      "modified_text": "1140 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "64405bb46b8e08b76da24b14",
      "name": "ttps://accounts.flybe.com/o3r-app-server/flybe/login - from wallet.bundle.js that i see has not published \ud83d\ude21",
      "description": "",
      "modified": "2023-04-19T21:23:00.215000",
      "created": "2023-04-19T21:23:00.215000",
      "tags": [
        "url https",
        "chromeua",
        "runtime data",
        "optout",
        "ansi",
        "unicode",
        "temp",
        "dropped file",
        "localappdata",
        "drmedgeua",
        "optin",
        "hosts",
        "qakbot"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/62c8b9e6618f124d6103d9cc8bf0b29309e32e250b15f2cf5bdbab7c718c1970/643fc8790148eb4a120d88de"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1087",
          "name": "Account Discovery",
          "display_name": "T1087 - Account Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 150,
        "URL": 1741,
        "hostname": 519,
        "FileHash-SHA256": 73,
        "FileHash-MD5": 69,
        "FileHash-SHA1": 69,
        "IPv4": 2,
        "email": 4
      },
      "indicator_count": 2627,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 90,
      "modified_text": "1140 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ns1.r4ns.net",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ns1.r4ns.net",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780452771.9609
}