{
  "type": "URL",
  "indicator": "https://test-ransomware.testpanw.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://test-ransomware.testpanw.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4142621303,
      "indicator": "https://test-ransomware.testpanw.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "69dbbce69edaea3a4dd19895",
          "name": "VirusTotal CREATED 38 MINUTES AGO by Q.Vashti clone.",
          "description": "",
          "modified": "2026-04-13T01:03:15.999000",
          "created": "2026-04-12T15:40:22.011000",
          "tags": [
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "size",
            "ascii text",
            "pattern match",
            "mitre att",
            "ck id",
            "meta",
            "virustotal",
            "date",
            "iframe",
            "april",
            "hybrid",
            "apikey",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "title",
            "body"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1115",
              "name": "Clipboard Data",
              "display_name": "T1115 - Clipboard Data"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "69dbb3d8b7fb4d110520d1b1",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 38,
            "FileHash-SHA1": 37,
            "FileHash-SHA256": 115,
            "IPv4": 2,
            "SSLCertFingerprint": 6,
            "URL": 165,
            "domain": 17,
            "hostname": 65
          },
          "indicator_count": 445,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 48,
          "modified_text": "6 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69dc04c12782d2d76c111a93",
          "name": "VirusTotal \u2022 PsBanker \u2022 Attacked / Blocked",
          "description": "",
          "modified": "2026-04-12T20:46:57.338000",
          "created": "2026-04-12T20:46:57.338000",
          "tags": [
            "indicator role",
            "active related",
            "ck ids",
            "files",
            "information",
            "discovery",
            "mitre att",
            "pattern match",
            "ck id",
            "ck matrix",
            "ascii text",
            "united",
            "binary file",
            "april",
            "hybrid",
            "apikey",
            "general",
            "local",
            "path",
            "iframe",
            "click",
            "protocol",
            "learn",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "execution att",
            "related pulses",
            "dll read",
            "function read",
            "icmp traffic",
            "machineguid",
            "systembiosdate",
            "total",
            "read",
            "write",
            "network_icmp",
            "js_eval",
            "recon_fingerprint",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "tls handshake",
            "execution",
            "dock",
            "persistence",
            "malware",
            "unknown",
            "neue",
            "certificate",
            "error",
            "scans show",
            "record value",
            "title site",
            "servers",
            "emails",
            "all hostname",
            "dnsadmin",
            "data upload",
            "extraction",
            "failed",
            "include review",
            "exclude sugges",
            "find s",
            "typ no",
            "active",
            "urls",
            "ip address",
            "asn as54113",
            "registrar",
            "wscript",
            "united states",
            "stcalifornia",
            "lmountain view",
            "ogoogle llc",
            "ogoogle trust",
            "cngts ca",
            "whitelisted",
            "as15169",
            "hostile",
            "crash",
            "contacted",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "detections alf",
            "hostile yara",
            "detections none",
            "less ip",
            "domains",
            "ms windows",
            "intel",
            "pe32",
            "regsetvalueexa",
            "langturkish",
            "sublangdefault",
            "port",
            "destination",
            "entries",
            "worm",
            "delphi",
            "win32",
            "body",
            "explorer",
            "defender",
            "regdword",
            "false",
            "true",
            "end sub",
            "object",
            "createobject",
            "sheetschanged",
            "private sub",
            "string",
            "boolean",
            "cancel",
            "trojan",
            "copy",
            "query",
            "dns update",
            "useragent",
            "myapp",
            "delphi alerts",
            "alerts deadhost",
            "women who code",
            "tulach",
            "114.114.114.114",
            "samuel",
            "brian sabey"
          ],
          "references": [
            "https://www.virustotal.com/gui/search/maxsecure:%22virus.webtoolbar.w32.searchsuite.gen_227097%22%20entity:file",
            "this.target",
            "c6pPVZhf.exe FileHash-SHA256 99e60fbd12fa9cffb9e84b4f8fa53169cd9eb965f083337de1995926a5ed83f1",
            "amazon.com \u2022 pki.goog \u2022 google-analytics.com",
            "authrootstl.cab common file extension",
            "dlvr.it \u2022 securityaffairs.com \u2022 wscript.shell",
            "https://securityaffairs.com/144927/cyber-crime~#",
            "https://securityaffairs.com/144927/cyber-crime/qbot-campaign-april-2023.html",
            "virustotalcloud.firebaseapp.com \u2022 firebaseapp.com \u2022 firebase.google.com \u2022 dns-admin@google.com",
            "https://clockoutbox.es/password",
            "http://cr-malware.testpanw.com/url",
            "IDS Detections: Query to a *.pw domain - Likely Hostile",
            "Alerts: network_icmp deletes_executed_files injection_resumethread dumped_buffer",
            "Alerts: network_http nids_alert suspicious_tld allocates_rwx antisandbox_foregroundwindows",
            "Alerts: applcation_raises_exception creates_exe suspicious_process stealth_window uses_",
            "Alerts: windows_utilities antivm_memory_available pe_features raises_exception",
            "IP\u2019s Contacted: 104.16.132.229  104.31.4.167  108.177.126.101  108.177.126.94  13.107.21.200  172.217.14.227",
            "IP\u2019s Contacted: 172.217.3.163  172.217.3.202  172.217.3.206  173.194.69.94",
            "Domains Contacted: www.youtube.com www.google.co.ck www.google.com ocsp.pki.goog",
            "Domains Contacted: www.virustotal.com www.gstatic.com fonts.googleapis.com",
            "Domains Contacted:: i.ytimg.com encrypted-tbn0.gstatic.com cponline.pw",
            "Win32:Crypt-SKC\\ [Trj] ,  Win.Malware.Delf-6899401-0 ,  Worm:Win32/AutoRun!atmn",
            "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
            "Yara Detections compromised_site_redirector_fromcharcode ,  Delphi",
            "Alerts: dead_host network_icmp persistence_autorun modifies_certificates modifies_proxy_wpad",
            "Alerts: multiple_useragents dumped_buffer networkdyndns_checkip network_http allocates_rwx",
            "IP\u2019s Contacted: 104.97.41.163  142.251.33.67  142.251.33.78  209.197.3.8  216.239.32.29",
            "Domains Contacted: pki.goog www.microsoft.com ocsp.pki.goog freedns.afraid.org",
            "Domains Contacted: xred.mooo.com www.download.windowsupdate.com docs.google.com",
            "114.114.114.114 = Tulach"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ALF:Trojan:Win64/PsBanker",
              "display_name": "ALF:Trojan:Win64/PsBanker",
              "target": null
            },
            {
              "id": "Worm:Win32/AutoRun!atmn",
              "display_name": "Worm:Win32/AutoRun!atmn",
              "target": "/malware/Worm:Win32/AutoRun!atmn"
            },
            {
              "id": "Trojan:O97M/Madeba.A!det",
              "display_name": "Trojan:O97M/Madeba.A!det",
              "target": "/malware/Trojan:O97M/Madeba.A!det"
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1115",
              "name": "Clipboard Data",
              "display_name": "T1115 - Clipboard Data"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1114,
            "hostname": 594,
            "domain": 200,
            "FileHash-SHA256": 2379,
            "FileHash-MD5": 426,
            "FileHash-SHA1": 259,
            "IPv4": 322,
            "SSLCertFingerprint": 24,
            "email": 2,
            "IPv6": 1
          },
          "indicator_count": 5321,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "6 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69dbbce26d5b849642a36636",
          "name": "VirusTotal CREATED 38 MINUTES AGO by Q.Vashti clone.",
          "description": "",
          "modified": "2026-04-12T15:48:33.039000",
          "created": "2026-04-12T15:40:18.013000",
          "tags": [
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "size",
            "ascii text",
            "pattern match",
            "mitre att",
            "ck id",
            "meta",
            "virustotal",
            "date",
            "iframe",
            "april",
            "hybrid",
            "apikey",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "title",
            "body"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1115",
              "name": "Clipboard Data",
              "display_name": "T1115 - Clipboard Data"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "69dbb3d8b7fb4d110520d1b1",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 39,
            "FileHash-SHA1": 38,
            "FileHash-SHA256": 315,
            "IPv4": 2,
            "SSLCertFingerprint": 6,
            "URL": 164,
            "domain": 17,
            "hostname": 65
          },
          "indicator_count": 646,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 48,
          "modified_text": "7 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69dbb3d8b7fb4d110520d1b1",
          "name": "VirusTotal",
          "description": "I\u2019m blocked. For now\u2026.",
          "modified": "2026-04-12T15:01:44.934000",
          "created": "2026-04-12T15:01:44.934000",
          "tags": [
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "size",
            "ascii text",
            "pattern match",
            "mitre att",
            "ck id",
            "meta",
            "virustotal",
            "date",
            "iframe",
            "april",
            "hybrid",
            "apikey",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "title",
            "body"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1115",
              "name": "Clipboard Data",
              "display_name": "T1115 - Clipboard Data"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 38,
            "FileHash-SHA1": 37,
            "FileHash-SHA256": 115,
            "IPv4": 2,
            "SSLCertFingerprint": 6,
            "URL": 164,
            "domain": 17,
            "hostname": 65
          },
          "indicator_count": 444,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "7 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6907f7e98289b75f3e5ecaba",
          "name": "- Treece Alfrey Musat P.C. - Malicious Legal Google Botnet",
          "description": "Christopher P.\nAhmann\u2019s Google Botnet. Defense attorneys fighting worker\u2019s compensation case and ruining a targets life for years. Malicious.[OTX auto popular-HOSTNAME: Google Video.com (GOOGlevideo.COM), an unauthorised website, has been blocked by the internet service regulator, the regulator of the domain registry.]\n\n#pulsed_by_otx #private_google #legal_goigle #malicious_practices",
          "modified": "2025-12-03T00:01:23.660000",
          "created": "2025-11-03T00:31:37.396000",
          "tags": [
            "status",
            "date",
            "name servers",
            "lowfi",
            "passive dns",
            "urls",
            "domain",
            "susp",
            "win32",
            "search",
            "win64",
            "error",
            "url https",
            "url http",
            "ipv4",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "morocco",
            "united kingdom",
            "united",
            "present nov",
            "aaaa",
            "present oct",
            "cname",
            "brazil",
            "malaysia",
            "title",
            "present jun",
            "ip address",
            "creation date",
            "record value",
            "emails",
            "unknown aaaa",
            "body",
            "url add",
            "pulse pulses",
            "http",
            "related nids",
            "files location",
            "flag united",
            "trojan",
            "trojandropper",
            "virtool",
            "entries",
            "next associated",
            "ipv4 add",
            "unknown ns",
            "present jul",
            "present sep",
            "present aug",
            "win32upatre nov",
            "candyopen",
            "tlsv1",
            "port",
            "destination",
            "ogoogle trust",
            "cngts ca",
            "show",
            "read c",
            "youtube",
            "copy",
            "dock",
            "write",
            "next",
            "malware",
            "persistence",
            "execution",
            "filehashmd5",
            "hostname",
            "filehashsha256",
            "types of",
            "germany",
            "poland",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 400,
            "URL": 2857,
            "FileHash-MD5": 217,
            "FileHash-SHA1": 172,
            "FileHash-SHA256": 1426,
            "email": 6,
            "hostname": 1019,
            "SSLCertFingerprint": 6
          },
          "indicator_count": 6103,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "137 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69138421066f81131da59cc5",
          "name": "Malicious Legal Google Botnet  - Treece Alfrey Musat P.C.\u2022 Christopher P. Ahmann Spam - Malicious ",
          "description": "",
          "modified": "2025-12-03T00:01:23.660000",
          "created": "2025-11-11T18:44:49.343000",
          "tags": [
            "status",
            "date",
            "name servers",
            "lowfi",
            "passive dns",
            "urls",
            "domain",
            "susp",
            "win32",
            "search",
            "win64",
            "error",
            "url https",
            "url http",
            "ipv4",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "morocco",
            "united kingdom",
            "united",
            "present nov",
            "aaaa",
            "present oct",
            "cname",
            "brazil",
            "malaysia",
            "title",
            "present jun",
            "ip address",
            "creation date",
            "record value",
            "emails",
            "unknown aaaa",
            "body",
            "url add",
            "pulse pulses",
            "http",
            "related nids",
            "files location",
            "flag united",
            "trojan",
            "trojandropper",
            "virtool",
            "entries",
            "next associated",
            "ipv4 add",
            "unknown ns",
            "present jul",
            "present sep",
            "present aug",
            "win32upatre nov",
            "candyopen",
            "tlsv1",
            "port",
            "destination",
            "ogoogle trust",
            "cngts ca",
            "show",
            "read c",
            "youtube",
            "copy",
            "dock",
            "write",
            "next",
            "malware",
            "persistence",
            "execution",
            "filehashmd5",
            "hostname",
            "filehashsha256",
            "types of",
            "germany",
            "poland",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6907f7e98289b75f3e5ecaba",
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 400,
            "URL": 2857,
            "FileHash-MD5": 217,
            "FileHash-SHA1": 172,
            "FileHash-SHA256": 1426,
            "email": 6,
            "hostname": 1019,
            "SSLCertFingerprint": 6
          },
          "indicator_count": 6103,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "137 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68fbc84609098d17c316f23c",
          "name": "NSO - Multiple crimes",
          "description": "Multiple crimes including illegal gambling, loan sharking, cybercrimes , content reputation , instructions. Starfield seen again. Team 8 has seen Starfield in more than 300 pulses. Now it\u2019s gone. Check your devices for innocent looking searches you\u2019ve never searched. Browser extensions found on 3 targeted devices with an adversary with full CnC armed with a deletion and disk wipe service. Local - Denver. \n\nAlso, very concerning is specific Airline to be attacked revealed. It cant be researched without bringing down a flight or messing up air command & control. DJT has already made travel a risky feat by being influenced to fire the (NOAA) & (DOT). Its manipulation. PP Mafia bros. \n\nDoes anyone have any power? Contact someone. We did have a mystery plane incident in Denver after I first reported. Just space junk , ya know the usual. I am serious about preventing crime. I need some help!",
          "modified": "2025-11-23T17:00:58.297000",
          "created": "2025-10-24T18:41:10.936000",
          "tags": [
            "type indicator",
            "added active",
            "related pulses",
            "script urls",
            "united",
            "unknown ns",
            "a domains",
            "ip address",
            "meta",
            "asn as13335",
            "msie",
            "chrome",
            "ransom",
            "trojan",
            "passive dns",
            "backdoor",
            "http request",
            "twitter",
            "win32/crix.c check-in",
            "gmt content",
            "ipv4",
            "urls",
            "files",
            "data upload",
            "extraction",
            "domain add",
            "e emeseieee",
            "dynamicloader",
            "e eue",
            "eweienedeoewese",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "edeeefeaeuelete",
            "unknown",
            "write",
            "bits",
            "malware",
            "xserver",
            "encrypt",
            "unknown aaaa",
            "moved",
            "cloudfront x",
            "hio52 p1",
            "name servers",
            "accept encoding",
            "emails",
            "servers",
            "extr",
            "u a640",
            "a69f u",
            "fe2e fe2f",
            "u a720",
            "a7ff",
            "u feff",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "pattern match",
            "mitre att",
            "null",
            "body",
            "pizza",
            "friday",
            "hybrid",
            "general",
            "local",
            "path",
            "starfield",
            "iframe",
            "click",
            "strings",
            "core",
            "bet",
            "gambling",
            "record value",
            "date",
            "present sep",
            "present apr",
            "colombia",
            "present jun",
            "present nov",
            "cookie",
            "present oct",
            "entries",
            "next associated",
            "error",
            "attack",
            "government",
            "scotland",
            "news",
            "covid19",
            "subscribe",
            "october",
            "crown copyright",
            "nhs scotland",
            "parliament",
            "coronavirus",
            "redacted for",
            "domain status",
            "server",
            "privacy tech",
            "privacy admin",
            "email",
            "country",
            "postal code",
            "stateprovince",
            "code",
            "host name",
            "rdap database",
            "handle",
            "iana registrar",
            "entity roles",
            "links",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cnr12",
            "validity",
            "subject public",
            "key info",
            "medium",
            "write c",
            "search",
            "pe file",
            "high",
            "checks",
            "http",
            "delete",
            "copy",
            "guard",
            "mozilla",
            "next",
            "godaddy",
            "creation date",
            "hostname",
            "pulse submit",
            "url analysis",
            "domain",
            "files ip",
            "trojandropper",
            "mtb oct",
            "mtb may",
            "refloadapihash",
            "foundry",
            "fastly",
            "value a",
            "com laude",
            "ltd dba",
            "nomiq",
            "limited dba",
            "pulse",
            "location united",
            "asn asnone",
            "nameservers"
          ],
          "references": [
            "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
            "fazendabetb.live \u2022 bowiesports.com Check first???",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
            "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
            "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
            "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
            "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
            "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
            "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
            "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
            "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
            "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
            "The Scottish Government www.gov.scot The NHS Scotland support",
            "http://129.2.4.2/32 Lencr",
            "qlw020.managed-sprint.dynalabs.io (Check)",
            "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
            "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
            "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
            "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
            "ExternalHosts: US",
            "Starfield again - HoneyPot / Dod- DoW",
            "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
            "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
            "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
          ],
          "public": 1,
          "adversary": "NSO",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Bulgaria",
            "Singapore",
            "Denmark",
            "Australia",
            "Jersey",
            "Japan",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "Autoit",
              "display_name": "Autoit",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti",
              "display_name": "Ransom:Win32/Crowti",
              "target": "/malware/Ransom:Win32/Crowti"
            },
            {
              "id": "Backdoor:Win32/Tofsee.",
              "display_name": "Backdoor:Win32/Tofsee.",
              "target": "/malware/Backdoor:Win32/Tofsee."
            },
            {
              "id": "#Lowfi:SIGATTR:DownloadAndExecute",
              "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
              "target": null
            },
            {
              "id": "Win.Dropper.Vbclone",
              "display_name": "Win.Dropper.Vbclone",
              "target": null
            },
            {
              "id": "Win.Packer",
              "display_name": "Win.Packer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6261,
            "domain": 1806,
            "hostname": 2427,
            "FileHash-MD5": 384,
            "FileHash-SHA1": 381,
            "email": 13,
            "FileHash-SHA256": 1418,
            "SSLCertFingerprint": 14
          },
          "indicator_count": 12704,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "146 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68fc18514965ccd3b55c216d",
          "name": "Dorv \u2022 Obfuscator - Affecting DropBox",
          "description": "",
          "modified": "2025-11-23T17:00:58.297000",
          "created": "2025-10-25T00:22:41.686000",
          "tags": [
            "type indicator",
            "added active",
            "related pulses",
            "script urls",
            "united",
            "unknown ns",
            "a domains",
            "ip address",
            "meta",
            "asn as13335",
            "msie",
            "chrome",
            "ransom",
            "trojan",
            "passive dns",
            "backdoor",
            "http request",
            "twitter",
            "win32/crix.c check-in",
            "gmt content",
            "ipv4",
            "urls",
            "files",
            "data upload",
            "extraction",
            "domain add",
            "e emeseieee",
            "dynamicloader",
            "e eue",
            "eweienedeoewese",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "edeeefeaeuelete",
            "unknown",
            "write",
            "bits",
            "malware",
            "xserver",
            "encrypt",
            "unknown aaaa",
            "moved",
            "cloudfront x",
            "hio52 p1",
            "name servers",
            "accept encoding",
            "emails",
            "servers",
            "extr",
            "u a640",
            "a69f u",
            "fe2e fe2f",
            "u a720",
            "a7ff",
            "u feff",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "pattern match",
            "mitre att",
            "null",
            "body",
            "pizza",
            "friday",
            "hybrid",
            "general",
            "local",
            "path",
            "starfield",
            "iframe",
            "click",
            "strings",
            "core",
            "bet",
            "gambling",
            "record value",
            "date",
            "present sep",
            "present apr",
            "colombia",
            "present jun",
            "present nov",
            "cookie",
            "present oct",
            "entries",
            "next associated",
            "error",
            "attack",
            "government",
            "scotland",
            "news",
            "covid19",
            "subscribe",
            "october",
            "crown copyright",
            "nhs scotland",
            "parliament",
            "coronavirus",
            "redacted for",
            "domain status",
            "server",
            "privacy tech",
            "privacy admin",
            "email",
            "country",
            "postal code",
            "stateprovince",
            "code",
            "host name",
            "rdap database",
            "handle",
            "iana registrar",
            "entity roles",
            "links",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cnr12",
            "validity",
            "subject public",
            "key info",
            "medium",
            "write c",
            "search",
            "pe file",
            "high",
            "checks",
            "http",
            "delete",
            "copy",
            "guard",
            "mozilla",
            "next",
            "godaddy",
            "creation date",
            "hostname",
            "pulse submit",
            "url analysis",
            "domain",
            "files ip",
            "trojandropper",
            "mtb oct",
            "mtb may",
            "refloadapihash",
            "foundry",
            "fastly",
            "value a",
            "com laude",
            "ltd dba",
            "nomiq",
            "limited dba",
            "pulse",
            "location united",
            "asn asnone",
            "nameservers"
          ],
          "references": [
            "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
            "fazendabetb.live \u2022 bowiesports.com Check first???",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
            "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
            "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
            "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
            "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
            "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
            "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
            "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
            "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
            "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
            "The Scottish Government www.gov.scot The NHS Scotland support",
            "http://129.2.4.2/32 Lencr",
            "qlw020.managed-sprint.dynalabs.io (Check)",
            "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
            "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
            "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
            "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
            "ExternalHosts: US",
            "Starfield again - HoneyPot / Dod- DoW",
            "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
            "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
            "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
          ],
          "public": 1,
          "adversary": "NSO",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Bulgaria",
            "Singapore",
            "Denmark",
            "Australia",
            "Jersey",
            "Japan",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "Autoit",
              "display_name": "Autoit",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti",
              "display_name": "Ransom:Win32/Crowti",
              "target": "/malware/Ransom:Win32/Crowti"
            },
            {
              "id": "Backdoor:Win32/Tofsee.",
              "display_name": "Backdoor:Win32/Tofsee.",
              "target": "/malware/Backdoor:Win32/Tofsee."
            },
            {
              "id": "#Lowfi:SIGATTR:DownloadAndExecute",
              "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
              "target": null
            },
            {
              "id": "Win.Dropper.Vbclone",
              "display_name": "Win.Dropper.Vbclone",
              "target": null
            },
            {
              "id": "Win.Packer",
              "display_name": "Win.Packer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "68fbc84609098d17c316f23c",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6261,
            "domain": 1806,
            "hostname": 2427,
            "FileHash-MD5": 384,
            "FileHash-SHA1": 381,
            "email": 13,
            "FileHash-SHA256": 1418,
            "SSLCertFingerprint": 14
          },
          "indicator_count": 12704,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "146 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Alerts: multiple_useragents dumped_buffer networkdyndns_checkip network_http allocates_rwx",
        "https://securityaffairs.com/144927/cyber-crime/qbot-campaign-april-2023.html",
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "amazon.com \u2022 pki.goog \u2022 google-analytics.com",
        "Alerts: windows_utilities antivm_memory_available pe_features raises_exception",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "ExternalHosts: US",
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
        "dlvr.it \u2022 securityaffairs.com \u2022 wscript.shell",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "Alerts: network_icmp deletes_executed_files injection_resumethread dumped_buffer",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "Alerts: dead_host network_icmp persistence_autorun modifies_certificates modifies_proxy_wpad",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "Domains Contacted: pki.goog www.microsoft.com ocsp.pki.goog freedns.afraid.org",
        "https://www.virustotal.com/gui/search/maxsecure:%22virus.webtoolbar.w32.searchsuite.gen_227097%22%20entity:file",
        "114.114.114.114 = Tulach",
        "http://129.2.4.2/32 Lencr",
        "Win32:Crypt-SKC\\ [Trj] ,  Win.Malware.Delf-6899401-0 ,  Worm:Win32/AutoRun!atmn",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "IP\u2019s Contacted: 104.97.41.163  142.251.33.67  142.251.33.78  209.197.3.8  216.239.32.29",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "https://clockoutbox.es/password",
        "IP\u2019s Contacted: 172.217.3.163  172.217.3.202  172.217.3.206  173.194.69.94",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b",
        "IDS Detections: Query to a *.pw domain - Likely Hostile",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "authrootstl.cab common file extension",
        "virustotalcloud.firebaseapp.com \u2022 firebaseapp.com \u2022 firebase.google.com \u2022 dns-admin@google.com",
        "Alerts: applcation_raises_exception creates_exe suspicious_process stealth_window uses_",
        "Domains Contacted:: i.ytimg.com encrypted-tbn0.gstatic.com cponline.pw",
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "IP\u2019s Contacted: 104.16.132.229  104.31.4.167  108.177.126.101  108.177.126.94  13.107.21.200  172.217.14.227",
        "this.target",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "Starfield again - HoneyPot / Dod- DoW",
        "Domains Contacted: xred.mooo.com www.download.windowsupdate.com docs.google.com",
        "http://cr-malware.testpanw.com/url",
        "Yara Detections compromised_site_redirector_fromcharcode ,  Delphi",
        "https://securityaffairs.com/144927/cyber-crime~#",
        "Domains Contacted: www.youtube.com www.google.co.ck www.google.com ocsp.pki.goog",
        "Alerts: network_http nids_alert suspicious_tld allocates_rwx antisandbox_foregroundwindows",
        "c6pPVZhf.exe FileHash-SHA256 99e60fbd12fa9cffb9e84b4f8fa53169cd9eb965f083337de1995926a5ed83f1",
        "Domains Contacted: www.virustotal.com www.gstatic.com fonts.googleapis.com",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
        "The Scottish Government www.gov.scot The NHS Scotland support"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "NSO"
          ],
          "malware_families": [
            "Ransom:win32/crowti",
            "Trojan:o97m/madeba.a!det",
            "Alf:trojan:win64/psbanker",
            "Backdoor:win32/tofsee.",
            "Win.dropper.vbclone",
            "Upatre",
            "Worm:win32/autorun!atmn",
            "Win.packer",
            "#lowfi:sigattr:downloadandexecute",
            "Autoit",
            "Tulach"
          ],
          "industries": [],
          "unique_indicators": 23925
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/testpanw.com",
    "whois": "http://whois.domaintools.com/testpanw.com",
    "domain": "testpanw.com",
    "hostname": "test-ransomware.testpanw.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "69dbbce69edaea3a4dd19895",
      "name": "VirusTotal CREATED 38 MINUTES AGO by Q.Vashti clone.",
      "description": "",
      "modified": "2026-04-13T01:03:15.999000",
      "created": "2026-04-12T15:40:22.011000",
      "tags": [
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "size",
        "ascii text",
        "pattern match",
        "mitre att",
        "ck id",
        "meta",
        "virustotal",
        "date",
        "iframe",
        "april",
        "hybrid",
        "apikey",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "title",
        "body"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1115",
          "name": "Clipboard Data",
          "display_name": "T1115 - Clipboard Data"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "69dbb3d8b7fb4d110520d1b1",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 38,
        "FileHash-SHA1": 37,
        "FileHash-SHA256": 115,
        "IPv4": 2,
        "SSLCertFingerprint": 6,
        "URL": 165,
        "domain": 17,
        "hostname": 65
      },
      "indicator_count": 445,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 48,
      "modified_text": "6 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69dc04c12782d2d76c111a93",
      "name": "VirusTotal \u2022 PsBanker \u2022 Attacked / Blocked",
      "description": "",
      "modified": "2026-04-12T20:46:57.338000",
      "created": "2026-04-12T20:46:57.338000",
      "tags": [
        "indicator role",
        "active related",
        "ck ids",
        "files",
        "information",
        "discovery",
        "mitre att",
        "pattern match",
        "ck id",
        "ck matrix",
        "ascii text",
        "united",
        "binary file",
        "april",
        "hybrid",
        "apikey",
        "general",
        "local",
        "path",
        "iframe",
        "click",
        "protocol",
        "learn",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "execution att",
        "related pulses",
        "dll read",
        "function read",
        "icmp traffic",
        "machineguid",
        "systembiosdate",
        "total",
        "read",
        "write",
        "network_icmp",
        "js_eval",
        "recon_fingerprint",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "tls handshake",
        "execution",
        "dock",
        "persistence",
        "malware",
        "unknown",
        "neue",
        "certificate",
        "error",
        "scans show",
        "record value",
        "title site",
        "servers",
        "emails",
        "all hostname",
        "dnsadmin",
        "data upload",
        "extraction",
        "failed",
        "include review",
        "exclude sugges",
        "find s",
        "typ no",
        "active",
        "urls",
        "ip address",
        "asn as54113",
        "registrar",
        "wscript",
        "united states",
        "stcalifornia",
        "lmountain view",
        "ogoogle llc",
        "ogoogle trust",
        "cngts ca",
        "whitelisted",
        "as15169",
        "hostile",
        "crash",
        "contacted",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "detections alf",
        "hostile yara",
        "detections none",
        "less ip",
        "domains",
        "ms windows",
        "intel",
        "pe32",
        "regsetvalueexa",
        "langturkish",
        "sublangdefault",
        "port",
        "destination",
        "entries",
        "worm",
        "delphi",
        "win32",
        "body",
        "explorer",
        "defender",
        "regdword",
        "false",
        "true",
        "end sub",
        "object",
        "createobject",
        "sheetschanged",
        "private sub",
        "string",
        "boolean",
        "cancel",
        "trojan",
        "copy",
        "query",
        "dns update",
        "useragent",
        "myapp",
        "delphi alerts",
        "alerts deadhost",
        "women who code",
        "tulach",
        "114.114.114.114",
        "samuel",
        "brian sabey"
      ],
      "references": [
        "https://www.virustotal.com/gui/search/maxsecure:%22virus.webtoolbar.w32.searchsuite.gen_227097%22%20entity:file",
        "this.target",
        "c6pPVZhf.exe FileHash-SHA256 99e60fbd12fa9cffb9e84b4f8fa53169cd9eb965f083337de1995926a5ed83f1",
        "amazon.com \u2022 pki.goog \u2022 google-analytics.com",
        "authrootstl.cab common file extension",
        "dlvr.it \u2022 securityaffairs.com \u2022 wscript.shell",
        "https://securityaffairs.com/144927/cyber-crime~#",
        "https://securityaffairs.com/144927/cyber-crime/qbot-campaign-april-2023.html",
        "virustotalcloud.firebaseapp.com \u2022 firebaseapp.com \u2022 firebase.google.com \u2022 dns-admin@google.com",
        "https://clockoutbox.es/password",
        "http://cr-malware.testpanw.com/url",
        "IDS Detections: Query to a *.pw domain - Likely Hostile",
        "Alerts: network_icmp deletes_executed_files injection_resumethread dumped_buffer",
        "Alerts: network_http nids_alert suspicious_tld allocates_rwx antisandbox_foregroundwindows",
        "Alerts: applcation_raises_exception creates_exe suspicious_process stealth_window uses_",
        "Alerts: windows_utilities antivm_memory_available pe_features raises_exception",
        "IP\u2019s Contacted: 104.16.132.229  104.31.4.167  108.177.126.101  108.177.126.94  13.107.21.200  172.217.14.227",
        "IP\u2019s Contacted: 172.217.3.163  172.217.3.202  172.217.3.206  173.194.69.94",
        "Domains Contacted: www.youtube.com www.google.co.ck www.google.com ocsp.pki.goog",
        "Domains Contacted: www.virustotal.com www.gstatic.com fonts.googleapis.com",
        "Domains Contacted:: i.ytimg.com encrypted-tbn0.gstatic.com cponline.pw",
        "Win32:Crypt-SKC\\ [Trj] ,  Win.Malware.Delf-6899401-0 ,  Worm:Win32/AutoRun!atmn",
        "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
        "Yara Detections compromised_site_redirector_fromcharcode ,  Delphi",
        "Alerts: dead_host network_icmp persistence_autorun modifies_certificates modifies_proxy_wpad",
        "Alerts: multiple_useragents dumped_buffer networkdyndns_checkip network_http allocates_rwx",
        "IP\u2019s Contacted: 104.97.41.163  142.251.33.67  142.251.33.78  209.197.3.8  216.239.32.29",
        "Domains Contacted: pki.goog www.microsoft.com ocsp.pki.goog freedns.afraid.org",
        "Domains Contacted: xred.mooo.com www.download.windowsupdate.com docs.google.com",
        "114.114.114.114 = Tulach"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ALF:Trojan:Win64/PsBanker",
          "display_name": "ALF:Trojan:Win64/PsBanker",
          "target": null
        },
        {
          "id": "Worm:Win32/AutoRun!atmn",
          "display_name": "Worm:Win32/AutoRun!atmn",
          "target": "/malware/Worm:Win32/AutoRun!atmn"
        },
        {
          "id": "Trojan:O97M/Madeba.A!det",
          "display_name": "Trojan:O97M/Madeba.A!det",
          "target": "/malware/Trojan:O97M/Madeba.A!det"
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1115",
          "name": "Clipboard Data",
          "display_name": "T1115 - Clipboard Data"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1114,
        "hostname": 594,
        "domain": 200,
        "FileHash-SHA256": 2379,
        "FileHash-MD5": 426,
        "FileHash-SHA1": 259,
        "IPv4": 322,
        "SSLCertFingerprint": 24,
        "email": 2,
        "IPv6": 1
      },
      "indicator_count": 5321,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "6 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69dbbce26d5b849642a36636",
      "name": "VirusTotal CREATED 38 MINUTES AGO by Q.Vashti clone.",
      "description": "",
      "modified": "2026-04-12T15:48:33.039000",
      "created": "2026-04-12T15:40:18.013000",
      "tags": [
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "size",
        "ascii text",
        "pattern match",
        "mitre att",
        "ck id",
        "meta",
        "virustotal",
        "date",
        "iframe",
        "april",
        "hybrid",
        "apikey",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "title",
        "body"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1115",
          "name": "Clipboard Data",
          "display_name": "T1115 - Clipboard Data"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "69dbb3d8b7fb4d110520d1b1",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 39,
        "FileHash-SHA1": 38,
        "FileHash-SHA256": 315,
        "IPv4": 2,
        "SSLCertFingerprint": 6,
        "URL": 164,
        "domain": 17,
        "hostname": 65
      },
      "indicator_count": 646,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 48,
      "modified_text": "7 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69dbb3d8b7fb4d110520d1b1",
      "name": "VirusTotal",
      "description": "I\u2019m blocked. For now\u2026.",
      "modified": "2026-04-12T15:01:44.934000",
      "created": "2026-04-12T15:01:44.934000",
      "tags": [
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "size",
        "ascii text",
        "pattern match",
        "mitre att",
        "ck id",
        "meta",
        "virustotal",
        "date",
        "iframe",
        "april",
        "hybrid",
        "apikey",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "title",
        "body"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1115",
          "name": "Clipboard Data",
          "display_name": "T1115 - Clipboard Data"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 38,
        "FileHash-SHA1": 37,
        "FileHash-SHA256": 115,
        "IPv4": 2,
        "SSLCertFingerprint": 6,
        "URL": 164,
        "domain": 17,
        "hostname": 65
      },
      "indicator_count": 444,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "7 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6907f7e98289b75f3e5ecaba",
      "name": "- Treece Alfrey Musat P.C. - Malicious Legal Google Botnet",
      "description": "Christopher P.\nAhmann\u2019s Google Botnet. Defense attorneys fighting worker\u2019s compensation case and ruining a targets life for years. Malicious.[OTX auto popular-HOSTNAME: Google Video.com (GOOGlevideo.COM), an unauthorised website, has been blocked by the internet service regulator, the regulator of the domain registry.]\n\n#pulsed_by_otx #private_google #legal_goigle #malicious_practices",
      "modified": "2025-12-03T00:01:23.660000",
      "created": "2025-11-03T00:31:37.396000",
      "tags": [
        "status",
        "date",
        "name servers",
        "lowfi",
        "passive dns",
        "urls",
        "domain",
        "susp",
        "win32",
        "search",
        "win64",
        "error",
        "url https",
        "url http",
        "ipv4",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "morocco",
        "united kingdom",
        "united",
        "present nov",
        "aaaa",
        "present oct",
        "cname",
        "brazil",
        "malaysia",
        "title",
        "present jun",
        "ip address",
        "creation date",
        "record value",
        "emails",
        "unknown aaaa",
        "body",
        "url add",
        "pulse pulses",
        "http",
        "related nids",
        "files location",
        "flag united",
        "trojan",
        "trojandropper",
        "virtool",
        "entries",
        "next associated",
        "ipv4 add",
        "unknown ns",
        "present jul",
        "present sep",
        "present aug",
        "win32upatre nov",
        "candyopen",
        "tlsv1",
        "port",
        "destination",
        "ogoogle trust",
        "cngts ca",
        "show",
        "read c",
        "youtube",
        "copy",
        "dock",
        "write",
        "next",
        "malware",
        "persistence",
        "execution",
        "filehashmd5",
        "hostname",
        "filehashsha256",
        "types of",
        "germany",
        "poland",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 400,
        "URL": 2857,
        "FileHash-MD5": 217,
        "FileHash-SHA1": 172,
        "FileHash-SHA256": 1426,
        "email": 6,
        "hostname": 1019,
        "SSLCertFingerprint": 6
      },
      "indicator_count": 6103,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "137 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69138421066f81131da59cc5",
      "name": "Malicious Legal Google Botnet  - Treece Alfrey Musat P.C.\u2022 Christopher P. Ahmann Spam - Malicious ",
      "description": "",
      "modified": "2025-12-03T00:01:23.660000",
      "created": "2025-11-11T18:44:49.343000",
      "tags": [
        "status",
        "date",
        "name servers",
        "lowfi",
        "passive dns",
        "urls",
        "domain",
        "susp",
        "win32",
        "search",
        "win64",
        "error",
        "url https",
        "url http",
        "ipv4",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "morocco",
        "united kingdom",
        "united",
        "present nov",
        "aaaa",
        "present oct",
        "cname",
        "brazil",
        "malaysia",
        "title",
        "present jun",
        "ip address",
        "creation date",
        "record value",
        "emails",
        "unknown aaaa",
        "body",
        "url add",
        "pulse pulses",
        "http",
        "related nids",
        "files location",
        "flag united",
        "trojan",
        "trojandropper",
        "virtool",
        "entries",
        "next associated",
        "ipv4 add",
        "unknown ns",
        "present jul",
        "present sep",
        "present aug",
        "win32upatre nov",
        "candyopen",
        "tlsv1",
        "port",
        "destination",
        "ogoogle trust",
        "cngts ca",
        "show",
        "read c",
        "youtube",
        "copy",
        "dock",
        "write",
        "next",
        "malware",
        "persistence",
        "execution",
        "filehashmd5",
        "hostname",
        "filehashsha256",
        "types of",
        "germany",
        "poland",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6907f7e98289b75f3e5ecaba",
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 400,
        "URL": 2857,
        "FileHash-MD5": 217,
        "FileHash-SHA1": 172,
        "FileHash-SHA256": 1426,
        "email": 6,
        "hostname": 1019,
        "SSLCertFingerprint": 6
      },
      "indicator_count": 6103,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "137 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68fbc84609098d17c316f23c",
      "name": "NSO - Multiple crimes",
      "description": "Multiple crimes including illegal gambling, loan sharking, cybercrimes , content reputation , instructions. Starfield seen again. Team 8 has seen Starfield in more than 300 pulses. Now it\u2019s gone. Check your devices for innocent looking searches you\u2019ve never searched. Browser extensions found on 3 targeted devices with an adversary with full CnC armed with a deletion and disk wipe service. Local - Denver. \n\nAlso, very concerning is specific Airline to be attacked revealed. It cant be researched without bringing down a flight or messing up air command & control. DJT has already made travel a risky feat by being influenced to fire the (NOAA) & (DOT). Its manipulation. PP Mafia bros. \n\nDoes anyone have any power? Contact someone. We did have a mystery plane incident in Denver after I first reported. Just space junk , ya know the usual. I am serious about preventing crime. I need some help!",
      "modified": "2025-11-23T17:00:58.297000",
      "created": "2025-10-24T18:41:10.936000",
      "tags": [
        "type indicator",
        "added active",
        "related pulses",
        "script urls",
        "united",
        "unknown ns",
        "a domains",
        "ip address",
        "meta",
        "asn as13335",
        "msie",
        "chrome",
        "ransom",
        "trojan",
        "passive dns",
        "backdoor",
        "http request",
        "twitter",
        "win32/crix.c check-in",
        "gmt content",
        "ipv4",
        "urls",
        "files",
        "data upload",
        "extraction",
        "domain add",
        "e emeseieee",
        "dynamicloader",
        "e eue",
        "eweienedeoewese",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "edeeefeaeuelete",
        "unknown",
        "write",
        "bits",
        "malware",
        "xserver",
        "encrypt",
        "unknown aaaa",
        "moved",
        "cloudfront x",
        "hio52 p1",
        "name servers",
        "accept encoding",
        "emails",
        "servers",
        "extr",
        "u a640",
        "a69f u",
        "fe2e fe2f",
        "u a720",
        "a7ff",
        "u feff",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "pattern match",
        "mitre att",
        "null",
        "body",
        "pizza",
        "friday",
        "hybrid",
        "general",
        "local",
        "path",
        "starfield",
        "iframe",
        "click",
        "strings",
        "core",
        "bet",
        "gambling",
        "record value",
        "date",
        "present sep",
        "present apr",
        "colombia",
        "present jun",
        "present nov",
        "cookie",
        "present oct",
        "entries",
        "next associated",
        "error",
        "attack",
        "government",
        "scotland",
        "news",
        "covid19",
        "subscribe",
        "october",
        "crown copyright",
        "nhs scotland",
        "parliament",
        "coronavirus",
        "redacted for",
        "domain status",
        "server",
        "privacy tech",
        "privacy admin",
        "email",
        "country",
        "postal code",
        "stateprovince",
        "code",
        "host name",
        "rdap database",
        "handle",
        "iana registrar",
        "entity roles",
        "links",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cnr12",
        "validity",
        "subject public",
        "key info",
        "medium",
        "write c",
        "search",
        "pe file",
        "high",
        "checks",
        "http",
        "delete",
        "copy",
        "guard",
        "mozilla",
        "next",
        "godaddy",
        "creation date",
        "hostname",
        "pulse submit",
        "url analysis",
        "domain",
        "files ip",
        "trojandropper",
        "mtb oct",
        "mtb may",
        "refloadapihash",
        "foundry",
        "fastly",
        "value a",
        "com laude",
        "ltd dba",
        "nomiq",
        "limited dba",
        "pulse",
        "location united",
        "asn asnone",
        "nameservers"
      ],
      "references": [
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "The Scottish Government www.gov.scot The NHS Scotland support",
        "http://129.2.4.2/32 Lencr",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "ExternalHosts: US",
        "Starfield again - HoneyPot / Dod- DoW",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
      ],
      "public": 1,
      "adversary": "NSO",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Bulgaria",
        "Singapore",
        "Denmark",
        "Australia",
        "Jersey",
        "Japan",
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "Autoit",
          "display_name": "Autoit",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti",
          "display_name": "Ransom:Win32/Crowti",
          "target": "/malware/Ransom:Win32/Crowti"
        },
        {
          "id": "Backdoor:Win32/Tofsee.",
          "display_name": "Backdoor:Win32/Tofsee.",
          "target": "/malware/Backdoor:Win32/Tofsee."
        },
        {
          "id": "#Lowfi:SIGATTR:DownloadAndExecute",
          "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
          "target": null
        },
        {
          "id": "Win.Dropper.Vbclone",
          "display_name": "Win.Dropper.Vbclone",
          "target": null
        },
        {
          "id": "Win.Packer",
          "display_name": "Win.Packer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6261,
        "domain": 1806,
        "hostname": 2427,
        "FileHash-MD5": 384,
        "FileHash-SHA1": 381,
        "email": 13,
        "FileHash-SHA256": 1418,
        "SSLCertFingerprint": 14
      },
      "indicator_count": 12704,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "146 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68fc18514965ccd3b55c216d",
      "name": "Dorv \u2022 Obfuscator - Affecting DropBox",
      "description": "",
      "modified": "2025-11-23T17:00:58.297000",
      "created": "2025-10-25T00:22:41.686000",
      "tags": [
        "type indicator",
        "added active",
        "related pulses",
        "script urls",
        "united",
        "unknown ns",
        "a domains",
        "ip address",
        "meta",
        "asn as13335",
        "msie",
        "chrome",
        "ransom",
        "trojan",
        "passive dns",
        "backdoor",
        "http request",
        "twitter",
        "win32/crix.c check-in",
        "gmt content",
        "ipv4",
        "urls",
        "files",
        "data upload",
        "extraction",
        "domain add",
        "e emeseieee",
        "dynamicloader",
        "e eue",
        "eweienedeoewese",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "edeeefeaeuelete",
        "unknown",
        "write",
        "bits",
        "malware",
        "xserver",
        "encrypt",
        "unknown aaaa",
        "moved",
        "cloudfront x",
        "hio52 p1",
        "name servers",
        "accept encoding",
        "emails",
        "servers",
        "extr",
        "u a640",
        "a69f u",
        "fe2e fe2f",
        "u a720",
        "a7ff",
        "u feff",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "pattern match",
        "mitre att",
        "null",
        "body",
        "pizza",
        "friday",
        "hybrid",
        "general",
        "local",
        "path",
        "starfield",
        "iframe",
        "click",
        "strings",
        "core",
        "bet",
        "gambling",
        "record value",
        "date",
        "present sep",
        "present apr",
        "colombia",
        "present jun",
        "present nov",
        "cookie",
        "present oct",
        "entries",
        "next associated",
        "error",
        "attack",
        "government",
        "scotland",
        "news",
        "covid19",
        "subscribe",
        "october",
        "crown copyright",
        "nhs scotland",
        "parliament",
        "coronavirus",
        "redacted for",
        "domain status",
        "server",
        "privacy tech",
        "privacy admin",
        "email",
        "country",
        "postal code",
        "stateprovince",
        "code",
        "host name",
        "rdap database",
        "handle",
        "iana registrar",
        "entity roles",
        "links",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cnr12",
        "validity",
        "subject public",
        "key info",
        "medium",
        "write c",
        "search",
        "pe file",
        "high",
        "checks",
        "http",
        "delete",
        "copy",
        "guard",
        "mozilla",
        "next",
        "godaddy",
        "creation date",
        "hostname",
        "pulse submit",
        "url analysis",
        "domain",
        "files ip",
        "trojandropper",
        "mtb oct",
        "mtb may",
        "refloadapihash",
        "foundry",
        "fastly",
        "value a",
        "com laude",
        "ltd dba",
        "nomiq",
        "limited dba",
        "pulse",
        "location united",
        "asn asnone",
        "nameservers"
      ],
      "references": [
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "The Scottish Government www.gov.scot The NHS Scotland support",
        "http://129.2.4.2/32 Lencr",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "ExternalHosts: US",
        "Starfield again - HoneyPot / Dod- DoW",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
      ],
      "public": 1,
      "adversary": "NSO",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Bulgaria",
        "Singapore",
        "Denmark",
        "Australia",
        "Jersey",
        "Japan",
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "Autoit",
          "display_name": "Autoit",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti",
          "display_name": "Ransom:Win32/Crowti",
          "target": "/malware/Ransom:Win32/Crowti"
        },
        {
          "id": "Backdoor:Win32/Tofsee.",
          "display_name": "Backdoor:Win32/Tofsee.",
          "target": "/malware/Backdoor:Win32/Tofsee."
        },
        {
          "id": "#Lowfi:SIGATTR:DownloadAndExecute",
          "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
          "target": null
        },
        {
          "id": "Win.Dropper.Vbclone",
          "display_name": "Win.Dropper.Vbclone",
          "target": null
        },
        {
          "id": "Win.Packer",
          "display_name": "Win.Packer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "68fbc84609098d17c316f23c",
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6261,
        "domain": 1806,
        "hostname": 2427,
        "FileHash-MD5": 384,
        "FileHash-SHA1": 381,
        "email": 13,
        "FileHash-SHA256": 1418,
        "SSLCertFingerprint": 14
      },
      "indicator_count": 12704,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "146 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://test-ransomware.testpanw.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://test-ransomware.testpanw.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776616925.6186702
}