{
  "type": "URL",
  "indicator": "https://soultech.sa/en/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://soultech.sa/en/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4069567044,
      "indicator": "https://soultech.sa/en/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 20,
      "pulses": [
        {
          "id": "69b49ad5dd40a24d83cd6a72",
          "name": "Chris P. Ahmann \u2022 PRIVATE PROPERTY Colorado State Fixer!",
          "description": "",
          "modified": "2026-03-13T23:16:37.716000",
          "created": "2026-03-13T23:16:37.716000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "69631fbd16e306ee2b76c4da",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "32 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69b496396ca4987e95ad37d1",
          "name": "Chris Buzz by QVashni (wow)",
          "description": "",
          "modified": "2026-03-13T22:56:57.314000",
          "created": "2026-03-13T22:56:57.314000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "69482caa00d327da8f0a87bc",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 46,
          "modified_text": "32 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69b49587dd104e342dda1628",
          "name": "C Ahman Attorney Clone by Top Tier, Q.Vashti",
          "description": "",
          "modified": "2026-03-13T22:53:59.112000",
          "created": "2026-03-13T22:53:59.112000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "691f4d4ef0a2a570b8b21cd2",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 46,
          "modified_text": "32 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69631fbd16e306ee2b76c4da",
          "name": "Chris P. Ahmann \u2022 STAY Away!f PRIVATE PROPERTY Colorado State Fixer!",
          "description": "",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2026-01-11T03:57:49.242000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "695557ee134b978b00883c29",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "84 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "695557ee134b978b00883c29",
          "name": "Chris P. Ahmann \u2022 Stay out of PRIVATE PROPERTY HITMAN!  Colorado State",
          "description": "",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2025-12-31T17:05:50.134000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "691f4d4ef0a2a570b8b21cd2",
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "84 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69482caa00d327da8f0a87bc",
          "name": "Chris P.\u2019 Buzz\u2019 Ahmann Colorado State Criminal Defense Attorney (22.20.2025)",
          "description": "",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2025-12-21T17:21:46.434000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "691f4d4ef0a2a570b8b21cd2",
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "84 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "691f4d4ef0a2a570b8b21cd2",
          "name": "Chris P. Ahmann Colorado State Criminal Defense Attorney",
          "description": "Chris P. Ahmann Colorado State Criminal Defense attorney hired by quasi government Workers Compensation to completely destroy Tsara Brashears literally to death. None of her spinal cord injuries , and other assault injuries discussed or compensated for in rushed settlement case. Her awful racist attorney refused to represent plaintiffs in hearing. Never met with in person  for no good reason. Tsara represented herself.  Less that 24 hour notice. No briefings, no awareness or mention that Ahmann was representing Jeffrey Scott Reimer for assault\n case. Brashears required 24 hour care by end of life. Received 0 workers compsarion payments. But if this doesn\u2019t prove Reimer\u2019s guilt what does? Continued harassment of associated. \n\nNotice the outages? You\u2019ve cost BILLIONS? Stop threatening everyone.",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2025-11-20T17:18:06.929000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "84 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6928f8d9e4222a6a219d785e",
          "name": "ClipBanker Spy & Information stealer | Crazy Frost | MaaS | Chrome & Cloudflare attacks",
          "description": "It appears that entity CrazyFrost provides MasS among other things that include major smear campaigns.| Likely quasi government , and Law Firm contractors.. Domestic terrorizing isn\u2019t a stretch.\nClipBanker: A form of banking trojan information stealer and spy that specifically monitors and steals information, likely by modifying the clipboard contents to redirect financial transactions (e.g., changing a copied bank account number to the attacker's).\n\n[OTX populated - HOSTNAME: CloudFlare.com.., a company owned by the US government, has been added to Pulse, an anti-virus database. (Pulses) created by users.]",
          "modified": "2025-12-28T00:04:06.179000",
          "created": "2025-11-28T01:20:25.401000",
          "tags": [
            "dynamicloader",
            "json",
            "ascii text",
            "high",
            "data",
            "x90uxa4xf8",
            "cape",
            "stream",
            "guard",
            "write",
            "trojan",
            "redline",
            "malware",
            "push",
            "local",
            "injection_inter_process",
            "recon_fingerprint",
            "persistence_ads",
            "process_creation_suspicious_location",
            "infostealer_browser",
            "infostealer_cookies",
            "stealth_file",
            "cape_detected_threat",
            "antivm_generic_bios",
            "cape_extracted_content",
            "united",
            "mtb jul",
            "a domains",
            "aaaa",
            "443 ma86400",
            "servers",
            "win32upatre jul",
            "virtool",
            "b778b1",
            "div div",
            "d9e4f4",
            "edf2f8",
            "present mar",
            "fastest privacy",
            "first dns",
            "win32",
            "trojandropper",
            "passive dns",
            "mtb nov",
            "ipv4 add",
            "asn as13335",
            "dns resolutions",
            "domain",
            "data upload",
            "extraction",
            "yara",
            "troja yara",
            "trojar data",
            "virto",
            "worn data",
            "included iocs",
            "manually add",
            "resolved ips",
            "ta0002",
            "evasion ta0005",
            "tr shared",
            "modules",
            "files",
            "infor",
            "t1027",
            "process t1057",
            "community score",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "defense evasion",
            "spawns",
            "flag",
            "name server",
            "date",
            "cloudflare",
            "data protected",
            "misc activity",
            "et info",
            "dns requests",
            "domain address",
            "gmt flag",
            "techtarget",
            "server",
            "et policy",
            "prefetch2",
            "t1179 hooking",
            "access windows",
            "installs",
            "mitre att",
            "ck techniques",
            "click",
            "windir",
            "country",
            "contacted hosts",
            "ip address",
            "process details",
            "contacted",
            "http traffic",
            "suricata alerts",
            "event category",
            "found"
          ],
          "references": [
            "Malware : ClipBanker Entity: Crazy Frost",
            "www.crazyfrost.com FileDescription :JF_CF_MiniZM FileVersion: 1.1.0.0 InternalName: jf_cf_frostovip.exe LegalCopyright Copyright \u00a9 CrazyFrost",
            "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
            "Services : GoogleChromeElevationService = Delete",
            "Yara: RansomWin32SintaCry CodeOverlap TrojanClickerWin32Zeriest CodeOverlap",
            "Yara: TrojanDownloaderMSILBalamid CodeOverlap TrojanDropperWin32Popsenong CodeOverlap",
            "Yara: TrojanPythonKaazar CodeOverlap TrojanSpyWin32Chekafev CodeOverlap",
            "Yara: TrojanWin32Kredbegg  CodeOverlap TrojanWin32Motve CodeOverlap TrojanWin32Pitroj",
            "Yara : VirToolMSILLuxod CodeOverlap WormMSILVonriamt CodeOverlap TrojanWin32Depriz CodeOverlap",
            "Yara: WormWin32Rombrast CodeOverlap Jorgen,Ibsen PECompact_2xx VZX Jeremy,Collake",
            "Sigma: Matches rule Suspicious desktop.ini Action by Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)",
            "CS IDS: Matches rule (http_inspect) invalid status line",
            "CS IDS: Matches rule INDICATOR-COMPROMISE png file attachment without matching file magic Unique rule identifier: This rule belongs to a private collection.",
            "jf_cf_frostovip.exe FILEHASH SHA256 4b9d6c5de40bfc4da8cb8b3ab9408dc574346b97268983f10bef8810e3f6bed8",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian\t URL\thttp://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t\u2022 http://www.anyxxxtube",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
            "http://www.anyxxxtube/"
          ],
          "public": 1,
          "adversary": "Crazy Frost",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Trojan.Disfa/downloader10",
              "display_name": "Trojan.Disfa/downloader10",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zusy",
              "display_name": "Trojan:Win32/Zusy",
              "target": "/malware/Trojan:Win32/Zusy"
            },
            {
              "id": "Rozena",
              "display_name": "Rozena",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            },
            {
              "id": "T1464",
              "name": "Jamming or Denial of Service",
              "display_name": "T1464 - Jamming or Denial of Service"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 295,
            "FileHash-SHA1": 217,
            "FileHash-SHA256": 1887,
            "URL": 3263,
            "domain": 597,
            "hostname": 1085,
            "email": 2,
            "CVE": 1
          },
          "indicator_count": 7347,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "108 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6920c43c3772bb24f26f70cc",
          "name": "Xred_Malware \u2022 Dark Comet \u2022 Darkgate \u2022 Elex \u2022 Glassworm | AutoRun",
          "description": "Attack originates from government contractors/ quasi governmental entities. Criminal Defense and Government contracted Law firms commonly abuse these tactics. Targeting. Found in data of a target. Focused on (1) FILE HASH and (1)  IP address .[referenced] *XRed _Mal\n* EXE Infection | OTX  auto populated - Adversaries may be able to gain access to victim systems using a variety of techniques to evade detection and conceal their actions. and their intentions, as well as using other techniques, to avoid detection.",
          "modified": "2025-12-21T18:01:07.268000",
          "created": "2025-11-21T19:57:48.145000",
          "tags": [
            "dynamicloader",
            "write c",
            "write",
            "high",
            "yara rule",
            "myapp",
            "delphi",
            "worm",
            "win32",
            "error",
            "code",
            "malware",
            "defender",
            "medium",
            "binary file",
            "heavensgate",
            "bochs",
            "dynamic",
            "td td",
            "td tr",
            "united",
            "a td",
            "a domains",
            "dynamic dns",
            "static dns",
            "dd wrt",
            "twitter",
            "trojan",
            "trojandropper",
            "null",
            "enough",
            "simple",
            "click",
            "easy",
            "premium",
            "associated urls",
            "server response",
            "google safe",
            "results nov",
            "avast avg",
            "11.21.2025",
            "11.20.2025",
            "borland delphi",
            "pe32",
            "intel",
            "ms windows",
            "inno setup",
            "win32 exe",
            "pecompact",
            "delphi generic",
            "pe32 compiler",
            "dark comet",
            "dark gate",
            "glassworm",
            "md5 code",
            "data",
            "porkbun llc",
            "windows match",
            "getprocaddress",
            "peb idrdata",
            "match peb",
            "t1547",
            "t1059 t1112",
            "shared modules",
            "t1129",
            "boot",
            "logon autostart",
            "execu",
            "t1134 boot",
            "encoding",
            "capture e1113",
            "file attributes",
            "analysis ob0001",
            "b0001 software",
            "virtual machine",
            "detection b0009",
            "analysis ob0002",
            "ob0003 screen",
            "windows get",
            "check",
            "encode",
            "check internet",
            "wininet set",
            "clear file",
            "enumerate gui",
            "get hostname",
            "get keyboard",
            "set registry",
            "find",
            "capture",
            "url http",
            "consolefoundry",
            "console foundry",
            "foundry",
            "malware catalog tree",
            "autorun keys",
            "modification",
            "alexander karp",
            "peter theil",
            "christoper ahmann",
            "christopher pool",
            "mercedes",
            "apple",
            "palantir",
            "adversarial",
            "adversaries",
            "hostile",
            "quasi",
            "empty hash",
            "denver",
            "mal_xred_backdoor",
            "backdoor",
            "xred",
            "brian sabey",
            "first-send-petikvx",
            "stop",
            "glassworm",
            "elex",
            "darkgate",
            "dark-comet",
            "search",
            "entries",
            "show",
            "yara detections",
            "icmp traffic",
            "rtf file",
            "top source",
            "top destination",
            "format",
            "host",
            "copy",
            "next",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "found",
            "access att",
            "font",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "ascii text",
            "pattern match",
            "sha256",
            "mitre att",
            "title",
            "meta",
            "hybrid",
            "local",
            "path",
            "strings",
            "body",
            "contact",
            "trace",
            "form",
            "bitcoin",
            "core",
            "jeffrey reimer",
            "exe infection",
            "cve",
            "porn"
          ],
          "references": [
            "FILEHASH-SHA256 d0ce79b3e0f4798423871dd66c14172b1a0eac34131c1b92d210a7b5c31a8aa0",
            "Name 2025-11-19_b627882129bf281be5a3df318fff678b_dark-comet_darkgate_elex_glassworm_stop",
            "Antivirus Detection: Worm:Win32/AutoRun!atmn [Win.Trojan.Emotet relationship]",
            "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com",
            "IDS Detections: Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
            "Yara : Zeppelin_30 ,  compromised_site_redirector_fromcharcode ,",
            "Yara : BobSoft Mini Delphi -> BoB / BobSoft , Delphi",
            "Alerts : suspicious_iocontrol_codes process_creation_suspicious_location network_dyndns",
            "Alerts: multiple_useragents persistence_autorun binary_yara procmem_yara suricata_alert",
            "Alerts: antivm_bochs_keys antivm_generic_disk enumerates_physical_drives  antisandbox_sleep",
            "Alerts: physical_drive_access mouse_movement_detect dynamic_function_loading",
            "Alerts: http_request resumethread_remote_process antianalysis_tls_section network_httpn",
            "Alerts: packer_unknown",
            "Malicious IP Contacted: 69.42.215.252",
            "Abused Domains Contacted: xred.mooo.com freedns.afraid.org",
            "IP 69.42.215.252: http://nginx.com/ \u2022nginx.com\t\u2022 http://nginx.org/ \u2022 nginx.org \u2022 afraid.org \u2022 afraid.org",
            "IP 69.42.215.252: nginx.com\u2022 vb.cu \u2022 vb.il \u2022 yourdomain.com \u2022 yourdomain.com",
            "IP 69.42.215.252: theirname.yourdomain.com \u2022 www.freebsd.org freebsd.org \u2022 your.domain.com",
            "Windows Match api: GetProcAddress fs access  *access PEB Idr_data Match PEB access fs access",
            "consolefoundry.date \u2022 http://consolefoundry.date \u2022 http://consolefoundry",
            "Matches rule Wow6432Node CurrentVersion Autorun Keys Modification -  Credits (split) below",
            "by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
            "http://freedns.afraid.org/images/apple.gif",
            "https://www.nextron-systems.com/notes-on-virustotal-matches/",
            "https://www.mumuplayer.com/redirect/customerservice/_wig",
            "https://www.mumuplayer.com/redirect/customerservice/fB)y",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 http://www.anyxxxtube/",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t| Truth",
            "https://www.semena.cz/exoticke-okrasne/78-plumerie-havajska-kvetina-semena-3-ks.html",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears",
            "http://consolefoundry.date/one/gate.php",
            "https://hybrid-analysis.com/sample/ba5890ad431b894b0dfd6c9d3f3d6cbd7fedae1bd5a51483f54b22ba0209e3b8/6920be8a548209db740dd354"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.Emotet-9850453",
              "display_name": "Win.Trojan.Emotet-9850453",
              "target": null
            },
            {
              "id": "Win.Trojan.BlackNetRAT-7838854-0",
              "display_name": "Win.Trojan.BlackNetRAT-7838854-0",
              "target": null
            },
            {
              "id": "Win.Dropper.Nanocore-10021490-0",
              "display_name": "Win.Dropper.Nanocore-10021490-0",
              "target": null
            },
            {
              "id": "Worm:Win32/AutoRun!atmn",
              "display_name": "Worm:Win32/AutoRun!atmn",
              "target": "/malware/Worm:Win32/AutoRun!atmn"
            },
            {
              "id": "Win.Packed.Remcos-10024510-0",
              "display_name": "Win.Packed.Remcos-10024510-0",
              "target": null
            },
            {
              "id": "Code Overlap",
              "display_name": "Code Overlap",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "PSW:Win32/VB.CU",
              "display_name": "PSW:Win32/VB.CU",
              "target": "/malware/PSW:Win32/VB.CU"
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1134",
              "name": "Access Token Manipulation",
              "display_name": "T1134 - Access Token Manipulation"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1541",
              "name": "Foreground Persistence",
              "display_name": "T1541 - Foreground Persistence"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1049",
              "name": "System Network Connections Discovery",
              "display_name": "T1049 - System Network Connections Discovery"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1592",
              "name": "Gather Victim Host Information",
              "display_name": "T1592 - Gather Victim Host Information"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1470",
              "name": "Obtain Device Cloud Backups",
              "display_name": "T1470 - Obtain Device Cloud Backups"
            },
            {
              "id": "T1078.004",
              "name": "Cloud Accounts",
              "display_name": "T1078.004 - Cloud Accounts"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 460,
            "FileHash-SHA1": 437,
            "FileHash-SHA256": 4483,
            "SSLCertFingerprint": 2,
            "URL": 6487,
            "hostname": 1772,
            "domain": 652,
            "CVE": 3,
            "email": 5
          },
          "indicator_count": 14301,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "114 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "690e8b773dc39921d88abd44",
          "name": "Nanocore - Affected",
          "description": "- wmsspacer.gif\n| Photography: WMSspacer.gif, |[wmstransparent.org,]\n* YARA Detections : \nDotNET_Reactor\nSystem.Security.Cryptography.AesCryptoServiceProvider\nSystem.Security.Cryptography\nSystem.Security.Cryptography ~\nI CryptoTransform |\n Wmsspacer, i.g.sg.js..png.com, on-screen.|",
          "modified": "2025-12-07T23:02:29.645000",
          "created": "2025-11-08T00:14:47.600000",
          "tags": [
            "hgnvastlaiz",
            "read c",
            "medium",
            "rgba",
            "memcommit",
            "delete",
            "png image",
            "unicode",
            "dock",
            "execution",
            "malware",
            "crlf line",
            "speichermedium",
            "productversion",
            "fileversion",
            "engine dll",
            "internalname",
            "einstellungen",
            "comodo ca",
            "limited st",
            "yara detections",
            "next pe",
            "eula",
            "policy",
            "direct",
            "opencandy",
            "suspicious_write_exe",
            "network_icmp",
            "process_martian",
            "present jun",
            "present jul",
            "domain",
            "united",
            "ip address",
            "unknown ns",
            "ms windows",
            "intel",
            "verisign",
            "time stamping",
            "unknown",
            "class",
            "write",
            "markus",
            "temple",
            "msie",
            "windows nt",
            "get http",
            "lehash",
            "av detections",
            "ids detections",
            "alerts",
            "file score",
            "low risk",
            "compromised_site_redirector_fromcharcode",
            "present aug",
            "passive dns",
            "all ipv4",
            "urls",
            "files",
            "hosting",
            "america flag",
            "win32",
            "ipv4 add",
            "signed file, valid signature. revoked.",
            "united states",
            "pws",
            "atros",
            "fiha",
            "search",
            "entries",
            "present oct",
            "next associated",
            "show",
            "high",
            "wow64",
            "slcc2",
            "next",
            "domain add",
            "poland",
            "poland unknown",
            "ipv4",
            "location poland",
            "poland asn",
            "et policy",
            "pe exe",
            "dll windows",
            "amazon s3",
            "location united",
            "associated urls",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results feb",
            "nanocore",
            "url add",
            "http",
            "related nids",
            "files location",
            "flag united",
            "malicious image",
            "files domain",
            "files related",
            "pulses otx",
            "related tags",
            "resources whois",
            "virustotal",
            "present sep",
            "status",
            "present nov",
            "present mar",
            "trojan",
            "script script",
            "div div",
            "link",
            "a li",
            "meta",
            "sweden",
            "invalid url",
            "head title",
            "title head",
            "reference",
            "bad request",
            "server",
            "netherlands",
            "creation date",
            "date",
            "running server",
            "ahmann",
            "christopher",
            "p",
            "tam",
            "legal",
            "treece",
            "alfrey",
            "muscat",
            "adversaries",
            "cyber crime",
            "quasi",
            "government"
          ],
          "references": [
            "wmsspacer.gif : 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87",
            "ceidg.gov.pl \u2022 https://www.csrc.gov.cn.lxcvc.com/ \u2022 www.alt.krasnopil-silrada.gov.ua",
            "http://www.mof.gov.cn.lxcvc.com/ \u2022  http://www.mohurd.gov.cn.lxcvc.com/ \u2022",
            "www.opencandy.com",
            "http://www.opencandy.com/privacy \u2022 http://www.opencandy.com/privacy-policy. \u2022  license@opencandy.com \u2022",
            "Yara Detections : compromised_site_redirector_fromcharcode",
            "Matches rule: skip20_sqllang_hook from ruleset skip20_sqllang_hook by Mathieu Tartare <mathieu.tartare@eset.com>",
            "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs",
            "http://pcoptimizerpro.com/eula.aspx \u2022 http://www.pcoptimizerpro.com/privacypolicy.aspx",
            "pcoptimizerpro.com \u2022 www.pcoptimizerpro.com",
            "PE EXE UpdatesDll.dll : 69081ab853021bd28bf7fb1eb4eac3199623c8ed413589e6f3898806a15f0f23",
            "YARA: DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform",
            "https://img.fkcdn.com/image/kg8avm80/mobile/j/f/9/apple-iphone-12-dummyapplefsn-200x200-imafwg8dkyh2zgrh.jpeg",
            "https://heavyfetish.com/search/CHEESE-PIZZA-porn/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.Nanocore-5",
              "display_name": "Win.Trojan.Nanocore-5",
              "target": null
            },
            {
              "id": "Win.Trojan.Adinstall-2",
              "display_name": "Win.Trojan.Adinstall-2",
              "target": null
            },
            {
              "id": "PSW.Generic13",
              "display_name": "PSW.Generic13",
              "target": null
            },
            {
              "id": "Atros.UPK",
              "display_name": "Atros.UPK",
              "target": null
            },
            {
              "id": "Luhe.Fiha.A",
              "display_name": "Luhe.Fiha.A",
              "target": null
            },
            {
              "id": "Pua.Optimizerpro/PCOptimizerPro",
              "display_name": "Pua.Optimizerpro/PCOptimizerPro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1491.001",
              "name": "Internal Defacement",
              "display_name": "T1491.001 - Internal Defacement"
            },
            {
              "id": "T1204.003",
              "name": "Malicious Image",
              "display_name": "T1204.003 - Malicious Image"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 753,
            "FileHash-SHA1": 622,
            "FileHash-SHA256": 4336,
            "URL": 2448,
            "domain": 300,
            "hostname": 788,
            "CVE": 1,
            "email": 4
          },
          "indicator_count": 9252,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "128 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68cb233ba91aa1eb958b3f31",
          "name": "Home - RMHS | APT 10 \u2022 Andromeda \u2022  OneLouder",
          "description": "I don\u2019t even know what to say. I\u2019ve received several complaints. This is 2nd time checking out technical issues that do exist. Operates as a Human Service entity for injured persons. OTX auto populated \u2018Golfing\u2019 as industry. \n\nDoes serve the severely disabled population. Does pay caregivers. Possibly a front page a FF link page, I have no idea",
          "modified": "2025-10-17T19:03:15.031000",
          "created": "2025-09-17T21:08:11.518000",
          "tags": [
            "script urls",
            "meta",
            "moved",
            "x tec",
            "passive dns",
            "encrypt",
            "america flag",
            "san francisco",
            "extraction",
            "data upload",
            "type indicatod",
            "united states",
            "a domains",
            "united",
            "gmt server",
            "jose",
            "university",
            "bill",
            "rmhs",
            "information",
            "board",
            "lorin",
            "joseph",
            "all veterans",
            "rocky mountain",
            "mission",
            "vice",
            "april",
            "school",
            "austin",
            "prior",
            "ipv4 add",
            "urls",
            "files",
            "location united",
            "wordpress",
            "rmhs meta",
            "tags viewport",
            "rmhs og",
            "rmhs article",
            "wpbakery page",
            "builder",
            "slider plugin",
            "google tag",
            "mountain human",
            "denver",
            "connecting",
            "denver start",
            "relevance home",
            "providers",
            "contact us",
            "rmhs main",
            "server",
            "redacted tech",
            "redacted admin",
            "registrar abuse",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "dnssec",
            "country",
            "ttl value",
            "graph summary",
            "resolved ips",
            "ip address",
            "port",
            "data",
            "screenshots no",
            "involved direct",
            "country name",
            "name response",
            "tcp connections",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "found",
            "spawns",
            "t1590 gather",
            "path",
            "ascii text",
            "exif standard",
            "tiff image",
            "format",
            "stop",
            "false",
            "soldier",
            "model",
            "youth",
            "baby",
            "june",
            "general",
            "local",
            "click",
            "strings",
            "core",
            "warrior",
            "green",
            "emotion",
            "flash",
            "nina",
            "hunk",
            "fono",
            "daam",
            "mitre att",
            "ck techniques",
            "id name",
            "malicious",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "brand",
            "microsoft edge",
            "show process",
            "self",
            "date",
            "comspec",
            "hybrid",
            "form",
            "log id",
            "gmtn",
            "tls web",
            "b2 f6",
            "b0n timestamp",
            "f9401a",
            "record value",
            "x wix",
            "certificate",
            "domain add",
            "pulse submit",
            "body",
            "domain related",
            "blackbox",
            "apple",
            "helix",
            "dvrdns",
            "tracking",
            "remote access",
            "ios",
            "spyware",
            "hoax",
            "dynamicloader",
            "ptls6",
            "medium",
            "flashpix",
            "high",
            "ygjpavclsline",
            "officespace",
            "chartshared",
            "powershell",
            "write",
            "malware",
            "ygjpaulscontext",
            "status",
            "japan unknown",
            "domain",
            "pulses",
            "search",
            "accept",
            "apt10",
            "trojanspy",
            "win32",
            "entries",
            "susp",
            "backdoor",
            "useragent",
            "showing",
            "virtool",
            "twitter",
            "mozilla",
            "trojandropper",
            "trojan",
            "title",
            "onelouder",
            "yara det",
            "maware samoe",
            "genaco x",
            "ids detec",
            "ids terse",
            "win3 data",
            "include review",
            "exclude sugges",
            "targeting",
            "show",
            "copy",
            "reads",
            "dynamic",
            "vendor finding",
            "notes clamav",
            "files matching",
            "number",
            "sample analysis",
            "hide samples",
            "date hash",
            "next yara"
          ],
          "references": [
            "rmhumanservices.org",
            "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt",
            "ntp17.dn.n-helix.com \u2022 ntp6.n-helix.com \u2022\tn-helix.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://www.dvrdns.net/BlackBox/google/googleMapKey.txt",
            "http://www.dvrdns.net/BlackBox/AOKI/AMEXA07/AMEX-A07%20PCViewer(3.9.8.1).exe",
            "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H%2520Player",
            "http://www.dvrdns.net/BlackBox/IROAD/IROAD_X9/version.txt",
            "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/IROAD%20Viewer(4.1.6.1).exe",
            "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/",
            "https://we4.ondemand.esker.com/ondemand/webaccess/logon.aspx?status=CookieNotFound",
            "https://www.mlkfoundation.net/ (Foundry DGA)",
            "remotewd.com x 34 devices",
            "South Africa based:  remote.advisoroffice.com",
            "acc.lehigtapp.com - malware",
            "http://watchhers.net/index.php (espionage entity /palantir relationship  - seen before with palantir and Pegasus sometimes simultaneously )",
            "Active - apple-dns.net \u2022 nr-data.net \u2022 tunes.apple.com \u2022  emails.redvue.com \u2022",
            "Active - pointing:  https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
            "http://help.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
            "http://wpgchanfp01.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
            "Excess porn -http://barbaramarx.com/__media__/js/netsoltrademark.php?d=www.pornxxxgals.info/feet-licking-porn/",
            "https://www.rmhumanservices.org/wp-content/themes/unicon/framework/js/isotope.pkgd.min.js malware hosting",
            "YARA Detections: NAME STRINGS CATEGORY APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
            "acc.lehigtapp.com - APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
            "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt \u2022 www.dvrdns.net",
            "IDS Detections: Koobface HTTP Request (2) W32/Bayrob Attempted Checkin 2",
            "IDS Terse HTTP 1.0 Request Possible Nivdort Probable OneLouder downloader (Zeus P2P)",
            "IDS: Win32/Nivdort Checkin Win32.Sality.bh Checkin 2 Andromeda Checkin Hostname",
            "1.organization.api.powerplatform.partner.microsoftonline.cn",
            "chinaeast2.admin.api.powerautomate.cn",
            "https://cisomag.com/mysterious-malware-infects-over-45000-android-phones/amp/",
            "https://hhahiag.r.af.d.sendibt2.com/tr/cl/k5n4lETrM7BShW8xAUoWzvHtXjUA9oY0eN0p94b4t6YmDCrHhUgR0CnWSrSU4oUFIIWHm33C5ltugoVezhyEVu8aXyY_lcNjanZPDFg-LOsishNuFrY6IJn0V0mjTudzlxtGsp9Cf04n9fUhwGutzxcgUbjXHhhy9RZdcxw9Z89-_v9NL4wQvbEhDhAlekBXUxvWjkXG_WyC8myfJAYzXL_43Cok-YEiyDHA7JvRwSX9aWdWtcE5N-kL3K-VM_-tvhSJcLt-mXjsbAN6DYkoz2r7j11242EYDQHdzTiC1Or0k6_Ptz-GvAw4cZyo3978asi27ijV89a5ngu_Ene6XOjg_UMpexvj9Zrihu4i9EPTSC-5-7qKwlTLKNHiwI6DvmurR5IoMJVMPa-xIDMUN2LCMTwUHMvfo0q2a0btH2Fx2A",
            "ssa-gov.authorizeddns",
            "hmmm\u2026http://palander.stjernstrom.se/",
            "https://jt667.keap-link003.com/v2/click/063b9634a5ebbdf34f43cbbbca6019ca/eJyNkEEPwUAQhf_LnEularE3EZGmOAhn2bRTlu2abIdEpP_dEHEicZ335nvz5g6M3njOStBwZKWGEEHAwpJFz9OzZ1O8xH6Spr1BBM760zycLwT6_m33oz-n6ThNBioCvhGKZ7OeTPNsNd8tslUuXjJBQv4BDVUyUqMPaLacZAto259krC3PrgJvQHO44LNTaaUXb4MT_4GZGh3HJzTUJbPH-BUbY22s61DACuW0AjuFMDB0D1w7wRoi9OX7KzneQFfGNdg-ANNtagU"
          ],
          "public": 1,
          "adversary": "APT 10",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "APT 10",
              "display_name": "APT 10",
              "target": null
            },
            {
              "id": "OneLouder",
              "display_name": "OneLouder",
              "target": null
            },
            {
              "id": "Andromeda",
              "display_name": "Andromeda",
              "target": null
            },
            {
              "id": "Sality",
              "display_name": "Sality",
              "target": null
            },
            {
              "id": "KoobFace",
              "display_name": "KoobFace",
              "target": null
            },
            {
              "id": "Bayrob",
              "display_name": "Bayrob",
              "target": null
            },
            {
              "id": "Nivdort Checkin",
              "display_name": "Nivdort Checkin",
              "target": null
            },
            {
              "id": "Win.Malware.Installcore-6950365-0",
              "display_name": "Win.Malware.Installcore-6950365-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1574.006",
              "name": "Dynamic Linker Hijacking",
              "display_name": "T1574.006 - Dynamic Linker Hijacking"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [
            "Golfing",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 690,
            "hostname": 1912,
            "URL": 5925,
            "FileHash-SHA1": 273,
            "email": 8,
            "FileHash-SHA256": 3618,
            "CIDR": 3,
            "FileHash-MD5": 254,
            "SSLCertFingerprint": 19,
            "CVE": 2
          },
          "indicator_count": 12704,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "179 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68c59a023815f66367c6900b",
          "name": "Virus.Injector affecting Online Payment system",
          "description": "fed.paypal.com_underground_exchange \u2022 \nYara Detections:\nConventionEngine_Keyword_Install |\nHigh Priority Alerts:\ncape_detected_threat | IDS Detections:\nWin32/Viking.GN ICMP Echo Request |\nPhilis.J ICMP Sweep (Payload Hello World)\n[FileHash SHA256 cb83f04591cc1d602e650dd5c12f4470cf21b04328477bd6a52081f37c04bd7c]\n[Virus.Injector.ATA_virussign.com_8f3417c51a5e6b0b2241e61ef1a9eef1.exe] [File present on vx-underground.org | virus.exchange ~ vxunderground_0]\n[OTX populated] Researchers have identified and identified the source of the Viking, Philis malware, which has infected more than 1.5 million victims in the past year and is currently on the verge of being shut down.]\n#inject #install #keyword #fed.paypal #botnet #payload #grey #algorithm_manipulation #virusinstall",
          "modified": "2025-10-13T15:15:41.500000",
          "created": "2025-09-13T16:21:22.747000",
          "tags": [
            "echo request",
            "sweep",
            "payload hello",
            "world",
            "search",
            "entries",
            "ids detections",
            "yara detections",
            "cape",
            "viking",
            "philis",
            "malware",
            "et",
            "adobe acrobat",
            "filehashsha256",
            "data upload",
            "extraction",
            "type",
            "no matching",
            "indicator",
            "failed",
            "url url",
            "samplepath",
            "samplename",
            "match info",
            "info",
            "base64",
            "ta0002 command",
            "t1059 severity",
            "modules t1129",
            "windows",
            "ta0003 modify",
            "registry t1112",
            "defense evasion",
            "encoding",
            "delete registry",
            "tree",
            "analysis ob0002",
            "control ob0004",
            "b0030 receive",
            "files",
            "ob0007 system",
            "e1082 file",
            "resolved ips",
            "sugges",
            "stop show",
            "domain",
            "hostname",
            "hostname data",
            "mitre att",
            "ip detections",
            "country"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 21,
            "FileHash-SHA1": 7,
            "FileHash-SHA256": 488,
            "URL": 758,
            "hostname": 321,
            "domain": 104
          },
          "indicator_count": 1699,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "183 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "689b9b9fab42ca4f016a226f",
          "name": "Elastic's Al-driven Endpoint Security - Red Team Malicious (moved?)",
          "description": "Endgame - Unruy Activity -System infection | (Moved) Endpoint security (MOVED) from Elastic\nElastic's Al-driven security analytics empowers you with comprehensive endpoint protection. Detect, investigate, and respond to threats faster with a single agent and unified console. Gain actionable insights for a proactive defense posture. All built on the Search\nAl platform.\n| Used maliciously against monitored non-criminal targets. |\n{ virus - https://universitycenter.uccs.edu/}\n#unruy #activity #monitored_target #red_team_malicious #trojan #worm #moved\n#ai #adversarial #custom_malware #ransom #crypt #guardrails #dns #cnc #evasive #domain_generation #remote_access #devices #remotewd #virus #custom_malware #rip #endgame \n\u2022 TrojanDropper\t\t\t\n\u2022 Win32:Evo-gen\t\u2022 Cassini\n\u2022 RansomX-gen\u2022 Zombie.A\n\u2022 win32:MalwareX-gen\t\u2022 Win32:Malware-gen \u2022  Nymeria\n\u2022 Forcud +",
          "modified": "2025-09-11T13:03:18.814000",
          "created": "2025-08-12T19:53:03.953000",
          "tags": [
            "url http",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "entries",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "href",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "show technique",
            "ck matrix",
            "null",
            "refresh",
            "body",
            "span",
            "general",
            "local",
            "path",
            "iframe",
            "click",
            "date",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "united",
            "unknown ns",
            "ip address",
            "creation date",
            "search",
            "present sep",
            "moved",
            "domain add",
            "encrypt",
            "accept",
            "please",
            "passive dns",
            "msie",
            "next associated",
            "html",
            "background",
            "unknown site",
            "div div",
            "trojan",
            "zeus",
            "process32nextw",
            "read c",
            "show",
            "shellexecuteexw",
            "windows nt",
            "wow64",
            "copy",
            "dock",
            "write",
            "malware",
            "unknown",
            "defense evasion",
            "t1480 execution",
            "file defense",
            "august",
            "hybrid",
            "port",
            "destination",
            "tlsv1",
            "as15169",
            "ogoogle trust",
            "cngts ca",
            "execution",
            "next",
            "persistence",
            "data upload",
            "extraction",
            "win32",
            "ransom",
            "trojandropper",
            "mtb nov",
            "forcud",
            "files show",
            "date hash",
            "avast avg"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4179,
            "domain": 774,
            "hostname": 1673,
            "FileHash-MD5": 169,
            "FileHash-SHA1": 110,
            "FileHash-SHA256": 2073,
            "email": 1,
            "SSLCertFingerprint": 13,
            "CVE": 1
          },
          "indicator_count": 8993,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "215 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68930449988277cd29c25cb7",
          "name": "https://firebase.google.com/ - Ransom \u2022 Wiper\u2022 Trojan dropper",
          "description": "",
          "modified": "2025-09-05T07:00:00.711000",
          "created": "2025-08-06T07:29:13.136000",
          "tags": [
            "url https",
            "iocs",
            "learn more",
            "ipv4",
            "domain",
            "hostname",
            "types of",
            "sweden",
            "united",
            "belgium",
            "indicator role",
            "title added",
            "active related",
            "pulses hostname",
            "showing",
            "document file",
            "v2 document",
            "search",
            "medium",
            "ms windows",
            "vista event",
            "port",
            "msie",
            "windows nt",
            "wow64",
            "dirty",
            "write",
            "powershell",
            "copy",
            "next",
            "defender",
            "dynamicloader",
            "high",
            "fwlink",
            "windows",
            "cmd c",
            "alerts",
            "bios",
            "related pulses",
            "pulses",
            "related tags",
            "file type",
            "ascii text",
            "sha256",
            "external",
            "virustotal api",
            "screenshots",
            "june",
            "flag",
            "usa windows",
            "input threat",
            "level analysis",
            "summary",
            "gbrflag",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "ssl certificate",
            "defense evasion",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "size",
            "mitre att",
            "date",
            "path",
            "format",
            "august",
            "hybrid",
            "local",
            "form",
            "click",
            "strings",
            "ubar",
            "truetype",
            "web open",
            "font format",
            "description web",
            "general",
            "iframe",
            "slcc2",
            "media center",
            "destination",
            "tlsv1",
            "unknown",
            "execution",
            "dock",
            "persistence",
            "malware",
            "encrypt",
            "ck techniques",
            "read c",
            "show",
            "entries",
            "delete",
            "data upload",
            "extraction",
            "onlv",
            "find",
            "type",
            "no matching",
            "indicator",
            "mtb may",
            "trojandropper",
            "passive dns",
            "next associated",
            "lowfi",
            "gmt cache",
            "sameorigin",
            "ipv4 add",
            "trojan",
            "mtb apr",
            "files show",
            "date hash",
            "avast avg",
            "shellterlod may",
            "win32qqpass apr",
            "trojanspy",
            "ransom",
            "wiper",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "results aug",
            "urls show",
            "hookwowlow may"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6893032410060f658d862c60",
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4593,
            "hostname": 1754,
            "domain": 399,
            "FileHash-SHA256": 2128,
            "FileHash-MD5": 426,
            "FileHash-SHA1": 299,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 9616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "222 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6893032410060f658d862c60",
          "name": "Hosting App - Partial research | Emotet Worm",
          "description": "#firebase #google #dark_web_hosting #ransom #tracking #locate #monitored_targets #worm #emotet #malware #remoted_devices #trojan #reputation\n\n\u2022 Targets likely unaware.\n\n[m.pornsexer.xxx.3.1.adiosfil.roksit.net - reputation tool]",
          "modified": "2025-09-05T07:00:00.711000",
          "created": "2025-08-06T07:24:20.645000",
          "tags": [
            "url https",
            "iocs",
            "learn more",
            "ipv4",
            "domain",
            "hostname",
            "types of",
            "sweden",
            "united",
            "belgium",
            "indicator role",
            "title added",
            "active related",
            "pulses hostname",
            "showing",
            "document file",
            "v2 document",
            "search",
            "medium",
            "ms windows",
            "vista event",
            "port",
            "msie",
            "windows nt",
            "wow64",
            "dirty",
            "write",
            "powershell",
            "copy",
            "next",
            "defender",
            "dynamicloader",
            "high",
            "fwlink",
            "windows",
            "cmd c",
            "alerts",
            "bios",
            "related pulses",
            "pulses",
            "related tags",
            "file type",
            "ascii text",
            "sha256",
            "external",
            "virustotal api",
            "screenshots",
            "june",
            "flag",
            "usa windows",
            "input threat",
            "level analysis",
            "summary",
            "gbrflag",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "ssl certificate",
            "defense evasion",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "size",
            "mitre att",
            "date",
            "path",
            "format",
            "august",
            "hybrid",
            "local",
            "form",
            "click",
            "strings",
            "ubar",
            "truetype",
            "web open",
            "font format",
            "description web",
            "general",
            "iframe",
            "slcc2",
            "media center",
            "destination",
            "tlsv1",
            "unknown",
            "execution",
            "dock",
            "persistence",
            "malware",
            "encrypt",
            "ck techniques",
            "read c",
            "show",
            "entries",
            "delete",
            "data upload",
            "extraction",
            "onlv",
            "find",
            "type",
            "no matching",
            "indicator",
            "mtb may",
            "trojandropper",
            "passive dns",
            "next associated",
            "lowfi",
            "gmt cache",
            "sameorigin",
            "ipv4 add",
            "trojan",
            "mtb apr",
            "files show",
            "date hash",
            "avast avg",
            "shellterlod may",
            "win32qqpass apr",
            "trojanspy",
            "ransom",
            "wiper",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "results aug",
            "urls show",
            "hookwowlow may"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4593,
            "hostname": 1754,
            "domain": 399,
            "FileHash-SHA256": 2128,
            "FileHash-MD5": 426,
            "FileHash-SHA1": 299,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 9616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "222 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68858e8244c8db854e8947c1",
          "name": "Goodreads Malware",
          "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
          "modified": "2025-08-26T01:03:19.405000",
          "created": "2025-07-27T02:27:14.517000",
          "tags": [
            "passive dns",
            "urls",
            "url add",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "united",
            "flag united",
            "present jun",
            "present may",
            "present apr",
            "search",
            "moved",
            "creation date",
            "record value",
            "date",
            "body",
            "meta",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "memcommit",
            "value1",
            "partnerid4146",
            "username",
            "gamesessionid",
            "port",
            "destination",
            "regsetvalueexa",
            "mozilla",
            "write",
            "persistence",
            "execution",
            "malware",
            "copy",
            "next",
            "process32nextw",
            "show",
            "entries",
            "module load",
            "t1129",
            "intel",
            "ms windows",
            "showing",
            "t1045",
            "win32",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "size",
            "pattern match",
            "ascii text",
            "null",
            "error",
            "starfield",
            "click",
            "hybrid",
            "local",
            "path",
            "strings",
            "refresh",
            "tools",
            "onload",
            "span",
            "smbds ipc",
            "ms17010",
            "msf style",
            "probe ms17010",
            "generic flags",
            "yara detections",
            "nrv2x",
            "upxoepplace"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 155,
            "hostname": 1237,
            "FileHash-SHA256": 1141,
            "domain": 574,
            "URL": 4593,
            "FileHash-SHA1": 139,
            "email": 1,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 7848,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "232 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687605f986433ebf2673f0b8",
          "name": "Win.Malware.Downloadguide-6803841-0 | Patient Monitoring",
          "description": "Part of an elaborate, unrelenting espionage campaign , multiple compromises, targeting.\n> alf:PUA:Win32/DownloadGuide \nLink below found in previous Pulse -[http://s0.patient.media/res/f91b97f6b547405cb4370cbb003dfea2-jquery-1.11.1.min.js.gzip]\n\u2022 Win.Malware.Downloadguide-6803841-0\nYara:\nresearch_pe_signed_outside_timestamp\n\u2022\nkernel32_dll_xor_exe_key_51_key_byte_encoded \u2022\nxor_0x33_kernel32_dll \u2022 \nConcerning: {Domain\tAddress\tRegistrar\tCountry\ns0.patient.media\n-\tGoDaddy.com, LLC\nOrganization: Egton Medical Information Systems Limited\nName Server: ns34.domaincontrol.com\nCreation Date: 2015-01-12T16:20:56}\n\n{https://www.anyxxxtube.net/search-porn/tsara-brashears/}\n{https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net}\n{wallpapers-nature.com}\n{https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian}",
          "modified": "2025-08-14T07:05:00.239000",
          "created": "2025-07-15T07:40:41.180000",
          "tags": [
            "url http",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses hostname",
            "entries",
            "gmt etag",
            "server",
            "ecacc",
            "serving ip",
            "address",
            "dom dom",
            "data upload",
            "extraction",
            "pdf report",
            "enter",
            "failed",
            "extraction data",
            "enter sc",
            "type",
            "extra data",
            "extri please",
            "review data",
            "excluded tous",
            "tui sugges",
            "find",
            "show",
            "at filer",
            "iocs",
            "levelbluelabs",
            "please",
            "included iocs",
            "excluded io",
            "find suggested",
            "types",
            "domain data",
            "search",
            "o please",
            "manually add",
            "c data",
            "o suggesteo",
            "include data",
            "review uus",
            "u exclude",
            "find s",
            "indicaok data",
            "dom doman",
            "filehash",
            "md5 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "copy",
            "push",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "pattern match",
            "ascii text",
            "size",
            "mitre att",
            "utf8",
            "null",
            "refresh",
            "body",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "date",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "evasion att",
            "t1480 execution",
            "discovery att"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3597,
            "FileHash-MD5": 343,
            "domain": 547,
            "hostname": 1222,
            "FileHash-SHA1": 343,
            "FileHash-SHA256": 4464,
            "CVE": 1,
            "email": 1
          },
          "indicator_count": 10518,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "244 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6875e98438889e51b3fdd18f",
          "name": "Critical \u2022 Schedule system process - Mirai | Foundry Overwatch",
          "description": "",
          "modified": "2025-08-14T05:04:16.839000",
          "created": "2025-07-15T05:39:16.652000",
          "tags": [
            "win32 exe",
            "country",
            "include review",
            "exclude",
            "defense evasion",
            "access ta0006",
            "command",
            "control ta0011",
            "impact ta0040",
            "impact ob0008",
            "file system",
            "system oc0008",
            "match unknown",
            "adversaries",
            "match info",
            "info",
            "execution flow",
            "t1574 dll",
            "tries",
            "registry",
            "modify system",
            "process t1543",
            "unknown",
            "window",
            "ob0009 install",
            "ob0012 install",
            "insecure",
            "b0047 modify",
            "registry e1112",
            "hidden files",
            "registry run",
            "keys",
            "startup folder",
            "f0012 file",
            "critical",
            "united",
            "as15169",
            "delete c",
            "as16509",
            "show",
            "search",
            "intel",
            "ms windows",
            "entries",
            "medium",
            "worm",
            "copy",
            "write",
            "explorer",
            "malware",
            "next",
            "present jul",
            "status",
            "date",
            "ip address",
            "domain",
            "servers",
            "showing",
            "unknown ns",
            "related pulses",
            "pulses",
            "tags",
            "related tags",
            "more file",
            "type",
            "date april",
            "am size",
            "sha1 sha256",
            "as14618",
            "united kingdom",
            "as54113",
            "as15133 verizon",
            "top source",
            "top destination",
            "status domain",
            "ip whitelisted",
            "whitelisted",
            "tcp include",
            "source source",
            "oamazon",
            "cnamazon rsa",
            "odigicert inc",
            "sweden as20940",
            "as20940",
            "entries tls",
            "ip destination",
            "encrypt",
            "aaaa",
            "found",
            "certificate",
            "next associated",
            "urls show",
            "date checked",
            "error",
            "windows",
            "high",
            "yara detections",
            "installs",
            "checks",
            "filehash",
            "sha256 add",
            "themida",
            "data upload",
            "extraction",
            "md5 add",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "win32",
            "ddos",
            "passive dns",
            "activity",
            "checkin",
            "win64",
            "mtb jan",
            "lowfi",
            "trojan",
            "ransom",
            "trojandropper",
            "yara",
            "nsis",
            "nss bv",
            "su data",
            "windo alerts",
            "andariel",
            "malware traffic",
            "nids",
            "icmp traffic",
            "dns query",
            "id deadhost",
            "connects",
            "andariel high",
            "richhash",
            "external",
            "virustotal api",
            "screenshots",
            "failed",
            "auurtonany data",
            "themida andarie",
            "present may",
            "japan unknown",
            "unknown cname",
            "domain add",
            "urls",
            "files",
            "http headers",
            "msie",
            "windows nt",
            "tcp syn",
            "resolverror",
            "externalport",
            "internalport",
            "wget command",
            "devices home",
            "execution",
            "foundry",
            "home networks",
            "mirai",
            "x.com",
            "porn",
            "monitored target",
            "d link",
            "targets"
          ],
          "references": [
            "TJprojMain.exe {79c7303a1a49b85569245a8ca1c1a26be720387845af9391fa1e4677308bd6b6}",
            "Crowdsourced Signa: Schedule system process by Joe Security",
            "Sigma \u2022 Suspicious Process Masquerading As SvcHost.EXE by Swachchhanda Shrawan Poudel",
            "Sigma \u2022 System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)",
            "Yara \u2022  NSIS from ruleset NSIS by kevoreilly",
            "Yara \u2022 rule SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "Yara \u2022 Windows_Generic_Threat_7526f106 from ruleset Windows_Generic_Threat by Elastic Security",
            "Alerts: persistence_autorun \u2022 persistence_autorun_tasks stealth_hiddenreg \u2022 suspicious_command",
            "IDS : Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI",
            "Mirai - ]1.0.0.0 - Unix.Trojan.Mirai-6981169-0",
            "*Themida_2xx. Oreans,Technologies",
            "*Andariel Backdoor Activity (Checkin)",
            "Alert: dead_host nids_malware_alert network_icmp nolookup_communication",
            "IDS: WGET Command Specifying Output in HTTP Headers",
            "IDS: D-Link Devices Home Network Administration Protocol Command Execution",
            "foundry2-lbl.dvr.dn2.n-helix.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://foundry2sdbl",
            "https://xn--72c9abh1f8ad1lzc.com/video_tag/pornthai/ \u2022 https://ro.theskinnyfoodco.com/en-fr/blogs/recipes/pornstar-martini-recipe \u2022 m.pornsexer.xxx.3.1.adiosfil.roksit.net",
            "x.com \u2022 nr-data.net \u2022 apple.k8s.joewa.com",
            "http://apple.cc.lvlid.com/ \u2022 http://apple.cc.lvlid.com/ios/ \u2022 http://www.apple.cc.lvlid.com/ios",
            "Devices remotely connected, tracked , monitored"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Worm:Win32/Mofksys.RND!MTB",
              "display_name": "Worm:Win32/Mofksys.RND!MTB",
              "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
            },
            {
              "id": "Unix.Trojan.Mirai-6981169-0",
              "display_name": "Unix.Trojan.Mirai-6981169-0",
              "target": null
            },
            {
              "id": "Win.Malware.Ursu-9856871-0",
              "display_name": "Win.Malware.Ursu-9856871-0",
              "target": null
            },
            {
              "id": "ELF:DDoS-Y\\ [Trj]",
              "display_name": "ELF:DDoS-Y\\ [Trj]",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1134",
              "name": "Access Token Manipulation",
              "display_name": "T1134 - Access Token Manipulation"
            },
            {
              "id": "T1485",
              "name": "Data Destruction",
              "display_name": "T1485 - Data Destruction"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1543",
              "name": "Create or Modify System Process",
              "display_name": "T1543 - Create or Modify System Process"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [
            "Healthcare",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 448,
            "FileHash-SHA1": 435,
            "FileHash-SHA256": 5851,
            "hostname": 2580,
            "domain": 1176,
            "URL": 7133,
            "SSLCertFingerprint": 30,
            "email": 3,
            "CVE": 3
          },
          "indicator_count": 17659,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "244 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "682cfb53a84a74af05540d11",
          "name": "PredatorTheStealer found on Updated  iOS  (plural)",
          "description": "PredatorTheStealer (FileHash-SHA256 000054b3c872904de589f504b020b8a0a60ee3e6f6f490c05024fa2a117aeef7 || MITRE ATT&CK Tactics and Techniques\nExecution | TA0002Persistence | TA0003 \nPrivilege Escalation TA0004 Defense Evasion \nTA0005 Credential Access TA0006\nDiscovery TA0009 Collection\nTA0009 Command and Control\nTA0011 Impact | may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.  | Malware Behavior Catalog Tree: \nAnti-Static Analysis\nOB0002\nCollection\nOB0003\nCommand and Control\nOB0004\nCredential Access\nOB0005\nDefense Evasion\nOB0006\nDiscovery\nOB0007\nImpact\nOB0008\nFile System\nOC0001\nProcess\nOC0003\nData\nOC0004\nCryptography\nOC0005\nCommunication\nOC0006\nOperating System\nOC0008\nCapabilities |\nLoad-Code | Capabilities\nLoad-Code\nCollection\nCommunication\nHost-Interaction\nLinking\nData-Manipulation\nAnti-Analysis",
          "modified": "2025-06-19T21:02:08.632000",
          "created": "2025-05-20T21:59:47.193000",
          "tags": [
            "pe32",
            "intel",
            "ms windows",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "os2 executable",
            "pe32 compiler",
            "exe32",
            "compiler",
            "contained",
            "type",
            "language",
            "sha256",
            "get http",
            "post http",
            "dns resolutions",
            "resolved ips"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 175,
            "FileHash-MD5": 15,
            "FileHash-SHA1": 3,
            "domain": 52,
            "hostname": 91,
            "URL": 153
          },
          "indicator_count": 489,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "299 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "682be3ca66569d4a2855faec",
          "name": "Critical iOS Update / Privacy Mode/ Locked down resistant Pegasus",
          "description": "PegasusLoader | Endangered target -\nBrilliantly executed malevolence towards a crime victim for what reason? Targets name censored on OTX.\nCritical-Capture Wi-Fi password by Joe Security | High Priority Malicious-Tor Client/Browser Execution by frack113 Potential Product Reconnaissance Via Wmic.EXE by Nasreddine Bencherchali |\n| Suspicious DNS Query for IP Lookup Service APIs by Brandon George (blog post), Thomas Patzke | Hardware Model Reconnaissance Via Wmic.EXE by Florian Roth (Nextron Systems)\n| Suspicious Network Connection to IP Lookup Service APIs by Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)\n|  PSScriptPolicyTest Creation By Uncommon Process by Nasreddine Bencherchali (Nextron Systems)\n|  WMIC Loading Scripting Libraries by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)\n| Non Interactive PowerShell Process Spawned by Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements) Suspicious PowerShell Get Current User by frack113",
          "modified": "2025-06-19T01:04:18.874000",
          "created": "2025-05-20T02:07:05.466000",
          "tags": [
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "url https",
            "filehashmd5",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "netherlands",
            "united",
            "france",
            "germany",
            "search",
            "get https"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 596,
            "hostname": 211,
            "FileHash-MD5": 18,
            "FileHash-SHA1": 10,
            "FileHash-SHA256": 330,
            "domain": 77
          },
          "indicator_count": 1242,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "300 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt \u2022 www.dvrdns.net",
        "https://www.semena.cz/exoticke-okrasne/78-plumerie-havajska-kvetina-semena-3-ks.html",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "Yara Detections : compromised_site_redirector_fromcharcode",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "acc.lehigtapp.com - malware",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "South Africa based:  remote.advisoroffice.com",
        "http://www.dvrdns.net/BlackBox/google/googleMapKey.txt",
        "YARA: DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform",
        "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com",
        "CS IDS: Matches rule (http_inspect) invalid status line",
        "http://wpgchanfp01.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
        "IP 69.42.215.252: theirname.yourdomain.com \u2022 www.freebsd.org freebsd.org \u2022 your.domain.com",
        "*Andariel Backdoor Activity (Checkin)",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "x.com \u2022 nr-data.net \u2022 apple.k8s.joewa.com",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H%2520Player",
        "IDS Detections: Koobface HTTP Request (2) W32/Bayrob Attempted Checkin 2",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/",
        "YARA Detections: NAME STRINGS CATEGORY APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt",
        "remotewd.com x 34 devices",
        "hmmm\u2026http://palander.stjernstrom.se/",
        "Yara: WormWin32Rombrast CodeOverlap Jorgen,Ibsen PECompact_2xx VZX Jeremy,Collake",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "Yara: RansomWin32SintaCry CodeOverlap TrojanClickerWin32Zeriest CodeOverlap",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "Alerts: persistence_autorun \u2022 persistence_autorun_tasks stealth_hiddenreg \u2022 suspicious_command",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "Alerts: packer_unknown",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_X9/version.txt",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian\t URL\thttp://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t\u2022 http://www.anyxxxtube",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "www.opencandy.com",
        "IDS: D-Link Devices Home Network Administration Protocol Command Execution",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://hhahiag.r.af.d.sendibt2.com/tr/cl/k5n4lETrM7BShW8xAUoWzvHtXjUA9oY0eN0p94b4t6YmDCrHhUgR0CnWSrSU4oUFIIWHm33C5ltugoVezhyEVu8aXyY_lcNjanZPDFg-LOsishNuFrY6IJn0V0mjTudzlxtGsp9Cf04n9fUhwGutzxcgUbjXHhhy9RZdcxw9Z89-_v9NL4wQvbEhDhAlekBXUxvWjkXG_WyC8myfJAYzXL_43Cok-YEiyDHA7JvRwSX9aWdWtcE5N-kL3K-VM_-tvhSJcLt-mXjsbAN6DYkoz2r7j11242EYDQHdzTiC1Or0k6_Ptz-GvAw4cZyo3978asi27ijV89a5ngu_Ene6XOjg_UMpexvj9Zrihu4i9EPTSC-5-7qKwlTLKNHiwI6DvmurR5IoMJVMPa-xIDMUN2LCMTwUHMvfo0q2a0btH2Fx2A",
        "Mirai - ]1.0.0.0 - Unix.Trojan.Mirai-6981169-0",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "http://watchhers.net/index.php (espionage entity /palantir relationship  - seen before with palantir and Pegasus sometimes simultaneously )",
        "http://consolefoundry.date/one/gate.php",
        "Antivirus Detection: Worm:Win32/AutoRun!atmn [Win.Trojan.Emotet relationship]",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "Alerts: antivm_bochs_keys antivm_generic_disk enumerates_physical_drives  antisandbox_sleep",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "Yara \u2022 rule SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "Devices remotely connected, tracked , monitored",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "IP 69.42.215.252: http://nginx.com/ \u2022nginx.com\t\u2022 http://nginx.org/ \u2022 nginx.org \u2022 afraid.org \u2022 afraid.org",
        "by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
        "https://we4.ondemand.esker.com/ondemand/webaccess/logon.aspx?status=CookieNotFound",
        "1.organization.api.powerplatform.partner.microsoftonline.cn",
        "Matches rule: skip20_sqllang_hook from ruleset skip20_sqllang_hook by Mathieu Tartare <mathieu.tartare@eset.com>",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs",
        "IDS Detections: Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "https://cisomag.com/mysterious-malware-infects-over-45000-android-phones/amp/",
        "Alerts: physical_drive_access mouse_movement_detect dynamic_function_loading",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "Sigma \u2022 System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "remotewd.com device local",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "http://www.mof.gov.cn.lxcvc.com/ \u2022  http://www.mohurd.gov.cn.lxcvc.com/ \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t| Truth",
        "https://www.mumuplayer.com/redirect/customerservice/_wig",
        "chinaeast2.admin.api.powerautomate.cn",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://jt667.keap-link003.com/v2/click/063b9634a5ebbdf34f43cbbbca6019ca/eJyNkEEPwUAQhf_LnEularE3EZGmOAhn2bRTlu2abIdEpP_dEHEicZ335nvz5g6M3njOStBwZKWGEEHAwpJFz9OzZ1O8xH6Spr1BBM760zycLwT6_m33oz-n6ThNBioCvhGKZ7OeTPNsNd8tslUuXjJBQv4BDVUyUqMPaLacZAto259krC3PrgJvQHO44LNTaaUXb4MT_4GZGh3HJzTUJbPH-BUbY22s61DACuW0AjuFMDB0D1w7wRoi9OX7KzneQFfGNdg-ANNtagU",
        "IDS: WGET Command Specifying Output in HTTP Headers",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "http://www.opencandy.com/privacy \u2022 http://www.opencandy.com/privacy-policy. \u2022  license@opencandy.com \u2022",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "http://apple.cc.lvlid.com/ \u2022 http://apple.cc.lvlid.com/ios/ \u2022 http://www.apple.cc.lvlid.com/ios",
        "Excess porn -http://barbaramarx.com/__media__/js/netsoltrademark.php?d=www.pornxxxgals.info/feet-licking-porn/",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "http://freedns.afraid.org/images/apple.gif",
        "Sigma \u2022 Suspicious Process Masquerading As SvcHost.EXE by Swachchhanda Shrawan Poudel",
        "FILEHASH-SHA256 d0ce79b3e0f4798423871dd66c14172b1a0eac34131c1b92d210a7b5c31a8aa0",
        "Windows Match api: GetProcAddress fs access  *access PEB Idr_data Match PEB access fs access",
        "Yara: TrojanDownloaderMSILBalamid CodeOverlap TrojanDropperWin32Popsenong CodeOverlap",
        "https://img.fkcdn.com/image/kg8avm80/mobile/j/f/9/apple-iphone-12-dummyapplefsn-200x200-imafwg8dkyh2zgrh.jpeg",
        "ntp17.dn.n-helix.com \u2022 ntp6.n-helix.com \u2022\tn-helix.com",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png",
        "http://www.anyxxxtube/",
        "Sigma: Matches rule Suspicious desktop.ini Action by Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "http://help.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
        "Alert: dead_host nids_malware_alert network_icmp nolookup_communication",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Name 2025-11-19_b627882129bf281be5a3df318fff678b_dark-comet_darkgate_elex_glassworm_stop",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "Yara \u2022 Windows_Generic_Threat_7526f106 from ruleset Windows_Generic_Threat by Elastic Security",
        "*Themida_2xx. Oreans,Technologies",
        "ssa-gov.authorizeddns",
        "https://www.mlkfoundation.net/ (Foundry DGA)",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "Yara \u2022  NSIS from ruleset NSIS by kevoreilly",
        "ceidg.gov.pl \u2022 https://www.csrc.gov.cn.lxcvc.com/ \u2022 www.alt.krasnopil-silrada.gov.ua",
        "acc.lehigtapp.com - APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
        "IP 69.42.215.252: nginx.com\u2022 vb.cu \u2022 vb.il \u2022 yourdomain.com \u2022 yourdomain.com",
        "consolefoundry.date \u2022 http://consolefoundry.date \u2022 http://consolefoundry",
        "https://www.rmhumanservices.org/wp-content/themes/unicon/framework/js/isotope.pkgd.min.js malware hosting",
        "Malware : ClipBanker Entity: Crazy Frost",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "jf_cf_frostovip.exe FILEHASH SHA256 4b9d6c5de40bfc4da8cb8b3ab9408dc574346b97268983f10bef8810e3f6bed8",
        "Alerts: http_request resumethread_remote_process antianalysis_tls_section network_httpn",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "IDS: Win32/Nivdort Checkin Win32.Sality.bh Checkin 2 Andromeda Checkin Hostname",
        "http://pcoptimizerpro.com/eula.aspx \u2022 http://www.pcoptimizerpro.com/privacypolicy.aspx",
        "http://watchhers.net/index.php",
        "Yara : BobSoft Mini Delphi -> BoB / BobSoft , Delphi",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 http://www.anyxxxtube/",
        "Yara: TrojanWin32Kredbegg  CodeOverlap TrojanWin32Motve CodeOverlap TrojanWin32Pitroj",
        "rmhumanservices.org",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "IDS Terse HTTP 1.0 Request Possible Nivdort Probable OneLouder downloader (Zeus P2P)",
        "foundry2-lbl.dvr.dn2.n-helix.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://foundry2sdbl",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "CS IDS: Matches rule INDICATOR-COMPROMISE png file attachment without matching file magic Unique rule identifier: This rule belongs to a private collection.",
        "wmsspacer.gif : 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87",
        "TJprojMain.exe {79c7303a1a49b85569245a8ca1c1a26be720387845af9391fa1e4677308bd6b6}",
        "https://www.vgt.pl/favicon.ico",
        "https://www.mumuplayer.com/redirect/customerservice/fB)y",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://xn--72c9abh1f8ad1lzc.com/video_tag/pornthai/ \u2022 https://ro.theskinnyfoodco.com/en-fr/blogs/recipes/pornstar-martini-recipe \u2022 m.pornsexer.xxx.3.1.adiosfil.roksit.net",
        "Active - apple-dns.net \u2022 nr-data.net \u2022 tunes.apple.com \u2022  emails.redvue.com \u2022",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "http://www.dvrdns.net/BlackBox/AOKI/AMEXA07/AMEX-A07%20PCViewer(3.9.8.1).exe",
        "https://hybrid-analysis.com/sample/ba5890ad431b894b0dfd6c9d3f3d6cbd7fedae1bd5a51483f54b22ba0209e3b8/6920be8a548209db740dd354",
        "Alerts: multiple_useragents persistence_autorun binary_yara procmem_yara suricata_alert",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "www.crazyfrost.com FileDescription :JF_CF_MiniZM FileVersion: 1.1.0.0 InternalName: jf_cf_frostovip.exe LegalCopyright Copyright \u00a9 CrazyFrost",
        "https://www.nextron-systems.com/notes-on-virustotal-matches/",
        "Alerts : suspicious_iocontrol_codes process_creation_suspicious_location network_dyndns",
        "Abused Domains Contacted: xred.mooo.com freedns.afraid.org",
        "PE EXE UpdatesDll.dll : 69081ab853021bd28bf7fb1eb4eac3199623c8ed413589e6f3898806a15f0f23",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/IROAD%20Viewer(4.1.6.1).exe",
        "Crowdsourced Signa: Schedule system process by Joe Security",
        "Services : GoogleChromeElevationService = Delete",
        "https://heavyfetish.com/search/CHEESE-PIZZA-porn/",
        "Matches rule Wow6432Node CurrentVersion Autorun Keys Modification -  Credits (split) below",
        "Malicious IP Contacted: 69.42.215.252",
        "Yara: TrojanPythonKaazar CodeOverlap TrojanSpyWin32Chekafev CodeOverlap",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "Yara : VirToolMSILLuxod CodeOverlap WormMSILVonriamt CodeOverlap TrojanWin32Depriz CodeOverlap",
        "IDS : Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI",
        "Active - pointing:  https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
        "Yara : Zeppelin_30 ,  compromised_site_redirector_fromcharcode ,",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "pcoptimizerpro.com \u2022 www.pcoptimizerpro.com",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Crazy Frost",
            "APT 10"
          ],
          "malware_families": [
            "Psw:win32/vb.cu",
            "Unix.trojan.mirai-6981169-0",
            "Code overlap",
            "Trojan:win32/mydoom",
            "Luhe.fiha.a",
            "Win.malware.ursu-9856871-0",
            "Onelouder",
            "Et",
            "Worm:win32/autorun!atmn",
            "Elf:ddos-y\\ [trj]",
            "Trojanspy:win32/nivdort",
            "Trojan:win32/zusy",
            "Psw.generic13",
            "Trojan:win32/qshell",
            "Pua.optimizerpro/pcoptimizerpro",
            "Atros.upk",
            "Win.dropper.nanocore-10021490-0",
            "Tofsee",
            "Bayrob",
            "Other malware",
            "Rozena",
            "Koobface",
            "Trojan.disfa/downloader10",
            "Nivdort checkin",
            "Worm:win32/mofksys.rnd!mtb",
            "Worm:win32/autorun",
            "Win.trojan.emotet-9850453",
            "Win.malware.installcore-6950365-0",
            "Win.packed.remcos-10024510-0",
            "Apt 10",
            "Sality",
            "Win.trojan.blacknetrat-7838854-0",
            "Win.trojan.adinstall-2",
            "Alf:heraklezeval:trojan:win32/clipbanker",
            "Win.trojan.nanocore-5",
            "Andromeda",
            "Jaik"
          ],
          "industries": [
            "Government",
            "Healthcare",
            "Golfing",
            "Technology"
          ],
          "unique_indicators": 106882
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/soultech.sa",
    "whois": "http://whois.domaintools.com/soultech.sa",
    "domain": "soultech.sa",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 20,
  "pulses": [
    {
      "id": "69b49ad5dd40a24d83cd6a72",
      "name": "Chris P. Ahmann \u2022 PRIVATE PROPERTY Colorado State Fixer!",
      "description": "",
      "modified": "2026-03-13T23:16:37.716000",
      "created": "2026-03-13T23:16:37.716000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "69631fbd16e306ee2b76c4da",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "32 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69b496396ca4987e95ad37d1",
      "name": "Chris Buzz by QVashni (wow)",
      "description": "",
      "modified": "2026-03-13T22:56:57.314000",
      "created": "2026-03-13T22:56:57.314000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "69482caa00d327da8f0a87bc",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 46,
      "modified_text": "32 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69b49587dd104e342dda1628",
      "name": "C Ahman Attorney Clone by Top Tier, Q.Vashti",
      "description": "",
      "modified": "2026-03-13T22:53:59.112000",
      "created": "2026-03-13T22:53:59.112000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "691f4d4ef0a2a570b8b21cd2",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 46,
      "modified_text": "32 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69631fbd16e306ee2b76c4da",
      "name": "Chris P. Ahmann \u2022 STAY Away!f PRIVATE PROPERTY Colorado State Fixer!",
      "description": "",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2026-01-11T03:57:49.242000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "695557ee134b978b00883c29",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "84 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "695557ee134b978b00883c29",
      "name": "Chris P. Ahmann \u2022 Stay out of PRIVATE PROPERTY HITMAN!  Colorado State",
      "description": "",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2025-12-31T17:05:50.134000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "691f4d4ef0a2a570b8b21cd2",
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "84 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69482caa00d327da8f0a87bc",
      "name": "Chris P.\u2019 Buzz\u2019 Ahmann Colorado State Criminal Defense Attorney (22.20.2025)",
      "description": "",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2025-12-21T17:21:46.434000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "691f4d4ef0a2a570b8b21cd2",
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "84 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "691f4d4ef0a2a570b8b21cd2",
      "name": "Chris P. Ahmann Colorado State Criminal Defense Attorney",
      "description": "Chris P. Ahmann Colorado State Criminal Defense attorney hired by quasi government Workers Compensation to completely destroy Tsara Brashears literally to death. None of her spinal cord injuries , and other assault injuries discussed or compensated for in rushed settlement case. Her awful racist attorney refused to represent plaintiffs in hearing. Never met with in person  for no good reason. Tsara represented herself.  Less that 24 hour notice. No briefings, no awareness or mention that Ahmann was representing Jeffrey Scott Reimer for assault\n case. Brashears required 24 hour care by end of life. Received 0 workers compsarion payments. But if this doesn\u2019t prove Reimer\u2019s guilt what does? Continued harassment of associated. \n\nNotice the outages? You\u2019ve cost BILLIONS? Stop threatening everyone.",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2025-11-20T17:18:06.929000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "84 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6928f8d9e4222a6a219d785e",
      "name": "ClipBanker Spy & Information stealer | Crazy Frost | MaaS | Chrome & Cloudflare attacks",
      "description": "It appears that entity CrazyFrost provides MasS among other things that include major smear campaigns.| Likely quasi government , and Law Firm contractors.. Domestic terrorizing isn\u2019t a stretch.\nClipBanker: A form of banking trojan information stealer and spy that specifically monitors and steals information, likely by modifying the clipboard contents to redirect financial transactions (e.g., changing a copied bank account number to the attacker's).\n\n[OTX populated - HOSTNAME: CloudFlare.com.., a company owned by the US government, has been added to Pulse, an anti-virus database. (Pulses) created by users.]",
      "modified": "2025-12-28T00:04:06.179000",
      "created": "2025-11-28T01:20:25.401000",
      "tags": [
        "dynamicloader",
        "json",
        "ascii text",
        "high",
        "data",
        "x90uxa4xf8",
        "cape",
        "stream",
        "guard",
        "write",
        "trojan",
        "redline",
        "malware",
        "push",
        "local",
        "injection_inter_process",
        "recon_fingerprint",
        "persistence_ads",
        "process_creation_suspicious_location",
        "infostealer_browser",
        "infostealer_cookies",
        "stealth_file",
        "cape_detected_threat",
        "antivm_generic_bios",
        "cape_extracted_content",
        "united",
        "mtb jul",
        "a domains",
        "aaaa",
        "443 ma86400",
        "servers",
        "win32upatre jul",
        "virtool",
        "b778b1",
        "div div",
        "d9e4f4",
        "edf2f8",
        "present mar",
        "fastest privacy",
        "first dns",
        "win32",
        "trojandropper",
        "passive dns",
        "mtb nov",
        "ipv4 add",
        "asn as13335",
        "dns resolutions",
        "domain",
        "data upload",
        "extraction",
        "yara",
        "troja yara",
        "trojar data",
        "virto",
        "worn data",
        "included iocs",
        "manually add",
        "resolved ips",
        "ta0002",
        "evasion ta0005",
        "tr shared",
        "modules",
        "files",
        "infor",
        "t1027",
        "process t1057",
        "community score",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "defense evasion",
        "spawns",
        "flag",
        "name server",
        "date",
        "cloudflare",
        "data protected",
        "misc activity",
        "et info",
        "dns requests",
        "domain address",
        "gmt flag",
        "techtarget",
        "server",
        "et policy",
        "prefetch2",
        "t1179 hooking",
        "access windows",
        "installs",
        "mitre att",
        "ck techniques",
        "click",
        "windir",
        "country",
        "contacted hosts",
        "ip address",
        "process details",
        "contacted",
        "http traffic",
        "suricata alerts",
        "event category",
        "found"
      ],
      "references": [
        "Malware : ClipBanker Entity: Crazy Frost",
        "www.crazyfrost.com FileDescription :JF_CF_MiniZM FileVersion: 1.1.0.0 InternalName: jf_cf_frostovip.exe LegalCopyright Copyright \u00a9 CrazyFrost",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "Services : GoogleChromeElevationService = Delete",
        "Yara: RansomWin32SintaCry CodeOverlap TrojanClickerWin32Zeriest CodeOverlap",
        "Yara: TrojanDownloaderMSILBalamid CodeOverlap TrojanDropperWin32Popsenong CodeOverlap",
        "Yara: TrojanPythonKaazar CodeOverlap TrojanSpyWin32Chekafev CodeOverlap",
        "Yara: TrojanWin32Kredbegg  CodeOverlap TrojanWin32Motve CodeOverlap TrojanWin32Pitroj",
        "Yara : VirToolMSILLuxod CodeOverlap WormMSILVonriamt CodeOverlap TrojanWin32Depriz CodeOverlap",
        "Yara: WormWin32Rombrast CodeOverlap Jorgen,Ibsen PECompact_2xx VZX Jeremy,Collake",
        "Sigma: Matches rule Suspicious desktop.ini Action by Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)",
        "CS IDS: Matches rule (http_inspect) invalid status line",
        "CS IDS: Matches rule INDICATOR-COMPROMISE png file attachment without matching file magic Unique rule identifier: This rule belongs to a private collection.",
        "jf_cf_frostovip.exe FILEHASH SHA256 4b9d6c5de40bfc4da8cb8b3ab9408dc574346b97268983f10bef8810e3f6bed8",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian\t URL\thttp://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t\u2022 http://www.anyxxxtube",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "http://www.anyxxxtube/"
      ],
      "public": 1,
      "adversary": "Crazy Frost",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "Trojan.Disfa/downloader10",
          "display_name": "Trojan.Disfa/downloader10",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zusy",
          "display_name": "Trojan:Win32/Zusy",
          "target": "/malware/Trojan:Win32/Zusy"
        },
        {
          "id": "Rozena",
          "display_name": "Rozena",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1498",
          "name": "Network Denial of Service",
          "display_name": "T1498 - Network Denial of Service"
        },
        {
          "id": "T1464",
          "name": "Jamming or Denial of Service",
          "display_name": "T1464 - Jamming or Denial of Service"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 295,
        "FileHash-SHA1": 217,
        "FileHash-SHA256": 1887,
        "URL": 3263,
        "domain": 597,
        "hostname": 1085,
        "email": 2,
        "CVE": 1
      },
      "indicator_count": 7347,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "108 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6920c43c3772bb24f26f70cc",
      "name": "Xred_Malware \u2022 Dark Comet \u2022 Darkgate \u2022 Elex \u2022 Glassworm | AutoRun",
      "description": "Attack originates from government contractors/ quasi governmental entities. Criminal Defense and Government contracted Law firms commonly abuse these tactics. Targeting. Found in data of a target. Focused on (1) FILE HASH and (1)  IP address .[referenced] *XRed _Mal\n* EXE Infection | OTX  auto populated - Adversaries may be able to gain access to victim systems using a variety of techniques to evade detection and conceal their actions. and their intentions, as well as using other techniques, to avoid detection.",
      "modified": "2025-12-21T18:01:07.268000",
      "created": "2025-11-21T19:57:48.145000",
      "tags": [
        "dynamicloader",
        "write c",
        "write",
        "high",
        "yara rule",
        "myapp",
        "delphi",
        "worm",
        "win32",
        "error",
        "code",
        "malware",
        "defender",
        "medium",
        "binary file",
        "heavensgate",
        "bochs",
        "dynamic",
        "td td",
        "td tr",
        "united",
        "a td",
        "a domains",
        "dynamic dns",
        "static dns",
        "dd wrt",
        "twitter",
        "trojan",
        "trojandropper",
        "null",
        "enough",
        "simple",
        "click",
        "easy",
        "premium",
        "associated urls",
        "server response",
        "google safe",
        "results nov",
        "avast avg",
        "11.21.2025",
        "11.20.2025",
        "borland delphi",
        "pe32",
        "intel",
        "ms windows",
        "inno setup",
        "win32 exe",
        "pecompact",
        "delphi generic",
        "pe32 compiler",
        "dark comet",
        "dark gate",
        "glassworm",
        "md5 code",
        "data",
        "porkbun llc",
        "windows match",
        "getprocaddress",
        "peb idrdata",
        "match peb",
        "t1547",
        "t1059 t1112",
        "shared modules",
        "t1129",
        "boot",
        "logon autostart",
        "execu",
        "t1134 boot",
        "encoding",
        "capture e1113",
        "file attributes",
        "analysis ob0001",
        "b0001 software",
        "virtual machine",
        "detection b0009",
        "analysis ob0002",
        "ob0003 screen",
        "windows get",
        "check",
        "encode",
        "check internet",
        "wininet set",
        "clear file",
        "enumerate gui",
        "get hostname",
        "get keyboard",
        "set registry",
        "find",
        "capture",
        "url http",
        "consolefoundry",
        "console foundry",
        "foundry",
        "malware catalog tree",
        "autorun keys",
        "modification",
        "alexander karp",
        "peter theil",
        "christoper ahmann",
        "christopher pool",
        "mercedes",
        "apple",
        "palantir",
        "adversarial",
        "adversaries",
        "hostile",
        "quasi",
        "empty hash",
        "denver",
        "mal_xred_backdoor",
        "backdoor",
        "xred",
        "brian sabey",
        "first-send-petikvx",
        "stop",
        "glassworm",
        "elex",
        "darkgate",
        "dark-comet",
        "search",
        "entries",
        "show",
        "yara detections",
        "icmp traffic",
        "rtf file",
        "top source",
        "top destination",
        "format",
        "host",
        "copy",
        "next",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "found",
        "access att",
        "font",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "ascii text",
        "pattern match",
        "sha256",
        "mitre att",
        "title",
        "meta",
        "hybrid",
        "local",
        "path",
        "strings",
        "body",
        "contact",
        "trace",
        "form",
        "bitcoin",
        "core",
        "jeffrey reimer",
        "exe infection",
        "cve",
        "porn"
      ],
      "references": [
        "FILEHASH-SHA256 d0ce79b3e0f4798423871dd66c14172b1a0eac34131c1b92d210a7b5c31a8aa0",
        "Name 2025-11-19_b627882129bf281be5a3df318fff678b_dark-comet_darkgate_elex_glassworm_stop",
        "Antivirus Detection: Worm:Win32/AutoRun!atmn [Win.Trojan.Emotet relationship]",
        "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com",
        "IDS Detections: Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
        "Yara : Zeppelin_30 ,  compromised_site_redirector_fromcharcode ,",
        "Yara : BobSoft Mini Delphi -> BoB / BobSoft , Delphi",
        "Alerts : suspicious_iocontrol_codes process_creation_suspicious_location network_dyndns",
        "Alerts: multiple_useragents persistence_autorun binary_yara procmem_yara suricata_alert",
        "Alerts: antivm_bochs_keys antivm_generic_disk enumerates_physical_drives  antisandbox_sleep",
        "Alerts: physical_drive_access mouse_movement_detect dynamic_function_loading",
        "Alerts: http_request resumethread_remote_process antianalysis_tls_section network_httpn",
        "Alerts: packer_unknown",
        "Malicious IP Contacted: 69.42.215.252",
        "Abused Domains Contacted: xred.mooo.com freedns.afraid.org",
        "IP 69.42.215.252: http://nginx.com/ \u2022nginx.com\t\u2022 http://nginx.org/ \u2022 nginx.org \u2022 afraid.org \u2022 afraid.org",
        "IP 69.42.215.252: nginx.com\u2022 vb.cu \u2022 vb.il \u2022 yourdomain.com \u2022 yourdomain.com",
        "IP 69.42.215.252: theirname.yourdomain.com \u2022 www.freebsd.org freebsd.org \u2022 your.domain.com",
        "Windows Match api: GetProcAddress fs access  *access PEB Idr_data Match PEB access fs access",
        "consolefoundry.date \u2022 http://consolefoundry.date \u2022 http://consolefoundry",
        "Matches rule Wow6432Node CurrentVersion Autorun Keys Modification -  Credits (split) below",
        "by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
        "http://freedns.afraid.org/images/apple.gif",
        "https://www.nextron-systems.com/notes-on-virustotal-matches/",
        "https://www.mumuplayer.com/redirect/customerservice/_wig",
        "https://www.mumuplayer.com/redirect/customerservice/fB)y",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 http://www.anyxxxtube/",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t| Truth",
        "https://www.semena.cz/exoticke-okrasne/78-plumerie-havajska-kvetina-semena-3-ks.html",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears",
        "http://consolefoundry.date/one/gate.php",
        "https://hybrid-analysis.com/sample/ba5890ad431b894b0dfd6c9d3f3d6cbd7fedae1bd5a51483f54b22ba0209e3b8/6920be8a548209db740dd354"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.Emotet-9850453",
          "display_name": "Win.Trojan.Emotet-9850453",
          "target": null
        },
        {
          "id": "Win.Trojan.BlackNetRAT-7838854-0",
          "display_name": "Win.Trojan.BlackNetRAT-7838854-0",
          "target": null
        },
        {
          "id": "Win.Dropper.Nanocore-10021490-0",
          "display_name": "Win.Dropper.Nanocore-10021490-0",
          "target": null
        },
        {
          "id": "Worm:Win32/AutoRun!atmn",
          "display_name": "Worm:Win32/AutoRun!atmn",
          "target": "/malware/Worm:Win32/AutoRun!atmn"
        },
        {
          "id": "Win.Packed.Remcos-10024510-0",
          "display_name": "Win.Packed.Remcos-10024510-0",
          "target": null
        },
        {
          "id": "Code Overlap",
          "display_name": "Code Overlap",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "PSW:Win32/VB.CU",
          "display_name": "PSW:Win32/VB.CU",
          "target": "/malware/PSW:Win32/VB.CU"
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1134",
          "name": "Access Token Manipulation",
          "display_name": "T1134 - Access Token Manipulation"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1541",
          "name": "Foreground Persistence",
          "display_name": "T1541 - Foreground Persistence"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1049",
          "name": "System Network Connections Discovery",
          "display_name": "T1049 - System Network Connections Discovery"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1592",
          "name": "Gather Victim Host Information",
          "display_name": "T1592 - Gather Victim Host Information"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1470",
          "name": "Obtain Device Cloud Backups",
          "display_name": "T1470 - Obtain Device Cloud Backups"
        },
        {
          "id": "T1078.004",
          "name": "Cloud Accounts",
          "display_name": "T1078.004 - Cloud Accounts"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 460,
        "FileHash-SHA1": 437,
        "FileHash-SHA256": 4483,
        "SSLCertFingerprint": 2,
        "URL": 6487,
        "hostname": 1772,
        "domain": 652,
        "CVE": 3,
        "email": 5
      },
      "indicator_count": 14301,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "114 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "690e8b773dc39921d88abd44",
      "name": "Nanocore - Affected",
      "description": "- wmsspacer.gif\n| Photography: WMSspacer.gif, |[wmstransparent.org,]\n* YARA Detections : \nDotNET_Reactor\nSystem.Security.Cryptography.AesCryptoServiceProvider\nSystem.Security.Cryptography\nSystem.Security.Cryptography ~\nI CryptoTransform |\n Wmsspacer, i.g.sg.js..png.com, on-screen.|",
      "modified": "2025-12-07T23:02:29.645000",
      "created": "2025-11-08T00:14:47.600000",
      "tags": [
        "hgnvastlaiz",
        "read c",
        "medium",
        "rgba",
        "memcommit",
        "delete",
        "png image",
        "unicode",
        "dock",
        "execution",
        "malware",
        "crlf line",
        "speichermedium",
        "productversion",
        "fileversion",
        "engine dll",
        "internalname",
        "einstellungen",
        "comodo ca",
        "limited st",
        "yara detections",
        "next pe",
        "eula",
        "policy",
        "direct",
        "opencandy",
        "suspicious_write_exe",
        "network_icmp",
        "process_martian",
        "present jun",
        "present jul",
        "domain",
        "united",
        "ip address",
        "unknown ns",
        "ms windows",
        "intel",
        "verisign",
        "time stamping",
        "unknown",
        "class",
        "write",
        "markus",
        "temple",
        "msie",
        "windows nt",
        "get http",
        "lehash",
        "av detections",
        "ids detections",
        "alerts",
        "file score",
        "low risk",
        "compromised_site_redirector_fromcharcode",
        "present aug",
        "passive dns",
        "all ipv4",
        "urls",
        "files",
        "hosting",
        "america flag",
        "win32",
        "ipv4 add",
        "signed file, valid signature. revoked.",
        "united states",
        "pws",
        "atros",
        "fiha",
        "search",
        "entries",
        "present oct",
        "next associated",
        "show",
        "high",
        "wow64",
        "slcc2",
        "next",
        "domain add",
        "poland",
        "poland unknown",
        "ipv4",
        "location poland",
        "poland asn",
        "et policy",
        "pe exe",
        "dll windows",
        "amazon s3",
        "location united",
        "associated urls",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results feb",
        "nanocore",
        "url add",
        "http",
        "related nids",
        "files location",
        "flag united",
        "malicious image",
        "files domain",
        "files related",
        "pulses otx",
        "related tags",
        "resources whois",
        "virustotal",
        "present sep",
        "status",
        "present nov",
        "present mar",
        "trojan",
        "script script",
        "div div",
        "link",
        "a li",
        "meta",
        "sweden",
        "invalid url",
        "head title",
        "title head",
        "reference",
        "bad request",
        "server",
        "netherlands",
        "creation date",
        "date",
        "running server",
        "ahmann",
        "christopher",
        "p",
        "tam",
        "legal",
        "treece",
        "alfrey",
        "muscat",
        "adversaries",
        "cyber crime",
        "quasi",
        "government"
      ],
      "references": [
        "wmsspacer.gif : 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87",
        "ceidg.gov.pl \u2022 https://www.csrc.gov.cn.lxcvc.com/ \u2022 www.alt.krasnopil-silrada.gov.ua",
        "http://www.mof.gov.cn.lxcvc.com/ \u2022  http://www.mohurd.gov.cn.lxcvc.com/ \u2022",
        "www.opencandy.com",
        "http://www.opencandy.com/privacy \u2022 http://www.opencandy.com/privacy-policy. \u2022  license@opencandy.com \u2022",
        "Yara Detections : compromised_site_redirector_fromcharcode",
        "Matches rule: skip20_sqllang_hook from ruleset skip20_sqllang_hook by Mathieu Tartare <mathieu.tartare@eset.com>",
        "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs",
        "http://pcoptimizerpro.com/eula.aspx \u2022 http://www.pcoptimizerpro.com/privacypolicy.aspx",
        "pcoptimizerpro.com \u2022 www.pcoptimizerpro.com",
        "PE EXE UpdatesDll.dll : 69081ab853021bd28bf7fb1eb4eac3199623c8ed413589e6f3898806a15f0f23",
        "YARA: DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform",
        "https://img.fkcdn.com/image/kg8avm80/mobile/j/f/9/apple-iphone-12-dummyapplefsn-200x200-imafwg8dkyh2zgrh.jpeg",
        "https://heavyfetish.com/search/CHEESE-PIZZA-porn/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.Nanocore-5",
          "display_name": "Win.Trojan.Nanocore-5",
          "target": null
        },
        {
          "id": "Win.Trojan.Adinstall-2",
          "display_name": "Win.Trojan.Adinstall-2",
          "target": null
        },
        {
          "id": "PSW.Generic13",
          "display_name": "PSW.Generic13",
          "target": null
        },
        {
          "id": "Atros.UPK",
          "display_name": "Atros.UPK",
          "target": null
        },
        {
          "id": "Luhe.Fiha.A",
          "display_name": "Luhe.Fiha.A",
          "target": null
        },
        {
          "id": "Pua.Optimizerpro/PCOptimizerPro",
          "display_name": "Pua.Optimizerpro/PCOptimizerPro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1491.001",
          "name": "Internal Defacement",
          "display_name": "T1491.001 - Internal Defacement"
        },
        {
          "id": "T1204.003",
          "name": "Malicious Image",
          "display_name": "T1204.003 - Malicious Image"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 753,
        "FileHash-SHA1": 622,
        "FileHash-SHA256": 4336,
        "URL": 2448,
        "domain": 300,
        "hostname": 788,
        "CVE": 1,
        "email": 4
      },
      "indicator_count": 9252,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "128 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://soultech.sa/en/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://soultech.sa/en/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776251062.5623422
}