{
  "type": "URL",
  "indicator": "https://pastebin.com/raw/7B75u64B",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://pastebin.com/raw/7B75u64B",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "akamai",
        "message": "Akamai rank: #7443",
        "name": "Akamai Popular Domain"
      },
      {
        "source": "whitelist",
        "message": "Whitelisted domain pastebin.com",
        "name": "Whitelisted domain"
      },
      {
        "source": "majestic",
        "message": "Whitelisted domain pastebin.com",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 4035919037,
      "indicator": "https://pastebin.com/raw/7B75u64B",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "6a11c64ca3bff8e89c178d30",
          "name": "00da7f1e650af65ee27f2c786561d83b",
          "description": "",
          "modified": "2026-05-23T15:22:52.733000",
          "created": "2026-05-23T15:22:52.733000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 157,
            "FileHash-SHA1": 158,
            "FileHash-SHA256": 644,
            "IPv4": 3,
            "URL": 125,
            "domain": 25,
            "hostname": 23
          },
          "indicator_count": 1135,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 183,
          "modified_text": "7 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69b63553f456643631f3e4a4",
          "name": "pastebin",
          "description": "",
          "modified": "2026-04-14T04:40:38.996000",
          "created": "2026-03-15T04:28:03.718000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 202,
            "FileHash-MD5": 55,
            "FileHash-SHA1": 52,
            "FileHash-SHA256": 414,
            "domain": 27,
            "hostname": 15
          },
          "indicator_count": 765,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 184,
          "modified_text": "47 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6972c77629c99c11b7cbb49e",
          "name": "Pastebin",
          "description": "",
          "modified": "2026-02-22T00:01:56.892000",
          "created": "2026-01-23T00:57:26.045000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 418,
            "FileHash-MD5": 25,
            "FileHash-SHA1": 25,
            "FileHash-SHA256": 286,
            "domain": 20,
            "hostname": 10
          },
          "indicator_count": 784,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 182,
          "modified_text": "98 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "696d68861e62aa8e88b1bf49",
          "name": "icanhazip",
          "description": "",
          "modified": "2026-02-17T23:01:58.369000",
          "created": "2026-01-18T23:11:02.230000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 123,
            "FileHash-MD5": 42,
            "FileHash-SHA1": 39,
            "FileHash-SHA256": 316,
            "domain": 4,
            "hostname": 6
          },
          "indicator_count": 530,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 182,
          "modified_text": "102 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "67558e68d83558d656a114df",
          "name": "svchost.exe story 2021-2024",
          "description": "This story has started earlier, but was saved in VT on 2021-02-27 \"Why not signed svchost.exe\" 643ec58e82e0272c97c2a59f6020970d881af19c0ad5029db9c958c13b6558c7\nI upload many \"bad\" svchost.exe's to VT. Finally, on a new device I found \nsvchost.exe 949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b (2022-05-07).\nI said to myself, finally this bad story is over. No, no, 24H2 Windows was introduced in early December 2024 and Dridex svchost.exe: 324451797ac909a4dd40c7a2f7347ef91f6b7c786941ad5035f609c0fc15edaa replaced the normal 2022 svchost.exe. A similar Dridex svchost.exe was downloaded to an older machine in June 2024: 6fc3bf1fdfd76860be782554f8d25bd32f108db934d70f4253f1e5f23522e503 via national CDN edge. I said, \"OK, no problem, we can use VPN to avoid manipulated Win files through manipulated edges. This is not true, as now confirmed, in December DRIDEX svchost.exe>> 135[.]236[.]137[.]174 >>  & 135[.]236[.]136[.]184 >> hpbackgroundtransfer utility.",
          "modified": "2025-12-11T13:05:38.197000",
          "created": "2024-12-08T12:17:44.243000",
          "tags": [
            "Cobalt Strike",
            "Dridex",
            "file is not signed",
            "reserved IPsss"
          ],
          "references": [
            "https://www.virustotal.com/gui/file/49fab89d62923d68d5f9627c68110ef522a668730598c3b09cd74fbe8f3f3e62/community",
            "https://www.virustotal.com/gui/file/643ec58e82e0272c97c2a59f6020970d881af19c0ad5029db9c958c13b6558c7",
            "https://www.virustotal.com/gui/file/f3feb95e7bcfb0766a694d93fca29eda7e2ca977c2395b4be75242814eb6d881",
            "https://www.filescan.io/reports/949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b/fc8005a6-a1a3-462e-a4b5-feaf1148ebd4/osint",
            "https://strontic.github.io/xcyclopedia/library/svchost.exe-F586835082F632DC8D9404D83BC16316.html",
            "https://www.virustotal.com/gui/file/324451797ac909a4dd40c7a2f7347ef91f6b7c786941ad5035f609c0fc15edaa/community",
            "https://www.virustotal.com/gui/file/136cebf9a07bd3481f15fbd2ad827ab7f5f8aadf6b4c907e12eabbe5a805b90a/relations",
            "https://www.virustotal.com/gui/file/6fc3bf1fdfd76860be782554f8d25bd32f108db934d70f4253f1e5f23522e503",
            "https://www.virustotal.com/gui/file/949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b/community",
            "https://www.netresec.com/?page=Blog&tag=a0e9f5d64349fb13191bc781f81f42e1",
            "https://otx.alienvault.com/pulse/6762d336994cd2c72202bca6",
            "https://www.virustotal.com/graph/embed/ga2c69d1c79e54bc088a5a4bac359c294ae5361c0254e41ac8999cdd4514b787a?theme=dark",
            "https://www.virustotal.com/gui/file/53a39b900e3bfbf384acd13f0fc2329fa8d42b61e993d8ed5adf3a1428005d26/community",
            "https://www.virustotal.com/graph/embed/g4c565503c94d4ec69ed2137f260b849ae903fba733854579b452f8da589e6683?theme=dark"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "PWS:MSIL/StormKitty",
              "display_name": "PWS:MSIL/StormKitty",
              "target": "/malware/PWS:MSIL/StormKitty"
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 10,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "userlolxxl",
            "id": "276085",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_276085/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 13,
            "FileHash-MD5": 6,
            "FileHash-SHA1": 6,
            "URL": 2
          },
          "indicator_count": 27,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 36,
          "modified_text": "171 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68f9498e1fe6bbb23b5fabf8",
          "name": "mylnikov",
          "description": "",
          "modified": "2025-11-21T21:00:52.756000",
          "created": "2025-10-22T21:15:58.319000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 39,
            "FileHash-SHA1": 40,
            "FileHash-SHA256": 433,
            "URL": 332,
            "domain": 1,
            "hostname": 7
          },
          "indicator_count": 852,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 182,
          "modified_text": "190 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "681c2c4e00e81af02679f188",
          "name": "Subawhipnator",
          "description": "",
          "modified": "2025-06-07T03:01:57.178000",
          "created": "2025-05-08T04:00:14.220000",
          "tags": [],
          "references": [
            "https://www.virustotal.com/graph/gbaa289fdf61c406992796875711de9e9a8cbd5ec729c4152928a590329fd12af"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 28,
            "URL": 178,
            "FileHash-MD5": 88,
            "FileHash-SHA1": 88,
            "FileHash-SHA256": 422,
            "hostname": 3
          },
          "indicator_count": 807,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 182,
          "modified_text": "358 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.virustotal.com/graph/gbaa289fdf61c406992796875711de9e9a8cbd5ec729c4152928a590329fd12af",
        "https://www.virustotal.com/gui/file/f3feb95e7bcfb0766a694d93fca29eda7e2ca977c2395b4be75242814eb6d881",
        "https://www.virustotal.com/gui/file/643ec58e82e0272c97c2a59f6020970d881af19c0ad5029db9c958c13b6558c7",
        "https://www.virustotal.com/graph/embed/g4c565503c94d4ec69ed2137f260b849ae903fba733854579b452f8da589e6683?theme=dark",
        "https://www.virustotal.com/gui/file/324451797ac909a4dd40c7a2f7347ef91f6b7c786941ad5035f609c0fc15edaa/community",
        "https://www.virustotal.com/graph/embed/ga2c69d1c79e54bc088a5a4bac359c294ae5361c0254e41ac8999cdd4514b787a?theme=dark",
        "https://www.filescan.io/reports/949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b/fc8005a6-a1a3-462e-a4b5-feaf1148ebd4/osint",
        "https://www.virustotal.com/gui/file/949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b/community",
        "https://www.netresec.com/?page=Blog&tag=a0e9f5d64349fb13191bc781f81f42e1",
        "https://www.virustotal.com/gui/file/49fab89d62923d68d5f9627c68110ef522a668730598c3b09cd74fbe8f3f3e62/community",
        "https://www.virustotal.com/gui/file/6fc3bf1fdfd76860be782554f8d25bd32f108db934d70f4253f1e5f23522e503",
        "https://otx.alienvault.com/pulse/6762d336994cd2c72202bca6",
        "https://strontic.github.io/xcyclopedia/library/svchost.exe-F586835082F632DC8D9404D83BC16316.html",
        "https://www.virustotal.com/gui/file/53a39b900e3bfbf384acd13f0fc2329fa8d42b61e993d8ed5adf3a1428005d26/community",
        "https://www.virustotal.com/gui/file/136cebf9a07bd3481f15fbd2ad827ab7f5f8aadf6b4c907e12eabbe5a805b90a/relations"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Pws:msil/stormkitty",
            "Lumma stealer"
          ],
          "industries": [],
          "unique_indicators": 4753
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/pastebin.com",
    "whois": "http://whois.domaintools.com/pastebin.com",
    "domain": "pastebin.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "6a11c64ca3bff8e89c178d30",
      "name": "00da7f1e650af65ee27f2c786561d83b",
      "description": "",
      "modified": "2026-05-23T15:22:52.733000",
      "created": "2026-05-23T15:22:52.733000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 157,
        "FileHash-SHA1": 158,
        "FileHash-SHA256": 644,
        "IPv4": 3,
        "URL": 125,
        "domain": 25,
        "hostname": 23
      },
      "indicator_count": 1135,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 183,
      "modified_text": "7 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69b63553f456643631f3e4a4",
      "name": "pastebin",
      "description": "",
      "modified": "2026-04-14T04:40:38.996000",
      "created": "2026-03-15T04:28:03.718000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 202,
        "FileHash-MD5": 55,
        "FileHash-SHA1": 52,
        "FileHash-SHA256": 414,
        "domain": 27,
        "hostname": 15
      },
      "indicator_count": 765,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 184,
      "modified_text": "47 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6972c77629c99c11b7cbb49e",
      "name": "Pastebin",
      "description": "",
      "modified": "2026-02-22T00:01:56.892000",
      "created": "2026-01-23T00:57:26.045000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 418,
        "FileHash-MD5": 25,
        "FileHash-SHA1": 25,
        "FileHash-SHA256": 286,
        "domain": 20,
        "hostname": 10
      },
      "indicator_count": 784,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 182,
      "modified_text": "98 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "696d68861e62aa8e88b1bf49",
      "name": "icanhazip",
      "description": "",
      "modified": "2026-02-17T23:01:58.369000",
      "created": "2026-01-18T23:11:02.230000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 123,
        "FileHash-MD5": 42,
        "FileHash-SHA1": 39,
        "FileHash-SHA256": 316,
        "domain": 4,
        "hostname": 6
      },
      "indicator_count": 530,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 182,
      "modified_text": "102 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "67558e68d83558d656a114df",
      "name": "svchost.exe story 2021-2024",
      "description": "This story has started earlier, but was saved in VT on 2021-02-27 \"Why not signed svchost.exe\" 643ec58e82e0272c97c2a59f6020970d881af19c0ad5029db9c958c13b6558c7\nI upload many \"bad\" svchost.exe's to VT. Finally, on a new device I found \nsvchost.exe 949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b (2022-05-07).\nI said to myself, finally this bad story is over. No, no, 24H2 Windows was introduced in early December 2024 and Dridex svchost.exe: 324451797ac909a4dd40c7a2f7347ef91f6b7c786941ad5035f609c0fc15edaa replaced the normal 2022 svchost.exe. A similar Dridex svchost.exe was downloaded to an older machine in June 2024: 6fc3bf1fdfd76860be782554f8d25bd32f108db934d70f4253f1e5f23522e503 via national CDN edge. I said, \"OK, no problem, we can use VPN to avoid manipulated Win files through manipulated edges. This is not true, as now confirmed, in December DRIDEX svchost.exe>> 135[.]236[.]137[.]174 >>  & 135[.]236[.]136[.]184 >> hpbackgroundtransfer utility.",
      "modified": "2025-12-11T13:05:38.197000",
      "created": "2024-12-08T12:17:44.243000",
      "tags": [
        "Cobalt Strike",
        "Dridex",
        "file is not signed",
        "reserved IPsss"
      ],
      "references": [
        "https://www.virustotal.com/gui/file/49fab89d62923d68d5f9627c68110ef522a668730598c3b09cd74fbe8f3f3e62/community",
        "https://www.virustotal.com/gui/file/643ec58e82e0272c97c2a59f6020970d881af19c0ad5029db9c958c13b6558c7",
        "https://www.virustotal.com/gui/file/f3feb95e7bcfb0766a694d93fca29eda7e2ca977c2395b4be75242814eb6d881",
        "https://www.filescan.io/reports/949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b/fc8005a6-a1a3-462e-a4b5-feaf1148ebd4/osint",
        "https://strontic.github.io/xcyclopedia/library/svchost.exe-F586835082F632DC8D9404D83BC16316.html",
        "https://www.virustotal.com/gui/file/324451797ac909a4dd40c7a2f7347ef91f6b7c786941ad5035f609c0fc15edaa/community",
        "https://www.virustotal.com/gui/file/136cebf9a07bd3481f15fbd2ad827ab7f5f8aadf6b4c907e12eabbe5a805b90a/relations",
        "https://www.virustotal.com/gui/file/6fc3bf1fdfd76860be782554f8d25bd32f108db934d70f4253f1e5f23522e503",
        "https://www.virustotal.com/gui/file/949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b/community",
        "https://www.netresec.com/?page=Blog&tag=a0e9f5d64349fb13191bc781f81f42e1",
        "https://otx.alienvault.com/pulse/6762d336994cd2c72202bca6",
        "https://www.virustotal.com/graph/embed/ga2c69d1c79e54bc088a5a4bac359c294ae5361c0254e41ac8999cdd4514b787a?theme=dark",
        "https://www.virustotal.com/gui/file/53a39b900e3bfbf384acd13f0fc2329fa8d42b61e993d8ed5adf3a1428005d26/community",
        "https://www.virustotal.com/graph/embed/g4c565503c94d4ec69ed2137f260b849ae903fba733854579b452f8da589e6683?theme=dark"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "PWS:MSIL/StormKitty",
          "display_name": "PWS:MSIL/StormKitty",
          "target": "/malware/PWS:MSIL/StormKitty"
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 10,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "userlolxxl",
        "id": "276085",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_276085/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 13,
        "FileHash-MD5": 6,
        "FileHash-SHA1": 6,
        "URL": 2
      },
      "indicator_count": 27,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 36,
      "modified_text": "171 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68f9498e1fe6bbb23b5fabf8",
      "name": "mylnikov",
      "description": "",
      "modified": "2025-11-21T21:00:52.756000",
      "created": "2025-10-22T21:15:58.319000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 39,
        "FileHash-SHA1": 40,
        "FileHash-SHA256": 433,
        "URL": 332,
        "domain": 1,
        "hostname": 7
      },
      "indicator_count": 852,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 182,
      "modified_text": "190 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "681c2c4e00e81af02679f188",
      "name": "Subawhipnator",
      "description": "",
      "modified": "2025-06-07T03:01:57.178000",
      "created": "2025-05-08T04:00:14.220000",
      "tags": [],
      "references": [
        "https://www.virustotal.com/graph/gbaa289fdf61c406992796875711de9e9a8cbd5ec729c4152928a590329fd12af"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 28,
        "URL": 178,
        "FileHash-MD5": 88,
        "FileHash-SHA1": 88,
        "FileHash-SHA256": 422,
        "hostname": 3
      },
      "indicator_count": 807,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 182,
      "modified_text": "358 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://pastebin.com/raw/7B75u64B",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "error": "Expecting value: line 1 column 1 (char 0)",
    "indicator": "https://pastebin.com/raw/7B75u64B",
    "type": "URL"
  },
  "from_cache": true,
  "_cached_at": 1780234166.8094068
}