{
  "type": "URL",
  "indicator": "https://syncthing.planetven.us",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://syncthing.planetven.us",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4227710626,
      "indicator": "https://syncthing.planetven.us",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "69ddeb45c45f6a3cd721397d",
          "name": "Active attacks  \u2022 Apple \u2022 Tulach",
          "description": "Including 360+ Apple\nIoC\u2019s from Malicious Tulac.cc + Virtual Servers Pulses. Ongoing history of malicious attacks, custom malware engineer, malicious media , account control. \n\nI was blocked from VirusToltal. It was Tulach Nextcloud posse. What I am doing now s legal. \n\nReferenced below. URL: \"https://accountapple.com/\" contacted related malicious domain: \"accountapple.com\"\nCONTACTED DOMAIN: \"sqllq.com\" has been identified as malicious",
          "modified": "2026-04-14T07:22:45.250000",
          "created": "2026-04-14T07:22:45.250000",
          "tags": [
            "url http",
            "ipv4",
            "indicator role",
            "active related",
            "united",
            "moved",
            "gmt content",
            "certificate",
            "all domain",
            "msie",
            "chrome",
            "extraction",
            "data upload",
            "twitter",
            "cookie",
            "extra",
            "include data",
            "review locs",
            "exclude",
            "suggested os",
            "onlv",
            "failed",
            "stop data",
            "read c",
            "unicode",
            "rgba",
            "memcommit",
            "delete",
            "dock",
            "write",
            "execution",
            "sc type",
            "extri",
            "include review",
            "exclude sugges",
            "typ data",
            "a domains",
            "present apr",
            "script urls",
            "files",
            "files ip",
            "address",
            "ios",
            "mac",
            "apple",
            "appleid",
            "itunes",
            "next associated",
            "all ipv4",
            "included ic",
            "uny teade",
            "type hostnar",
            "hostnar hostnar",
            "hostnar",
            "macair",
            "macairaustralia",
            "ipad",
            "ipod",
            "cryptexportkey",
            "invalid pointer",
            "cryptgenkey",
            "stream",
            "defender",
            "delphi",
            "class",
            "stack",
            "format",
            "unknown",
            "united states",
            "phishing",
            "password",
            "traffic redirected",
            "service mod",
            "service execution",
            "youtube",
            "music",
            "streams",
            "songs",
            "played songs",
            "music streams",
            "most played",
            "fonelab",
            "indicator",
            "included iocs",
            "manually add",
            "review ocs",
            "exclude inn",
            "sugges data",
            "find",
            "include",
            "url https",
            "enter sc",
            "type",
            "no matchme",
            "search otx",
            "https",
            "references x",
            "analyze",
            "open th",
            "url data",
            "se http",
            "no match",
            "excluded iocs",
            "iocs",
            "ip whitelisted",
            "whitelisted",
            "tcp include",
            "analysis date",
            "file score",
            "medium risk",
            "yara detections",
            "contacted",
            "related tags",
            "x vercel",
            "file type",
            "type indicator",
            "role title",
            "related pulses",
            "mulch virtua",
            "library loade",
            "included i0",
            "review ioc",
            "excluded ic",
            "suggested",
            "find sugt",
            "samuel tulach",
            "unity engine",
            "tulach",
            "sa awareness",
            "sabey",
            "sar cut",
            "autofill",
            "includer review",
            "portiana oney",
            "targeting",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "musickit_1_.js",
            "lazarus",
            "injection",
            "CVE-2017-8570",
            "prefetch2",
            "target",
            "aaaa",
            "ip address",
            "record value",
            "emails",
            "samuel tuachs",
            "sapev",
            "review exclude",
            "monitored target",
            "script",
            "mitre att",
            "ascii text",
            "span",
            "path",
            "iframe",
            "april",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "body",
            "development att",
            "t1055.012 list planting",
            "active"
          ],
          "references": [
            "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
            "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
            "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
            "https://podcasts.apple.com/us/podcast/lazarus",
            "http://help.aiseesoft.jp/video-converter-ultimate/",
            "http://help.aiseesoft.jp/blu-ray-player",
            "http://help.aiseesoft.jp/fonelab/",
            "https://action.aiseesoft.jp/itunes.php",
            "http://help.aiseesoft.jp/total-video-converter",
            "http://help.aiseesoft.jp/total-video-converter/",
            "http://help.aiseesoft.jp/video-converter-ultimate/",
            "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
            "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
            "http://test-firstmile.digitecgalaxus.ch",
            "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
            "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
            "cdn.rss.applemarketingtools.com",
            "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
            "1.bing.com.cn",
            "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
            "www.phantomcameras.cn",
            "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
            "podcasts.apple.com \u2022 23.34.32.21",
            "www.apple.com \u2022 23.34.32.199",
            "js-cdn.music.apple.com \u2022 23.78.51.170",
            "http://firstmile.digitecgalaxus.ch",
            "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
            "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
            "Tulach.cc",
            "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
            "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
            "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
            "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
            "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
            "asp.net domain pointer",
            "developer.x.com",
            "aotx.alienvault.com (aotx.?)",
            "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
            "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1020.001",
              "name": "Traffic Duplication",
              "display_name": "T1020.001 - Traffic Duplication"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591.002",
              "name": "Business Relationships",
              "display_name": "T1591.002 - Business Relationships"
            },
            {
              "id": "T1591.001",
              "name": "Determine Physical Locations",
              "display_name": "T1591.001 - Determine Physical Locations"
            },
            {
              "id": "T1585.001",
              "name": "Social Media Accounts",
              "display_name": "T1585.001 - Social Media Accounts"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1055.012",
              "name": "Process Hollowing",
              "display_name": "T1055.012 - Process Hollowing"
            },
            {
              "id": "T1432",
              "name": "Access Contact List",
              "display_name": "T1432 - Access Contact List"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1029,
            "domain": 396,
            "email": 7,
            "URL": 2784,
            "FileHash-SHA256": 898,
            "FileHash-MD5": 79,
            "FileHash-SHA1": 68,
            "IPv4": 35,
            "CVE": 1,
            "SSLCertFingerprint": 13
          },
          "indicator_count": 5310,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "5 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69a2127d12dce12538b57d72",
          "name": "FBI Files | Tor device connection | Unique attack against (non -criminal) monitored targets  ~ Apple Jacked Targets",
          "description": "Remote Attack - FBI Files | Tor device connection | Unique attack against (non -criminal) monitored targets.\n\nChecked search history on a targeted device and found an FBI link apparently delivered via unknown AI technology.\n|| yara detections\nzur foerderung\nA\n+ Add Tag\n\u8840\nCount: 1\nGRO Probability: 1\nText: Suricata Alerts Event\nCategory Description CID\nIND131.188.40.12g otx.alienvault.com\nlocal:49181 (TCP) Misc\nAttack ET TOR Known Tor\nRelay/Router (Not Exit)\n\"A\" | [[Next pulse will list on malware, rats , bats, Trojans used]",
          "modified": "2026-03-29T20:03:36.333000",
          "created": "2026-02-27T21:54:05.261000",
          "tags": [
            "pattern match",
            "heuristic match",
            "all url",
            "files domain",
            "pulses otx",
            "germany unknown",
            "aaaa",
            "ip address",
            "emails",
            "gmt server",
            "vary",
            "modified",
            "accept",
            "title",
            "present feb",
            "present jan",
            "united",
            "part",
            "moved",
            "passive dns",
            "cname",
            "final",
            "bill",
            "antivm",
            "xlsx",
            "xlsm",
            "urls",
            "otx logo",
            "all hostname",
            "server",
            "organization",
            "city",
            "stateprovince",
            "postal code",
            "phone",
            "registrar abuse",
            "privacy admin",
            "paris admin",
            "april",
            "direct",
            "february",
            "http",
            "dfn verein",
            "zur foerderung",
            "domain",
            "page url",
            "tags",
            "de summary",
            "erlangen",
            "germany",
            "securitytrails",
            "de seen",
            "general info",
            "geo erlangen",
            "as as680",
            "de note",
            "route",
            "data upload",
            "extraction",
            "failed",
            "extra data",
            "referen",
            "include review",
            "exclude data",
            "summary",
            "url age",
            "as680",
            "se source",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "over",
            "ascii text",
            "mitre att",
            "size",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "node traffic",
            "tlsv1",
            "search",
            "rgba",
            "medium",
            "read c",
            "module load",
            "t1129",
            "execution",
            "next",
            "dock",
            "write",
            "persistence",
            "calls",
            "apis",
            "reads",
            "model",
            "value",
            "getprocaddress",
            "show technique",
            "ck matrix",
            "access type",
            "windir",
            "regexp",
            "open",
            "date",
            "format",
            "virtual disk drive",
            "sha256",
            "sha1",
            "body",
            "filehashsha1",
            "found",
            "unknown",
            "stop",
            "root",
            "form",
            "9999",
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "hybrid analysis",
            "api key",
            "vetting process",
            "please note",
            "please",
            "bad traffic",
            "et info",
            "tls handshake",
            "failure",
            "flag",
            "analysis tip",
            "openurl c",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "show",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "malicious yara",
            "detections none",
            "less ip",
            "dynamicloader",
            "get na",
            "c3bhaw",
            "high",
            "copy",
            "guard",
            "push",
            "Palantir",
            "Foundry",
            "Whitehouse",
            "X.Com",
            "Justice.gov",
            "Apple",
            "AI",
            "node traffic"
          ],
          "references": [
            "tor.sebastianhahn.net \u2022 dap.digitalgov.gov \u2022 fbi.gov \u2022  x.com \u2022 sebastianhahn.net",
            "https://tor.sebastianhahn.net \u2022 faui2k9.de\t \u2022 gitbot.faui2k9.de \u2022 tor-dirauth.sebastianhahn.net \u2022",
            "http://truefoundry.prodigaltech.com/",
            "git.spywarewatchdog.org",
            "marriott-control-prd.accenture.cn",
            "marriott-datacenter-prd.accenture.cn",
            "accenture.cn",
            "c.j.location.host \u2022 videodata.video \u2022 referrer.search",
            "target.id  \u2022 tostring.call  \u2022 title.search",
            "https://hybrid-analysis.com/sample/2f05feed2065b7385b156ebf3a7c6c19def3d412227cee0d46e8a53fb3e9ac41/697bc423b6e7a4dc46010737",
            "https://hybrid-analysis.com/sample/430c376c1754f1f160e3d68bafc970eba37811bdb08d73a86bf6f4be1e7267b3/69a1ea603a3303fa120dad19",
            "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70/69a19551cb5537805706bca9",
            "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
            "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
            "calathea-containers.palantirfedstart.com \u2018 BYE ALREADY\u2019",
            "http://truefoundry.prodigaltech.com/",
            "Attacker being used by several legal entities attacking a target\u2019s family",
            "Clyde &Co | Chris Ahmann | Brian Sabey /Hall & Evans & Hall Render",
            "Luxury Apartments and Townhome communities do use Foundry Palantir",
            "Some Colorado communities have been taken over by the State Government",
            "Quasi Government: Specifically Pinnacol and Commerce & Industry ( AIG)",
            "Denver Justice System. Palantir allegedly moved  potato Headquarters to Miami",
            "Foundry Foot Soldiers are still in Colorado targeting innocents",
            "Foundry Palantir still has a presence in Colorado",
            "I need some help.",
            "Accurately tipped about air travel safety. In past. Proven true.",
            "Tipped of new looming airline threats",
            "Tipped on hits and other savage plans  to be executed against targets. Targets can be any (1) person.",
            "Sound crazy. We know Palantir commits ALL manner of crime. They are money motivated.",
            "FBI files opened up on a targeted phone, Iunseel, only in search history.",
            "Air Safety: it\u2019s important to have  passengers or hackers unable  to communicate via airline networks /",
            "No phones or circuit board tech. Smart watches.You can\u2019t bring large bottles of hygiene products. Deal with a new reality!",
            "Hours after files were deemed malicious. We powered on targeted Smart TV",
            "You have to go through a series of steps to change themes and wallpapers , including powering off TV",
            "Significant? The screen once had a floral theme. Now a black background with a single fish as Wallpaper .",
            "A man claiming to have the name Sebastian is communicating with targets love one",
            "Uses code, no phone calls. Connected via instagram.",
            "I\u2019m not sure what brings man to from NY to Denver today. I consider him malicious",
            "By remote view of NEW targeys view, all key calls are routed through him.",
            "Targets associated warned. Not very open to advice.",
            "I would post his public information. It may be unwise.",
            "Connects to all NEW targets key contacts main targets contacts.",
            "We have foot soldiers. Be aware",
            "https://www.justice.gov/opa/pr/departmen.t",
            "https://api.manus.im/api/oauth2_callback/apple",
            "https://apple.btprmjo.cc/",
            "https://creative.miqdigital.com/.well-known/apple-app-site-association",
            "internationalfrontier.com",
            "http://www.internationalfrontier.com/i/pdf/2017-04-03-IFR-2017.pdf",
            "http://www.internationalfrontier.com",
            "http://www.internationalfrontier.com/i/pdf/Montana-Presentation-2011.pdf",
            "https://tylerjoycedenver.followupboss.com/unsubscribe/T6pEHkEaLZAN5Jxflvspix0zKbJZwfY9pjBpUTk7q06azxItZ7aiRb7brQhy1NNFqrcrUe4cKmI455MBqcwK9_it6dqx6QWdANshp0om1Bv-5ezKkyVJDphCHvPQNvMupI1owe03rtqYAyu8Cj3cWw~~",
            "Related to: https://otx.alienvault.com/pulse/69a1a73eb0578b92962dae97"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Node Traffic",
              "display_name": "Node Traffic",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1048",
              "name": "Exfiltration Over Alternative Protocol",
              "display_name": "T1048 - Exfiltration Over Alternative Protocol"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1048.003",
              "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
              "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1007",
              "name": "System Service Discovery",
              "display_name": "T1007 - System Service Discovery"
            },
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1055.011",
              "name": "Extra Window Memory Injection",
              "display_name": "T1055.011 - Extra Window Memory Injection"
            },
            {
              "id": "T1055.001",
              "name": "Dynamic-link Library Injection",
              "display_name": "T1055.001 - Dynamic-link Library Injection"
            },
            {
              "id": "T1055.004",
              "name": "Asynchronous Procedure Call",
              "display_name": "T1055.004 - Asynchronous Procedure Call"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1055.014",
              "name": "VDSO Hijacking",
              "display_name": "T1055.014 - VDSO Hijacking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5643,
            "domain": 700,
            "hostname": 1918,
            "FileHash-SHA256": 1161,
            "FileHash-MD5": 235,
            "email": 4,
            "FileHash-SHA1": 200,
            "CVE": 1,
            "CIDR": 2,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 9873,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "21 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69aa019f4509897e354fe029",
          "name": "credit Q Vashti Cloned Pulse ",
          "description": "",
          "modified": "2026-03-29T20:03:36.333000",
          "created": "2026-03-05T22:20:15.324000",
          "tags": [
            "pattern match",
            "heuristic match",
            "all url",
            "files domain",
            "pulses otx",
            "germany unknown",
            "aaaa",
            "ip address",
            "emails",
            "gmt server",
            "vary",
            "modified",
            "accept",
            "title",
            "present feb",
            "present jan",
            "united",
            "part",
            "moved",
            "passive dns",
            "cname",
            "final",
            "bill",
            "antivm",
            "xlsx",
            "xlsm",
            "urls",
            "otx logo",
            "all hostname",
            "server",
            "organization",
            "city",
            "stateprovince",
            "postal code",
            "phone",
            "registrar abuse",
            "privacy admin",
            "paris admin",
            "april",
            "direct",
            "february",
            "http",
            "dfn verein",
            "zur foerderung",
            "domain",
            "page url",
            "tags",
            "de summary",
            "erlangen",
            "germany",
            "securitytrails",
            "de seen",
            "general info",
            "geo erlangen",
            "as as680",
            "de note",
            "route",
            "data upload",
            "extraction",
            "failed",
            "extra data",
            "referen",
            "include review",
            "exclude data",
            "summary",
            "url age",
            "as680",
            "se source",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "over",
            "ascii text",
            "mitre att",
            "size",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "node traffic",
            "tlsv1",
            "search",
            "rgba",
            "medium",
            "read c",
            "module load",
            "t1129",
            "execution",
            "next",
            "dock",
            "write",
            "persistence",
            "calls",
            "apis",
            "reads",
            "model",
            "value",
            "getprocaddress",
            "show technique",
            "ck matrix",
            "access type",
            "windir",
            "regexp",
            "open",
            "date",
            "format",
            "virtual disk drive",
            "sha256",
            "sha1",
            "body",
            "filehashsha1",
            "found",
            "unknown",
            "stop",
            "root",
            "form",
            "9999",
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "hybrid analysis",
            "api key",
            "vetting process",
            "please note",
            "please",
            "bad traffic",
            "et info",
            "tls handshake",
            "failure",
            "flag",
            "analysis tip",
            "openurl c",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "show",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "malicious yara",
            "detections none",
            "less ip",
            "dynamicloader",
            "get na",
            "c3bhaw",
            "high",
            "copy",
            "guard",
            "push",
            "Palantir",
            "Foundry",
            "Whitehouse",
            "X.Com",
            "Justice.gov",
            "Apple",
            "AI",
            "node traffic"
          ],
          "references": [
            "tor.sebastianhahn.net \u2022 dap.digitalgov.gov \u2022 fbi.gov \u2022  x.com \u2022 sebastianhahn.net",
            "https://tor.sebastianhahn.net \u2022 faui2k9.de\t \u2022 gitbot.faui2k9.de \u2022 tor-dirauth.sebastianhahn.net \u2022",
            "http://truefoundry.prodigaltech.com/",
            "git.spywarewatchdog.org",
            "marriott-control-prd.accenture.cn",
            "marriott-datacenter-prd.accenture.cn",
            "accenture.cn",
            "c.j.location.host \u2022 videodata.video \u2022 referrer.search",
            "target.id  \u2022 tostring.call  \u2022 title.search",
            "https://hybrid-analysis.com/sample/2f05feed2065b7385b156ebf3a7c6c19def3d412227cee0d46e8a53fb3e9ac41/697bc423b6e7a4dc46010737",
            "https://hybrid-analysis.com/sample/430c376c1754f1f160e3d68bafc970eba37811bdb08d73a86bf6f4be1e7267b3/69a1ea603a3303fa120dad19",
            "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70/69a19551cb5537805706bca9",
            "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
            "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
            "calathea-containers.palantirfedstart.com \u2018 BYE ALREADY\u2019",
            "http://truefoundry.prodigaltech.com/",
            "Attacker being used by several legal entities attacking a target\u2019s family",
            "Clyde &Co | Chris Ahmann | Brian Sabey /Hall & Evans & Hall Render",
            "Luxury Apartments and Townhome communities do use Foundry Palantir",
            "Some Colorado communities have been taken over by the State Government",
            "Quasi Government: Specifically Pinnacol and Commerce & Industry ( AIG)",
            "Denver Justice System. Palantir allegedly moved  potato Headquarters to Miami",
            "Foundry Foot Soldiers are still in Colorado targeting innocents",
            "Foundry Palantir still has a presence in Colorado",
            "I need some help.",
            "Accurately tipped about air travel safety. In past. Proven true.",
            "Tipped of new looming airline threats",
            "Tipped on hits and other savage plans  to be executed against targets. Targets can be any (1) person.",
            "Sound crazy. We know Palantir commits ALL manner of crime. They are money motivated.",
            "FBI files opened up on a targeted phone, Iunseel, only in search history.",
            "Air Safety: it\u2019s important to have  passengers or hackers unable  to communicate via airline networks /",
            "No phones or circuit board tech. Smart watches.You can\u2019t bring large bottles of hygiene products. Deal with a new reality!",
            "Hours after files were deemed malicious. We powered on targeted Smart TV",
            "You have to go through a series of steps to change themes and wallpapers , including powering off TV",
            "Significant? The screen once had a floral theme. Now a black background with a single fish as Wallpaper .",
            "A man claiming to have the name Sebastian is communicating with targets love one",
            "Uses code, no phone calls. Connected via instagram.",
            "I\u2019m not sure what brings man to from NY to Denver today. I consider him malicious",
            "By remote view of NEW targeys view, all key calls are routed through him.",
            "Targets associated warned. Not very open to advice.",
            "I would post his public information. It may be unwise.",
            "Connects to all NEW targets key contacts main targets contacts.",
            "We have foot soldiers. Be aware",
            "https://www.justice.gov/opa/pr/departmen.t",
            "https://api.manus.im/api/oauth2_callback/apple",
            "https://apple.btprmjo.cc/",
            "https://creative.miqdigital.com/.well-known/apple-app-site-association",
            "internationalfrontier.com",
            "http://www.internationalfrontier.com/i/pdf/2017-04-03-IFR-2017.pdf",
            "http://www.internationalfrontier.com",
            "http://www.internationalfrontier.com/i/pdf/Montana-Presentation-2011.pdf",
            "https://tylerjoycedenver.followupboss.com/unsubscribe/T6pEHkEaLZAN5Jxflvspix0zKbJZwfY9pjBpUTk7q06azxItZ7aiRb7brQhy1NNFqrcrUe4cKmI455MBqcwK9_it6dqx6QWdANshp0om1Bv-5ezKkyVJDphCHvPQNvMupI1owe03rtqYAyu8Cj3cWw~~",
            "Related to: https://otx.alienvault.com/pulse/69a1a73eb0578b92962dae97"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Node Traffic",
              "display_name": "Node Traffic",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1048",
              "name": "Exfiltration Over Alternative Protocol",
              "display_name": "T1048 - Exfiltration Over Alternative Protocol"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1048.003",
              "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
              "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1007",
              "name": "System Service Discovery",
              "display_name": "T1007 - System Service Discovery"
            },
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1055.011",
              "name": "Extra Window Memory Injection",
              "display_name": "T1055.011 - Extra Window Memory Injection"
            },
            {
              "id": "T1055.001",
              "name": "Dynamic-link Library Injection",
              "display_name": "T1055.001 - Dynamic-link Library Injection"
            },
            {
              "id": "T1055.004",
              "name": "Asynchronous Procedure Call",
              "display_name": "T1055.004 - Asynchronous Procedure Call"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1055.014",
              "name": "VDSO Hijacking",
              "display_name": "T1055.014 - VDSO Hijacking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "69a2127d12dce12538b57d72",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5644,
            "domain": 701,
            "hostname": 1920,
            "FileHash-SHA256": 1161,
            "FileHash-MD5": 235,
            "email": 4,
            "FileHash-SHA1": 200,
            "CVE": 1,
            "CIDR": 2,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 9877,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 49,
          "modified_text": "21 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://www.internationalfrontier.com/i/pdf/2017-04-03-IFR-2017.pdf",
        "aotx.alienvault.com (aotx.?)",
        "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
        "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
        "https://podcasts.apple.com/us/podcast/lazarus",
        "http://firstmile.digitecgalaxus.ch",
        "http://www.internationalfrontier.com/i/pdf/Montana-Presentation-2011.pdf",
        "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
        "developer.x.com",
        "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
        "www.phantomcameras.cn",
        "Air Safety: it\u2019s important to have  passengers or hackers unable  to communicate via airline networks /",
        "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
        "Denver Justice System. Palantir allegedly moved  potato Headquarters to Miami",
        "http://help.aiseesoft.jp/total-video-converter/",
        "podcasts.apple.com \u2022 23.34.32.21",
        "http://truefoundry.prodigaltech.com/",
        "Targets associated warned. Not very open to advice.",
        "http://test-firstmile.digitecgalaxus.ch",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "http://www.internationalfrontier.com",
        "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
        "marriott-datacenter-prd.accenture.cn",
        "Significant? The screen once had a floral theme. Now a black background with a single fish as Wallpaper .",
        "FBI files opened up on a targeted phone, Iunseel, only in search history.",
        "Foundry Palantir still has a presence in Colorado",
        "You have to go through a series of steps to change themes and wallpapers , including powering off TV",
        "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
        "Quasi Government: Specifically Pinnacol and Commerce & Industry ( AIG)",
        "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
        "www.apple.com \u2022 23.34.32.199",
        "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
        "1.bing.com.cn",
        "Tipped of new looming airline threats",
        "https://apple.btprmjo.cc/",
        "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
        "http://help.aiseesoft.jp/total-video-converter",
        "c.j.location.host \u2022 videodata.video \u2022 referrer.search",
        "https://www.justice.gov/opa/pr/departmen.t",
        "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
        "target.id  \u2022 tostring.call  \u2022 title.search",
        "Related to: https://otx.alienvault.com/pulse/69a1a73eb0578b92962dae97",
        "http://help.aiseesoft.jp/blu-ray-player",
        "calathea-containers.palantirfedstart.com \u2018 BYE ALREADY\u2019",
        "https://api.manus.im/api/oauth2_callback/apple",
        "https://tylerjoycedenver.followupboss.com/unsubscribe/T6pEHkEaLZAN5Jxflvspix0zKbJZwfY9pjBpUTk7q06azxItZ7aiRb7brQhy1NNFqrcrUe4cKmI455MBqcwK9_it6dqx6QWdANshp0om1Bv-5ezKkyVJDphCHvPQNvMupI1owe03rtqYAyu8Cj3cWw~~",
        "asp.net domain pointer",
        "Luxury Apartments and Townhome communities do use Foundry Palantir",
        "I need some help.",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70/69a19551cb5537805706bca9",
        "git.spywarewatchdog.org",
        "We have foot soldiers. Be aware",
        "https://hybrid-analysis.com/sample/2f05feed2065b7385b156ebf3a7c6c19def3d412227cee0d46e8a53fb3e9ac41/697bc423b6e7a4dc46010737",
        "No phones or circuit board tech. Smart watches.You can\u2019t bring large bottles of hygiene products. Deal with a new reality!",
        "https://creative.miqdigital.com/.well-known/apple-app-site-association",
        "Hours after files were deemed malicious. We powered on targeted Smart TV",
        "tor.sebastianhahn.net \u2022 dap.digitalgov.gov \u2022 fbi.gov \u2022  x.com \u2022 sebastianhahn.net",
        "I would post his public information. It may be unwise.",
        "Tulach.cc",
        "Foundry Foot Soldiers are still in Colorado targeting innocents",
        "accenture.cn",
        "By remote view of NEW targeys view, all key calls are routed through him.",
        "Accurately tipped about air travel safety. In past. Proven true.",
        "https://action.aiseesoft.jp/itunes.php",
        "A man claiming to have the name Sebastian is communicating with targets love one",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "https://hybrid-analysis.com/sample/430c376c1754f1f160e3d68bafc970eba37811bdb08d73a86bf6f4be1e7267b3/69a1ea603a3303fa120dad19",
        "internationalfrontier.com",
        "Connects to all NEW targets key contacts main targets contacts.",
        "https://tor.sebastianhahn.net \u2022 faui2k9.de\t \u2022 gitbot.faui2k9.de \u2022 tor-dirauth.sebastianhahn.net \u2022",
        "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
        "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f",
        "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
        "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
        "Attacker being used by several legal entities attacking a target\u2019s family",
        "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
        "Clyde &Co | Chris Ahmann | Brian Sabey /Hall & Evans & Hall Render",
        "js-cdn.music.apple.com \u2022 23.78.51.170",
        "Some Colorado communities have been taken over by the State Government",
        "Tipped on hits and other savage plans  to be executed against targets. Targets can be any (1) person.",
        "Sound crazy. We know Palantir commits ALL manner of crime. They are money motivated.",
        "marriott-control-prd.accenture.cn",
        "Uses code, no phone calls. Connected via instagram.",
        "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
        "I\u2019m not sure what brings man to from NY to Denver today. I consider him malicious",
        "cdn.rss.applemarketingtools.com",
        "http://help.aiseesoft.jp/fonelab/",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Node traffic"
          ],
          "industries": [],
          "unique_indicators": 14437
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/planetven.us",
    "whois": "http://whois.domaintools.com/planetven.us",
    "domain": "planetven.us",
    "hostname": "syncthing.planetven.us"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "69ddeb45c45f6a3cd721397d",
      "name": "Active attacks  \u2022 Apple \u2022 Tulach",
      "description": "Including 360+ Apple\nIoC\u2019s from Malicious Tulac.cc + Virtual Servers Pulses. Ongoing history of malicious attacks, custom malware engineer, malicious media , account control. \n\nI was blocked from VirusToltal. It was Tulach Nextcloud posse. What I am doing now s legal. \n\nReferenced below. URL: \"https://accountapple.com/\" contacted related malicious domain: \"accountapple.com\"\nCONTACTED DOMAIN: \"sqllq.com\" has been identified as malicious",
      "modified": "2026-04-14T07:22:45.250000",
      "created": "2026-04-14T07:22:45.250000",
      "tags": [
        "url http",
        "ipv4",
        "indicator role",
        "active related",
        "united",
        "moved",
        "gmt content",
        "certificate",
        "all domain",
        "msie",
        "chrome",
        "extraction",
        "data upload",
        "twitter",
        "cookie",
        "extra",
        "include data",
        "review locs",
        "exclude",
        "suggested os",
        "onlv",
        "failed",
        "stop data",
        "read c",
        "unicode",
        "rgba",
        "memcommit",
        "delete",
        "dock",
        "write",
        "execution",
        "sc type",
        "extri",
        "include review",
        "exclude sugges",
        "typ data",
        "a domains",
        "present apr",
        "script urls",
        "files",
        "files ip",
        "address",
        "ios",
        "mac",
        "apple",
        "appleid",
        "itunes",
        "next associated",
        "all ipv4",
        "included ic",
        "uny teade",
        "type hostnar",
        "hostnar hostnar",
        "hostnar",
        "macair",
        "macairaustralia",
        "ipad",
        "ipod",
        "cryptexportkey",
        "invalid pointer",
        "cryptgenkey",
        "stream",
        "defender",
        "delphi",
        "class",
        "stack",
        "format",
        "unknown",
        "united states",
        "phishing",
        "password",
        "traffic redirected",
        "service mod",
        "service execution",
        "youtube",
        "music",
        "streams",
        "songs",
        "played songs",
        "music streams",
        "most played",
        "fonelab",
        "indicator",
        "included iocs",
        "manually add",
        "review ocs",
        "exclude inn",
        "sugges data",
        "find",
        "include",
        "url https",
        "enter sc",
        "type",
        "no matchme",
        "search otx",
        "https",
        "references x",
        "analyze",
        "open th",
        "url data",
        "se http",
        "no match",
        "excluded iocs",
        "iocs",
        "ip whitelisted",
        "whitelisted",
        "tcp include",
        "analysis date",
        "file score",
        "medium risk",
        "yara detections",
        "contacted",
        "related tags",
        "x vercel",
        "file type",
        "type indicator",
        "role title",
        "related pulses",
        "mulch virtua",
        "library loade",
        "included i0",
        "review ioc",
        "excluded ic",
        "suggested",
        "find sugt",
        "samuel tulach",
        "unity engine",
        "tulach",
        "sa awareness",
        "sabey",
        "sar cut",
        "autofill",
        "includer review",
        "portiana oney",
        "targeting",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "musickit_1_.js",
        "lazarus",
        "injection",
        "CVE-2017-8570",
        "prefetch2",
        "target",
        "aaaa",
        "ip address",
        "record value",
        "emails",
        "samuel tuachs",
        "sapev",
        "review exclude",
        "monitored target",
        "script",
        "mitre att",
        "ascii text",
        "span",
        "path",
        "iframe",
        "april",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "body",
        "development att",
        "t1055.012 list planting",
        "active"
      ],
      "references": [
        "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
        "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
        "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
        "https://podcasts.apple.com/us/podcast/lazarus",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "http://help.aiseesoft.jp/blu-ray-player",
        "http://help.aiseesoft.jp/fonelab/",
        "https://action.aiseesoft.jp/itunes.php",
        "http://help.aiseesoft.jp/total-video-converter",
        "http://help.aiseesoft.jp/total-video-converter/",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
        "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
        "http://test-firstmile.digitecgalaxus.ch",
        "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
        "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
        "cdn.rss.applemarketingtools.com",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "1.bing.com.cn",
        "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
        "www.phantomcameras.cn",
        "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
        "podcasts.apple.com \u2022 23.34.32.21",
        "www.apple.com \u2022 23.34.32.199",
        "js-cdn.music.apple.com \u2022 23.78.51.170",
        "http://firstmile.digitecgalaxus.ch",
        "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
        "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
        "Tulach.cc",
        "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
        "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
        "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
        "asp.net domain pointer",
        "developer.x.com",
        "aotx.alienvault.com (aotx.?)",
        "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
        "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1020.001",
          "name": "Traffic Duplication",
          "display_name": "T1020.001 - Traffic Duplication"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591.002",
          "name": "Business Relationships",
          "display_name": "T1591.002 - Business Relationships"
        },
        {
          "id": "T1591.001",
          "name": "Determine Physical Locations",
          "display_name": "T1591.001 - Determine Physical Locations"
        },
        {
          "id": "T1585.001",
          "name": "Social Media Accounts",
          "display_name": "T1585.001 - Social Media Accounts"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1055.012",
          "name": "Process Hollowing",
          "display_name": "T1055.012 - Process Hollowing"
        },
        {
          "id": "T1432",
          "name": "Access Contact List",
          "display_name": "T1432 - Access Contact List"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1029,
        "domain": 396,
        "email": 7,
        "URL": 2784,
        "FileHash-SHA256": 898,
        "FileHash-MD5": 79,
        "FileHash-SHA1": 68,
        "IPv4": 35,
        "CVE": 1,
        "SSLCertFingerprint": 13
      },
      "indicator_count": 5310,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "5 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69a2127d12dce12538b57d72",
      "name": "FBI Files | Tor device connection | Unique attack against (non -criminal) monitored targets  ~ Apple Jacked Targets",
      "description": "Remote Attack - FBI Files | Tor device connection | Unique attack against (non -criminal) monitored targets.\n\nChecked search history on a targeted device and found an FBI link apparently delivered via unknown AI technology.\n|| yara detections\nzur foerderung\nA\n+ Add Tag\n\u8840\nCount: 1\nGRO Probability: 1\nText: Suricata Alerts Event\nCategory Description CID\nIND131.188.40.12g otx.alienvault.com\nlocal:49181 (TCP) Misc\nAttack ET TOR Known Tor\nRelay/Router (Not Exit)\n\"A\" | [[Next pulse will list on malware, rats , bats, Trojans used]",
      "modified": "2026-03-29T20:03:36.333000",
      "created": "2026-02-27T21:54:05.261000",
      "tags": [
        "pattern match",
        "heuristic match",
        "all url",
        "files domain",
        "pulses otx",
        "germany unknown",
        "aaaa",
        "ip address",
        "emails",
        "gmt server",
        "vary",
        "modified",
        "accept",
        "title",
        "present feb",
        "present jan",
        "united",
        "part",
        "moved",
        "passive dns",
        "cname",
        "final",
        "bill",
        "antivm",
        "xlsx",
        "xlsm",
        "urls",
        "otx logo",
        "all hostname",
        "server",
        "organization",
        "city",
        "stateprovince",
        "postal code",
        "phone",
        "registrar abuse",
        "privacy admin",
        "paris admin",
        "april",
        "direct",
        "february",
        "http",
        "dfn verein",
        "zur foerderung",
        "domain",
        "page url",
        "tags",
        "de summary",
        "erlangen",
        "germany",
        "securitytrails",
        "de seen",
        "general info",
        "geo erlangen",
        "as as680",
        "de note",
        "route",
        "data upload",
        "extraction",
        "failed",
        "extra data",
        "referen",
        "include review",
        "exclude data",
        "summary",
        "url age",
        "as680",
        "se source",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "over",
        "ascii text",
        "mitre att",
        "size",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "node traffic",
        "tlsv1",
        "search",
        "rgba",
        "medium",
        "read c",
        "module load",
        "t1129",
        "execution",
        "next",
        "dock",
        "write",
        "persistence",
        "calls",
        "apis",
        "reads",
        "model",
        "value",
        "getprocaddress",
        "show technique",
        "ck matrix",
        "access type",
        "windir",
        "regexp",
        "open",
        "date",
        "format",
        "virtual disk drive",
        "sha256",
        "sha1",
        "body",
        "filehashsha1",
        "found",
        "unknown",
        "stop",
        "root",
        "form",
        "9999",
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "hybrid analysis",
        "api key",
        "vetting process",
        "please note",
        "please",
        "bad traffic",
        "et info",
        "tls handshake",
        "failure",
        "flag",
        "analysis tip",
        "openurl c",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "show",
        "pulse pulses",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "malicious yara",
        "detections none",
        "less ip",
        "dynamicloader",
        "get na",
        "c3bhaw",
        "high",
        "copy",
        "guard",
        "push",
        "Palantir",
        "Foundry",
        "Whitehouse",
        "X.Com",
        "Justice.gov",
        "Apple",
        "AI",
        "node traffic"
      ],
      "references": [
        "tor.sebastianhahn.net \u2022 dap.digitalgov.gov \u2022 fbi.gov \u2022  x.com \u2022 sebastianhahn.net",
        "https://tor.sebastianhahn.net \u2022 faui2k9.de\t \u2022 gitbot.faui2k9.de \u2022 tor-dirauth.sebastianhahn.net \u2022",
        "http://truefoundry.prodigaltech.com/",
        "git.spywarewatchdog.org",
        "marriott-control-prd.accenture.cn",
        "marriott-datacenter-prd.accenture.cn",
        "accenture.cn",
        "c.j.location.host \u2022 videodata.video \u2022 referrer.search",
        "target.id  \u2022 tostring.call  \u2022 title.search",
        "https://hybrid-analysis.com/sample/2f05feed2065b7385b156ebf3a7c6c19def3d412227cee0d46e8a53fb3e9ac41/697bc423b6e7a4dc46010737",
        "https://hybrid-analysis.com/sample/430c376c1754f1f160e3d68bafc970eba37811bdb08d73a86bf6f4be1e7267b3/69a1ea603a3303fa120dad19",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70/69a19551cb5537805706bca9",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
        "calathea-containers.palantirfedstart.com \u2018 BYE ALREADY\u2019",
        "http://truefoundry.prodigaltech.com/",
        "Attacker being used by several legal entities attacking a target\u2019s family",
        "Clyde &Co | Chris Ahmann | Brian Sabey /Hall & Evans & Hall Render",
        "Luxury Apartments and Townhome communities do use Foundry Palantir",
        "Some Colorado communities have been taken over by the State Government",
        "Quasi Government: Specifically Pinnacol and Commerce & Industry ( AIG)",
        "Denver Justice System. Palantir allegedly moved  potato Headquarters to Miami",
        "Foundry Foot Soldiers are still in Colorado targeting innocents",
        "Foundry Palantir still has a presence in Colorado",
        "I need some help.",
        "Accurately tipped about air travel safety. In past. Proven true.",
        "Tipped of new looming airline threats",
        "Tipped on hits and other savage plans  to be executed against targets. Targets can be any (1) person.",
        "Sound crazy. We know Palantir commits ALL manner of crime. They are money motivated.",
        "FBI files opened up on a targeted phone, Iunseel, only in search history.",
        "Air Safety: it\u2019s important to have  passengers or hackers unable  to communicate via airline networks /",
        "No phones or circuit board tech. Smart watches.You can\u2019t bring large bottles of hygiene products. Deal with a new reality!",
        "Hours after files were deemed malicious. We powered on targeted Smart TV",
        "You have to go through a series of steps to change themes and wallpapers , including powering off TV",
        "Significant? The screen once had a floral theme. Now a black background with a single fish as Wallpaper .",
        "A man claiming to have the name Sebastian is communicating with targets love one",
        "Uses code, no phone calls. Connected via instagram.",
        "I\u2019m not sure what brings man to from NY to Denver today. I consider him malicious",
        "By remote view of NEW targeys view, all key calls are routed through him.",
        "Targets associated warned. Not very open to advice.",
        "I would post his public information. It may be unwise.",
        "Connects to all NEW targets key contacts main targets contacts.",
        "We have foot soldiers. Be aware",
        "https://www.justice.gov/opa/pr/departmen.t",
        "https://api.manus.im/api/oauth2_callback/apple",
        "https://apple.btprmjo.cc/",
        "https://creative.miqdigital.com/.well-known/apple-app-site-association",
        "internationalfrontier.com",
        "http://www.internationalfrontier.com/i/pdf/2017-04-03-IFR-2017.pdf",
        "http://www.internationalfrontier.com",
        "http://www.internationalfrontier.com/i/pdf/Montana-Presentation-2011.pdf",
        "https://tylerjoycedenver.followupboss.com/unsubscribe/T6pEHkEaLZAN5Jxflvspix0zKbJZwfY9pjBpUTk7q06azxItZ7aiRb7brQhy1NNFqrcrUe4cKmI455MBqcwK9_it6dqx6QWdANshp0om1Bv-5ezKkyVJDphCHvPQNvMupI1owe03rtqYAyu8Cj3cWw~~",
        "Related to: https://otx.alienvault.com/pulse/69a1a73eb0578b92962dae97"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Node Traffic",
          "display_name": "Node Traffic",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1048",
          "name": "Exfiltration Over Alternative Protocol",
          "display_name": "T1048 - Exfiltration Over Alternative Protocol"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1048.003",
          "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
          "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1007",
          "name": "System Service Discovery",
          "display_name": "T1007 - System Service Discovery"
        },
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1055.011",
          "name": "Extra Window Memory Injection",
          "display_name": "T1055.011 - Extra Window Memory Injection"
        },
        {
          "id": "T1055.001",
          "name": "Dynamic-link Library Injection",
          "display_name": "T1055.001 - Dynamic-link Library Injection"
        },
        {
          "id": "T1055.004",
          "name": "Asynchronous Procedure Call",
          "display_name": "T1055.004 - Asynchronous Procedure Call"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1055.014",
          "name": "VDSO Hijacking",
          "display_name": "T1055.014 - VDSO Hijacking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 5643,
        "domain": 700,
        "hostname": 1918,
        "FileHash-SHA256": 1161,
        "FileHash-MD5": 235,
        "email": 4,
        "FileHash-SHA1": 200,
        "CVE": 1,
        "CIDR": 2,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 9873,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "21 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69aa019f4509897e354fe029",
      "name": "credit Q Vashti Cloned Pulse ",
      "description": "",
      "modified": "2026-03-29T20:03:36.333000",
      "created": "2026-03-05T22:20:15.324000",
      "tags": [
        "pattern match",
        "heuristic match",
        "all url",
        "files domain",
        "pulses otx",
        "germany unknown",
        "aaaa",
        "ip address",
        "emails",
        "gmt server",
        "vary",
        "modified",
        "accept",
        "title",
        "present feb",
        "present jan",
        "united",
        "part",
        "moved",
        "passive dns",
        "cname",
        "final",
        "bill",
        "antivm",
        "xlsx",
        "xlsm",
        "urls",
        "otx logo",
        "all hostname",
        "server",
        "organization",
        "city",
        "stateprovince",
        "postal code",
        "phone",
        "registrar abuse",
        "privacy admin",
        "paris admin",
        "april",
        "direct",
        "february",
        "http",
        "dfn verein",
        "zur foerderung",
        "domain",
        "page url",
        "tags",
        "de summary",
        "erlangen",
        "germany",
        "securitytrails",
        "de seen",
        "general info",
        "geo erlangen",
        "as as680",
        "de note",
        "route",
        "data upload",
        "extraction",
        "failed",
        "extra data",
        "referen",
        "include review",
        "exclude data",
        "summary",
        "url age",
        "as680",
        "se source",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "over",
        "ascii text",
        "mitre att",
        "size",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "node traffic",
        "tlsv1",
        "search",
        "rgba",
        "medium",
        "read c",
        "module load",
        "t1129",
        "execution",
        "next",
        "dock",
        "write",
        "persistence",
        "calls",
        "apis",
        "reads",
        "model",
        "value",
        "getprocaddress",
        "show technique",
        "ck matrix",
        "access type",
        "windir",
        "regexp",
        "open",
        "date",
        "format",
        "virtual disk drive",
        "sha256",
        "sha1",
        "body",
        "filehashsha1",
        "found",
        "unknown",
        "stop",
        "root",
        "form",
        "9999",
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "hybrid analysis",
        "api key",
        "vetting process",
        "please note",
        "please",
        "bad traffic",
        "et info",
        "tls handshake",
        "failure",
        "flag",
        "analysis tip",
        "openurl c",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "show",
        "pulse pulses",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "malicious yara",
        "detections none",
        "less ip",
        "dynamicloader",
        "get na",
        "c3bhaw",
        "high",
        "copy",
        "guard",
        "push",
        "Palantir",
        "Foundry",
        "Whitehouse",
        "X.Com",
        "Justice.gov",
        "Apple",
        "AI",
        "node traffic"
      ],
      "references": [
        "tor.sebastianhahn.net \u2022 dap.digitalgov.gov \u2022 fbi.gov \u2022  x.com \u2022 sebastianhahn.net",
        "https://tor.sebastianhahn.net \u2022 faui2k9.de\t \u2022 gitbot.faui2k9.de \u2022 tor-dirauth.sebastianhahn.net \u2022",
        "http://truefoundry.prodigaltech.com/",
        "git.spywarewatchdog.org",
        "marriott-control-prd.accenture.cn",
        "marriott-datacenter-prd.accenture.cn",
        "accenture.cn",
        "c.j.location.host \u2022 videodata.video \u2022 referrer.search",
        "target.id  \u2022 tostring.call  \u2022 title.search",
        "https://hybrid-analysis.com/sample/2f05feed2065b7385b156ebf3a7c6c19def3d412227cee0d46e8a53fb3e9ac41/697bc423b6e7a4dc46010737",
        "https://hybrid-analysis.com/sample/430c376c1754f1f160e3d68bafc970eba37811bdb08d73a86bf6f4be1e7267b3/69a1ea603a3303fa120dad19",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70/69a19551cb5537805706bca9",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
        "calathea-containers.palantirfedstart.com \u2018 BYE ALREADY\u2019",
        "http://truefoundry.prodigaltech.com/",
        "Attacker being used by several legal entities attacking a target\u2019s family",
        "Clyde &Co | Chris Ahmann | Brian Sabey /Hall & Evans & Hall Render",
        "Luxury Apartments and Townhome communities do use Foundry Palantir",
        "Some Colorado communities have been taken over by the State Government",
        "Quasi Government: Specifically Pinnacol and Commerce & Industry ( AIG)",
        "Denver Justice System. Palantir allegedly moved  potato Headquarters to Miami",
        "Foundry Foot Soldiers are still in Colorado targeting innocents",
        "Foundry Palantir still has a presence in Colorado",
        "I need some help.",
        "Accurately tipped about air travel safety. In past. Proven true.",
        "Tipped of new looming airline threats",
        "Tipped on hits and other savage plans  to be executed against targets. Targets can be any (1) person.",
        "Sound crazy. We know Palantir commits ALL manner of crime. They are money motivated.",
        "FBI files opened up on a targeted phone, Iunseel, only in search history.",
        "Air Safety: it\u2019s important to have  passengers or hackers unable  to communicate via airline networks /",
        "No phones or circuit board tech. Smart watches.You can\u2019t bring large bottles of hygiene products. Deal with a new reality!",
        "Hours after files were deemed malicious. We powered on targeted Smart TV",
        "You have to go through a series of steps to change themes and wallpapers , including powering off TV",
        "Significant? The screen once had a floral theme. Now a black background with a single fish as Wallpaper .",
        "A man claiming to have the name Sebastian is communicating with targets love one",
        "Uses code, no phone calls. Connected via instagram.",
        "I\u2019m not sure what brings man to from NY to Denver today. I consider him malicious",
        "By remote view of NEW targeys view, all key calls are routed through him.",
        "Targets associated warned. Not very open to advice.",
        "I would post his public information. It may be unwise.",
        "Connects to all NEW targets key contacts main targets contacts.",
        "We have foot soldiers. Be aware",
        "https://www.justice.gov/opa/pr/departmen.t",
        "https://api.manus.im/api/oauth2_callback/apple",
        "https://apple.btprmjo.cc/",
        "https://creative.miqdigital.com/.well-known/apple-app-site-association",
        "internationalfrontier.com",
        "http://www.internationalfrontier.com/i/pdf/2017-04-03-IFR-2017.pdf",
        "http://www.internationalfrontier.com",
        "http://www.internationalfrontier.com/i/pdf/Montana-Presentation-2011.pdf",
        "https://tylerjoycedenver.followupboss.com/unsubscribe/T6pEHkEaLZAN5Jxflvspix0zKbJZwfY9pjBpUTk7q06azxItZ7aiRb7brQhy1NNFqrcrUe4cKmI455MBqcwK9_it6dqx6QWdANshp0om1Bv-5ezKkyVJDphCHvPQNvMupI1owe03rtqYAyu8Cj3cWw~~",
        "Related to: https://otx.alienvault.com/pulse/69a1a73eb0578b92962dae97"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Node Traffic",
          "display_name": "Node Traffic",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1048",
          "name": "Exfiltration Over Alternative Protocol",
          "display_name": "T1048 - Exfiltration Over Alternative Protocol"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1048.003",
          "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
          "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1007",
          "name": "System Service Discovery",
          "display_name": "T1007 - System Service Discovery"
        },
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1055.011",
          "name": "Extra Window Memory Injection",
          "display_name": "T1055.011 - Extra Window Memory Injection"
        },
        {
          "id": "T1055.001",
          "name": "Dynamic-link Library Injection",
          "display_name": "T1055.001 - Dynamic-link Library Injection"
        },
        {
          "id": "T1055.004",
          "name": "Asynchronous Procedure Call",
          "display_name": "T1055.004 - Asynchronous Procedure Call"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1055.014",
          "name": "VDSO Hijacking",
          "display_name": "T1055.014 - VDSO Hijacking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "69a2127d12dce12538b57d72",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 5644,
        "domain": 701,
        "hostname": 1920,
        "FileHash-SHA256": 1161,
        "FileHash-MD5": 235,
        "email": 4,
        "FileHash-SHA1": 200,
        "CVE": 1,
        "CIDR": 2,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 9877,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 49,
      "modified_text": "21 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "type": "URL",
    "indicator": "https://syncthing.planetven.us",
    "stats": {
      "malicious": 1,
      "suspicious": 0,
      "harmless": 61,
      "undetected": 32,
      "total": 94,
      "verdict": "suspicious",
      "ratio": "1/94"
    },
    "verdict": "suspicious",
    "ratio": "1/94",
    "final_url": "https://syncthing.planetven.us/",
    "title": "",
    "reputation": 0,
    "tags": [],
    "top_detections": [
      {
        "vendor": "SOCRadar",
        "result": "malware",
        "category": "malicious"
      }
    ],
    "last_analysis": 1772208377,
    "error": null
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://syncthing.planetven.us",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776646881.8339782
}