{ "type": "URL", "indicator": "https://ww38.ui.input.text.enter.item.name", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://ww38.ui.input.text.enter.item.name", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3417663985, "indicator": "https://ww38.ui.input.text.enter.item.name", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 18, "pulses": [ { "id": "66f9ae71e7d4851280fa367f", "name": "The Jane Doe Syndrome Files: Credential Dumping and Data Exfiltration", "description": "This pulse outlines a series of techniques (Tactics) utilized in a cyber intrusion targeting Jane Doe's MacBook. These techniques span various stages of the attack lifecycle, including credential dumping (T1003), system discovery (T1016, T1082), and data exfiltration methods (T1114, T1560). The attacker employed advanced obfuscation strategies (T1027) and input capture methods (T1056) to maintain persistence and evade detection, while also utilizing command and scripting interpreters (T1059) to execute malicious commands.\n\nFurthermore, the adversary manipulated system tokens (T1134) and leveraged remote access software (T1219) to control the compromised system. Techniques for data destruction (T1485) and artifact hiding (T1564) indicate a concerted effort to cover tracks and minimize detection.\n\nBy examining these techniques, we can better understand the methods used in this intrusion, facilitating enhanced detection and prevention strategies for future incidents.", "modified": "2024-11-08T00:03:35.782000", "created": "2024-09-29T19:45:53.583000", "tags": [ "autogenerated", "please", "class", "hp laserjet", "duplexer", "modify", "printer", "description", "location", "share", "printer make", "ppd file", "model", "driver", "ipp everywhere", "printers", "hardware", "baud rate", "parity", "odd data", "flow control", "software", "rtscts", "dtrdsr", "input", "type", "name", "value", "hidden", "delete class", "form", "h2 class", "warning", "p align", "allow", "advanced", "use kerberos", "save", "max clients", "maximum", "metadata", "documents", "max log", "img src", "width", "height", "align", "absmiddle", "indicator", "status", "printername", "idle", "edit", "cupsdconf", "error", "blockquote", "unknown", "h3 class", "jobs", "help jobs", "helptitle", "qtext", "topic", "bmtext", "qptext", "cups", "search", "online help", "documents all", "hold job", "server default", "shared", "test page", "pause class", "accept jobs", "move all", "jobs cancel", "all jobs", "class delete", "cancel", "move job", "destination", "release", "reprint", "action", "method", "name user", "size pages", "state control", "jobid", "withheld", "held", "change settings", "label", "input type", "select name", "multiple size", "option", "inches feet", "table", "submit", "set default", "prev", "next", "last", "accept", "options", "default", "delete printer", "form action", "pause", "reject", "resume", "print", "self test", "pause printer", "location make", "model status", "test", "please stand", "allowed users", "prevent", "whichjobs", "standard rom", "standard", "copyright", "standard font", "cups ppd", "easy software", "apache license", "license", "symbol special", "deskjet", "cups sample", "hplaserjet", "laserjet", "hpdeskjet", "hpdeskjet2", "epson", "stylus color", "stylus photo", "escp", "epson9pin", "zebra", "dymo3x0", "dymo", "labelwriter", "advance", "leading", "move", "black", "gold", "rotate", "never", "cyan", "yellow", "turn", "long edge", "edge", "oversize", "address", "b1jis b1", "adobe", "small", "image", "apple mime", "xhtml", "pict string", "cgimageio", "radiance", "fujifilm", "preview", "os x", "colorsync", "airprint", "do not", "this file", "it is", "you install", "versions of", "base mime", "format", "postscript", "language", "pattern match", "ras2", "pwgraster", "comment", "attr", "group", "attr language", "attr integer", "attr name", "attributes", "attr keyword", "post", "resource admin", "operation", "group operation", "create", "withvalue", "display", "d recipienturi", "expect", "tv d", "member", "createjob", "senddocument", "create faxout", "get list", "display jobname", "cupsgetdevices", "get job", "expect jobstate", "job template", "get printer", "cupsgetppd", "cupsgetppds", "get ppd", "attr text", "product", "psversion", "version", "message", "hello", "cupsgetprinters", "beep", "sound", "count", "ingroup", "oftype keyword", "oftype integer", "oftype text", "oftype charset", "oftype enum", "az09", "withallvalues", "mediaregex", "oftype", "print file", "printjob", "test printjob", "file", "ippurischeme", "member integer", "print test", "printuri", "post resource", "validatejob", "validate", "printjob group", "repeatmatch", "choice", "envelope", "resolution", "modelname", "inputslot", "pcfilename", "modelnumber", "attribute", "false", "darkness", "media", "generic", "mark", "dark", "tear", "cupsbanner show", "header printer", "footer printer", "notice cups", "header cover", "page footer", "cover page", "header top", "secret footer", "top secret", "header secret", "footer secret", "vzefibootloader", "nsunavailable", "virtualization", "base class", "vzbootloader", "network device", "initialize", "host network", "property", "return", "define", "nsarray", "bsd name", "ethernet", "vzconsoledevice", "console port", "defines", "a directory", "vzexport extern", "apiavailable", "bool", "nsenum", "nsinteger", "local file", "raw format", "nsurl", "nserror", "file handle", "storage device", "nserror error", "nsfilehandle", "boot loader", "efi rom", "efi boot", "vzerrorcode", "vzerrordomain", "error type", "nserror domain", "vzerrorsave", "nbd server", "nbd client", "nsoptions", "nsuinteger", "nsswiftname", "nvram", "write", "sorcvbuf", "sosndbuf", "mtu value", "data", "data sent", "true", "graphics", "intel", "indicate", "enable", "nsdata", "opaque", "host audio", "host output", "host input", "cgsize", "new display", "protocol", "unix domain", "socket", "rosetta", "caching", "rosetta daemon", "nsstring", "abstract socket", "rosetta support", "linux", "arm64", "availability", "download", "vzmacaddress", "mac address", "a vzmacaddress", "linux kernel", "ram disk", "linux boot", "a mac", "configuration", "mac hardware", "describes", "mac platform", "mac keyboard", "usb keyboard", "mac machine", "apple silicon", "rosetta runtime", "nsobject", "handle", "init", "url property", "whether", "recovery", "block", "nullable", "load", "mac trackpad", "usb pointing", "cpus", "overwrite", "nsdictionary", "directory share", "check", "namemax", "vznetworkdevice", "nbd url", "nbd uniform", "nbd protocol", "url error", "nat attachment", "a network", "nvm express", "nsscreen", "nssize", "serial port", "directory", "spice agent", "spice guest", "a console", "vzsocketdevice", "vzstoragedevice", "vzexport", "usb controller", "vzusbcontroller", "usb device", "device uuid", "nsuuid uuid", "usb mass", "vzusbdevice", "virtio block", "device", "storage storage", "virtio console", "delegate object", "a class", "extra care", "virtio entropy", "nsstring name", "array", "virtio file", "system device", "discussion", "nsstring tag", "port", "bool isconsole", "a virtio", "virtio graphics", "virtio gpu", "virtio", "port array", "utf8", "virtio network", "macaddress", "virtio socket", "close", "does nothing", "virtio sound", "nsarray streams", "pointer", "device input", "a pcm", "audio stream", "source", "sink", "device output", "device stream", "memory balloon", "target memory", "return yes", "start", "stop", "usb xhci", "automatically", "nsview", "virtual machine", "cpucount", "verify", "apple swift", "o librarylevel", "swift", "cachingoptions", "vzaudiodevice", "vzdebugstub", "swiftname", "targetosiphone", "targetososx", "targetosios", "apple computer", "targetostv", "targetosvision", "targetostvos", "targetosxr", "vtbaseh", "vtint32point", "vtint32size", "iphonena", "apiunavailable", "vtexport const", "abstract", "cfstringref", "readwrite", "cfnumber", "cfboolean", "optional", "null", "macos", "cmnullable", "pass null", "call", "video toolbox", "contains", "cmtime duration", "cvimagebuffer", "vterrorsh", "cfoptions", "12914", "uint32", "osstatus", "12900", "12901", "12902", "12903", "17690", "vtexport", "encoder", "zero", "alpha", "requires", "cmsamplebuffer", "prototype", "osstatus status", "cfrelease", "cvpixelbuffer", "iosurface", "hdr metadata", "hdr per", "frame metadata", "cf type", "cfretain", "a mechanism", "cmbridgedtype", "interface", "specifies", "a reference", "pixel rotation", "session", "a pixel", "cf object", "vtframesilo", "returns", "vtframesiloh", "vtframesiloref", "pass", "pixel transfer", "vtexport void", "media extension", "video raw", "processors", "standard video", "metal device", "metal", "rawprocessors", "cfstring", "copy", "vtsessionh", "cfdictionaryref", "apis", "vtsessionref", "raw processor", "a cfdictionary", "cfswiftname", "vtutilitiesh", "cgimage", "builds", "cfarrayref", "raw processing", "list", "list element", "cfdictionaries", "skipper", "vdspdftexecute", "vdspdftexecuted", "vdspdftzop", "vdspfft16copv", "vdspfft16zopv", "vdspfft32copv", "vdspfft32zopv", "vdspbiquad", "vdspbiquadd", "vdspbiquadm", "project version", "created", "elana stettin", "apple", "swextern", "title", "typedef", "param", "nsstring title", "represents", "nsitemprovider", "const", "swhidden extern", "swdefines", "swextern extern", "sha256 hash", "merkle tree", "sociallayer", "swperson", "devin clary", "swaction", "sbappcontext", "sbapplocator", "sbapplication", "sbelementarray", "sbobject", "scriptingbridge", "objecttype", "finder", "bridge", "index", "apple event", "target", "urls", "locator", "scripting", "desctype", "receiver", "track", "code", "sccontentfilter", "bgra format", "rgha format", "const nonnull", "nserrorenum", "nsurl outputurl", "avfiletypempeg4", "provides", "scwindow", "scdisplay", "cgrect frame", "bool indicating", "pixel", "scstream", "control center", "takes", "cfdictionary", "rbhash", "initvmrandom", "initvmtranscode", "initarray", "initbarevm", "initbignum", "initcomplex", "initcont", "initdir", "initfile", "libxml", "require", "cfpropertylist", "xml parser", "libxmlparser", "xml file", "plist", "cfplisterror", "exception", "format error", "easy", "kruse", "mit license", "standarderror", "cfformaterror", "cftypeerror", "nokogiri", "parserinterface", "cftype", "cfdate", "cfinteger", "blob", "ruby string", "uidfixnum", "ruby integer", "date", "format constant", "formatbinary", "formatxml", "magicnumber", "enumerator", "cfdata", "ruby", "example", "john", "path", "plainparser", "ascii", "cfreal", "importplain", "escapechar", "read", "length", "utf16be", "cfarray", "offsetsize", "integer", "rexml", "rexmlparser", "float", "appledtd plist", "dom node", "prefix", "config", "item", "bindir", "libruby", "rubypath", "fileoperations", "arch", "installer", "template", "install", "major", "yesno", "todo", "kwargs", "makefiles", "miniportile", "cmakecmd", "configure", "cmakefile", "cmake", "keyringname", "debug", "targetos", "ldflags", "gpgexe", "digest", "stdout", "patch", "installerror", "savefile", "task", "packages", "dlext", "minero aoki", "rubyversion", "loaderror", "sqlite3", "was sqlite3", "apiobjects", "database", "pragmas", "resultset", "sqlite3ruby faq", "sqliteruby faq", "value klass", "qnil", "sqliteok", "sqliteerror", "sqliteinternal", "sqliteperm", "sqliteabort", "sqlitebusy", "sqlitelocked", "datagetstruct", "int2num", "main", "done", "stringvalueptr", "note", "sqlite3ruby", "sqlite3rubyptr", "unused", "gnuc", "lclint", "usasciip", "utf8p", "utf16lep", "utf16le", "utf16bep", "sqlite3stmtruby", "rubyplatform", "darwin", "rcarchs", "libpkgconfig", "pkgconfigpath", "pkgconf", "mswin", "cflags", "install sqlite3", "int2fix", "rbignumlen", "sizeofbdigits", "charbit", "bdigit", "bmax", "value unused", "sqliteopenuri", "open", "requireopendb", "nilp", "qtrue", "id2sym", "requireopenstmt", "donep", "rstringlen", "num2int", "attrs", "deal", "xsd module", "xmlparser", "nokogiri xml", "simply", "rubyengine", "slop decorator", "css3 selector", "xpath", "nokogiri class", "parse", "html", "xml document", "0x30", "0x41", "0x61", "gumbogentable", "gumboasciicntrl", "gumboasciispace", "gumboasciidigit", "constfn", "gumboasciih", "gumboasciialpha", "gumboasciialnum", "c0 control", "gumbocharrefh", "gumboattributeh", "gumboattribute", "craig barnes", "google inc", "as is", "basis", "or conditions", "any kind", "gumboerrorh", "gumbotag", "additional", "gumbovector", "encoding", "gumboerrparser", "gumboerrortype", "html tag", "minwordlength", "maxwordlength", "maxhashvalue", "ansic code", "m100 n", "computed", "totalkeywords", "minhashvalue", "doctype", "capacity", "doctype system", "sourcelength", "sourcetext", "silence", "html5", "a struct", "text", "gumbo", "gumboh", "anything", "gumboparserh", "output", "library", "oopstyle", "gumboparser", "const localname", "string", "ietfdtd html", "w3cdtd html", "level", "html strict", "terminator", "final", "buffer", "gnucatleast", "hasattribute", "macrosh", "printf", "returnsnonnull", "win32", "unusedifndebug", "malloc", "pure", "m100", "gumbotaglookuph", "gumbotag tag", "taghashslot", "gumbotagunknown", "gumbotokentypeh", "gumbotokencdata", "gumbotokennull", "gumbotokeneof", "gumbotokentype", "gumbotaglast", "position", "gumbotokenizerh", "struct", "gumbotoken", "spec", "stack", "emittoken", "continue", "current", "utf8iterator", "utf8accept", "parser", "html5 spec", "rest", "gumboutf8h", "unicode code", "html5 parser", "utf8 decoding", "func", "gumbodebug", "gumboutilh", "utility", "debug wrapper", "script", "attribute value", "comment end", "doctype name", "cdata section", "rcdata end", "rawtext end", "initialcapacity", "gumboalloc", "vector", "memmove", "gumbovectorh", "initializes", "ownership", "stringvaluecstr", "rtest", "xmlchar", "html document", "nokogiristrnew2", "html4", "value get", "qfalse", "a list", "value list", "attrsdepr", "attrsopt", "chunk", "pushparser", "xmlsax", "value chunk", "w3c dom", "xmlelementnode", "finds", "qundef", "value val", "value args", "value exc", "libxml2patches", "rbconfig", "packagerootdir", "cppflags", "libs", "dldflags", "nokogiri test", "attributedecl", "defaultvalue", "atype", "tree", "ctxt", "noreturn", "xmldocptr doc", "private", "nokogirinative", "nokogiristrnew", "xmldoc", "value setvalue", "value content", "xmlchar value", "xmlnode cur", "content", "cdata", "cdata element", "value argv", "value rbnode", "document", "value document", "value getname", "pcdata", "element", "mult", "datawrapstruct", "value ctxtval", "mydoc", "userdata", "encodinghandler", "value key", "delete", "elementdecl", "id iddocument", "etype", "value prefix", "orig", "externalid", "systemid", "nodenr", "xmlnodeset", "nodeset", "nodetab", "xmldtd", "value hash", "publicid", "notation", "hash", "rbfuncall", "parseargs", "xmlnode", "without", "href", "xmlns", "namespace node", "nodes", "value rbreader", "relaxng schema", "relaxng", "value name", "nokogirisaxself", "rbivget", "rbstrorqnil", "xmlchar name", "xmlparserctxt", "text element", "value string", "schema", "xmlschema", "context", "stringval", "wrapper", "emp0001n", "emp0002n", "xslt", "handler", "handlerstate", "checktype", "tarray", "id documentid", "comment element", "node", "first", "prop", "typeerror", "gc", "pkpublicchannel", "pkpushpayload", "pkpushregistry", "pkpushtypevoip", "pushkit", "object", "pkpushtype type", "forward", "http", "apple push", "pkexport extern", "nsstringenum", "payload data", "voip", "json format", "callkit", "pkpushtype", "framework", "apps", "push", "odsessioncreate", "odattributemap", "odconfiguration", "odcontext", "odmappings", "odmoduleentry", "odnode", "odquery", "odrecord", "odrecordmap", "nsavailablemac", "original code", "nsstring value", "custom", "modifications", "apple public", "source license", "of any", "nsavailable", "nsrunloop", "objc", "sets", "odsession", "sfauthorization", "will", "odsessionref", "cfexport", "odqueryref", "odnoderef", "cfexport bool", "odrecordref", "cfdataref", "cfexport const", "utf8 encoding", "odattributetype", "odrecordtype", "attribute type", "local", "realm", "cftyperef", "odnodegetdsref", "odnodegettypeid", "odrecorddelete", "odtriggercancel", "odnodeinit", "odquerycreate", "odqueryinit", "odsessioninit", "albuffer3i", "albufferdata", "albufferf", "albufferfv", "albufferi", "albufferiv", "aldistancemodel", "aldopplerfactor", "algetbooleanv", "algetbuffer3f", "alcapi", "alcapientry", "alcboolean", "targetosmac", "alcdevice", "alcenum param", "alalch", "alcchar", "alcsizei", "capture", "alenum param", "alapi", "aluint sid", "alfloat", "aluint bid", "alsizei", "alint", "alfloat value", "alapientry", "aluint", "play", "speed", "bits", "alutapi alvoid", "alvoid data", "alsizei size", "alsizei freq", "gnu library", "general public", "aluth", "alenum format", "openalopenalh", "umbrella header", "alvoid", "openal", "alvoid nonnull", "alenum", "roger beep", "sendable", "preconcurrency", "rawvalue", "network import", "failure", "service", "must", "number", "stride", "brief", "descriptor", "matrix", "mtlpackedfloat3", "infinity", "metalversion", "minimum point", "maximum point", "interpolation", "translation", "offset", "acceleration", "declare", "prior", "insert", "nonnull", "nsrange", "mtldevice", "t argname", "mtlstructtype", "mtlarraytype", "mtltype", "mtlpointertype", "instance", "methodkind", "swiftprivate", "mtlbuffer", "nullability", "mtlcommandqueue", "mtlresource", "mtlresidencyset", "command encoder", "individual", "mtlexport", "xcode", "gpu trace", "apideprecated", "mtlcapturescope", "remarks", "mtlallocation", "metal command", "mtldispatchtype", "mtlorigin", "mtlsize", "mtlblitoption", "flush", "gpu work", "marks", "specify", "mtlinline", "mtlintern", "stdcversion", "mtlextern", "definition", "inline", "nsstring label", "stencil", "defaults", "allocate", "typical", "nsprocessinfo", "mtldrawable", "present", "cftimeinterval", "gpustarttime", "gpuendtime", "mtlcountersh", "mtlcounter", "mtlcounterset", "mtllibrary", "a container", "mtlfence", "mtldatatype", "default usage", "mtlfunction", "mtllogcontainer", "mtlsharedevent", "mtlevent", "synchronously", "a function", "cpu cache", "requiredsize", "behavior", "mtlheap", "query device", "dispatch", "metal shading", "language guide", "raytriangle", "vends", "groups", "encodes", "mtliofilehandle", "mtlextern sizet", "mtlextern void", "mtlstoreaction", "mtlloglevel", "enum", "mtlmutability", "astcetc2bc", "normal", "astc", "clamptoedge", "depth", "mtlcoordinate2d", "nsnumber", "controls", "mtlclearcolor", "adds", "mtlregion", "cpu mapping", "mtltexture", "mtlindextype", "filter option", "clamp", "mtlrenderstages", "draw", "mtlstepfunction", "vertex", "compute", "gpu resource", "nsuinteger x", "identify", "nsuinteger y", "nsuinteger z", "mtlsize size", "mtlvertexformat", "nsuintegermax", "mtlpixelformat", "mtltexturetype", "slice", "swiftui", "coregraphics", "swift import", "previewregistry", "libraryitem", "category", "dict", "apple root", "code signing", "public", "uus10u", "GUANGZHOU FIVE SIX TECHNOLOGY", "Havana Syndrome", "Aishah Lazim", "Al-Arqam", "Brooklyn" ], "references": [ "httpd.exp", "metadata.json", "add-class.tmpl", "choose-make.tmpl", "choose-model.tmpl", "choose-device.tmpl", "add-printer.tmpl", "choose-serial.tmpl", "class-added.tmpl", "choose-uri.tmpl", "class-confirm.tmpl", "admin.tmpl", "class-deleted.tmpl", "class-modified.tmpl", "classes-header.tmpl", "command.tmpl", "classes.tmpl", "edit-config.tmpl", "error-op.tmpl", "class-jobs-header.tmpl", "error.tmpl", "header.tmpl", "help-header.tmpl", "help-printable.tmpl", "help-trailer.tmpl", "job-hold.tmpl", "class.tmpl", "job-cancel.tmpl", "job-move.tmpl", "job-moved.tmpl", "job-release.tmpl", "job-restart.tmpl", "list-available-printers.tmpl", "jobs.tmpl", "norestart.tmpl", "option-boolean.tmpl", "option-header.tmpl", "option-conflict.tmpl", "option-pickmany.tmpl", "option-pickone.tmpl", "modify-printer.tmpl", "option-trailer.tmpl", "pager.tmpl", "printer-cancel-jobs.tmpl", "printer-added.tmpl", "printer-accept.tmpl", "printer-configured.tmpl", "printer-default.tmpl", "printer-confirm.tmpl", "printer-deleted.tmpl", "printer-jobs-header.tmpl", "printer-modified.tmpl", "jobs-header.tmpl", "printer-stop.tmpl", "modify-class.tmpl", "printer-reject.tmpl", "printers-header.tmpl", "printer-start.tmpl", "printer.tmpl", "printers.tmpl", "set-printer-options-trailer.tmpl", "test-page.tmpl", "restart.tmpl", "users.tmpl", "set-printer-options-header.tmpl", "search.tmpl", "trailer.tmpl", "font.defs", "hp.h", "epson.h", "label.h", "raster.defs", "media.defs", "apple.types", "apple.convs", "mime.convs", "mime.types", "cancel-current-job.test", "create-job-sheets.test", "create-job.test", "create-job-format.test", "create-job-timeout.test", "create-printer-subscription.test", "cups-create-local-printer.test", "fax-job.test", "get-completed-jobs.test", "get-devices.test", "get-job-attributes.test", "get-job-attributes2.test", "get-notifications.test", "get-jobs.test", "get-job-template-attributes.test", "get-ppd-printer.test", "get-ppds-drv-only.test", "get-ppd.test", "get-ppds-make-and-model.test", "get-ppds-make.test", "get-ppds-product.test", "get-ppds-psversion.test", "get-ppds-language.test", "get-printer-description-attributes.test", "get-ppds.test", "get-printer-attributes.test", "get-subscriptions.test", "identify-printer-display.test", "get-printers-printer-id.test", "identify-printer-multiple.test", "get-printers.test", "identify-printer.test", "get-printer-attributes-suite.test", "ipp-2.0.test", "ipp-2.2.test", "ipp-backend.test", "ipp-2.1.test", "print-job-and-wait.test", "print-job-deflate.test", "print-job-hold.test", "print-job-gzip.test", "ipp-1.1.test", "print-job-manual.test", "print-job-password.test", "print-job.test", "print-job-media-col.test", "print-uri.test", "print-job-letter.test", "set-attrs-hold.test", "validate-job.test", "ipp-everywhere.test", "sample.drv", "testprint", "classified", "standard", "topsecret", "secret", "confidential", "unclassified", "ntp_opendirectory.conf", "ntp.conf", "notify.conf", "nfs.conf", "nsmb.conf", "xtab", "6015FED9-D723-4332-87D9-C478CF341407.aamdownload", "AuraService-fda-test", "com.adobe.acrobat.rna.AcroCefBrowserLock.DC", "ExmanProcessMutex", "proxy.xml", "A53749AF-3855-4842-A1E7-4AEFA60BD2AC", "XPdb-wal", "VZBootLoader.h", "VZAudioInputStreamSource.h", "VZBridgedNetworkDeviceAttachment.h", "VZAudioOutputStreamSink.h", "VZBridgedNetworkInterface.h", "VZConsoleDeviceConfiguration.h", "VZConsoleDevice.h", "VZConsolePortConfiguration.h", "VZDirectorySharingDevice.h", "VZDirectoryShare.h", "VZDefines.h", "VZDiskImageStorageDeviceAttachment.h", "VZDiskSynchronizationMode.h", "VZDiskBlockDeviceStorageDeviceAttachment.h", "Virtualization.h", "VZDirectorySharingDeviceConfiguration.h", "VZEntropyDeviceConfiguration.h", "VZEFIBootLoader.h", "VZError.h", "VZEFIVariableStore.h", "VZFileHandleNetworkDeviceAttachment.h", "VZFileHandleSerialPortAttachment.h", "VZFileSerialPortAttachment.h", "VZGraphicsDevice.h", "VZGenericPlatformConfiguration.h", "VZGenericMachineIdentifier.h", "VZGraphicsDeviceConfiguration.h", "VZGraphicsDisplayConfiguration.h", "VZHostAudioOutputStreamSink.h", "VZKeyboardConfiguration.h", "VZHostAudioInputStreamSource.h", "VZGraphicsDisplay.h", "VZAudioDeviceConfiguration.h", "VZLinuxRosettaUnixSocketCachingOptions.h", "VZLinuxRosettaAbstractSocketCachingOptions.h", "VZLinuxRosettaDirectoryShare.h", "VZMACAddress.h", "VZLinuxBootLoader.h", "VZMacGraphicsDevice.h", "VZMacGraphicsDisplay.h", "VZMacGraphicsDeviceConfiguration.h", "VZMacHardwareModel.h", "VZMacKeyboardConfiguration.h", "VZMacMachineIdentifier.h", "VZMacOSBootLoader.h", "VZLinuxRosettaCachingOptions.h", "VZMacOSInstaller.h", "VZMacOSVirtualMachineStartOptions.h", "VZMacOSRestoreImage.h", "VZMacTrackpadConfiguration.h", "VZMacOSConfigurationRequirements.h", "VZMemoryBalloonDevice.h", "VZMemoryBalloonDeviceConfiguration.h", "VZMacAuxiliaryStorage.h", "VZMultipleDirectoryShare.h", "VZMacPlatformConfiguration.h", "VZNetworkDevice.h", "VZNetworkBlockDeviceStorageDeviceAttachment.h", "VZNATNetworkDeviceAttachment.h", "VZNetworkDeviceAttachment.h", "VZPlatformConfiguration.h", "VZPointingDeviceConfiguration.h", "VZNetworkDeviceConfiguration.h", "VZSharedDirectory.h", "VZSerialPortAttachment.h", "VZNVMExpressControllerDeviceConfiguration.h", "VZMacGraphicsDisplayConfiguration.h", "VZSerialPortConfiguration.h", "VZSingleDirectoryShare.h", "VZSpiceAgentPortAttachment.h", "VZSocketDeviceConfiguration.h", "VZSocketDevice.h", "VZStorageDevice.h", "VZStorageDeviceAttachment.h", "VZStorageDeviceConfiguration.h", "VZUSBControllerConfiguration.h", "VZUSBDeviceConfiguration.h", "VZUSBMassStorageDevice.h", "VZUSBKeyboardConfiguration.h", "VZUSBController.h", "VZUSBDevice.h", "VZVirtioBlockDeviceConfiguration.h", "VZUSBScreenCoordinatePointingDeviceConfiguration.h", "VZUSBMassStorageDeviceConfiguration.h", "VZVirtioConsoleDevice.h", "VZVirtioConsoleDeviceConfiguration.h", "VZVirtioConsoleDeviceSerialPortConfiguration.h", "VZVirtioEntropyDeviceConfiguration.h", "VZVirtioConsolePort.h", "VZVirtioConsolePortConfigurationArray.h", "VZVirtioFileSystemDevice.h", "VZVirtioConsolePortConfiguration.h", "VZVirtioGraphicsDevice.h", "VZVirtioGraphicsDeviceConfiguration.h", "VZVirtioGraphicsScanout.h", "VZVirtioGraphicsScanoutConfiguration.h", "VZVirtioConsolePortArray.h", "VZVirtioFileSystemDeviceConfiguration.h", "VZVirtioNetworkDeviceConfiguration.h", "VZVirtioSocketConnection.h", "VZVirtioSocketDevice.h", "VZVirtioSoundDeviceConfiguration.h", "VZVirtioSocketListener.h", "VZVirtioSoundDeviceInputStreamConfiguration.h", "VZVirtioSocketDeviceConfiguration.h", "VZVirtioSoundDeviceOutputStreamConfiguration.h", "VZVirtioSoundDeviceStreamConfiguration.h", "VZVirtioTraditionalMemoryBalloonDeviceConfiguration.h", "VZVirtualMachineDelegate.h", "VZVirtualMachineStartOptions.h", "VZVirtioTraditionalMemoryBalloonDevice.h", "VZVirtualMachine.h", "VZXHCIControllerConfiguration.h", "VZVirtualMachineView.h", "VZVirtualMachineConfiguration.h", "VZXHCIController.h", "x86_64-apple-macos.swiftinterface", "arm64e-apple-macos.swiftinterface", "module.modulemap", "Virtualization.tbd", "VideoToolbox.apinotes", "VideoToolbox.h", "VTBase.h", "VTDecompressionProperties.h", "VTCompressionSession.h", "VTErrors.h", "VTCompressionProperties.h", "VTDecompressionSession.h", "VTHDRPerFrameMetadataGenerationSession.h", "VTMultiPassStorage.h", "VTPixelRotationSession.h", "VTFrameSilo.h", "VTPixelRotationProperties.h", "VTPixelTransferSession.h", "VTProfessionalVideoWorkflow.h", "VTRAWProcessingProperties.h", "VTPixelTransferProperties.h", "VTSession.h", "VTUtilities.h", "VTVideoEncoderList.h", "VTRAWProcessingSession.h", "libvDSP.tbd", "SharedWithYouCore.h", "SWAction.h", "SWCollaborationActionHandler.h", "SWCollaborationCoordinator.h", "SWCollaborationMetadata.h", "SWCollaborationOption.h", "SWCollaborationOptionsPickerGroup.h", "SWCollaborationOptionsGroup.h", "SWCollaborationShareOptions.h", "SWDefines.h", "SWPersonIdentity.h", "SWPerson.h", "SWStartCollaborationAction.h", "SWPersonIdentityProof.h", "SWUpdateCollaborationParticipantsAction.h", "SharedWithYouCore.tbd", "ScriptingBridge.tbd", "SBElementArray.h", "ScriptingBridge.apinotes", "ScriptingBridge.h", "SBApplication.h", "SBObject.h", "SCScreenshotManager.h", "SCError.h", "SCRecordingOutput.h", "ScreenCaptureKit.h", "SCShareableContent.h", "SCContentSharingPicker.h", "SCStream.h", "Ruby.tbd", "rbLibXMLParser.rb", "rbCFPlistError.rb", "rbNokogiriParser.rb", "rbCFTypes.rb", "rbCFPropertyList.rb", "rbPlainCFPropertyList.rb", "rbBinaryCFPropertyList.rb", "rbREXMLParser.rb", "cfpropertylist.rb", "setup.rb", "libxml.rb", "xml.rb", "mini_portile_cmake.rb", "version.rb", "mini_portile.rb", "sqlite3.rb", "faq.rb", "exception.c", "backup.h", "backup.c", "database.h", "exception.h", "sqlite3_ruby.h", "statement.h", "extconf.rb", "sqlite3.c", "database.c", "statement.c", "nokogiri.rb", "ascii.c", "ascii.h", "char_ref.h", "attribute.h", "attribute.c", "error.h", "foreign_attrs.c", "insertion_mode.h", "error.c", "gumbo.h", "parser.h", "replacement.h", "parser.c", "string_buffer.h", "string_buffer.c", "string_piece.c", "macros.h", "svg_attrs.c", "tag_lookup.h", "svg_tags.c", "tag_lookup.c", "token_type.h", "tag.c", "token_buffer.h", "token_buffer.c", "tokenizer.h", "tokenizer.c", "utf8.c", "utf8.h", "util.c", "util.h", "tokenizer_states.h", "vector.c", "vector.h", "html4_document.c", "html4_entity_lookup.c", "html4_element_description.c", "html4_sax_push_parser.c", "libxml2_backwards_compat.c", "nokogiri.c", "test_global_handlers.c", "xml_attribute_decl.c", "nokogiri.h", "xml_attr.c", "xml_cdata.c", "xml_document_fragment.c", "xml_document.c", "xml_element_content.c", "html4_sax_parser_context.c", "xml_encoding_handler.c", "xml_element_decl.c", "xml_entity_decl.c", "xml_node_set.c", "xml_dtd.c", "gumbo.c", "xml_namespace.c", "xml_processing_instruction.c", "xml_reader.c", "xml_relax_ng.c", "xml_entity_reference.c", "xml_sax_parser.c", "xml_sax_push_parser.c", "xml_sax_parser_context.c", "xml_text.c", "xml_schema.c", "xml_xpath_context.c", "xslt_stylesheet.c", "xml_syntax_error.c", "xml_comment.c", "xml_node.c", "PushKit.tbd", "PKPushCredentials.h", "PKDefines.h", "PKPushPayload.h", "PushKit.h", "PKPushRegistry.h", "PushKit.apinotes", "OpenDirectory.tbd", "ODAttributeMap.h", "ODMappings.h", "NSOpenDirectory.h", "ODConfiguration.h", "ODQuery.h", "ODNode.h", "OpenDirectory.h", "ODRecordMap.h", "ODSession.h", "ODModuleEntry.h", "ODRecord.h", "CFODContext.h", "CFODSession.h", "CFOpenDirectory.h", "CFODQuery.h", "CFODNode.h", "CFODRecord.h", "CFOpenDirectoryConstants.h", "CFOpenDirectory.tbd", "OpenAL.tbd", "alc.h", "al.h", "alut.h", "OpenAL.h", "MacOSX_OALExtensions.h", "arm64e-apple-ios-macabi.swiftinterface", "x86_64-apple-ios-macabi.swiftinterface", "SwiftUI.swiftoverlay", "MTLAccelerationStructure.h", "Metal.h", "MTLAccelerationStructureTypes.h", "MTLAccelerationStructureCommandEncoder.h", "MTLArgumentEncoder.h", "MTLArgument.h", "MTLBinaryArchive.h", "Metal.apinotes", "MTLBlitPass.h", "MTLBuffer.h", "MTLCaptureManager.h", "MTLCaptureScope.h", "MTLAllocation.h", "MTLCommandEncoder.h", "MTLCommandBuffer.h", "MTLComputePass.h", "MTLBlitCommandEncoder.h", "MTLCommandQueue.h", "MTLDefines.h", "MTLDepthStencil.h", "MTLComputePipeline.h", "MTLDeviceCertification.h", "MTLDrawable.h", "MTLCounters.h", "MTLComputeCommandEncoder.h", "MTLDynamicLibrary.h", "MTLFence.h", "MTLFunctionConstantValues.h", "MTLFunctionDescriptor.h", "MTLFunctionLog.h", "MTLFunctionHandle.h", "MTLEvent.h", "MTLFunctionStitching.h", "MTLHeap.h", "MTLDevice.h", "MTLIndirectCommandBuffer.h", "MTLIntersectionFunctionTable.h", "MTLIOCommandQueue.h", "MTLLinkedFunctions.h", "MTLIOCommandBuffer.h", "MTLIOCompressor.h", "MTLParallelRenderCommandEncoder.h", "MTLLogState.h", "MTLPipeline.h", "MTLLibrary.h", "MTLPixelFormat.h", "MTLRasterizationRate.h", "MTLRenderPass.h", "MTLRenderPipeline.h", "MTLResidencySet.h", "MTLResourceStateCommandEncoder.h", "MTLResourceStatePass.h", "MTLResource.h", "MTLIndirectCommandEncoder.h", "MTLSampler.h", "MTLRenderCommandEncoder.h", "MTLStageInputOutputDescriptor.h", "MTLVisibleFunctionTable.h", "MTLTypes.h", "MTLVertexDescriptor.h", "MTLTexture.h", "WebKit.arm64e.bridgesupport", "WebKit.bridgesupport" ], "public": 1, "adversary": "DragonForce Hacker Group Malaysia", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "VZBootLoader", "display_name": "VZBootLoader", "target": null }, { "id": "TypeError", "display_name": "TypeError", "target": null }, { "id": "GC", "display_name": "GC", "target": null }, { "id": "CFTypeRef", "display_name": "CFTypeRef", "target": null } ], "attack_ids": [ { "id": "T1123", "name": "Audio Capture", "display_name": "T1123 - Audio Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1135", "name": "Network Share Discovery", "display_name": "T1135 - Network Share Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1124", "name": "System Time Discovery", "display_name": "T1124 - System Time Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1550", "name": "Use Alternate Authentication Material", "display_name": "T1550 - Use Alternate Authentication Material" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" } ], "industries": [ "Media" ], "TLP": "white", "cloned_from": null, "export_count": 49, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 346, "FileHash-SHA256": 272, "domain": 110, "hostname": 101, "email": 1, "CVE": 2, "FileHash-SHA1": 1 }, "indicator_count": 833, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "570 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6605781ad51380e5b1c22815", "name": "haul from the last two weeks of wrangling - presumed malware and IOC's found on my personal devices", "description": "nearing the two year mark of the first initial attack - unfortunately OTX was only able to pull domains from the large majority of files uploaded which seems to be a built in anti-debug feature and goes with the theme and \"look & feel\" of this latest iteration being that most of them were somehow someway remote and acting as a net file system on my machine", "modified": "2024-04-27T02:04:29.606000", "created": "2024-03-28T14:00:58.809000", "tags": [ "dddf", "target", "dddj", "path", "base o", "base", "backupfile", "base rw", "exit", "date", "hell", "gnu libtool", "please do", "linker", "lsmime3 lnss3", "lplc4 lnspr4", "ludev", "directory", "lmagic ljansson", "feugiat", "lorem ipsum", "nulla facilisi", "malesuada", "etiam tempor", "suspendisse", "consectetur", "bibendum", "amet", "eget aliquet", "basesectors", "date echo", "default", "label", "kernel", "append rhgb", "clsid", "systemroot", "webbrowser", "ispell", "imagemagick", "flex", "zle c", "whois", "locate", "rubber", "chown", "ruby", "ninja", "pacman", "restart", "kill", "django", "mark", "repl", "service", "term", "mkdir", "borg", "black", "conan", "dolphin", "dotnet", "hello", "john", "generic", "find", "shutdown", "mozilla", "first", "subsystem", "action", "goto", "load", "devtype", "idnetdriver", "drivers", "program", "interface", "nmunmanaged", "ethernet", "mac prefix", "attr", "virtualbox host", "mac address", "interface name", "hello world", "unit", "timer", "onbootsec5min", "install", "wait online", "networkmanager", "edit", "note", "typeoneshot", "cloud", "optin", "helper", "for testing", "only", "restrict", "grant", "enable debug", "trace", "killmodeprocess", "typedbus", "reload", "capdacoverride", "dhcp etc", "include", "yara", "cflags", "libs", "xxx remove", "the author", "this software", "isc license", "copyright", "schlueter", "permission", "software is", "provided", "as is", "disclaims all", "direct", "require", "semver", "comparator", "range", "releasetypes", "simple", "tilde", "09azaz", "prerelease", "same", "beta", "semverrangesgtr", "semverrangesltr", "coerce version", "ranges", "alpha", "standalone", "exits", "null", "false", "reverse", "compare", "a javascript", "copyright isaac", "typeerror", "maxsafeinteger", "maxlength", "break", "error", "number", "drop", "same direction", "symbol", "comp", "const", "caret", "flagloose", "xrange", "parse", "identifier", "object", "match", "string", "walk", "manually", "stop", "highhaspre", "major", "minor", "patch", "istanbul", "preminor", "index", "regexp", "build metadata", "meaning", "replace", "token", "zero", "star", "infinity", "return", "a cache", "build status", "coverage status", "the same", "options", "before", "lrulist", "cache", "length", "dispose", "maxage", "allowstale", "nodisposeonset", "yallist", "node", "array", "head", "function", "tail", "start", "insert", "just", "node object", "barbar", "array method", "default export", "any comparator", "complex range", "simple range", "c1 c2", "outer", "every simple", "ecomp", "must", "clone", "case", "ignore", "setmin", "determine", "version", "typeof", "contribute", "status", "node package", "manager", "benchmark suite", "installation", "direct download", "ql https", "node version", "usage", "project", "calendar", "package", "source", "license", "source form", "perl foundation", "distributor fee", "distribute", "standard", "neither", "module", "basecommand", "lifecyclecmd", "base command", "pacote", "browser", "workspace", "pkgname", "await", "boolean", "base class", "wrapwidth", "chalk", "command", "config", "npmcliconfig", "logfile", "timers", "display", "location", "audit", "arboristcmd", "arborist", "global", "whoami", "async", "json", "view", "pref", "pckmnt", "resolve", "utf8", "libnpmversion", "unstar", "update", "save", "omit", "packagelock", "dryrun", "force", "libnpmaccess", "spec", "uninstall", "todo", "enoent", "enotdir", "test", "scriptshell", "scope", "team", "create", "user", "libnpmteam", "destroy", "table", "list", "cidr", "stars", "eneedauth", "shrinkwrap", "rename", "npmcliarborist", "value", "unicode", "sbom", "cyclonedx", "build", "sbomformats", "response", "software bill", "look", "script", "runscript", "indent", "root", "minipass", "search", "pipeline", "filterstream", "libnpmsearch", "long", "grab", "packageurlcmd", "repo", "info", "repo const", "rebuild", "reifycmd", "publish", "libnpmpack", "npmclirunscript", "prune", "remove", "prefix", "args", "queryable", "packagejson", "pong", "cleanurl", "registry", "pack", "load tarball", "noise", "query", "edge", "etarget", "e403", "e404", "outdated", "homepage", "developer", "admin", "owner", "libnpmorg", "npmfetch", "logout", "getauth", "invalid", "parent", "depth", "type", "filteredby", "dedupe", "problems", "login", "link", "util", "installcitest", "runs", "prop", "password", "profile", "mode", "email", "twitter", "hook", "libnpmhook", "init", "wpath", "installtest", "complete", "globaltop", "help", "viewer", "glob", "pattern", "file", "globify", "explore", "shell", "handle", "fund", "which", "fundingsource", "archy", "explain", "helpsearch", "text", "part", "editor", "editor const", "childprocess", "check", "nodemodules", "docs", "promisify", "doctor", "cacache", "mask", "win32", "disttag", "packagespec", "semver range", "delete", "diff", "workspacepath", "actualtree", "libnpmdiff", "deprecate", "message", "write", "clean", "spawn", "compline", "comppoint", "compcword", "epipe", "completion", "compfish", "os x", "bugs", "report", "adduser", "exec", "libnpmexec", "localprefix", "runpath", "skip", "public key", "npmauditreport", "access", "item", "finddupes", "syntaxerror", "getcli", "eventemitter", "abort", "ssri", "columnify", "bundled", "tarball details", "sha1", "daily", "latest", "check daily", "weekly", "cyclonedxschema", "cyclonedxformat", "proppath", "propbundled", "propdevelopment", "propextraneous", "propprivate", "refvcs", "refwebsite", "crypto", "readpassword", "readusername", "reademail", "enter", "enter otp", "otpprompt", "afaf09", "passwordprompt", "auditerror", "getfundinginfo", "json output", "data", "append", "maybeindex", "ontimeend", "name", "returns", "noassertion", "spdxidentifer", "spdxdatalicense", "reldescribes", "reldep", "reftypepurl", "spdxid", "eotp", "e401", "setinterval", "npmlog", "proclog", "maxlogsperfile", "fsminipass", "open", "colmax", "colmin", "colgutter", "quick help", "convert", "b return", "mb return", "gb return", "sigint", "readline", "prompt", "promise", "eresolve error", "overridden", "peer", "extraneous", "optional", "isworkspace", "maxlen", "code", "unfinished", "notice", "isshellout", "matcherrorcode", "devnull", "npmcompletion", "compwords", "compreply", "o default", "f npmcompletion", "ifs compadd", "fish shell", "l cmd", "taken", "comp stuff", "lx compline", "abbrev", "please", "enyi", "json version", "cygwin", "c1 control", "numbers", "x09 x0a", "10000", "nodemodulesnpm", "builtin", "npmrc", "notsup", "notarget", "nospc", "rofs", "author", "npmclifs", "minimatch", "pathtofoo", "relative", "synopsis", "description", "field", "person", "configuration", "whether", "premajor", "prepatch", "prevents", "run git", "upgrade", "examples", "will", "shareman", "cidr whitelist", "please refer", "tokenid", "eslint", "c eslint", "compatibility", "older", "versions", "nodeoptions", "details", "output", "example", "posix", "unstarring", "lcall", "starring", "lock", "materials", "spdx", "lodash", "nodeenv", "initcwd", "boolean set", "boolean tells", "windows", "unix", "selector", "use cases", "queries", "equivalent", "boolean show", "nocolor environ", "cli look", "boolean force", "dependency", "json object", "production", "files", "cicd system", "property", "change", "url opener", "basic auth", "allow", "description a", "removes", "semvermajor", "ping https", "ping http", "found", "get http", "example add", "json format", "handy", "display prefix", "g usrlocal", "mycorp", "associate", "deprecated", "libnodemodules", "caveat note", "workspace usage", "string override", "tarball", "githubrepo", "initializer", "usrfoo", "forwarding", "suppose", "commandsnpm", "hooks", "url endpoint", "browse", "consider", "ci environment", "string optional", "promzard", "top level", "expect", "javascript", "it staff", "https", "cli team", "ecmascript", "readme", "package current", "latest location", "depended", "git repos", "git dependency", "newest version", "modify package", "description add", "show", "purpose tags", "tags", "keyvalue", "16 16", "boolean ignore", "boolean do", "string source", "treat", "example make", "grep", "travis ci", "details npm", "localappdata", "tab completion", "bulk advisory", "sha256publickey", "endpoint", "quick audit", "set access", "that user", "scoped", "python", "description npm", "node javascript", "important npm", "introduction", "c code", "unix system", "integrity", "provide", "facilitate", "cli tool", "handling old", "lockfiles", "file format", "legacy", "urls", "spdx license", "most", "barney rubble", "specify", "github", "dependencies", "github urls", "node installer", "linux", "overview", "windows node", "prefixetcnpmrc", "variablename", "home", "comments", "peruser config", "global config", "builtin config", "auth", "cycles", "local install", "global install", "appdata", "below", "please note", "stage", "after", "life cycle", "runs after", "post scripts", "scripts", "slate", "synopsis so", "rf usrlocal", "modules", "with", "laf usrlocal", "l npm", "description all", "installing", "myorgmypackage", "requiring", "publishing", "private modules", "scopes", "apis", "auth related", "does", "package name", "aliases", "folders", "os equivalent", "tarballs", "teams", "orgs", "super admin", "team admins", "developer guide", "description so", "be explicit", "blank", "standard glob", "link packages", "syntax", "selectors", "querying", "log file", "location all", "log levels", "information", "headers", "logs", "alias", "certificate", "format", "docext", "content", "descriptions", "shorthands", "keyb", "print", "dir1", "manual", "input", "line", "process", "display help", "dirs", "get contents", "maxdepth", "contents", "u2665 bxe5r", "ud834udf06 baz", "single", "cssesc", "usage arborist", "commands", "options most", "npm install", "npm rm", "time", "silent", "fetch", "conf", "handler", "extract", "additional", "jackspeak", "jack", "glob v", "expand", "drive letter", "never", "true", "rob browning", "gnu library", "general", "public license", "license file", "future import", "adderror", "cdfq", "charles levert", "egrep", "egrepegrep", "fgrepfgrep", "grepgrep", "svr4 grepegrep", "times", "attributeerror", "fixcygwinid", "enhanced", "false try", "false assert", "tsns", "inetaddress", "none", "return value", "unixaddress", "localrepo", "httpserver", "valueerror", "resourcepath", "exception", "eoferror", "c version", "bytesio", "offset", "binary", "ascii", "baseversion", "commit", "throw", "in n", "send", "data end", "if 10", "copy", "send logoutn", "exitatoi", "tmplink", "lcallc binls", "varlogsetup rm", "sf tmp", "slackware", "system console", "entry", "ansi mode", "b007e", "slackware ftp", "cdrom", "miquel van", "smoorenburg", "okay", "minix", "fixme", "overwrite", "connect", "ssh connection", "subcmd", "bbupttywidth", "bupforcetty", "hashsplitter", "b options", "false def", "hack", "kbytesr", "srcpath", "tmptagfiles", "device", "tmpreply", "reply", "including", "but not", "quotesplit", "quoteerror", "not word", "split line", "mainselect", "tpxetcfstab", "select", "slackware linux", "varlogmount", "anything", "tmpswapmsg", "swappart", "ndir", "swaplist", "tmpsetswap", "linux swap", "swap space", "redir", "linux fdisk", "tmptmpscript", "eof fi", "instsets", "gnome", "tmpsetds", "tmpsetseries", "gnu emacs", "gnome desktop", "linux kernel", "k desktop", "uucp", "tmp fi", "tmpsettpx", "tpxetcshadow", "root password", "detected", "internet", "press", "linux native", "partitions", "tmpreturn", "nodes", "nextpartition", "rootdevice", "mtpt", "size", "formatting", "doformat", "main", "done", "sourcemedia", "tmpmedia", "source media", "selection", "slackware cd", "network file", "tmpsetreturn", "maketag", "choice", "mount", "tagext", "tmpsetnewtag", "tmpsettagmake", "sorry", "tmpsetkeymap", "mapname", "moorhead", "keyboard map", "us keyboard", "updown", "copying", "kernel chmod", "kernel rdev", "lilo", "fullerr", "tmpsettestfull", "partition full", "setup", "altf2", "slackware setup", "dospart", "newdir", "tmptempscript", "tmpsetdos", "partition", "ntfs", "doslist", "installscripts", "tpxproc", "atapi cd", "kerberos", "file transfer", "iana", "appletalk", "network", "control", "secure shell", "chat", "contact", "prospero", "outtag", "outshift", "if 30", "conn", "setmode", "dumb", "smart", "clienterror", "rather", "stopiteration", "firstexclusion", "appendcommit", "firstbranchitem", "filterbranch", "origtip", "oldnew", "remoterepo", "group", "prevpath", "sisdir import", "dangerous", "count", "subcount", "ioerror", "oserror", "gitmodetree", "gitmodefile", "gitmodesymlink", "stack", "nonlocal", "revision", "presdir", "admdirpackages", "warn", "tmprequiredlist", "trigger", "arch", "procscsiscsi", "luns", "scsi", "ax1b", "skript", "scsi bus", "kurt garloff", "gnu gpl", "ieee1394", "l found0", "nextrepoid", "repoid", "realpath", "usb keyboard", "d libmodules", "nousb", "procbususb a", "procbususb fi", "load input", "q input", "inet system", "hostname", "attach", "etcmotd", "newdisk", "scan", "slackkernel", "ram disk", "r sbp2", "r ieee1394", "firewire", "noieee1394", "q ieee1394", "attempt", "use f", "none def", "return password", "return none", "passwd", "nametopwdcache", "gidtogrpcache", "nametogrpcache", "tagfile", "prompt mode", "help software", "less", "removepkg", "gnu cc", "linux source", "pkgtool", "proccmdline", "termvt100", "termlinux", "homeroot lessmm", "ps1u", "home path", "display less", "term ps1", "kind", "branch", "period", "tmpsetfdisk", "minor elif", "smashedline", "l dev", "tmpsetfdisk fi", "probe", "mylex", "raid", "disksets", "packagedir", "blurb", "sourcedir", "tmptmpmsg", "tmptagfile", "media", "pcmcia", "umountcdrom", "o ro", "floppy", "pcmcia andor", "cardbus", "usedflopfalse", "libdir", "libdir exedir", "bcmd", "exedir", "openssl set", "packageversion", "versiongreater", "invert", "optdict", "intify", "limited to", "sockets layer", "argv", "normally", "shutwr", "sigexception", "demuxconn", "pipe import", "demultiplex", "openssl", "debug", "opensslversion", "static imported", "target openssl", "cmake", "shared imported", "fatalerror", "obex", "import", "stringio import", "obex service", "bdaddr channeln", "ascii character", "alength", "notfoundreturn", "use nis", "nis version", "name service", "switch config", "legal", "use dns", "domain name", "os2 boot", "os2 fdisk", "partition magic", "boot manager", "tcpip subsystem", "nfs install", "network support", "make", "sample file", "zip disk", "zip drive", "first scsi", "first ide", "atari", "solaris", "drive x", "zip100", "linkdir", "linkdir fi", "tmp directory", "asap", "linkdir tmp", "indexerror", "want", "midxversion", "wrapper", "multiple index", "filename", "desiredhwm", "domidx", "exitstack", "total", "option", "c option", "vmsize", "vmrss", "vmdata", "vmstk", "majflt", "september", "guess object", "longmatch", "raid device", "devrd", "devname", "concord", "applyerror", "metadata", "einval", "macos", "frozen", "fifo", "common code", "faildelay", "faillogenab", "logunkfailenab", "logoklogins", "lastlogenab", "mailcheckenab", "quotasenab", "syslogsuenab", "syslogsgenab", "console console", "ttywidth", "baseexception", "pythonpath", "pipe", "sigismember", "xdropaqueauth", "libcpvalloc", "rtld", "gnu c", "library", "free software", "foundation", "gnu lesser", "general public", "merchantability", "refs", "keyerror", "important", "carefully", "kwargs", "super", "true result", "priority", "pmsg", "crunch", "tmptempmsg", "localnetmask", "localipaddr", "upnrun", "ip address", "localgateway", "kversion", "eof dialog", "tmpmask", "localnetwork", "slackdevice", "fgrep", "ftp site", "tmpsetmount", "reboot machine", "tmpwhichdrv", "tmpsetmount cat", "select floppy", "drive", "tmptempmsg exit", "tmptempmsg mv", "tmpsourcedir", "drivefound", "cddvd", "rdir", "cddvd drive", "tmpsetcddev", "ide bus", "tmperrordo exit", "third", "login binsh", "l ttys0", "l ttys1", "x0 s", "reboot", "stuff", "bupdir", "iterhelper", "next", "none d", "indexhdr", "ixexists", "ixhashvalid", "ixshamissing", "indexsig", "entlen", "footersig", "tmpdir", "experimental", "bdupcache", "brestore", "bindex", "agulbra", "tcpip", "linux box", "hlinkdb", "verify", "maxpertree", "bupblobbits", "buptreeblobbits", "giterror", "mpicount", "bupnormal", "bupchunked", "refresh", "close", "dump", "dest", "commonargs", "ref dest", "pick", "btree", "missingobject", "bloom filter", "existingcount", "idxlivecount", "ram budget", "bupfs", "importerror", "fuse", "verbose", "fakemetadata", "fsdecode", "ptraceerror", "ptracesetregs", "cpu64bits", "ptraceattach", "ptracedetach", "ptracesyscall", "cpuwordsize", "runningbsd", "ext2", "proc proc", "commanderror", "optionerror", "lcctype", "iso88591", "localrepo repo", "sbine2fsck", "bfailed", "elif", "bcanary", "posix acls", "linux partition", "move", "pgdnspace", "olargefile", "onofollow", "xdev", "xdevxdev", "dirlist", "prepend", "cyan", "white", "blue", "dialog box", "yellow", "active button", "inactive button", "search box", "input box", "green", "excluderxs", "doit", "s seed", "this command", "is extremely", "dangerous n", "chunksize", "socket", "return hex", "supports python", "rethrow", "hostrs", "bnone", "bload", "branchpath", "snapshotroot", "snapshot", "tmpidx", "bashsource", "bashlineno", "int dryrun", "importing", "ux f", "sbinbrc", "eof binsync", "unmounting file", "devnull echo", "rest", "first assert", "existing", "restcount", "none path", "maxbloombits", "bloomversion", "maxbitseach", "discussion", "k4 k5", "k6 k7", "k8 k9", "rvatoi", "exitrv", "exit 1", "noblock", "sisdir", "sislnk", "writetree", "rawtreeitem", "splittreeitem", "metadataro", "meta", "builtmodulename", "dkms", "packagename", "autoinstall", "kernelrelease", "kbuild", "kerneluname", "implementation", "murmurhash3", "jens taylor", "gary court", "austin appleby", "typeof h", "later", "tls1", "fbtfr", "fbfr", "apache http", "fbefr", "fbhfr", "fbabfr", "http", "keepalive", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "runtime data", "ansi", "getprocaddress", "access type", "ck id", "observed ja3", "mitre att", "show technique", "suspicious", "hybrid", "click", "delphi", "strings", "malicious", "february", "middle", "exploit", "gameover", "hybrid analysis", "api key", "vetting process", "ck matrix", "accept", "memoryfile scan", "invalid octet", "falcon sandbox", "tmpp59thrck", "informative", "name tactics" ], "references": [ "itl-logo.txt", "empty.exe", "libnm.la", "libyara.la", "sunjava_map.xml", "lorem.txt", "stage2", "q\u00e9\u00d5?e\u00ac\u00d2\u00b6.\u000f\u001c\u00cc", "syslinux.cfg", "x.jnlp", "desktop.ini", "a.txt", "a.txt:ads.txt", "dir:ads.txt", "b.txt:ads.txt", "no_ads.txt", ".:ads.txt", "b.txt", "nm-shared.xml", ".zcompdump-m1904-5.9", ".zcompdump", "90-nm-thunderbolt.rules", "84-nm-drivers.rules", "85-nm-unmanaged.rules", "???? ????????.txt", "notes.txt", "notes.txt:ads", "nm-cloud-setup.timer", "NetworkManager-wait-online.service", "nm-cloud-setup.service", "nm-priv-helper.service", "NetworkManager-dispatcher.service", "NetworkManager.service", "NetworkManager-ovs.conf", "nm-pppd-plugin.la", "yara.pc", "libnm.pc", "preload.js", "LICENSE", "index.js", "range.bnf", "package.json", "README.md", "semver.js", "comparator.js", "range.js", "valid.js", "sort.js", "satisfies.js", "rsort.js", "rcompare.js", "prerelease.js", "patch.js", "neq.js", "minor.js", "major.js", "lt.js", "inc.js", "parse.js", "gt.js", "eq.js", "gte.js", "compare-loose.js", "compare.js", "clean.js", "cmp.js", "coerce.js", "compare-build.js", "diff.js", "lte.js", "parse-options.js", "identifiers.js", "debug.js", "constants.js", "re.js", "yallist.js", "iterator.js", "subset.js", "to-comparators.js", "outside.js", "min-version.js", "min-satisfying.js", "max-satisfying.js", "ltr.js", "simplify.js", "intersects.js", "gtr.js", "npmrc", "cli.js", "lifecycle-cmd.js", "cli-entry.js", "package-url-cmd.js", "base-command.js", "npm.js", "arborist-cmd.js", "whoami.js", "view.js", "version.js", "unstar.js", "update.js", "unpublish.js", "uninstall.js", "test.js", "team.js", "stop.js", "start.js", "token.js", "stars.js", "shrinkwrap.js", "set.js", "star.js", "sbom.js", "run-script.js", "root.js", "search.js", "repo.js", "restart.js", "rebuild.js", "publish.js", "prune.js", "prefix.js", "pkg.js", "ping.js", "pack.js", "query.js", "outdated.js", "org.js", "owner.js", "logout.js", "ls.js", "ll.js", "login.js", "link.js", "install-ci-test.js", "profile.js", "hook.js", "init.js", "install-test.js", "install.js", "help.js", "explore.js", "fund.js", "explain.js", "help-search.js", "get.js", "edit.js", "docs.js", "doctor.js", "dist-tag.js", "dedupe.js", "deprecate.js", "ci.js", "config.js", "completion.js", "bugs.js", "adduser.js", "exec.js", "audit.js", "access.js", "cache.js", "find-dupes.js", "validate-engines.js", "web-auth.js", "tar.js", "update-notifier.js", "sbom-cyclonedx.js", "replace-info.js", "read-user-info.js", "reify-output.js", "queryable.js", "timers.js", "validate-lockfile.js", "sbom-spdx.js", "otplease.js", "pulse-till-done.js", "log-shim.js", "log-file.js", "npm-usage.js", "get-identity.js", "format-bytes.js", "open-url-prompt.js", "explain-eresolve.js", "explain-dep.js", "exit-handler.js", "open-url.js", "did-you-mean.js", "completion.sh", "completion.fish", "cmd-list.js", "auth.js", "audit-error.js", "is-windows.js", "display.js", "reify-finish.js", "error-message.js", "format-search-stream.js", "installed-shallow.js", "installed-deep.js", "update-workspaces.js", "get-workspaces.js", "npm-view.md", "npm-version.md", "npm-uninstall.md", "npm-token.md", "npx.md", "npm-team.md", "npm-stop.md", "npm-unstar.md", "npm-start.md", "npm-star.md", "npm-test.md", "npm-shrinkwrap.md", "npm-stars.md", "npm-sbom.md", "npm-root.md", "npm-run-script.md", "npm-restart.md", "npm-rebuild.md", "npm-query.md", "npm-search.md", "npm-prune.md", "npm-publish.md", "npm-profile.md", "npm-repo.md", "npm-whoami.md", "npm-pkg.md", "npm-pack.md", "npm-ping.md", "npm-org.md", "npm-owner.md", "npm-prefix.md", "npm-login.md", "npm-logout.md", "npm-link.md", "npm-install-ci-test.md", "npm-install.md", "npm-init.md", "npm-update.md", "npm-help-search.md", "npm-hook.md", "npm-help.md", "npm-find-dupes.md", "npm-explore.md", "npm-unpublish.md", "npm-exec.md", "npm-ls.md", "npm-edit.md", "npm-doctor.md", "npm-fund.md", "npm-outdated.md", "npm-docs.md", "npm-dist-tag.md", "npm-config.md", "npm-diff.md", "npm-ci.md", "npm-cache.md", "npm-bugs.md", "npm-completion.md", "npm-audit.md", "npm-access.md", "npm.md", "npm-install-test.md", "npm-adduser.md", "npm-dedupe.md", "package-lock-json.md", "package-json.md", "npm-shrinkwrap-json.md", "install.md", "npmrc.md", "folders.md", "workspaces.md", "scripts.md", "removal.md", "scope.md", "registry.md", "package-spec.md", "orgs.md", "developers.md", "dependency-selectors.md", "logging.md", "config.md", "node-which", "mkdirp", "qrcode-terminal", "installed-package-contents", "cssesc", "color-support", "arborist", "pacote", "glob", "empty", "xstat (2).py", "zgrep", "xstat.py", "wtmp", "web.py", "vt300", "vt300 (2)", "vt100 (3)", "vt100", "vint.py", "version (2).py", "version.py", "vdecmd", "unmigrate (2).sh", "unmigrate.sh", "tick.py", "termcap (2)", "termcap", "tag.py", "syslinux (2).cfg", "syslog.conf", "syslog (2).conf", "styles.css", "stdcrt (2)", "std (2)", "stage2 (3)", "stage2 (2)", "std", "ssh.py", "source_info.py", "split.py", "slackinstall", "stdcrt", "shells", "shells (2)", "shquote.py", "shadow (2)", "shadow", "setup (2)", "SeTswap (2)", "SeTPKG (2)", "setup", "SeTswap", "SeTpasswd (2)", "SeTpasswd", "SeTnopart (2)", "SeTpartitions (2)", "SeTnopart", "SeTPKG", "SeTmedia (2)", "SeTpartitions", "SeTmedia", "SeTmaketag", "slackinstall (2)", "SeTkeymap (2)", "SeTmaketag (2)", "SeTkernel", "SeTfull (2)", "SeTkernel (2)", "SeTfull", "SeTfdHELP", "SeTfdHELP (2)", "SeTkeymap", "SeTDOS (2)", "SeTconfig (2)", "services (2)", "SeTDOS", "SeTconfig", "services", "sendcmd.rc", "securetty (2)", "securetty", "server.py", "rm.py", "restore.py", "rm (2).py", "save.py", "removepkg", "rescan-scsi-bus", "removepkg (2)", "README (2)", "README", "repo.py", "rc.usb", "rc.inet1", "rc.S", "rc.ieee1394", "random.py", "pwdgrp.py", "PROMPThelp (2)", "profile (2)", "prune_older.py", "profile", "probe (2)", "probe", "pkgtool", "pkgtool (2)", "pcmcia", "path.py", "passwd (2)", "passwd", "OpenSSLConfigVersion.cmake", "options.py", "PROMPThelp", "openssl.pc", "openmachine.rc", "on__server.py", "on.py", "OpenSSLConfig.cmake", "obexstress", "nsswitch (2).conf", "nsswitch.conf", "nopartHELP (2)", "nopartHELP", "networks (2)", "networks", "network", "mux.py", "mtools (2).conf", "mtools.conf", "mtab (2)", "mtab", "motd (2)", "motd", "modules.pcimap", "modules.pnpbiosmap", "modules.parportmap", "modules.usbmap", "modules.isapnpmap", "modules.ieee1394map", "modules.generic_string", "modules.dep", "migrate (2).sh", "migrate.sh", "midx.py", "midx (2).py", "meta.py", "memtest.py", "margin.py", "makedevs (2).sh", "makedevs.sh", "metadata.py", "ls (2).py", "ls.py", "login (2).defs", "main.py", "login.defs", "list_idx.py", "libssl.pc", "libnm-wwan.la", "libnm-ppp-plugin.la", "libnm-device-plugin-wwan.la", "libnm-device-plugin-wifi.la", "libnm-device-plugin-team.la", "libnm-device-plugin-bluetooth.la", "libnm-device-plugin-ovs.la", "libnm-device-plugin-adsl.la", "libcrypto.pc", "libc6-i386_2.31-0ubuntu6_amd64.url", "libc6-i386_2.31-0ubuntu6_amd64.info", "libc6-i386_2.30-4_amd64.url", "libc6-i386_2.31-0ubuntu6_amd64.symbols", "libc6-i386_2.30-4_amd64.info", "libc6-i386_2.30-4_amd64.symbols", "libc6-i386_2.30-0ubuntu2_amd64.url", "libc6-i386_2.30-0ubuntu2_amd64.info", "libc6-i386_2.30-0ubuntu2.1_amd64.url", "libc6-i386_2.30-0ubuntu2_amd64.symbols", "libc6-i386_2.30-0ubuntu2.1_amd64.info", "libc6-i386_2.29-0ubuntu2_amd64.url", "libc6-i386_2.29-0ubuntu2_amd64.symbols", "libc6-i386_2.29-0ubuntu2_amd64.info", "libc6-i386_2.28-10_amd64.url", "libc6-i386_2.28-10_amd64.info", "libc6-i386_2.28-10_amd64.symbols", "libc6-i386_2.28-0ubuntu1_amd64.symbols", "libc6-i386_2.28-0ubuntu1_amd64.info", "libc6-i386_2.27-3ubuntu1_amd64.url", "libc6-i386_2.27-3ubuntu1_amd64.symbols", "libc6-i386_2.28-0ubuntu1_amd64.url", "libc6-i386_2.27-3ubuntu1_amd64.info", "libc6-i386_2.26-0ubuntu2_amd64.url", "libc6-i386_2.26-0ubuntu2_amd64.info", "libc6-i386_2.26-0ubuntu2_amd64.symbols", "libc6-i386_2.26-0ubuntu2.1_amd64.url", "libc6-i386_2.26-0ubuntu2.1_amd64.info", "libc6-i386_2.24-11+deb9u4_amd64.url", "libc6-i386_2.30-0ubuntu2.1_amd64.symbols", "libc6-i386_2.26-0ubuntu2.1_amd64.symbols", "libc6-i386_2.24-9ubuntu2_amd64.symbols", "libc6-i386_2.24-11+deb9u4_amd64.symbols", "libc6-i386_2.24-9ubuntu2_amd64.url", "libc6-i386_2.24-9ubuntu2_amd64.info", "libc6-i386_2.24-9ubuntu2.2_amd64.url", "libc6-i386_2.24-9ubuntu2.2_amd64.symbols", "libc6-i386_2.24-9ubuntu2.2_amd64.info", "libc6-i386_2.24-3ubuntu2.2_amd64.url", "libc6-i386_2.24-3ubuntu2.2_amd64.info", "libc6-i386_2.24-3ubuntu2.2_amd64.symbols", "libc6-i386_2.24-3ubuntu1_amd64.url", "libc6-i386_2.23-0ubuntu11_amd64.url", "libc6-i386_2.24-3ubuntu1_amd64.symbols", "libc6-i386_2.24-3ubuntu1_amd64.info", "libc6-i386_2.23-0ubuntu11_amd64.symbols", "libc6-i386_2.23-0ubuntu11_amd64.info", "libc6-i386_2.23-0ubuntu10_amd64.url", "libc6-i386_2.23-0ubuntu10_amd64.symbols", "libc6-i386_2.23-0ubuntu10_amd64.info", "libc6-i386_2.23-0ubuntu3_amd64.symbols", "libc6-i386_2.23-0ubuntu3_amd64.info", "libc6-i386_2.21-0ubuntu4_amd64.url", "libc6-i386_2.23-0ubuntu3_amd64.url", "libc6-i386_2.21-0ubuntu4_amd64.info", "libc6-i386_2.21-0ubuntu4.3_amd64.url", "libc6-i386_2.21-0ubuntu4_amd64.symbols", "libc6-i386_2.21-0ubuntu4.3_amd64.info", "libc6-i386_2.19-18+deb8u10_amd64.url", "libc6-i386_2.19-18+deb8u10_amd64.symbols", "libc6-i386_2.19-18+deb8u10_amd64.info", "libc6-i386_2.19-10ubuntu2_amd64.url", "libc6-i386_2.19-10ubuntu2_amd64.symbols", "libc6-i386_2.21-0ubuntu4.3_amd64.symbols", "libc6-i386_2.19-10ubuntu2_amd64.info", "libc6-i386_2.19-10ubuntu2.3_amd64.symbols", "libc6-i386_2.24-11+deb9u4_amd64.info", "libc6-i386_2.19-0ubuntu6_amd64.url", "libc6-i386_2.19-10ubuntu2.3_amd64.url", "libc6-i386_2.19-10ubuntu2.3_amd64.info", "libc6-i386_2.19-0ubuntu6_amd64.info", "libc6-i386_2.19-0ubuntu6_amd64.symbols", "libc6-i386_2.19-0ubuntu6.15_amd64.info", "libc6-i386_2.19-0ubuntu6.15_amd64.url", "libc6-i386_2.19-0ubuntu6.15_amd64.symbols", "libc6-i386_2.17-93ubuntu4_amd64.url", "libc6-i386_2.17-93ubuntu4_amd64.info", "libc6-i386_2.17-0ubuntu5_amd64.url", "libc6-i386_2.17-93ubuntu4_amd64.symbols", "libc6-i386_2.17-0ubuntu5_amd64.info", "libc6-i386_2.17-0ubuntu5.1_amd64.url", "libc6-i386_2.17-0ubuntu5_amd64.symbols", "libc6-i386_2.17-0ubuntu5.1_amd64.symbols", "libc6-i386_2.17-0ubuntu5.1_amd64.info", "libc6-i386_2.15-0ubuntu20_amd64.url", "libc6-i386_2.15-0ubuntu20.2_amd64.url", "libc6-i386_2.15-0ubuntu20_amd64.symbols", "libc6-i386_2.15-0ubuntu20.2_amd64.info", "libc6-i386_2.15-0ubuntu20.2_amd64.symbols", "libc6-i386_2.15-0ubuntu10_amd64.info", "libc6-i386_2.15-0ubuntu10_amd64.url", "libc6-i386_2.15-0ubuntu20_amd64.info", "libc6-i386_2.15-0ubuntu10.18_amd64.url", "libc6-i386_2.15-0ubuntu10_amd64.symbols", "libc6-i386_2.15-0ubuntu10.18_amd64.info", "libc6-i386_2.13-20ubuntu5_amd64.url", "libc6-i386_2.13-20ubuntu5_amd64.info", "libc6-i386_2.13-20ubuntu5_amd64.symbols", "libc6-i386_2.13-20ubuntu5.3_amd64.url", "libc6-i386_2.13-20ubuntu5.3_amd64.info", "libc6-i386_2.13-20ubuntu5.2_amd64.url", "libc6-i386_2.13-20ubuntu5.3_amd64.symbols", "libc6-i386_2.15-0ubuntu10.18_amd64.symbols", "libc6-i386_2.13-20ubuntu5.2_amd64.info", "libc6-i386_2.13-0ubuntu13_amd64.url", "libc6-i386_2.13-0ubuntu13_amd64.info", "libc6-i386_2.13-20ubuntu5.2_amd64.symbols", "libc6-i386_2.13-0ubuntu13.2_amd64.url", "libc6-i386_2.13-0ubuntu13_amd64.symbols", "libc6-i386_2.12.1-0ubuntu10.4_amd64.url", "libc6-i386_2.13-0ubuntu13.2_amd64.info", "libc6-i386_2.12.1-0ubuntu10.4_amd64.info", "libc6-i386_2.13-0ubuntu13.2_amd64.symbols", "libc6-i386_2.12.1-0ubuntu6_amd64.info", "libc6-i386_2.11.1-0ubuntu7_amd64.url", "libc6-i386_2.12.1-0ubuntu6_amd64.symbols", "libc6-i386_2.12.1-0ubuntu10.4_amd64.symbols", "libc6-i386_2.12.1-0ubuntu6_amd64.url", "libc6-i386_2.11.1-0ubuntu7_amd64.info", "libc6-i386_2.11.1-0ubuntu7.21_amd64.info", "libc6-i386_2.11.1-0ubuntu7.21_amd64.symbols", "libc6-i386_2.11.1-0ubuntu7.12_amd64.url", "libc6-i386_2.11.1-0ubuntu7_amd64.symbols", "libc6-i386_2.11.1-0ubuntu7.11_amd64.url", "libc6-i386_2.11.1-0ubuntu7.21_amd64.url", "libc6-i386_2.11.1-0ubuntu7.12_amd64.symbols", "libc6-i386_2.11.1-0ubuntu7.11_amd64.info", "libc6-i386_2.11.1-0ubuntu7.11_amd64.symbols", "libc6-i386_2.10.1-0ubuntu19_amd64.url", "libc6-i386_2.10.1-0ubuntu19_amd64.info", "libc6-i386_2.10.1-0ubuntu19_amd64.symbols", "libc6-i386_2.10.1-0ubuntu15_amd64.info", "libc6-i386_2.10.1-0ubuntu15_amd64.symbols", "libc6-i386_2.11.1-0ubuntu7.12_amd64.info", "libc6-i386_2.9-4ubuntu6_amd64.url", "libc6-i386_2.9-4ubuntu6_amd64.info", "libc6-i386_2.9-4ubuntu6_amd64.symbols", "libc6-i386_2.10.1-0ubuntu15_amd64.url", "libc6-i386_2.9-4ubuntu6.3_amd64.info", "libc6-i386_2.8~20080505-0ubuntu9_amd64.url", "libc6-i386_2.9-4ubuntu6.3_amd64.symbols", "libc6-i386_2.9-4ubuntu6.3_amd64.url", "libc6-i386_2.8~20080505-0ubuntu9_amd64.info", "libc6-i386_2.8~20080505-0ubuntu7_amd64.url", "libc6-i386_2.7-10ubuntu8.3_amd64.url", "libc6-i386_2.8~20080505-0ubuntu7_amd64.info", "libc6-i386_2.7-10ubuntu8.3_amd64.info", "libc6-i386_2.7-10ubuntu3_amd64.url", "libc6-i386_2.8~20080505-0ubuntu7_amd64.symbols", "libc6-i386_2.7-10ubuntu3_amd64.symbols", "libc6-i386_2.7-10ubuntu3_amd64.info", "libc6-i386_2.6.1-1ubuntu10_amd64.url", "libc6-i386_2.6.1-1ubuntu10_amd64.symbols", "libc6-i386_2.6.1-1ubuntu10_amd64.info", "libc6-i386_2.7-10ubuntu8.3_amd64.symbols", "libc6-i386_2.6.1-1ubuntu9_amd64.url", "libc6-i386_2.6.1-1ubuntu9_amd64.info", "libc6-i386_2.6.1-1ubuntu9_amd64.symbols", "libc6-i386_2.5-0ubuntu14_amd64.symbols", "libc6-i386_2.5-0ubuntu14_amd64.info", "libc6-i386_2.4-1ubuntu12_amd64.url", "libc6-i386_2.4-1ubuntu12_amd64.symbols", "libc6-i386_2.4-1ubuntu12_amd64.info", "libc6-i386_2.8~20080505-0ubuntu9_amd64.symbols", "libc6-i386_2.4-1ubuntu12.3_amd64.url", "libc6-i386_2.4-1ubuntu12.3_amd64.info", "libc6-i386_2.5-0ubuntu14_amd64.url", "libc6-i386_2.3.6-0ubuntu20_amd64.url", "libc6-i386_2.3.6-0ubuntu20_amd64.symbols", "libc6-i386_2.3.6-0ubuntu20_amd64.info", "libc6-i386_2.3.6-0ubuntu20.6_amd64.url", "libc6-i386_2.3.6-0ubuntu20.6_amd64.info", "libc6-i386_2.3.6-0ubuntu20.6_amd64.symbols", "ldd", "libc6-i386_2.4-1ubuntu12.3_amd64.symbols", "ld.so (2).conf", "ld.so.conf", "join.py", "itl-logo (3).txt", "itl-logo (2).txt", "issue", "issue (2)", "io.py", "installpkg", "INSNFS (2)", "installpkg (2)", "INSNFS", "INShd", "INShd (2)", "INSfd (2)", "INSfd", "INSdir (2)", "INSdir", "INSCD", "INSCD (2)", "inittab (2)", "inittab", "init.py", "__init__ (2).py", "__init__.py", "index (2).py", "index.py", "import_duplicity.py", "hosts (2)", "hosts", "host (2).conf", "host.conf", "HOSTNAME", "hlinkdb.py", "help.py", "helpers.py", "HOSTNAME (2)", "hashsplit.py", "group (2)", "group", "gc (2).py", "git.py", "get.py", "gc.py", "fuse.py", "func.py", "fstab (2)", "fstab", "ftp.py", "fsck (2).ext2", "fsck (2).ext3", "fsck.ext3", "fsck.ext2", "fsck.py", "filesize", "features.py", "fdisk (2)", "fdisk", "FDhelp (2)", "FDhelp", "empty (3)", "empty (2)", "drecurse.py", "dialogrc", "dialogrc (2)", "disk2 (2)", "drecurse (2).py", "disk2", "damage.py", "daemon.py", "compat.py", "closemachine.rc", "checkout_info.py", "cfdisk (2)", "client.py", "cfdisk", "cat_file.py", "bup-import-rsnapshot", "bup-import-rdiff-backup", "brc (2)", "brc", "bloom (2).py", "bloom.py", "asyncrecv.rc", "90-nm-cloud-setup.sh", "vfs.py", "tree.py", "template-WaR2X6", "a1676298638", "a4033901479", ".X1-lock", ".X0-lock", ".X1024-lock", "b3336837578", "MozillaUpdateLock-7A4D7A8EFFB43502", "imurmurhash.min.js", ".X1025-lock", "murmur2", "b529967783", "empty.lock~", "ab.1", "https://hybrid-analysis.com/sample/babc94597eadb83b520d6a46a57ef2ad963683aef1ff2fc6fa9ba5e98e78e008/65fcd2b1519a5f86d60eed63", "https://hybrid-analysis.com/file-collection/6604df33503d4a306e01c776", "https://hybrid-analysis.com/sample/babc94597eadb83b520d6a46a57ef2ad963683aef1ff2fc6fa9ba5e98e78e008/6604e16b6b94878cbb062194", "https://hybrid-analysis.com/file-collection/6604df4bb797f028b4065601", "https://hybrid-analysis.com/sample/2eaba531c48445e241c116f61653649e403d4b1ef07bfc96390e986e1eeb5b83/6604e230edf88ab15b0d83fc", "https://hybrid-analysis.com/file-collection/66057525d9b81759df06c4b5", "https://hybrid-analysis.com/sample/d714e2a850645f9a0f8f3785dd0eedd47a417417bed470b968e0f6a1a2e746e6/652cf1f4243d9d03b90f74a1", "https://www.virustotal.com/gui/file/ea8490563a229b89f2b779217938f9eb2bcf93dd89de9f7fc5c035632f0934b5/relations" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1489", "name": "Service Stop", "display_name": "T1489 - Service Stop" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" }, { "id": "T1030", "name": "Data Transfer Size Limits", "display_name": "T1030 - Data Transfer Size Limits" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 36, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Merkd1904", "id": "196517", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 297, "email": 8, "hostname": 204, "URL": 382, "FileHash-SHA1": 7, "CVE": 2, "FileHash-MD5": 45, "FileHash-SHA256": 5 }, "indicator_count": 950, "is_author": false, "is_subscribing": null, "subscriber_count": 72, "modified_text": "765 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708ea5a3214f63e1d6d94f", "name": "lumen.me Honeybadger", "description": "", "modified": "2023-12-06T15:09:25.749000", "created": "2023-12-06T15:09:25.749000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 475, "hostname": 315, "domain": 233, "URL": 1133 }, "indicator_count": 2156, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708e2d7cb4228401888b63", "name": "possibly a central bank", "description": "", "modified": "2023-12-06T15:07:25.990000", "created": "2023-12-06T15:07:25.990000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 622, "domain": 2558, "URL": 4203, "hostname": 1221, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708e0d95a8c74cc715f7a2", "name": "West.cn", "description": "", "modified": "2023-12-06T15:06:53.350000", "created": "2023-12-06T15:06:53.350000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 208, "domain": 533, "hostname": 757, "URL": 1861, "FileHash-MD5": 1 }, "indicator_count": 3360, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c534aadf7adf4f27d77", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "", "modified": "2023-12-06T14:59:31.122000", "created": "2023-12-06T14:59:31.122000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 302, "domain": 634, "URL": 2988, "hostname": 1208 }, "indicator_count": 5132, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708beba2ba8bcfb1d10237", "name": "hostkey - Industroyer&ReduceRight", "description": "", "modified": "2023-12-06T14:57:47.430000", "created": "2023-12-06T14:57:47.430000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 304, "hostname": 563, "domain": 407, "URL": 1776, "FileHash-SHA1": 2 }, "indicator_count": 3052, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708bbc4c8bf557c17688e1", "name": "\u9ad8\u5c71tv,\u9ad8\u5c71tv,\u9ad8\u5c71tv\u5f71\u9662,\u9ad8\u5c71tv\u770b\u7247\u7f51", "description": "", "modified": "2023-12-06T14:57:00.280000", "created": "2023-12-06T14:57:00.280000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 233, "domain": 361, "hostname": 563, "URL": 1374, "FileHash-SHA1": 1, "FileHash-MD5": 1 }, "indicator_count": 2534, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708bae2f0c59d34f050b9e", "name": "Malware and bots", "description": "", "modified": "2023-12-06T14:56:46.779000", "created": "2023-12-06T14:56:46.779000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 168, "hostname": 427, "domain": 214, "URL": 1188, "FileHash-MD5": 1, "FileHash-SHA1": 1, "email": 1 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "628af7e3df399fbe9095245f", "name": "lumen.me Honeybadger", "description": "window.ju_sha256, a new type of code, is written by the same characters:var l,b,c,g,p,a,h,d, c.", "modified": "2022-06-21T00:01:09.886000", "created": "2022-05-23T02:56:35.154000", "tags": [ "reduceright", "lj", "number", "query", "string", "trackevent", "date", "u003e div", "simulator", "error", "regexp", "pageview", "path", "void", "code", "l420", "g5vs2ll0p80", "copyright", "json", "uint8array", "ssnull", "script", "closure library", "xdfunction", "adfunction", "typeof t", "typeof symbol", "typeof", "window", "value", "function", "customevent", "image", "null", "sbfu", "typeof n", "object", "array", "control", "other", "android", "x3e div", "gtmnwh4dh2", "host", "page title", "page path", "typeerror", "promise", "typeof e", "typeof window", "aggregateerror", "math", "target", "rangeerror", "buffer", "index", "attempt", "argument", "google", "link", "ad tech", "providers", "ffffff", "ip address", "combine", "accept", "save", "explorer", "cookie", "back", "iframe", "blank", "position", "juorderid", "justuno", "body", "juorigtop", "event", "follow", "post", "config", "click", "local", "fast", "comp", "form", "unknown", "push", "trcimpl", "trcwarn" ], "references": [ "https://cdn.taboola.com/scripts/cds-pips.js", "https://www.iubenda.com/cookie-solution/confs/js/53119375.js", "https://cdn.jst.ai/mwgt_4.1.js?v=5.28", "https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.38.0/core-en.js", "https://s.pinimg.com/ct/lib/main.32155010.js", "https://analytics.tiktok.com/i18n/pixel/config.js?sdkid=C3I4VUA8DUF9JOO44QC0&hostname=lumen.me", "https://js.pvd.to/c/v1/pixel-1sdz.js?t=1653350400000", "https://cdn.jst.ai/vck.js", "https://www.googletagmanager.com/gtm.js?id=GTM-NWH4DH2", "https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C3I4VUA8DUF9JOO44QC0&lib=ttq", "https://cdn.taboola.com/libtrc/unip/1262365/tfa.js", "https://s.pinimg.com/ct/core.js", "https://www.googleoptimize.com/optimize.js?id=OPT-TQC6JW4", "https://www.googletagmanager.com/gtag/js?id=G-5VS2LL0P80&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtm.js?id=GTM-PF3JNK2>m_auth=a6AgvzJ0SAOcyjADNwrdlQ>m_preview=env-1>m_cookies_win=x" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Lj", "display_name": "Lj", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1134, "hostname": 315, "domain": 233, "FileHash-SHA256": 475 }, "indicator_count": 2157, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "1441 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6280aa12040a569d19f6285f", "name": "possibly a central bank", "description": "Tobias Ahlin,", "modified": "2022-06-14T00:00:05.659000", "created": "2022-05-15T07:21:54.499000", "tags": [ "regexp", "typeof e", "function", "typeof t", "width", "error", "object", "pseudo", "child", "form", "class", "null", "date", "this", "void", "accept", "reduceright", "number", "string", "l420", "g8m7ft2s1tv", "copyright", "json", "uint8array", "ssnull", "script", "closure library", "xdfunction", "adfunction", "typeerror", "symbol", "generator", "typeof n", "array", "promise", "weakmap", "typeof f", "natb", "409764", "animation", "suspense", "context", "forwardref", "deleted", "10252", "meta", "facebook", "unknown", "scroll", "backspace", "insert", "typeof symbol", "typeof c", "typeof s", "sprintf", "syntaxerror", "vhyj", "diefg", "bcdiefguxx", "constructor", "param", "rockn", "createclass", "source", "super", "infinity", "false", "contact", "internal", "phonenumber", "middle", "path", "redemption", "pass", "click", "cont", "albania", "armenia", "burma", "belarus", "cuba", "panama", "paraguay", "slovakia", "chad", "uruguay", "prop", "invert", "flip", "close", "small", "green", "union", "indonesia", "lucia", "martin", "mexico", "code", "apache", "blin", "slave", "gondi", "icelandic", "ganda", "zulu", "christmas", "burkina", "czech", "ukraine", "android", "format", "updater", "next", "hooks", "harmony", "trim", "python", "push", "shift", "slice", "shadowsizzle", "domdata", "hexchars", "agent", "launcher", "fail", "bind", "trident", "getclass", "body", "widget", "areasmodule", "duip", "hlwq", "fz5i", "dehu", "tbh0", "fwir", "x7am", "pcnd", "valr", "boolean", "portal", "partner", "ascio partner", "ascio", "tlds", "login en", "en de", "join today", "idns", "skip", "ascio domains", "tlds offered", "global whois", "checker", "helvetica neue", "arial", "d67a60", "inter", "baskerville", "15px", "180deg", "135deg", "video", "init", "wrap", "flip direction", "stop animation", "scale", "htmlelement", "hide", "typeof", "property", "fill", "noscroll", "matrix", "skew", "look", "julian garnier", "mit license", "typeof define", "typeof module", "htmlcollection", "255a", "qnull", "float32array", "nfunction", "tobias ahlin", "github", "spotify", "hyper island", "strong", "tobias", "read", "view", "ahlin bjerrome", "minecraft", "view project", "spinkit", "lookback", "ruby", "hello" ], "references": [ "xfe-URL-ascio.com-stix2-2.1-export.json", "https://tobiasahlin.com", "xfe-URL-tobiasahlin.com-stix2-2.1-export.json", "https://tobiasahlin.com/js/anime.min.js", "https://tobiasahlin.com/js/app.js?v=1", "https://tobiasahlin.com/js/portfolio.js", "https://tobiasahlin.com/css/site.css", "https://ascio.com", "https://portal.ascio.com/login", "https://static.zdassets.com/ekr/snippet.js?key=d814ea4a-a8eb-4a9c-aedd-cac0aa0e3551", "https://portal.ascio.com/7.602be6705ce7b901b821.js", "https://cdn.pendo.io/agent/static/783a696b-ddf4-4152-439e-f3761f54f088/pendo.js", "https://portal.ascio.com/runtime.48adad1e07e2679eb1f4.js", "https://js.hs-scripts.com/20704235.js", "https://www.ascio.com/wp-content/themes/Ascio/dist/js/front.js?ver=1648137806", "https://www.ascio.com/wp-includes/js/dist/i18n.min.js?ver=30fcecb428a0e8383d3776bcdd3a7834", "https://www.ascio.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c", "https://www.ascio.com/wp-includes/js/dist/vendor/react-dom.min.js?ver=17.0.1", "https://www.ascio.com/wp-includes/js/dist/vendor/lodash.min.js?ver=4.17.19", "xfe-URL-lodash.com-stix2-2.1-export.json", "https://www.ascio.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9", "https://www.google-analytics.com/gtm/optimize.js?id=OPT-NVZ8RF3", "https://www.googletagmanager.com/gtag/js?id=G-8M7FT2S1TV&l=dataLayer&cx=c" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4203, "hostname": 1221, "domain": 2558, "FileHash-SHA256": 622, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "1448 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6280398780fbe64692dd54fd", "name": "West.cn", "description": "If you want to know more about Shockwave Flash, spare a thought for the members of your own storage system:mt.co.g.o.mimeTypes.com, mime", "modified": "2022-06-13T00:00:32.864000", "created": "2022-05-14T23:21:43.936000", "tags": [ "jquery", "date", "vue jquery", "template", "layer", "paas", "dist", "wjf3m", "ajax", "business", "string", "number", "regexp", "copyright", "uint8array", "fnumber", "aw1045757556", "closure library", "xdfunction", "code", "ddos", "image", "script", "document", "unescape", "msie", "canvas", "domain", "click", "input", "label", "jdomname", "strong", "jactive15toast", "jclearinput", "case", "datatarget", "jdomainregcount", "span", "function", "x786e", "x53d6", "cite", "x4fe1", "iframe", "null", "prompt", "x6700", "x591a", "array", "numarray", "data", "midsize", "action", "keyword", "firstfix", "object", "5n3j", "3f4r", "5p3s", "1f5m", "hhe2", "bbf2", "3y3z", "1223", "6q6m", "zfunction", "psettimeout", "tsettimeout", "hsetinterval", "iparseint", "hnull", "pnull", "tnull", "lv1s", "efunction", "typeof t", "typeof e", "adobeedge", "typeof r", "webkittransform", "moztransform", "body", "this", "notifier", "invert", "name", "param", "value", "error", "false", "trigger", "restart", "form", "config", "constants", "true", "modalhelper", "relative", "fixed", "account login", "activexobject", "haslocation", "xmlhttprequest", "xmlregexp", "temp", "extpart", "foundation", "mit license", "write", "rhino", "mark", "import", "classnamedom", "onbeforedestroy", "login", "auto", "init", "typeof b", "width", "pseudo", "child", "enulle", "class", "accept", "shockwave flash", "new date1e3", "ka6e5", "la10" ], "references": [ "xfe-IP-103.24.249.209-stix2-2.1-export.json", "xfe-URL-West.cn-stix2-2.1-export.json", "https://m.west.cn/jscripts/baidutj/hm.js", "http://m.west.cn/jscripts/baidutj/hm.js", "https://www.west.cn/js2016/lib/jquery.SuperSlide/jquery.SuperSlide.2.1.1.x.js", "https://www.west.cn/js2016/root/jqinclude.js?t=20211126a", "https://www.googletagmanager.com/gtag/js?id=AW-1045757556" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 533, "URL": 1861, "hostname": 757, "FileHash-SHA256": 208, "FileHash-MD5": 1 }, "indicator_count": 3360, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1449 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6261f2763fabd1214a79f0e5", "name": "Masterhost.ru - malware hosting", "description": "Here is the code-decode for the punycode-overflow test, which is based on the results of the following test-run by the UK's Office of National Statistics (ONS).", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-22T00:10:30.250000", "tags": [ "fffe37", "b76810", "helvetica", "arial", "pf din", "text comp", "circe", "span", "button", "90deg", "object", "typeof t", "date", "promise", "function", "array", "regexp", "error", "typeof symbol", "typeof n", "null", "backspace", "void", "window", "vd", "gc", "typeof e", "sufeffxa0", "class", "attr", "pseudo", "child", "typeof module", "string", "weakmap", "proxy", "number", "boolean", "trnf", "keepalive", "transitiongroup", "hello", "comment", "infinity", "this", "copyright", "closure library", "xdfunction", "cdfunction", "ddfunction", "bded", "kefunction", "65535", "counter", "typeof c", "segoe ui", "typeerror", "lucida", "vwtabguid", "form", "impact", "light", "cureit", "bu durumda", "ip address", "devam", "yandex", "help section", "captcha code", "support service", "search", "edge", "swhealthlog", "logsdatabasev2", "trident", "android", "rangeerror", "webpackexports", "illegal input", "webpackrequire" ], "references": [ "https://admin.verbox.ru/support/support.js?h=afe80d31a1cabd6ae5c00580688f27d2", "https://www.youtube.com/s/player/534c466c/www-widgetapi.vflset/www-widgetapi.js", "https://site.yandex.net/v2.0/js/all.js", "https://mc.yandex.ru/metrika/tag.js", "https://www.googletagmanager.com/gtag/js?id=UA-36935570-1", "https://masterhost.ru/s/masterhost_v2/build/js/app.js?v=WivgGVzt/Ynv", "https://masterhost.ru/s/masterhost_v2/build/js/compiled.min.js?v=Q/hhNATxy3sx", "https://static.me-talk.ru/cabinet/build/chat/modern.support.js", "https://masterhost.ru/s/masterhost_v2/build/css/global.css?v=MUmvaY06hvKf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null }, { "id": "Vd", "display_name": "Vd", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1991, "hostname": 678, "FileHash-SHA256": 247, "domain": 404, "email": 1, "FileHash-MD5": 51 }, "indicator_count": 3372, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1472 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62616627ee302d24b23523c3", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "New RegExp(M) is a new type, and it will change any of the elements to the same type if you want to add them to your HTML page or add a third element.", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-21T14:11:51.629000", "tags": [ "tbody", "span", "thead", "tfoot", "multiple", "type", "href", "input", "halflings", "gradienttype1", "twitter", "false", "fontface", "fatface", "woff2", "u0259", "u1e001eff", "u2020", "u20a020ab", "u20ad20cf", "u2113", "u2c602c7f", "typesubmit", "function", "typeof c", "formdata", "this", "typeof define", "null", "typeof f", "object", "boolean", "typeof module", "error", "reflect", "math", "regexp", "number", "array", "typeerror", "string", "symbol", "typeof e", "typeof t", "class", "attr", "pseudo", "child", "js foundation", "account", "open", "navitem", "text", "mainnav", "click", "blank", "copyright", "u0027", "value", "body", "firefox", "enum", "html", "msie", "applewebkit", "traceconsole", "form", "iframe", "legend", "nonmsdombrowser", "callbackindex", "callbackframeid", "eventtarget", "eventargument", "validation", "explorer", "target", "plugin", "bootstrap", "https", "conflict", "focus", "next", "trigger", "checkbox", "delta", "scroll", "sourceid", "date", "sessiontoken", "sessionexpires", "void", "rangeerror", "utf16", "illegal input", "global", "chrome", "opredge", "opera", "safari", "version", "sxa0", "browser", "typeof require", "dom node", "typeof d", "component", "typeof h", "bubble", "reduceright", "script", "typeof n", "jhnew ia", "gtm5sn6brv", "path", "host", "trackpageview", "gw8yd4p2eny", "select", "strong", "uint8array", "android", "verify", "stop", "enterprise", "widget", "window", "generator", "reload", "r300", "caca", "closure library", "xdfunction", "adfunction", "cdfunction", "ddfunction", "bded", "please", "typeemail", "email", "jarallaxinner", "webkit", "property", "transform", "trident", "edge", "ipodi", "ipadi", "androidi", "blackberryi", "windows phonei", "xfunction", "pfunction", "wfunction", "show navigation", "mjquery", "typeof", "defaulttype", "hidden", "show", "shown", "startr", "endr", "federico zivolo", "distributed", "mit license", "statict", "flip" ], "references": [ "xfe-IP-78.142.35.163-stix2-2.1-export.json", "xfe-URL-Enom.com-stix2-2.1-export.json", "xfe-URL-4vendeta.com-stix2-2.1-export.json", "https://4vendeta.com/assets/js/jquery.min.js", "https://4vendeta.com/assets/js/popper.min.js", "https://4vendeta.com/assets/js/bootstrap.min.js", "https://4vendeta.com/assets/js/meanmenu.min.js", "https://4vendeta.com/assets/js/parallax.min.js", "https://4vendeta.com/assets/js/ajaxchimp.min.js", "https://www.googletagmanager.com/gtag/js?id=UA-92521958-1", "https://www.googletagmanager.com/gtag/js?id=G-W8YD4P2ENY&l=dataLayer&cx=c", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "https://www.googletagmanager.com/gtm.js?id=GTM-5SN6BRV", "https://static.zdassets.com/ekr/snippet.js?key=7342b695-e394-4f25-89a0-da9d262a48da", "https://cp.enom.com/js/jquery-3.5.1.min.js", "https://cp.enom.com/responsive/_js/knockout-3.3.0.min.js", "https://cp.enom.com/js/global-functions.js", "https://cp.enom.com/js/punycode.min.js", "https://cp.enom.com/js/jquery.disableonsubmit.min.js", "https://cp.enom.com/js/jquery.cookie.min.js", "https://cp.enom.com/js/cart.minicart.min.js", "https://cp.enom.com/js/openWin.min.js", "https://cp.enom.com/js/jquery.jgrowl.min.js", "https://cp.enom.com/scripts/Session.min.js", "https://cp.enom.com/responsive/_js/init.min.js", "https://cp.enom.com/responsive/_js/bootstrap.js", "https://cp.enom.com/WebResource.axd?d=6rtXrDcnyiYD-9dFDFOkxTRcPVSrAN8fR-cHKzNqPTy7bHic-2LLMHDnielTzEI-sd1KplHrRBudcZJOm0-lxubO7k41&t=637453818340000000", "https://cp.enom.com/ScriptResource.axd?d=fVjQa-0YyNqO6JmV36bw6eBJdTjE2YSdtcunOWcKYcBNn73MOJKQA_rxX3YMhcxLTgyDsGTKy0p9NEPvxzpqEpBKtm3GLb2GgI1LFYMC0Xr2lh71ZCttzgNGFnc5mS_Fc_DY5UH0M19Mr958h1jvmK4kzAM1&t=363be08", "https://cp.enom.com/ScriptResource.axd?d=lDjPFfAIWSrEAVNgTHTrISQmLEFmHAaibvNJQuGRZDbWpGFPLrFwaGVpjCUsI6HkqzbpwmaAa0cJCrq8f0eqEvIsQM8lvN_dVYVyESnohON4oTvdMZHDmwG83uJA4m2oqykP8TTTSIeV2oaNrlIXaX8cOxC5Cv6aGmjpdB2u-227wdn30&t=363be08", "https://cdn.optimizely.com/js/26241557.js", "https://cp.enom.com/verisign-seal.htm", "https://cp.enom.com/global/TopMenu.ascx.js", "http://alp-vision.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "http://alp-vision.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "http://alp-vision.com/wp-content/cache/autoptimize/js/autoptimize_78b4f9b28399aa3c8a405e45931ad058.js", "http://alp-vision.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.6", "http://fonts.googleapis.com/css?family=Abril+Fatface%3Aregular&subset=latin%2Ccyrillic&ver=5.7.6", "http://alp-vision.com/wp-content/themes/alp-vision/css/bootstrap.css?ver=1.0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2989, "hostname": 1208, "domain": 634, "FileHash-SHA256": 302 }, "indicator_count": 5133, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1472 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6256f92778c2f2177bdd4de9", "name": "\u9ad8\u5c71tv,\u9ad8\u5c71tv,\u9ad8\u5c71tv\u5f71\u9662,\u9ad8\u5c71tv\u770b\u7247\u7f51", "description": "Here is a full list of highlights from the Chinese TV series, which began in 2011 and has now been broadcast on Chinese television, online and mobile devices, and is now available to watch online.", "modified": "2022-05-13T00:03:35.765000", "created": "2022-04-13T16:24:07.391000", "tags": [ "date", "cnzzdata", "czuuid", "umdistinctid", "typeof symbol", "https", "zeno rocha", "typeof", "typeof define", "error", "array", "12863", "qrcode", "2g2g2h2h0g", "dhdh", "exptable", "logtable", "string", "typeof j", "regexp", "typeof e", "typeof t", "class", "attr", "pseudo", "child", "function", "typeof module", "ahgr", "0x40", "h0x1", "mm32", "indexof", "length", "h0x0", "0x248", "h0x2", "0x17b", "webpackrequire", "webpackexports", "object", "default", "hn return", "importsnvar", "truennnn", "iostf", "android", "nvar", "clickdownload", "this", "path", "service", "roboto", "boolean", "number", "createnamespace", "n default", "nn return", "null", "click", "void", "istanbul", "false", "close", "window", "info", "target", "find", "footer", "delta", "generator", "cascade", "code", "trigger", "next", "arrow", "slice", "checkbox", "body", "green", "phase", "copy", "infinity", "middle", "open", "calendar", "flex", "fail", "shift", "super", "internal", "form", "locale", "spinner", "spin", "multi", "mask", "write", "flip", "logic", "patch", "abcd", "skew", "main", "rest", "trim", "dark", "canvas", "facebook", "executor", "span", "tips", "sticky", "uploader", "bind", "config", "startpage", "speed", "toolbar", "refresh", "done", "format", "cardinal", "outside", "install", "public", "github", "vuejs", "jump", "browser", "sign", "view", "sponsor", "github sponsors", "mit license", "contact", "star", "stars", "javascript", "please", "strong", "\u9ad8\u5c71tv", "\u9ad8\u5c71tv\u5f71\u9662", "\u9ad8\u5c71tv\u770b\u7247\u7f51", "hd 20210830", "hd mu", "hd heydouga", "poro", "tv tv", "hd ok", "hd fol", "hd nanami2", "hd \uff13", "hd 20210927" ], "references": [ "http://www.bbbbop13.com:1313/", "xfe-URL-hyqxsnjj.com-stix2-2.1-export.json", "https://web.op39v.xyz/?channelCode=pingguo", "https://github.com/vuejs/vue-devtools", "https://web.op39v.xyz/js/chunk-vendors.js", "https://web.op39v.xyz/js/chunk-common.js", "https://res-1257422681.file.myqcloud.com/assets/yeyue/boinstall.js", "https://cdn.staticfile.org/jquery/3.6.0/jquery.min.js", "https://cdn.staticfile.org/qrcodejs/1.0.0/qrcode.min.js", "https://cdn.staticfile.org/clipboard.js/2.0.8/clipboard.min.js", "https://s9.cnzz.com/z_stat.php?id=1280740152&web_id=1280740152", "https://c.cnzz.com/core.php?web_id=1280740152&t=z" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1374, "hostname": 563, "CVE": 1, "domain": 361, "FileHash-SHA256": 233, "FileHash-SHA1": 1, "FileHash-MD5": 1 }, "indicator_count": 2534, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1480 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "625614852d13a468fd3f7ef9", "name": "Malware and bots", "description": "function se(t,e,n, r, n; if you want to know what type of document you are, you can use the new RegExp(M) to set it.", "modified": "2022-05-12T00:04:24.089000", "created": "2022-04-13T00:08:37.870000", "tags": [ "bygmo", "gmohd", "dx gmo", "nftadam", "iosandroid gmo", "csr sdgs", "english", "4444 gmo2020417", "developers gmo", "devsecopsthon", "tech", "font awesome", "free", "license", "cc by", "sil ofl", "code", "mit license", "brands", "fliph", "google", "import", "acbac1", "typeemail", "2deg", "1deg", "4deg", "css3", "animation cheat", "sheet", "justin aguilar", "questions", "slideexpandup", "expandup", "gradienttype0", "false", "copyright", "twitter", "f56505", "font", "font path", "woff", "truetype", "fontawesome", "unicode private", "tbody", "tfoot", "thead", "span", "multiple", "type", "href", "input", "halflings", "gradienttype1", "please", "function", "param", "method", "value", "target", "null", "array", "validator", "select", "checkbox", "date", "body", "error", "form", "meta", "class", "regexp", "typeof b", "width", "pseudo", "child", "sufeffxa0", "accept", "20px", "24px", "45deg", "typesubmit", "typenumber", "helvetica", "timelimit", "dialog", "content", "callback", "bodynoscroll", "click", "html", "confirm", "notice", "typeof e", "typeof t", "attr", "js foundation", "typeof module" ], "references": [ "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/js/jquery.min.js", "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/js/dialog.min.js", "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/js/common.js", "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/css/public.css", "xfe-URL-c81e728d9d4c2f636f067f89cc14862c.com-stix2-2.1-export.json", "https://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js", "http://downloads.mailchimp.com/js/jquery.form-n-validate.js", "http://imhrzluowdso.gq/i/css/bootstrap.css", "http://imhrzluowdso.gq/i/css/font-awesome.css", "http://imhrzluowdso.gq/i/css/bootstrap-theme.css", "http://imhrzluowdso.gq/i/css/animations.css", "http://imhrzluowdso.gq/i/css/style.css", "xfe-URL-imhrzluowdso.gq-stix2-2.1-export.json", "https://use.fontawesome.com/releases/v5.0.6/css/all.css" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1188, "domain": 214, "hostname": 427, "FileHash-SHA256": 168, "FileHash-MD5": 1, "FileHash-SHA1": 1, "email": 1 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1481 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "625eecb6fbc4353a109fe71c", "name": "hostkey - Industroyer&ReduceRight", "description": "Fbevents-PostalCodeType:f.exports, f.1, is a new addition to the list of \"signals\" that can be added to phone numbers.", "modified": "2022-04-19T17:09:10.196000", "created": "2022-04-19T17:09:10.196000", "tags": [ "livechat", "sign up", "free", "grow", "policy", "sign", "strong", "sorry", "identify", "increase", "lzutf8", "typeerror", "uint8array", "array", "error", "typeof r", "class", "invalid", "post", "uint32array", "date", "null", "papvisitorid", "string", "regexp", "value", "property", "valuenumber", "activexobject", "postaffparams", "object", "number", "boolean", "typeof e", "math", "first", "raid", "window", "service", "ukraine", "epsilon", "arrow", "target", "keepalive", "void", "shell", "econnaborted", "hkwfunction", "typeof symbol", "function", "promise", "request", "network error", "livechatwidget", "ticket form", "prechat survey", "postchat survey", "typeof n", "chat", "blank", "win32", "iframe", "reduceright", "copyright", "closure library", "xdfunction", "adfunction", "cdfunction", "ddfunction", "bded", "x3e div", "trackevent", "landingpagegpu", "x3e table", "gpudraw", "path", "code", "functional", "member", "hnew regexp", "qfunction", "adview", "addbillinginfo", "addtocart", "addtolist", "contact", "download", "install", "symbol", "iterator", "extractor", "pixel", "facebook", "meta", "65535", "counter", "segoe ui", "lucida", "ecommerce", "ext link", "comic", "form", "impact", "light" ], "references": [ "https://mc.yandex.ru/metrika/watch.js", "https://connect.facebook.net/signals/config/785878845108827", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://www.googletagmanager.com/gtm.js?id=GTM-M9D76H", "https://www.googletagmanager.com/gtag/js?id=UA-73589630-1", "https://cdn.livechatinc.com/tracking.js", "https://rec.smartlook.com/main-20220331074633.js", "https://hostkey.com/hk/widgets/ext/build/stock.bundle.js", "https://hostkey.com/hk/widgets/ext/src/hostkey.js", "https://hostkey.postaffiliatepro.com/scripts/Oy173jux8", "https://hostkey.postaffiliatepro.com/scripts/Oy173rux8?accountld=default1&url=S_hostkey.com%2F&referrer=&isInlframe=false&getParams=&anchor=", "https://widget.trustpilot.com/trustboxes/5613c9cde69ddc09340c6beb/index.html?templateld=5613c9cde69ddc09340c6beb&businessunitld=55e46b640000ff000582c91e#locale=en-GB&styleHeight=100%25&styleWidth=100%25&theme=light", "https://secure.livechatinc.com/" ], "public": 1, "adversary": "", "targeted_countries": [ "Tunisia" ], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null }, { "id": "Industroyer - S0604", "display_name": "Industroyer - S0604", "target": null } ], "attack_ids": [ { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1778, "hostname": 563, "FileHash-SHA256": 304, "domain": 407, "FileHash-SHA1": 2 }, "indicator_count": 3054, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1503 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624cdd04832a0e6ecab8c363", "name": "IBM X-FORCE EARLY WARNING", "description": "Collection of url on the early warning dashboard", "modified": "2022-04-06T00:21:24.051000", "created": "2022-04-06T00:21:24.051000", "tags": [ "segoe ui", "emoji", "lato", "applesystem", "roboto", "helvetica neue", "arial", "noto", "apple color", "symbol", "number", "tablesort", "function", "error", "customevent", "ariasort", "cell", "getcellbykey", "table", "datasort", "default sort", "false", "click" ], "references": [ "https://masteruydhshdh.ml/_autoindex/assets/js/tablesort.js", "https://masteruydhshdh.ml/_autoindex/assets/js/tablesort.number.js", "https://masteruydhshdh.ml/_autoindex/assets/css/autoindex.css", "https://masteruydhshdh.ml/_autoindex/assets/icons/folder-fill.svg" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 16, "URL": 44, "domain": 4 }, "indicator_count": 64, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1517 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C3I4VUA8DUF9JOO44QC0&lib=ttq", "libc6-i386_2.19-0ubuntu6.15_amd64.url", "libc6-i386_2.7-10ubuntu8.3_amd64.symbols", "PROMPThelp", "identify-printer.test", "printer-modified.tmpl", "modify-printer.tmpl", "WebKit.bridgesupport", "registry.md", "https://static.zdassets.com/ekr/snippet.js?key=7342b695-e394-4f25-89a0-da9d262a48da", "npm-query.md", "bloom (2).py", "empty.exe", "npm-token.md", "libc6-i386_2.30-4_amd64.info", "statement.c", "libc6-i386_2.24-3ubuntu1_amd64.symbols", "ls.js", "https://js.hs-scripts.com/20704235.js", "npm-init.md", "choose-device.tmpl", "unpublish.js", "SeTnopart", "logging.md", "ipp-backend.test", "create-printer-subscription.test", "syslog.conf", "https://tobiasahlin.com/js/anime.min.js", "compare.js", "glob", "VZEFIVariableStore.h", "README (2)", "q\u00e9\u00d5?e\u00ac\u00d2\u00b6.\u000f\u001c\u00cc", "outdated.js", "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/js/dialog.min.js", "explore.js", "b.txt:ads.txt", "html4_sax_push_parser.c", "https://www.virustotal.com/gui/file/ea8490563a229b89f2b779217938f9eb2bcf93dd89de9f7fc5c035632f0934b5/relations", "folders.md", "help-search.js", "libc6-i386_2.28-0ubuntu1_amd64.symbols", "npm-config.md", "print-job-hold.test", "host (2).conf", "html4_element_description.c", "NSOpenDirectory.h", "stage2 (2)", "lt.js", "printer-deleted.tmpl", "tar.js", "xml_comment.c", "lifecycle-cmd.js", "npm-completion.md", "npm-owner.md", "fstab", "rebuild.js", "shrinkwrap.js", "libc6-i386_2.9-4ubuntu6_amd64.symbols", "https://s.pinimg.com/ct/core.js", "npm-edit.md", "owner.js", "https://cdn.pendo.io/agent/static/783a696b-ddf4-4152-439e-f3761f54f088/pendo.js", "xml_schema.c", "VZVirtioGraphicsDeviceConfiguration.h", "https://cdn.jst.ai/mwgt_4.1.js?v=5.28", "xfe-URL-tobiasahlin.com-stix2-2.1-export.json", "A53749AF-3855-4842-A1E7-4AEFA60BD2AC", "prefix.js", "libc6-i386_2.23-0ubuntu3_amd64.symbols", "VZVirtioConsolePortConfigurationArray.h", "preload.js", "CFODQuery.h", "VZPointingDeviceConfiguration.h", "open-url-prompt.js", "ipp-2.1.test", "VZVirtioSoundDeviceOutputStreamConfiguration.h", "xml_entity_decl.c", "disk2", "modules.generic_string", "libc6-i386_2.15-0ubuntu10_amd64.url", "rbLibXMLParser.rb", "SeTmedia", "get-printers.test", "npmrc.md", "SeTnopart (2)", "termcap (2)", "https://secure.livechatinc.com/", "https://www.googletagmanager.com/gtm.js?id=GTM-NWH4DH2", "VZSocketDevice.h", "https://m.west.cn/jscripts/baidutj/hm.js", "inittab (2)", "XPdb-wal", "pkg.js", "VZHostAudioOutputStreamSink.h", "VZVirtioEntropyDeviceConfiguration.h", "SBObject.h", "get-subscriptions.test", "libyara.la", "VTDecompressionProperties.h", "libc6-i386_2.11.1-0ubuntu7.12_amd64.info", "get-ppds-drv-only.test", "VZGraphicsDevice.h", "parser.h", "https://masteruydhshdh.ml/_autoindex/assets/js/tablesort.js", "package.json", "https://4vendeta.com/assets/js/jquery.min.js", "SeTpartitions (2)", "SCScreenshotManager.h", "https://www.googleoptimize.com/optimize.js?id=OPT-TQC6JW4", "MTLDeviceCertification.h", "get-printers-printer-id.test", "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/js/common.js", "root.js", "fsck (2).ext2", "libc6-i386_2.24-9ubuntu2_amd64.symbols", "print-job-letter.test", "modules.parportmap", "link.js", "VZVirtioSocketConnection.h", "VZDiskImageStorageDeviceAttachment.h", "npm-install-test.md", "libnm.pc", "VZAudioDeviceConfiguration.h", "INSdir (2)", "nm-pppd-plugin.la", "VZSerialPortConfiguration.h", "SharedWithYouCore.h", "libc6-i386_2.9-4ubuntu6.3_amd64.url", "deprecate.js", "npm-pkg.md", "https://4vendeta.com/assets/js/bootstrap.min.js", "npm-ping.md", "foreign_attrs.c", "libc6-i386_2.28-10_amd64.url", "empty (2)", "Metal.apinotes", "hp.h", "features.py", "gc (2).py", "satisfies.js", "https://cp.enom.com/js/cart.minicart.min.js", "VZNVMExpressControllerDeviceConfiguration.h", "MTLTexture.h", "npm-exec.md", "VZVirtioNetworkDeviceConfiguration.h", "command.tmpl", "migrate.sh", "lte.js", "PKDefines.h", "init.js", "xfe-IP-78.142.35.163-stix2-2.1-export.json", "SWCollaborationShareOptions.h", "otplease.js", "al.h", "MTLCounters.h", "SeTkeymap", "networks (2)", "modules.pnpbiosmap", "libc6-i386_2.19-10ubuntu2_amd64.url", "ODQuery.h", "https://tobiasahlin.com/js/app.js?v=1", "VTDecompressionSession.h", "libc6-i386_2.26-0ubuntu2_amd64.symbols", "xml_sax_parser_context.c", "print-job-gzip.test", "gumbo.c", "npm-star.md", "fdisk", "CFOpenDirectory.tbd", "MTLRasterizationRate.h", "font.defs", "libc6-i386_2.10.1-0ubuntu19_amd64.info", "libc6-i386_2.10.1-0ubuntu15_amd64.symbols", "explain-dep.js", "npm-prefix.md", "libc6-i386_2.28-0ubuntu1_amd64.url", "PushKit.h", "libc6-i386_2.24-11+deb9u4_amd64.symbols", "installpkg (2)", "SeTswap", "create-job-sheets.test", "INShd", "publish.js", "VZMacPlatformConfiguration.h", "jobs-header.tmpl", "https://cdn.optimizely.com/js/26241557.js", "npm-shrinkwrap-json.md", "notify.conf", "prune.js", "closemachine.rc", "sbom.js", "MTLFunctionLog.h", "libc6-i386_2.7-10ubuntu3_amd64.url", "https://4vendeta.com/assets/js/parallax.min.js", "libc6-i386_2.13-0ubuntu13.2_amd64.url", "libc6-i386_2.3.6-0ubuntu20_amd64.url", "VZUSBControllerConfiguration.h", "exit-handler.js", "libc6-i386_2.15-0ubuntu20.2_amd64.symbols", "VZMacTrackpadConfiguration.h", "daemon.py", "MTLRenderCommandEncoder.h", "helpers.py", "VZUSBDevice.h", "mime.convs", "validate-lockfile.js", "log-file.js", "PKPushCredentials.h", "https://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js", "apple.types", "npm-unpublish.md", "VZVirtioSoundDeviceStreamConfiguration.h", "get-ppds-make-and-model.test", "libc6-i386_2.17-0ubuntu5.1_amd64.url", "https://web.op39v.xyz/?channelCode=pingguo", "media.defs", "yara.pc", "mini_portile.rb", "ipp-2.2.test", "adduser.js", "85-nm-unmanaged.rules", "install-test.js", "https://portal.ascio.com/7.602be6705ce7b901b821.js", "cache.js", "libc6-i386_2.13-0ubuntu13.2_amd64.symbols", "testprint", "libc6-i386_2.13-0ubuntu13_amd64.info", "libc6-i386_2.13-20ubuntu5.3_amd64.symbols", "SeTmedia (2)", "install-ci-test.js", "shells (2)", "npm-install.md", "VZUSBKeyboardConfiguration.h", "rescan-scsi-bus", "dialogrc (2)", "libc6-i386_2.21-0ubuntu4_amd64.info", "hook.js", "VZDirectorySharingDeviceConfiguration.h", "gte.js", "a.txt", "libc6-i386_2.17-0ubuntu5.1_amd64.symbols", "libc6-i386_2.11.1-0ubuntu7.12_amd64.url", "backup.h", "SeTmaketag (2)", "https://www.googletagmanager.com/gtag/js?id=UA-92521958-1", "libc6-i386_2.15-0ubuntu10.18_amd64.url", "VZFileSerialPortAttachment.h", "VZUSBMassStorageDevice.h", "a4033901479", "npm-sbom.md", "libc6-i386_2.21-0ubuntu4_amd64.symbols", "get.js", "epson.h", "dist-tag.js", "murmur2", "norestart.tmpl", "class-confirm.tmpl", "http://imhrzluowdso.gq/i/css/font-awesome.css", "yallist.js", "major.js", "SWAction.h", "open-url.js", "fund.js", "gumbo.h", "MTLBlitCommandEncoder.h", "option-boolean.tmpl", "libnm-wwan.la", "class-added.tmpl", "libc6-i386_2.30-4_amd64.url", "options.py", "drecurse (2).py", "SCError.h", "cfpropertylist.rb", "npm-pack.md", "b529967783", "xml_cdata.c", "jobs.tmpl", "styles.css", "printer-confirm.tmpl", "VZVirtualMachine.h", ".X1-lock", "MTLIOCommandQueue.h", "printer-added.tmpl", "https://www.ascio.com/wp-content/themes/Ascio/dist/js/front.js?ver=1648137806", "class-jobs-header.tmpl", "https://c.cnzz.com/core.php?web_id=1280740152&t=z", "empty", "ab.1", "httpd.exp", "npm-shrinkwrap.md", "network", "https://tobiasahlin.com", "token_buffer.c", "color-support", "MTLDrawable.h", "PKPushRegistry.h", "update-notifier.js", "https://www.googletagmanager.com/gtag/js?id=AW-1045757556", "host.conf", "VZVirtualMachineView.h", "printers-header.tmpl", "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/css/public.css", "npm-link.md", "installed-shallow.js", "libc6-i386_2.24-11+deb9u4_amd64.url", "npmrc", "MTLVertexDescriptor.h", "option-header.tmpl", "VZDefines.h", "add-printer.tmpl", "auth.js", "MTLIntersectionFunctionTable.h", "https://hybrid-analysis.com/file-collection/6604df4bb797f028b4065601", "https://masteruydhshdh.ml/_autoindex/assets/icons/folder-fill.svg", "MTLResidencySet.h", "MTLLogState.h", "rc.ieee1394", "VZDiskSynchronizationMode.h", "job-restart.tmpl", "explain.js", "libc6-i386_2.9-4ubuntu6_amd64.info", "empty (3)", "libc6-i386_2.24-9ubuntu2_amd64.url", "VZNetworkDevice.h", "libc6-i386_2.3.6-0ubuntu20.6_amd64.info", "nsswitch (2).conf", "VTCompressionProperties.h", "insertion_mode.h", "libc6-i386_2.13-20ubuntu5.3_amd64.info", "SCContentSharingPicker.h", "ScreenCaptureKit.h", "bup-import-rsnapshot", "itl-logo (2).txt", "macros.h", "npm-test.md", "FDhelp", "ODRecord.h", "npm-usage.js", "nm-cloud-setup.service", "set-printer-options-trailer.tmpl", "libc6-i386_2.5-0ubuntu14_amd64.url", "libnm-ppp-plugin.la", "get-jobs.test", "npm-ci.md", "rm.py", "xfe-URL-Enom.com-stix2-2.1-export.json", "get-ppd.test", ".X1024-lock", "VZDirectorySharingDevice.h", "NetworkManager-ovs.conf", "Ruby.tbd", "MTLAccelerationStructureTypes.h", "makedevs.sh", "libxml.rb", "audit-error.js", "http://fonts.googleapis.com/css?family=Abril+Fatface%3Aregular&subset=latin%2Ccyrillic&ver=5.7.6", "print-job-and-wait.test", "format-bytes.js", "Metal.h", "VZSocketDeviceConfiguration.h", "stop.js", "xml_sax_parser.c", "ExmanProcessMutex", "gc.py", "VZVirtioConsoleDeviceConfiguration.h", "SwiftUI.swiftoverlay", "MTLEvent.h", "exec.js", "simplify.js", "SeTPKG (2)", "xml_node.c", "https://www.ascio.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9", "MTLDevice.h", "cfdisk", "libc6-i386_2.9-4ubuntu6_amd64.url", "setup (2)", "scripts.md", "https://www.googletagmanager.com/gtm.js?id=GTM-PF3JNK2>m_auth=a6AgvzJ0SAOcyjADNwrdlQ>m_preview=env-1>m_cookies_win=x", "ODNode.h", "option-trailer.tmpl", "libc6-i386_2.5-0ubuntu14_amd64.symbols", "damage.py", "https://cdn.taboola.com/libtrc/unip/1262365/tfa.js", "ntp.conf", "VZVirtioConsoleDevice.h", "read-user-info.js", "VTRAWProcessingSession.h", "libc6-i386_2.19-10ubuntu2_amd64.symbols", "xml_element_content.c", "html4_sax_parser_context.c", "libc6-i386_2.9-4ubuntu6.3_amd64.symbols", "get.py", "https://cdn.staticfile.org/qrcodejs/1.0.0/qrcode.min.js", "openmachine.rc", "SWCollaborationMetadata.h", "index (2).py", "MTLAllocation.h", "https://cp.enom.com/js/openWin.min.js", "to-comparators.js", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "libc6-i386_2.31-0ubuntu6_amd64.url", "???? ????????.txt", "VZMacOSConfigurationRequirements.h", "set-printer-options-header.tmpl", "rm (2).py", "VideoToolbox.apinotes", "npm-login.md", "SWCollaborationOption.h", "ODRecordMap.h", "help-trailer.tmpl", "database.c", "exception.h", "vector.h", "https://cp.enom.com/responsive/_js/knockout-3.3.0.min.js", "SeTfull (2)", "parse-options.js", "npm-team.md", "star.js", "VTVideoEncoderList.h", "rc.S", "VZConsoleDevice.h", "https://hostkey.com/hk/widgets/ext/src/hostkey.js", "ci.js", "VZVirtioFileSystemDeviceConfiguration.h", "VZNetworkBlockDeviceStorageDeviceAttachment.h", "VZEFIBootLoader.h", "VZConsolePortConfiguration.h", "view.js", "backup.c", "libc6-i386_2.21-0ubuntu4.3_amd64.symbols", "svg_attrs.c", "inc.js", "passwd", "libcrypto.pc", "https://web.op39v.xyz/js/chunk-common.js", "attribute.c", "MTLCommandBuffer.h", "libc6-i386_2.13-20ubuntu5.2_amd64.url", "__init__ (2).py", "format-search-stream.js", "termcap", "tokenizer_states.h", "npm-prune.md", "probe", "libc6-i386_2.21-0ubuntu4.3_amd64.info", "get-devices.test", "VZGenericMachineIdentifier.h", "shquote.py", "server.py", "VZEntropyDeviceConfiguration.h", "libc6-i386_2.31-0ubuntu6_amd64.symbols", "VZVirtioConsolePort.h", "https://www.googletagmanager.com/gtag/js?id=UA-36935570-1", "SeTDOS", "ipp-1.1.test", "VZVirtualMachineStartOptions.h", "faq.rb", "http://alp-vision.com/wp-content/cache/autoptimize/js/autoptimize_78b4f9b28399aa3c8a405e45931ad058.js", "sunjava_map.xml", "INSCD", "VZMacHardwareModel.h", "libc6-i386_2.13-20ubuntu5_amd64.info", "midx.py", "test_global_handlers.c", "save.py", "display.js", "SeTmaketag", "https://cdn.jst.ai/vck.js", "ipp-2.0.test", "restart.tmpl", "coerce.js", "libc6-i386_2.7-10ubuntu3_amd64.info", "https://www.ascio.com/wp-includes/js/dist/vendor/lodash.min.js?ver=4.17.19", "printer-jobs-header.tmpl", "SeTfull", "npm.js", "xml.rb", "modify-class.tmpl", "VZMacKeyboardConfiguration.h", "identify-printer-display.test", "ssh.py", "https://cp.enom.com/verisign-seal.htm", "https://admin.verbox.ru/support/support.js?h=afe80d31a1cabd6ae5c00580688f27d2", "npm-outdated.md", "class-modified.tmpl", "npm-audit.md", "nokogiri.c", "version.py", "MTLCaptureManager.h", "list-available-printers.tmpl", "VZStorageDeviceConfiguration.h", "VZUSBDeviceConfiguration.h", "dedupe.js", "libc6-i386_2.12.1-0ubuntu6_amd64.info", "VZVirtioFileSystemDevice.h", "https://cp.enom.com/ScriptResource.axd?d=lDjPFfAIWSrEAVNgTHTrISQmLEFmHAaibvNJQuGRZDbWpGFPLrFwaGVpjCUsI6HkqzbpwmaAa0cJCrq8f0eqEvIsQM8lvN_dVYVyESnohON4oTvdMZHDmwG83uJA4m2oqykP8TTTSIeV2oaNrlIXaX8cOxC5Cv6aGmjpdB2u-227wdn30&t=363be08", "workspaces.md", "pwdgrp.py", "migrate (2).sh", "re.js", "libc6-i386_2.19-18+deb8u10_amd64.info", "SeTfdHELP", "metadata.py", "__init__.py", "modules.usbmap", "https://cp.enom.com/js/jquery-3.5.1.min.js", "OpenAL.h", "xfe-URL-lodash.com-stix2-2.1-export.json", "pager.tmpl", "SWCollaborationOptionsGroup.h", "http://imhrzluowdso.gq/i/css/bootstrap-theme.css", "fsck (2).ext3", "set.js", "VZError.h", "bloom.py", "npm-ls.md", "uninstall.js", "MacOSX_OALExtensions.h", "empty.lock~", "cli.js", "libc6-i386_2.17-93ubuntu4_amd64.symbols", "VTBase.h", "npm-search.md", "VZNetworkDeviceConfiguration.h", "README.md", "SWCollaborationOptionsPickerGroup.h", "VZFileHandleNetworkDeviceAttachment.h", "choose-uri.tmpl", "VZVirtioGraphicsScanout.h", "VTMultiPassStorage.h", "identifiers.js", "libc6-i386_2.12.1-0ubuntu10.4_amd64.symbols", "SBElementArray.h", "error.h", "class.tmpl", "libc6-i386_2.19-10ubuntu2.3_amd64.url", "ipp-everywhere.test", ".X1025-lock", "printer-default.tmpl", "npm-diff.md", "cssesc", "Virtualization.tbd", "https://4vendeta.com/assets/js/meanmenu.min.js", "token_type.h", "https://www.googletagmanager.com/gtag/js?id=UA-73589630-1", "b3336837578", "nokogiri.rb", "libc6-i386_2.8~20080505-0ubuntu9_amd64.symbols", "https://hostkey.postaffiliatepro.com/scripts/Oy173rux8?accountld=default1&url=S_hostkey.com%2F&referrer=&isInlframe=false&getParams=&anchor=", "libc6-i386_2.11.1-0ubuntu7.11_amd64.symbols", "queryable.js", "ODMappings.h", "rbNokogiriParser.rb", "https://www.googletagmanager.com/gtm.js?id=GTM-M9D76H", "xml_syntax_error.c", "MTLLinkedFunctions.h", "libc6-i386_2.24-3ubuntu2.2_amd64.symbols", "join.py", "NetworkManager.service", "libc6-i386_2.24-9ubuntu2_amd64.info", "https://www.ascio.com/wp-includes/js/dist/i18n.min.js?ver=30fcecb428a0e8383d3776bcdd3a7834", "error.c", "rbCFPlistError.rb", "package-url-cmd.js", "stars.js", "libc6-i386_2.23-0ubuntu3_amd64.url", "CFODRecord.h", "npm-repo.md", "libc6-i386_2.19-0ubuntu6_amd64.info", "login.js", "https://hostkey.com/hk/widgets/ext/build/stock.bundle.js", "libc6-i386_2.19-10ubuntu2.3_amd64.info", "libc6-i386_2.6.1-1ubuntu10_amd64.info", "unmigrate (2).sh", "choose-serial.tmpl", "inittab", "ascii.c", "path.py", "min-satisfying.js", "https://hybrid-analysis.com/sample/babc94597eadb83b520d6a46a57ef2ad963683aef1ff2fc6fa9ba5e98e78e008/6604e16b6b94878cbb062194", "trailer.tmpl", "slackinstall", "xml_sax_push_parser.c", "libc6-i386_2.30-0ubuntu2.1_amd64.url", "print-job.test", "npm-uninstall.md", "get-notifications.test", "INShd (2)", "debug.js", "VZVirtioSoundDeviceConfiguration.h", "vt300", "https://static.me-talk.ru/cabinet/build/chat/modern.support.js", "libc6-i386_2.31-0ubuntu6_amd64.info", "max-satisfying.js", ".:ads.txt", "libc6-i386_2.8~20080505-0ubuntu7_amd64.url", "INSdir", "https://cp.enom.com/js/punycode.min.js", "libc6-i386_2.13-20ubuntu5.2_amd64.info", "classified", "MTLAccelerationStructure.h", "libxml2_backwards_compat.c", "MTLArgumentEncoder.h", "random.py", "nm-cloud-setup.timer", "libc6-i386_2.15-0ubuntu20.2_amd64.info", "VZVirtioTraditionalMemoryBalloonDevice.h", "https://js.pvd.to/c/v1/pixel-1sdz.js?t=1653350400000", "https://www.googletagmanager.com/gtag/js?id=G-W8YD4P2ENY&l=dataLayer&cx=c", "MTLIndirectCommandBuffer.h", "issue (2)", "npm-whoami.md", "option-pickone.tmpl", "arm64e-apple-macos.swiftinterface", "libnm.la", "std", "libc6-i386_2.4-1ubuntu12.3_amd64.info", "xslt_stylesheet.c", "whoami.js", "web.py", "SWCollaborationCoordinator.h", "identify-printer-multiple.test", "syslog (2).conf", "job-moved.tmpl", "cli-entry.js", "printer-accept.tmpl", "arm64e-apple-ios-macabi.swiftinterface", "sample.drv", "libc6-i386_2.11.1-0ubuntu7_amd64.symbols", "print-uri.test", "drecurse.py", "VZGraphicsDeviceConfiguration.h", "libc6-i386_2.23-0ubuntu3_amd64.info", "npm-root.md", "cmp.js", "CFODNode.h", "constants.js", "alc.h", "libc6-i386_2.15-0ubuntu20_amd64.symbols", "http://downloads.mailchimp.com/js/jquery.form-n-validate.js", "syslinux.cfg", "VZXHCIController.h", "libssl.pc", "edit-config.tmpl", "probe (2)", "mkdirp", "npm-rebuild.md", "hashsplit.py", "VZVirtioBlockDeviceConfiguration.h", "header.tmpl", "SWPersonIdentity.h", "npm-unstar.md", "import_duplicity.py", "https://hybrid-analysis.com/sample/babc94597eadb83b520d6a46a57ef2ad963683aef1ff2fc6fa9ba5e98e78e008/65fcd2b1519a5f86d60eed63", "xml_attribute_decl.c", "https://site.yandex.net/v2.0/js/all.js", "sort.js", "MTLTypes.h", "npm-help.md", "libc6-i386_2.8~20080505-0ubuntu7_amd64.info", "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/js/jquery.min.js", "libc6-i386_2.23-0ubuntu11_amd64.symbols", "libc6-i386_2.17-0ubuntu5_amd64.url", "VZVirtioConsoleDeviceSerialPortConfiguration.h", "WebKit.arm64e.bridgesupport", "VZBridgedNetworkInterface.h", "https://github.com/vuejs/vue-devtools", "xml_reader.c", "help-header.tmpl", "reify-finish.js", "libc6-i386_2.30-0ubuntu2_amd64.info", "tag.py", "log-shim.js", "libc6-i386_2.11.1-0ubuntu7.11_amd64.url", "minor.js", "unmigrate.sh", "VZVirtioConsolePortConfiguration.h", "profile (2)", "VZLinuxRosettaAbstractSocketCachingOptions.h", "validate-engines.js", "libc6-i386_2.30-0ubuntu2_amd64.url", "brc (2)", "libc6-i386_2.29-0ubuntu2_amd64.symbols", "html4_document.c", "LICENSE", "zgrep", "libc6-i386_2.21-0ubuntu4_amd64.url", "MTLFunctionStitching.h", "ls (2).py", "MTLDepthStencil.h", "x86_64-apple-ios-macabi.swiftinterface", "char_ref.h", "VZLinuxRosettaCachingOptions.h", "MozillaUpdateLock-7A4D7A8EFFB43502", "test.js", "MTLCommandQueue.h", "xml_namespace.c", "nopartHELP (2)", "libc6-i386_2.24-9ubuntu2.2_amd64.url", "VZMacGraphicsDisplayConfiguration.h", "MTLFunctionHandle.h", "sbom-spdx.js", "libc6-i386_2.12.1-0ubuntu10.4_amd64.url", "libc6-i386_2.10.1-0ubuntu19_amd64.url", "HOSTNAME (2)", "docs.js", "libc6-i386_2.28-10_amd64.symbols", "compat.py", "index.py", "https://cdn.livechatinc.com/tracking.js", "get-job-template-attributes.test", "SeTkeymap (2)", "choose-model.tmpl", "ld.so.conf", "libc6-i386_2.17-0ubuntu5_amd64.symbols", "test-page.tmpl", "VZMacOSRestoreImage.h", "SCRecordingOutput.h", "npm-docs.md", "VZMacOSBootLoader.h", "xml_node_set.c", "apple.convs", "VZVirtualMachineConfiguration.h", "cat_file.py", "libc6-i386_2.15-0ubuntu20_amd64.info", "ld.so (2).conf", "https://masteruydhshdh.ml/_autoindex/assets/js/tablesort.number.js", "range.bnf", "restore.py", "module.modulemap", "update.js", "libnm-device-plugin-ovs.la", "SeTDOS (2)", "motd (2)", "libc6-i386_2.11.1-0ubuntu7_amd64.url", "libc6-i386_2.30-0ubuntu2.1_amd64.info", "fuse.py", "vector.c", "clean.js", "libc6-i386_2.13-0ubuntu13_amd64.url", "no_ads.txt", "nm-priv-helper.service", "VZMemoryBalloonDevice.h", "libc6-i386_2.7-10ubuntu3_amd64.symbols", "error-message.js", "tick.py", "version (2).py", "libc6-i386_2.13-20ubuntu5_amd64.symbols", "npm-org.md", "filesize", "completion.sh", "xfe-URL-West.cn-stix2-2.1-export.json", "ScriptingBridge.h", "SeTpartitions", "ScriptingBridge.apinotes", "setup.rb", "VZDiskBlockDeviceStorageDeviceAttachment.h", "version.rb", "version.js", "explain-eresolve.js", "libc6-i386_2.24-9ubuntu2.2_amd64.symbols", "ODConfiguration.h", "MTLResourceStatePass.h", "prerelease.js", "npm-access.md", "metadata.json", "VZDirectoryShare.h", "xml_encoding_handler.c", "get-workspaces.js", "imurmurhash.min.js", "search.tmpl", "PushKit.apinotes", "SWPersonIdentityProof.h", "VTPixelRotationSession.h", "MTLCaptureScope.h", "libc6-i386_2.8~20080505-0ubuntu7_amd64.symbols", "classes.tmpl", "VZLinuxRosettaUnixSocketCachingOptions.h", "web-auth.js", "VZMultipleDirectoryShare.h", "libc6-i386_2.13-0ubuntu13_amd64.symbols", "gtr.js", "stage2", "libc6-i386_2.30-0ubuntu2_amd64.symbols", "source_info.py", "VZVirtualMachineDelegate.h", "get-printer-description-attributes.test", "a1676298638", "libc6-i386_2.3.6-0ubuntu20_amd64.symbols", "pkgtool", "libc6-i386_2.17-0ubuntu5_amd64.info", "MTLRenderPass.h", "MTLIOCompressor.h", "npm-find-dupes.md", "npm-logout.md", "http://alp-vision.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.6", "wtmp", "https://web.op39v.xyz/js/chunk-vendors.js", "VZSingleDirectoryShare.h", "min-version.js", "https://masteruydhshdh.ml/_autoindex/assets/css/autoindex.css", "ScriptingBridge.tbd", "CFODSession.h", "libnm-device-plugin-bluetooth.la", "get-completed-jobs.test", "hosts (2)", "vint.py", "84-nm-drivers.rules", "http://imhrzluowdso.gq/i/css/style.css", "arborist-cmd.js", "libc6-i386_2.26-0ubuntu2.1_amd64.info", "libc6-i386_2.19-0ubuntu6_amd64.url", "https://4vendeta.com/assets/js/ajaxchimp.min.js", "SeTswap (2)", "valid.js", ".zcompdump", "tag_lookup.c", "libc6-i386_2.27-3ubuntu1_amd64.symbols", "libc6-i386_2.19-0ubuntu6_amd64.symbols", "libc6-i386_2.24-3ubuntu2.2_amd64.url", "libc6-i386_2.24-11+deb9u4_amd64.info", "libc6-i386_2.23-0ubuntu11_amd64.url", "mtools.conf", "token.js", "libc6-i386_2.17-93ubuntu4_amd64.url", "passwd (2)", "VTPixelTransferProperties.h", "https://ascio.com", "VZMacGraphicsDevice.h", "libc6-i386_2.13-20ubuntu5.3_amd64.url", "MTLIOCommandBuffer.h", "parser.c", "margin.py", "libc6-i386_2.26-0ubuntu2.1_amd64.url", "https://www.googletagmanager.com/gtag/js?id=G-5VS2LL0P80&l=dataLayer&cx=c", "libc6-i386_2.11.1-0ubuntu7.21_amd64.url", "https://cp.enom.com/ScriptResource.axd?d=fVjQa-0YyNqO6JmV36bw6eBJdTjE2YSdtcunOWcKYcBNn73MOJKQA_rxX3YMhcxLTgyDsGTKy0p9NEPvxzpqEpBKtm3GLb2GgI1LFYMC0Xr2lh71ZCttzgNGFnc5mS_Fc_DY5UH0M19Mr958h1jvmK4kzAM1&t=363be08", "libc6-i386_2.6.1-1ubuntu9_amd64.symbols", "dir:ads.txt", "mime.types", "OpenDirectory.h", "SharedWithYouCore.tbd", "SeTfdHELP (2)", "services (2)", "get-ppds-product.test", "libc6-i386_2.19-0ubuntu6.15_amd64.symbols", "func.py", "fax-job.test", "npm-fund.md", "VZAudioInputStreamSource.h", "MTLBinaryArchive.h", "scope.md", "option-pickmany.tmpl", "create-job-format.test", "utf8.h", "ODModuleEntry.h", "libc6-i386_2.27-3ubuntu1_amd64.info", "INSNFS", "SeTpasswd (2)", "https://www.googletagmanager.com/gtag/js?id=G-8M7FT2S1TV&l=dataLayer&cx=c", "get-ppds-make.test", "libc6-i386_2.30-4_amd64.symbols", "MTLFunctionDescriptor.h", "set-attrs-hold.test", "stdcrt (2)", "libc6-i386_2.28-0ubuntu1_amd64.info", "PKPushPayload.h", "mux.py", "secret", "libc6-i386_2.10.1-0ubuntu15_amd64.info", "libc6-i386_2.11.1-0ubuntu7.12_amd64.symbols", "dependency-selectors.md", "https://mc.yandex.ru/metrika/tag.js", "VZConsoleDeviceConfiguration.h", "HOSTNAME", "https://cp.enom.com/js/global-functions.js", "rc.inet1", "nsswitch.conf", "logout.js", "npm-explore.md", "libc6-i386_2.12.1-0ubuntu10.4_amd64.info", "run-script.js", "job-move.tmpl", "VZVirtioSocketListener.h", "profile", "itl-logo (3).txt", "VTHDRPerFrameMetadataGenerationSession.h", "sqlite3.c", "modules.ieee1394map", "npm.md", "MTLComputePass.h", "outside.js", "vt300 (2)", "libc6-i386_2.8~20080505-0ubuntu9_amd64.info", "users.tmpl", "npm-profile.md", "compare-build.js", "MTLBuffer.h", "tag_lookup.h", "tag.c", "completion.js", "ldd", "VZMACAddress.h", "VTCompressionSession.h", "SWPerson.h", "io.py", "libc6-i386_2.4-1ubuntu12.3_amd64.symbols", "libc6-i386_2.24-3ubuntu2.2_amd64.info", "util.h", "NetworkManager-wait-online.service", "libc6-i386_2.10.1-0ubuntu15_amd64.url", "obexstress", "libc6-i386_2.26-0ubuntu2_amd64.info", "npm-restart.md", "https://portal.ascio.com/login", "statement.h", "checkout_info.py", "VZGenericPlatformConfiguration.h", "VZKeyboardConfiguration.h", "OpenSSLConfigVersion.cmake", "shadow (2)", "asyncrecv.rc", "alut.h", "https://mc.yandex.ru/metrika/watch.js", "INSNFS (2)", "team.js", "confidential", "MTLComputePipeline.h", "https://masterhost.ru/s/masterhost_v2/build/js/app.js?v=WivgGVzt/Ynv", "profile.js", "bugs.js", "libc6-i386_2.28-10_amd64.info", "http://alp-vision.com/wp-content/themes/alp-vision/css/bootstrap.css?ver=1.0", "error-op.tmpl", "group (2)", "makedevs (2).sh", "https://4vendeta.com/assets/js/popper.min.js", "printer-stop.tmpl", "securetty", "90-nm-cloud-setup.sh", "MTLBlitPass.h", "attribute.h", "client.py", "installpkg", "mtab (2)", "disk2 (2)", "npm-cache.md", "string_buffer.h", ".X0-lock", "repo.py", "list_idx.py", "OpenAL.tbd", "libc6-i386_2.11.1-0ubuntu7_amd64.info", "https://rec.smartlook.com/main-20220331074633.js", "error.tmpl", "xml_attr.c", "midx (2).py", "MTLResourceStateCommandEncoder.h", "libc6-i386_2.29-0ubuntu2_amd64.url", "timers.js", "base-command.js", "libc6-i386_2.3.6-0ubuntu20.6_amd64.symbols", "xfe-IP-103.24.249.209-stix2-2.1-export.json", "ODSession.h", "libc6-i386_2.11.1-0ubuntu7.21_amd64.info", "VZMacAuxiliaryStorage.h", "VTSession.h", "meta.py", "string_piece.c", "repo.js", "mtools (2).conf", "libc6-i386_2.24-3ubuntu1_amd64.info", "libc6-i386_2.15-0ubuntu10_amd64.info", "npx.md", "libc6-i386_2.23-0ubuntu11_amd64.info", "vfs.py", "rbPlainCFPropertyList.rb", "print-job-password.test", "nokogiri.h", "utf8.c", "extconf.rb", "orgs.md", "cups-create-local-printer.test", "shadow", "libnm-device-plugin-team.la", "MTLArgument.h", "VZGraphicsDisplay.h", "job-release.tmpl", "removepkg (2)", "libc6-i386_2.4-1ubuntu12_amd64.url", "fsck.ext2", "VZVirtioSocketDevice.h", "nopartHELP", "VideoToolbox.h", "option-conflict.tmpl", "VZLinuxRosettaDirectoryShare.h", "rsort.js", "replace-info.js", "VZMacOSInstaller.h", "package-spec.md", "util.c", "brc", "rbCFPropertyList.rb", "libc6-i386_2.10.1-0ubuntu19_amd64.symbols", "npm-start.md", "get-ppds.test", "parse.js", "VZVirtioSoundDeviceInputStreamConfiguration.h", "modules.pcimap", "doctor.js", "https://portal.ascio.com/runtime.48adad1e07e2679eb1f4.js", "https://s9.cnzz.com/z_stat.php?id=1280740152&web_id=1280740152", "libc6-i386_2.7-10ubuntu8.3_amd64.info", "libc6-i386_2.26-0ubuntu2_amd64.url", "https://cp.enom.com/responsive/_js/init.min.js", "ascii.h", "libc6-i386_2.3.6-0ubuntu20_amd64.info", "libc6-i386_2.6.1-1ubuntu10_amd64.url", "slackinstall (2)", "SWDefines.h", "print-job-media-col.test", "neq.js", "VZVirtioConsolePortArray.h", "syslinux (2).cfg", "https://hybrid-analysis.com/sample/d714e2a850645f9a0f8f3785dd0eedd47a417417bed470b968e0f6a1a2e746e6/652cf1f4243d9d03b90f74a1", "OpenDirectory.tbd", "create-job.test", "https://cp.enom.com/js/jquery.disableonsubmit.min.js", "on.py", "start.js", "libc6-i386_2.11.1-0ubuntu7.11_amd64.info", "completion.fish", "stdcrt", "tokenizer.c", "xml_processing_instruction.c", "SeTconfig", "iterator.js", "https://tobiasahlin.com/css/site.css", "https://www.iubenda.com/cookie-solution/confs/js/53119375.js", "bup-import-rdiff-backup", "xstat.py", "libc6-i386_2.15-0ubuntu20_amd64.url", "get-ppd-printer.test", "securetty (2)", "npm-dedupe.md", "split.py", "VZLinuxBootLoader.h", "libc6-i386_2.17-93ubuntu4_amd64.info", "xml_document_fragment.c", "https://cp.enom.com/global/TopMenu.ascx.js", "SCStream.h", "VZMacGraphicsDeviceConfiguration.h", "template-WaR2X6", "https://hybrid-analysis.com/sample/2eaba531c48445e241c116f61653649e403d4b1ef07bfc96390e986e1eeb5b83/6604e230edf88ab15b0d83fc", "query.js", "6015FED9-D723-4332-87D9-C478CF341407.aamdownload", "class-deleted.tmpl", "printers.tmpl", "fsck.ext3", "validate-job.test", "services", "xfe-URL-4vendeta.com-stix2-2.1-export.json", "SeTpasswd", "VTFrameSilo.h", "setup", "index.js", "https://widget.trustpilot.com/trustboxes/5613c9cde69ddc09340c6beb/index.html?templateld=5613c9cde69ddc09340c6beb&businessunitld=55e46b640000ff000582c91e#locale=en-GB&styleHeight=100%25&styleWidth=100%25&theme=light", "https://hybrid-analysis.com/file-collection/6604df33503d4a306e01c776", "git.py", "xfe-URL-c81e728d9d4c2f636f067f89cc14862c.com-stix2-2.1-export.json", "job-hold.tmpl", "libc6-i386_2.4-1ubuntu12_amd64.symbols", "semver.js", "npm-dist-tag.md", "VZStorageDevice.h", "libc6-i386_2.15-0ubuntu10.18_amd64.info", "intersects.js", "MTLCommandEncoder.h", "printer-cancel-jobs.tmpl", "INSfd", "access.js", "on__server.py", "nsmb.conf", "package-lock-json.md", "get-job-attributes.test", "hlinkdb.py", "compare-loose.js", "https://cp.enom.com/js/jquery.cookie.min.js", "libc6-i386_2.3.6-0ubuntu20.6_amd64.url", "label.h", "xfe-URL-hyqxsnjj.com-stix2-2.1-export.json", "libc6-i386_2.24-9ubuntu2.2_amd64.info", "https://www.ascio.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c", "npm-doctor.md", "MTLVisibleFunctionTable.h", "qrcode-terminal", "https://cdn.taboola.com/scripts/cds-pips.js", "CFOpenDirectory.h", "networks", "get-ppds-psversion.test", "npm-help-search.md", "VZMacOSVirtualMachineStartOptions.h", "com.adobe.acrobat.rna.AcroCefBrowserLock.DC", "modules.dep", "svg_tags.c", "MTLLibrary.h", "SeTkernel", "ll.js", "pack.js", "MTLParallelRenderCommandEncoder.h", "print-job-deflate.test", "sendcmd.rc", "CFOpenDirectoryConstants.h", "find-dupes.js", "motd", "VTErrors.h", "NetworkManager-dispatcher.service", "MTLHeap.h", "printer-reject.tmpl", "MTLSampler.h", "https://www.west.cn/js2016/lib/jquery.SuperSlide/jquery.SuperSlide.2.1.1.x.js", "libc6-i386_2.19-10ubuntu2_amd64.info", "https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.38.0/core-en.js", "libc6-i386_2.13-0ubuntu13.2_amd64.info", "printer-start.tmpl", "libc6-i386_2.23-0ubuntu10_amd64.info", "choose-make.tmpl", "VTUtilities.h", "arborist", "VZFileHandleSerialPortAttachment.h", "VZUSBController.h", "https://www.west.cn/js2016/root/jqinclude.js?t=20211126a", "https://cp.enom.com/WebResource.axd?d=6rtXrDcnyiYD-9dFDFOkxTRcPVSrAN8fR-cHKzNqPTy7bHic-2LLMHDnielTzEI-sd1KplHrRBudcZJOm0-lxubO7k41&t=637453818340000000", "libc6-i386_2.8~20080505-0ubuntu9_amd64.url", "classes-header.tmpl", "issue", "nfs.conf", "VZSharedDirectory.h", ".zcompdump-m1904-5.9", "get-identity.js", "x.jnlp", "org.js", "cfdisk (2)", "VTPixelRotationProperties.h", "removal.md", "SeTkernel (2)", "MTLPixelFormat.h", "SWUpdateCollaborationParticipantsAction.h", "npm-adduser.md", "xtab", "token_buffer.h", "MTLFunctionConstantValues.h", "rbBinaryCFPropertyList.rb", "CFODContext.h", "cmd-list.js", "database.h", "npm-install-ci-test.md", "https://analytics.tiktok.com/i18n/pixel/config.js?sdkid=C3I4VUA8DUF9JOO44QC0&hostname=lumen.me", "libc6-i386_2.30-0ubuntu2.1_amd64.symbols", "VZUSBScreenCoordinatePointingDeviceConfiguration.h", "stage2 (3)", "get-printer-attributes-suite.test", "vt100", "https://cp.enom.com/responsive/_js/bootstrap.js", "OpenSSLConfig.cmake", "https://static.zdassets.com/ekr/snippet.js?key=d814ea4a-a8eb-4a9c-aedd-cac0aa0e3551", "notes.txt:ads", "gt.js", "https://cp.enom.com/js/jquery.jgrowl.min.js", "developers.md", "notes.txt", "VZBootLoader.h", "VZGraphicsDisplayConfiguration.h", "help-printable.tmpl", "xfe-URL-imhrzluowdso.gq-stix2-2.1-export.json", "shells", "MTLDynamicLibrary.h", "eq.js", "xstat (2).py", "README", "standard", "printer.tmpl", "add-class.tmpl", "rcompare.js", "https://hybrid-analysis.com/file-collection/66057525d9b81759df06c4b5", "is-windows.js", "libc6-i386_2.19-10ubuntu2.3_amd64.symbols", "SWStartCollaborationAction.h", "Virtualization.h", "tree.py", "get-job-attributes2.test", "rbREXMLParser.rb", "npm-update.md", "https://hostkey.postaffiliatepro.com/scripts/Oy173jux8", "VZSpiceAgentPortAttachment.h", "libc6-i386_2.23-0ubuntu10_amd64.url", "MTLAccelerationStructureCommandEncoder.h", "installed-package-contents", "printer-configured.tmpl", "libc6-i386_2.29-0ubuntu2_amd64.info", "patch.js", "http://imhrzluowdso.gq/i/css/animations.css", "VZStorageDeviceAttachment.h", "libc6-i386_2.13-20ubuntu5.2_amd64.symbols", "libc6-i386_2.6.1-1ubuntu10_amd64.symbols", "x86_64-apple-macos.swiftinterface", "ftp.py", "VZNetworkDeviceAttachment.h", "libc6-i386_2.9-4ubuntu6.3_amd64.info", "libnm-device-plugin-wwan.la", "job-cancel.tmpl", "exception.c", "VZMacGraphicsDisplay.h", "npm-stop.md", "VZHostAudioInputStreamSource.h", "std (2)", "desktop.ini", "package-json.md", "libc6-i386_2.24-3ubuntu1_amd64.url", "ls.py", "restart.js", "diff.js", "xml_relax_ng.c", "SWCollaborationActionHandler.h", "get-ppds-language.test", "lorem.txt", "libc6-i386_2.15-0ubuntu20.2_amd64.url", "itl-logo.txt", "string_buffer.c", "libc6-i386_2.26-0ubuntu2.1_amd64.symbols", "VZVirtioGraphicsScanoutConfiguration.h", "MTLFence.h", "libc6-i386_2.27-3ubuntu1_amd64.url", "https://masterhost.ru/s/masterhost_v2/build/js/compiled.min.js?v=Q/hhNATxy3sx", "xml_document.c", "npm-view.md", "rc.usb", "https://use.fontawesome.com/releases/v5.0.6/css/all.css", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "modules.isapnpmap", "VZAudioOutputStreamSink.h", "replacement.h", "xml_element_decl.c", "xml_xpath_context.c", "libc6-i386_2.17-0ubuntu5.1_amd64.info", "MTLResource.h", "raster.defs", "npm-version.md", "group", "VZBridgedNetworkDeviceAttachment.h", "http://www.bbbbop13.com:1313/", "pacote", "fdisk (2)", "SeTPKG", "VZVirtioTraditionalMemoryBalloonDeviceConfiguration.h", "VZVirtioGraphicsDevice.h", "VTPixelTransferSession.h", "range.js", "libnm-device-plugin-adsl.la", "MTLComputeCommandEncoder.h", "ODAttributeMap.h", "90-nm-thunderbolt.rules", "unstar.js", "sqlite3.rb", "https://cdn.staticfile.org/clipboard.js/2.0.8/clipboard.min.js", "VZNATNetworkDeviceAttachment.h", "cancel-current-job.test", "get-printer-attributes.test", "proxy.xml", "https://tobiasahlin.com/js/portfolio.js", "vdecmd", "search.js", "sqlite3_ruby.h", "libc6-i386_2.7-10ubuntu8.3_amd64.url", "https://masterhost.ru/s/masterhost_v2/build/css/global.css?v=MUmvaY06hvKf", "https://s.pinimg.com/ct/lib/main.32155010.js", "vt100 (3)", "ping.js", "subset.js", "VTProfessionalVideoWorkflow.h", "a.txt:ads.txt", "update-workspaces.js", "https://cdn.staticfile.org/jquery/3.6.0/jquery.min.js", "libc6-i386_2.19-18+deb8u10_amd64.symbols", "did-you-mean.js", "libc6-i386_2.12.1-0ubuntu6_amd64.url", "init.py", "install.js", "reify-output.js", "tokenizer.h", "VZUSBMassStorageDeviceConfiguration.h", "npm-publish.md", "libc6-i386_2.23-0ubuntu10_amd64.symbols", "FDhelp (2)", "nm-shared.xml", "xml_entity_reference.c", "create-job-timeout.test", "topsecret", "pulse-till-done.js", "VZPlatformConfiguration.h", "libc6-i386_2.19-18+deb8u10_amd64.url", "SeTconfig (2)", "memtest.py", "libc6-i386_2.13-20ubuntu5_amd64.url", "https://cp.enom.com/scripts/Session.min.js", "rbCFTypes.rb", "unclassified", "https://www.youtube.com/s/player/534c466c/www-widgetapi.vflset/www-widgetapi.js", "libnm-device-plugin-wifi.la", "edit.js", "http://alp-vision.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "admin.tmpl", "https://connect.facebook.net/signals/config/785878845108827", "http://m.west.cn/jscripts/baidutj/hm.js", "VZSerialPortAttachment.h", "libc6-i386_2.4-1ubuntu12_amd64.info", "VTRAWProcessingProperties.h", "config.md", "dialogrc", "INSfd (2)", "VZMemoryBalloonDeviceConfiguration.h", "fstab (2)", "fsck.py", "libc6-i386_2.6.1-1ubuntu9_amd64.info", "b.txt", "xml_dtd.c", "INSCD (2)", "VZVirtioSocketDeviceConfiguration.h", "installed-deep.js", "PushKit.tbd", "MTLStageInputOutputDescriptor.h", "https://www.ascio.com/wp-includes/js/dist/vendor/react-dom.min.js?ver=17.0.1", "npm-run-script.md", "pkgtool (2)", "login (2).defs", "MTLPipeline.h", "libc6-i386_2.12.1-0ubuntu6_amd64.symbols", "xml_text.c", "openssl.pc", "libc6-i386_2.11.1-0ubuntu7.21_amd64.symbols", "mtab", "https://www.google-analytics.com/gtm/optimize.js?id=OPT-NVZ8RF3", "VZMacMachineIdentifier.h", "hosts", "http://imhrzluowdso.gq/i/css/bootstrap.css", "sbom-cyclonedx.js", "https://www.googletagmanager.com/gtm.js?id=GTM-5SN6BRV", "html4_entity_lookup.c", "https://res-1257422681.file.myqcloud.com/assets/yeyue/boinstall.js", "npm-bugs.md", "libc6-i386_2.4-1ubuntu12.3_amd64.url", "npm-hook.md", "libc6-i386_2.15-0ubuntu10_amd64.symbols", "prune_older.py", "libc6-i386_2.15-0ubuntu10.18_amd64.symbols", "MTLRenderPipeline.h", "libc6-i386_2.21-0ubuntu4.3_amd64.url", "install.md", "libvDSP.tbd", "xfe-URL-ascio.com-stix2-2.1-export.json", "main.py", "libc6-i386_2.19-0ubuntu6.15_amd64.info", "PROMPThelp (2)", "node-which", "SBApplication.h", "SCShareableContent.h", "help.js", "ltr.js", "comparator.js", "AuraService-fda-test", "audit.js", "mini_portile_cmake.rb", "libc6-i386_2.6.1-1ubuntu9_amd64.url", "ntp_opendirectory.conf", "MTLDefines.h", "removepkg", "libc6-i386_2.5-0ubuntu14_amd64.info", "help.py", "login.defs", "pcmcia", "http://alp-vision.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "config.js", "VZXHCIControllerConfiguration.h", "MTLIndirectCommandEncoder.h", "npm-stars.md", "print-job-manual.test" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "DragonForce Hacker Group Malaysia" ], "malware_families": [ "Industroyer - s0604", "Vzbootloader", "Lj", "Cftyperef", "Reduceright", "Vd", "Gc", "Typeerror" ], "industries": [ "Media" ], "unique_indicators": 22703 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/item.name", "whois": "http://whois.domaintools.com/item.name", "domain": "item.name", "hostname": "ww38.ui.input.text.enter.item.name" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 18, "pulses": [ { "id": "66f9ae71e7d4851280fa367f", "name": "The Jane Doe Syndrome Files: Credential Dumping and Data Exfiltration", "description": "This pulse outlines a series of techniques (Tactics) utilized in a cyber intrusion targeting Jane Doe's MacBook. These techniques span various stages of the attack lifecycle, including credential dumping (T1003), system discovery (T1016, T1082), and data exfiltration methods (T1114, T1560). The attacker employed advanced obfuscation strategies (T1027) and input capture methods (T1056) to maintain persistence and evade detection, while also utilizing command and scripting interpreters (T1059) to execute malicious commands.\n\nFurthermore, the adversary manipulated system tokens (T1134) and leveraged remote access software (T1219) to control the compromised system. Techniques for data destruction (T1485) and artifact hiding (T1564) indicate a concerted effort to cover tracks and minimize detection.\n\nBy examining these techniques, we can better understand the methods used in this intrusion, facilitating enhanced detection and prevention strategies for future incidents.", "modified": "2024-11-08T00:03:35.782000", "created": "2024-09-29T19:45:53.583000", "tags": [ "autogenerated", "please", "class", "hp laserjet", "duplexer", "modify", "printer", "description", "location", "share", "printer make", "ppd file", "model", "driver", "ipp everywhere", "printers", "hardware", "baud rate", "parity", "odd data", "flow control", "software", "rtscts", "dtrdsr", "input", "type", "name", "value", "hidden", "delete class", "form", "h2 class", "warning", "p align", "allow", "advanced", "use kerberos", "save", "max clients", "maximum", "metadata", "documents", "max log", "img src", "width", "height", "align", "absmiddle", "indicator", "status", "printername", "idle", "edit", "cupsdconf", "error", "blockquote", "unknown", "h3 class", "jobs", "help jobs", "helptitle", "qtext", "topic", "bmtext", "qptext", "cups", "search", "online help", "documents all", "hold job", "server default", "shared", "test page", "pause class", "accept jobs", "move all", "jobs cancel", "all jobs", "class delete", "cancel", "move job", "destination", "release", "reprint", "action", "method", "name user", "size pages", "state control", "jobid", "withheld", "held", "change settings", "label", "input type", "select name", "multiple size", "option", "inches feet", "table", "submit", "set default", "prev", "next", "last", "accept", "options", "default", "delete printer", "form action", "pause", "reject", "resume", "print", "self test", "pause printer", "location make", "model status", "test", "please stand", "allowed users", "prevent", "whichjobs", "standard rom", "standard", "copyright", "standard font", "cups ppd", "easy software", "apache license", "license", "symbol special", "deskjet", "cups sample", "hplaserjet", "laserjet", "hpdeskjet", "hpdeskjet2", "epson", "stylus color", "stylus photo", "escp", "epson9pin", "zebra", "dymo3x0", "dymo", "labelwriter", "advance", "leading", "move", "black", "gold", "rotate", "never", "cyan", "yellow", "turn", "long edge", "edge", "oversize", "address", "b1jis b1", "adobe", "small", "image", "apple mime", "xhtml", "pict string", "cgimageio", "radiance", "fujifilm", "preview", "os x", "colorsync", "airprint", "do not", "this file", "it is", "you install", "versions of", "base mime", "format", "postscript", "language", "pattern match", "ras2", "pwgraster", "comment", "attr", "group", "attr language", "attr integer", "attr name", "attributes", "attr keyword", "post", "resource admin", "operation", "group operation", "create", "withvalue", "display", "d recipienturi", "expect", "tv d", "member", "createjob", "senddocument", "create faxout", "get list", "display jobname", "cupsgetdevices", "get job", "expect jobstate", "job template", "get printer", "cupsgetppd", "cupsgetppds", "get ppd", "attr text", "product", "psversion", "version", "message", "hello", "cupsgetprinters", "beep", "sound", "count", "ingroup", "oftype keyword", "oftype integer", "oftype text", "oftype charset", "oftype enum", "az09", "withallvalues", "mediaregex", "oftype", "print file", "printjob", "test printjob", "file", "ippurischeme", "member integer", "print test", "printuri", "post resource", "validatejob", "validate", "printjob group", "repeatmatch", "choice", "envelope", "resolution", "modelname", "inputslot", "pcfilename", "modelnumber", "attribute", "false", "darkness", "media", "generic", "mark", "dark", "tear", "cupsbanner show", "header printer", "footer printer", "notice cups", "header cover", "page footer", "cover page", "header top", "secret footer", "top secret", "header secret", "footer secret", "vzefibootloader", "nsunavailable", "virtualization", "base class", "vzbootloader", "network device", "initialize", "host network", "property", "return", "define", "nsarray", "bsd name", "ethernet", "vzconsoledevice", "console port", "defines", "a directory", "vzexport extern", "apiavailable", "bool", "nsenum", "nsinteger", "local file", "raw format", "nsurl", "nserror", "file handle", "storage device", "nserror error", "nsfilehandle", "boot loader", "efi rom", "efi boot", "vzerrorcode", "vzerrordomain", "error type", "nserror domain", "vzerrorsave", "nbd server", "nbd client", "nsoptions", "nsuinteger", "nsswiftname", "nvram", "write", "sorcvbuf", "sosndbuf", "mtu value", "data", "data sent", "true", "graphics", "intel", "indicate", "enable", "nsdata", "opaque", "host audio", "host output", "host input", "cgsize", "new display", "protocol", "unix domain", "socket", "rosetta", "caching", "rosetta daemon", "nsstring", "abstract socket", "rosetta support", "linux", "arm64", "availability", "download", "vzmacaddress", "mac address", "a vzmacaddress", "linux kernel", "ram disk", "linux boot", "a mac", "configuration", "mac hardware", "describes", "mac platform", "mac keyboard", "usb keyboard", "mac machine", "apple silicon", "rosetta runtime", "nsobject", "handle", "init", "url property", "whether", "recovery", "block", "nullable", "load", "mac trackpad", "usb pointing", "cpus", "overwrite", "nsdictionary", "directory share", "check", "namemax", "vznetworkdevice", "nbd url", "nbd uniform", "nbd protocol", "url error", "nat attachment", "a network", "nvm express", "nsscreen", "nssize", "serial port", "directory", "spice agent", "spice guest", "a console", "vzsocketdevice", "vzstoragedevice", "vzexport", "usb controller", "vzusbcontroller", "usb device", "device uuid", "nsuuid uuid", "usb mass", "vzusbdevice", "virtio block", "device", "storage storage", "virtio console", "delegate object", "a class", "extra care", "virtio entropy", "nsstring name", "array", "virtio file", "system device", "discussion", "nsstring tag", "port", "bool isconsole", "a virtio", "virtio graphics", "virtio gpu", "virtio", "port array", "utf8", "virtio network", "macaddress", "virtio socket", "close", "does nothing", "virtio sound", "nsarray streams", "pointer", "device input", "a pcm", "audio stream", "source", "sink", "device output", "device stream", "memory balloon", "target memory", "return yes", "start", "stop", "usb xhci", "automatically", "nsview", "virtual machine", "cpucount", "verify", "apple swift", "o librarylevel", "swift", "cachingoptions", "vzaudiodevice", "vzdebugstub", "swiftname", "targetosiphone", "targetososx", "targetosios", "apple computer", "targetostv", "targetosvision", "targetostvos", "targetosxr", "vtbaseh", "vtint32point", "vtint32size", "iphonena", "apiunavailable", "vtexport const", "abstract", "cfstringref", "readwrite", "cfnumber", "cfboolean", "optional", "null", "macos", "cmnullable", "pass null", "call", "video toolbox", "contains", "cmtime duration", "cvimagebuffer", "vterrorsh", "cfoptions", "12914", "uint32", "osstatus", "12900", "12901", "12902", "12903", "17690", "vtexport", "encoder", "zero", "alpha", "requires", "cmsamplebuffer", "prototype", "osstatus status", "cfrelease", "cvpixelbuffer", "iosurface", "hdr metadata", "hdr per", "frame metadata", "cf type", "cfretain", "a mechanism", "cmbridgedtype", "interface", "specifies", "a reference", "pixel rotation", "session", "a pixel", "cf object", "vtframesilo", "returns", "vtframesiloh", "vtframesiloref", "pass", "pixel transfer", "vtexport void", "media extension", "video raw", "processors", "standard video", "metal device", "metal", "rawprocessors", "cfstring", "copy", "vtsessionh", "cfdictionaryref", "apis", "vtsessionref", "raw processor", "a cfdictionary", "cfswiftname", "vtutilitiesh", "cgimage", "builds", "cfarrayref", "raw processing", "list", "list element", "cfdictionaries", "skipper", "vdspdftexecute", "vdspdftexecuted", "vdspdftzop", "vdspfft16copv", "vdspfft16zopv", "vdspfft32copv", "vdspfft32zopv", "vdspbiquad", "vdspbiquadd", "vdspbiquadm", "project version", "created", "elana stettin", "apple", "swextern", "title", "typedef", "param", "nsstring title", "represents", "nsitemprovider", "const", "swhidden extern", "swdefines", "swextern extern", "sha256 hash", "merkle tree", "sociallayer", "swperson", "devin clary", "swaction", "sbappcontext", "sbapplocator", "sbapplication", "sbelementarray", "sbobject", "scriptingbridge", "objecttype", "finder", "bridge", "index", "apple event", "target", "urls", "locator", "scripting", "desctype", "receiver", "track", "code", "sccontentfilter", "bgra format", "rgha format", "const nonnull", "nserrorenum", "nsurl outputurl", "avfiletypempeg4", "provides", "scwindow", "scdisplay", "cgrect frame", "bool indicating", "pixel", "scstream", "control center", "takes", "cfdictionary", "rbhash", "initvmrandom", "initvmtranscode", "initarray", "initbarevm", "initbignum", "initcomplex", "initcont", "initdir", "initfile", "libxml", "require", "cfpropertylist", "xml parser", "libxmlparser", "xml file", "plist", "cfplisterror", "exception", "format error", "easy", "kruse", "mit license", "standarderror", "cfformaterror", "cftypeerror", "nokogiri", "parserinterface", "cftype", "cfdate", "cfinteger", "blob", "ruby string", "uidfixnum", "ruby integer", "date", "format constant", "formatbinary", "formatxml", "magicnumber", "enumerator", "cfdata", "ruby", "example", "john", "path", "plainparser", "ascii", "cfreal", "importplain", "escapechar", "read", "length", "utf16be", "cfarray", "offsetsize", "integer", "rexml", "rexmlparser", "float", "appledtd plist", "dom node", "prefix", "config", "item", "bindir", "libruby", "rubypath", "fileoperations", "arch", "installer", "template", "install", "major", "yesno", "todo", "kwargs", "makefiles", "miniportile", "cmakecmd", "configure", "cmakefile", "cmake", "keyringname", "debug", "targetos", "ldflags", "gpgexe", "digest", "stdout", "patch", "installerror", "savefile", "task", "packages", "dlext", "minero aoki", "rubyversion", "loaderror", "sqlite3", "was sqlite3", "apiobjects", "database", "pragmas", "resultset", "sqlite3ruby faq", "sqliteruby faq", "value klass", "qnil", "sqliteok", "sqliteerror", "sqliteinternal", "sqliteperm", "sqliteabort", "sqlitebusy", "sqlitelocked", "datagetstruct", "int2num", "main", "done", "stringvalueptr", "note", "sqlite3ruby", "sqlite3rubyptr", "unused", "gnuc", "lclint", "usasciip", "utf8p", "utf16lep", "utf16le", "utf16bep", "sqlite3stmtruby", "rubyplatform", "darwin", "rcarchs", "libpkgconfig", "pkgconfigpath", "pkgconf", "mswin", "cflags", "install sqlite3", "int2fix", "rbignumlen", "sizeofbdigits", "charbit", "bdigit", "bmax", "value unused", "sqliteopenuri", "open", "requireopendb", "nilp", "qtrue", "id2sym", "requireopenstmt", "donep", "rstringlen", "num2int", "attrs", "deal", "xsd module", "xmlparser", "nokogiri xml", "simply", "rubyengine", "slop decorator", "css3 selector", "xpath", "nokogiri class", "parse", "html", "xml document", "0x30", "0x41", "0x61", "gumbogentable", "gumboasciicntrl", "gumboasciispace", "gumboasciidigit", "constfn", "gumboasciih", "gumboasciialpha", "gumboasciialnum", "c0 control", "gumbocharrefh", "gumboattributeh", "gumboattribute", "craig barnes", "google inc", "as is", "basis", "or conditions", "any kind", "gumboerrorh", "gumbotag", "additional", "gumbovector", "encoding", "gumboerrparser", "gumboerrortype", "html tag", "minwordlength", "maxwordlength", "maxhashvalue", "ansic code", "m100 n", "computed", "totalkeywords", "minhashvalue", "doctype", "capacity", "doctype system", "sourcelength", "sourcetext", "silence", "html5", "a struct", "text", "gumbo", "gumboh", "anything", "gumboparserh", "output", "library", "oopstyle", "gumboparser", "const localname", "string", "ietfdtd html", "w3cdtd html", "level", "html strict", "terminator", "final", "buffer", "gnucatleast", "hasattribute", "macrosh", "printf", "returnsnonnull", "win32", "unusedifndebug", "malloc", "pure", "m100", "gumbotaglookuph", "gumbotag tag", "taghashslot", "gumbotagunknown", "gumbotokentypeh", "gumbotokencdata", "gumbotokennull", "gumbotokeneof", "gumbotokentype", "gumbotaglast", "position", "gumbotokenizerh", "struct", "gumbotoken", "spec", "stack", "emittoken", "continue", "current", "utf8iterator", "utf8accept", "parser", "html5 spec", "rest", "gumboutf8h", "unicode code", "html5 parser", "utf8 decoding", "func", "gumbodebug", "gumboutilh", "utility", "debug wrapper", "script", "attribute value", "comment end", "doctype name", "cdata section", "rcdata end", "rawtext end", "initialcapacity", "gumboalloc", "vector", "memmove", "gumbovectorh", "initializes", "ownership", "stringvaluecstr", "rtest", "xmlchar", "html document", "nokogiristrnew2", "html4", "value get", "qfalse", "a list", "value list", "attrsdepr", "attrsopt", "chunk", "pushparser", "xmlsax", "value chunk", "w3c dom", "xmlelementnode", "finds", "qundef", "value val", "value args", "value exc", "libxml2patches", "rbconfig", "packagerootdir", "cppflags", "libs", "dldflags", "nokogiri test", "attributedecl", "defaultvalue", "atype", "tree", "ctxt", "noreturn", "xmldocptr doc", "private", "nokogirinative", "nokogiristrnew", "xmldoc", "value setvalue", "value content", "xmlchar value", "xmlnode cur", "content", "cdata", "cdata element", "value argv", "value rbnode", "document", "value document", "value getname", "pcdata", "element", "mult", "datawrapstruct", "value ctxtval", "mydoc", "userdata", "encodinghandler", "value key", "delete", "elementdecl", "id iddocument", "etype", "value prefix", "orig", "externalid", "systemid", "nodenr", "xmlnodeset", "nodeset", "nodetab", "xmldtd", "value hash", "publicid", "notation", "hash", "rbfuncall", "parseargs", "xmlnode", "without", "href", "xmlns", "namespace node", "nodes", "value rbreader", "relaxng schema", "relaxng", "value name", "nokogirisaxself", "rbivget", "rbstrorqnil", "xmlchar name", "xmlparserctxt", "text element", "value string", "schema", "xmlschema", "context", "stringval", "wrapper", "emp0001n", "emp0002n", "xslt", "handler", "handlerstate", "checktype", "tarray", "id documentid", "comment element", "node", "first", "prop", "typeerror", "gc", "pkpublicchannel", "pkpushpayload", "pkpushregistry", "pkpushtypevoip", "pushkit", "object", "pkpushtype type", "forward", "http", "apple push", "pkexport extern", "nsstringenum", "payload data", "voip", "json format", "callkit", "pkpushtype", "framework", "apps", "push", "odsessioncreate", "odattributemap", "odconfiguration", "odcontext", "odmappings", "odmoduleentry", "odnode", "odquery", "odrecord", "odrecordmap", "nsavailablemac", "original code", "nsstring value", "custom", "modifications", "apple public", "source license", "of any", "nsavailable", "nsrunloop", "objc", "sets", "odsession", "sfauthorization", "will", "odsessionref", "cfexport", "odqueryref", "odnoderef", "cfexport bool", "odrecordref", "cfdataref", "cfexport const", "utf8 encoding", "odattributetype", "odrecordtype", "attribute type", "local", "realm", "cftyperef", "odnodegetdsref", "odnodegettypeid", "odrecorddelete", "odtriggercancel", "odnodeinit", "odquerycreate", "odqueryinit", "odsessioninit", "albuffer3i", "albufferdata", "albufferf", "albufferfv", "albufferi", "albufferiv", "aldistancemodel", "aldopplerfactor", "algetbooleanv", "algetbuffer3f", "alcapi", "alcapientry", "alcboolean", "targetosmac", "alcdevice", "alcenum param", "alalch", "alcchar", "alcsizei", "capture", "alenum param", "alapi", "aluint sid", "alfloat", "aluint bid", "alsizei", "alint", "alfloat value", "alapientry", "aluint", "play", "speed", "bits", "alutapi alvoid", "alvoid data", "alsizei size", "alsizei freq", "gnu library", "general public", "aluth", "alenum format", "openalopenalh", "umbrella header", "alvoid", "openal", "alvoid nonnull", "alenum", "roger beep", "sendable", "preconcurrency", "rawvalue", "network import", "failure", "service", "must", "number", "stride", "brief", "descriptor", "matrix", "mtlpackedfloat3", "infinity", "metalversion", "minimum point", "maximum point", "interpolation", "translation", "offset", "acceleration", "declare", "prior", "insert", "nonnull", "nsrange", "mtldevice", "t argname", "mtlstructtype", "mtlarraytype", "mtltype", "mtlpointertype", "instance", "methodkind", "swiftprivate", "mtlbuffer", "nullability", "mtlcommandqueue", "mtlresource", "mtlresidencyset", "command encoder", "individual", "mtlexport", "xcode", "gpu trace", "apideprecated", "mtlcapturescope", "remarks", "mtlallocation", "metal command", "mtldispatchtype", "mtlorigin", "mtlsize", "mtlblitoption", "flush", "gpu work", "marks", "specify", "mtlinline", "mtlintern", "stdcversion", "mtlextern", "definition", "inline", "nsstring label", "stencil", "defaults", "allocate", "typical", "nsprocessinfo", "mtldrawable", "present", "cftimeinterval", "gpustarttime", "gpuendtime", "mtlcountersh", "mtlcounter", "mtlcounterset", "mtllibrary", "a container", "mtlfence", "mtldatatype", "default usage", "mtlfunction", "mtllogcontainer", "mtlsharedevent", "mtlevent", "synchronously", "a function", "cpu cache", "requiredsize", "behavior", "mtlheap", "query device", "dispatch", "metal shading", "language guide", "raytriangle", "vends", "groups", "encodes", "mtliofilehandle", "mtlextern sizet", "mtlextern void", "mtlstoreaction", "mtlloglevel", "enum", "mtlmutability", "astcetc2bc", "normal", "astc", "clamptoedge", "depth", "mtlcoordinate2d", "nsnumber", "controls", "mtlclearcolor", "adds", "mtlregion", "cpu mapping", "mtltexture", "mtlindextype", "filter option", "clamp", "mtlrenderstages", "draw", "mtlstepfunction", "vertex", "compute", "gpu resource", "nsuinteger x", "identify", "nsuinteger y", "nsuinteger z", "mtlsize size", "mtlvertexformat", "nsuintegermax", "mtlpixelformat", "mtltexturetype", "slice", "swiftui", "coregraphics", "swift import", "previewregistry", "libraryitem", "category", "dict", "apple root", "code signing", "public", "uus10u", "GUANGZHOU FIVE SIX TECHNOLOGY", "Havana Syndrome", "Aishah Lazim", "Al-Arqam", "Brooklyn" ], "references": [ "httpd.exp", "metadata.json", "add-class.tmpl", "choose-make.tmpl", "choose-model.tmpl", "choose-device.tmpl", "add-printer.tmpl", "choose-serial.tmpl", "class-added.tmpl", "choose-uri.tmpl", "class-confirm.tmpl", "admin.tmpl", "class-deleted.tmpl", "class-modified.tmpl", "classes-header.tmpl", "command.tmpl", "classes.tmpl", "edit-config.tmpl", "error-op.tmpl", "class-jobs-header.tmpl", "error.tmpl", "header.tmpl", "help-header.tmpl", "help-printable.tmpl", "help-trailer.tmpl", "job-hold.tmpl", "class.tmpl", "job-cancel.tmpl", "job-move.tmpl", "job-moved.tmpl", "job-release.tmpl", "job-restart.tmpl", "list-available-printers.tmpl", "jobs.tmpl", "norestart.tmpl", "option-boolean.tmpl", "option-header.tmpl", "option-conflict.tmpl", "option-pickmany.tmpl", "option-pickone.tmpl", "modify-printer.tmpl", "option-trailer.tmpl", "pager.tmpl", "printer-cancel-jobs.tmpl", "printer-added.tmpl", "printer-accept.tmpl", "printer-configured.tmpl", "printer-default.tmpl", "printer-confirm.tmpl", "printer-deleted.tmpl", "printer-jobs-header.tmpl", "printer-modified.tmpl", "jobs-header.tmpl", "printer-stop.tmpl", "modify-class.tmpl", "printer-reject.tmpl", "printers-header.tmpl", "printer-start.tmpl", "printer.tmpl", "printers.tmpl", "set-printer-options-trailer.tmpl", "test-page.tmpl", "restart.tmpl", "users.tmpl", "set-printer-options-header.tmpl", "search.tmpl", "trailer.tmpl", "font.defs", "hp.h", "epson.h", "label.h", "raster.defs", "media.defs", "apple.types", "apple.convs", "mime.convs", "mime.types", "cancel-current-job.test", "create-job-sheets.test", "create-job.test", "create-job-format.test", "create-job-timeout.test", "create-printer-subscription.test", "cups-create-local-printer.test", "fax-job.test", "get-completed-jobs.test", "get-devices.test", "get-job-attributes.test", "get-job-attributes2.test", "get-notifications.test", "get-jobs.test", "get-job-template-attributes.test", "get-ppd-printer.test", "get-ppds-drv-only.test", "get-ppd.test", "get-ppds-make-and-model.test", "get-ppds-make.test", "get-ppds-product.test", "get-ppds-psversion.test", "get-ppds-language.test", "get-printer-description-attributes.test", "get-ppds.test", "get-printer-attributes.test", "get-subscriptions.test", "identify-printer-display.test", "get-printers-printer-id.test", "identify-printer-multiple.test", "get-printers.test", "identify-printer.test", "get-printer-attributes-suite.test", "ipp-2.0.test", "ipp-2.2.test", "ipp-backend.test", "ipp-2.1.test", "print-job-and-wait.test", "print-job-deflate.test", "print-job-hold.test", "print-job-gzip.test", "ipp-1.1.test", "print-job-manual.test", "print-job-password.test", "print-job.test", "print-job-media-col.test", "print-uri.test", "print-job-letter.test", "set-attrs-hold.test", "validate-job.test", "ipp-everywhere.test", "sample.drv", "testprint", "classified", "standard", "topsecret", "secret", "confidential", "unclassified", "ntp_opendirectory.conf", "ntp.conf", "notify.conf", "nfs.conf", "nsmb.conf", "xtab", "6015FED9-D723-4332-87D9-C478CF341407.aamdownload", "AuraService-fda-test", "com.adobe.acrobat.rna.AcroCefBrowserLock.DC", "ExmanProcessMutex", "proxy.xml", "A53749AF-3855-4842-A1E7-4AEFA60BD2AC", "XPdb-wal", "VZBootLoader.h", "VZAudioInputStreamSource.h", "VZBridgedNetworkDeviceAttachment.h", "VZAudioOutputStreamSink.h", "VZBridgedNetworkInterface.h", "VZConsoleDeviceConfiguration.h", "VZConsoleDevice.h", "VZConsolePortConfiguration.h", "VZDirectorySharingDevice.h", "VZDirectoryShare.h", "VZDefines.h", "VZDiskImageStorageDeviceAttachment.h", "VZDiskSynchronizationMode.h", "VZDiskBlockDeviceStorageDeviceAttachment.h", "Virtualization.h", "VZDirectorySharingDeviceConfiguration.h", "VZEntropyDeviceConfiguration.h", "VZEFIBootLoader.h", "VZError.h", "VZEFIVariableStore.h", "VZFileHandleNetworkDeviceAttachment.h", "VZFileHandleSerialPortAttachment.h", "VZFileSerialPortAttachment.h", "VZGraphicsDevice.h", "VZGenericPlatformConfiguration.h", "VZGenericMachineIdentifier.h", "VZGraphicsDeviceConfiguration.h", "VZGraphicsDisplayConfiguration.h", "VZHostAudioOutputStreamSink.h", "VZKeyboardConfiguration.h", "VZHostAudioInputStreamSource.h", "VZGraphicsDisplay.h", "VZAudioDeviceConfiguration.h", "VZLinuxRosettaUnixSocketCachingOptions.h", "VZLinuxRosettaAbstractSocketCachingOptions.h", "VZLinuxRosettaDirectoryShare.h", "VZMACAddress.h", "VZLinuxBootLoader.h", "VZMacGraphicsDevice.h", "VZMacGraphicsDisplay.h", "VZMacGraphicsDeviceConfiguration.h", "VZMacHardwareModel.h", "VZMacKeyboardConfiguration.h", "VZMacMachineIdentifier.h", "VZMacOSBootLoader.h", "VZLinuxRosettaCachingOptions.h", "VZMacOSInstaller.h", "VZMacOSVirtualMachineStartOptions.h", "VZMacOSRestoreImage.h", "VZMacTrackpadConfiguration.h", "VZMacOSConfigurationRequirements.h", "VZMemoryBalloonDevice.h", "VZMemoryBalloonDeviceConfiguration.h", "VZMacAuxiliaryStorage.h", "VZMultipleDirectoryShare.h", "VZMacPlatformConfiguration.h", "VZNetworkDevice.h", "VZNetworkBlockDeviceStorageDeviceAttachment.h", "VZNATNetworkDeviceAttachment.h", "VZNetworkDeviceAttachment.h", "VZPlatformConfiguration.h", "VZPointingDeviceConfiguration.h", "VZNetworkDeviceConfiguration.h", "VZSharedDirectory.h", "VZSerialPortAttachment.h", "VZNVMExpressControllerDeviceConfiguration.h", "VZMacGraphicsDisplayConfiguration.h", "VZSerialPortConfiguration.h", "VZSingleDirectoryShare.h", "VZSpiceAgentPortAttachment.h", "VZSocketDeviceConfiguration.h", "VZSocketDevice.h", "VZStorageDevice.h", "VZStorageDeviceAttachment.h", "VZStorageDeviceConfiguration.h", "VZUSBControllerConfiguration.h", "VZUSBDeviceConfiguration.h", "VZUSBMassStorageDevice.h", "VZUSBKeyboardConfiguration.h", "VZUSBController.h", "VZUSBDevice.h", "VZVirtioBlockDeviceConfiguration.h", "VZUSBScreenCoordinatePointingDeviceConfiguration.h", "VZUSBMassStorageDeviceConfiguration.h", "VZVirtioConsoleDevice.h", "VZVirtioConsoleDeviceConfiguration.h", "VZVirtioConsoleDeviceSerialPortConfiguration.h", "VZVirtioEntropyDeviceConfiguration.h", "VZVirtioConsolePort.h", "VZVirtioConsolePortConfigurationArray.h", "VZVirtioFileSystemDevice.h", "VZVirtioConsolePortConfiguration.h", "VZVirtioGraphicsDevice.h", "VZVirtioGraphicsDeviceConfiguration.h", "VZVirtioGraphicsScanout.h", "VZVirtioGraphicsScanoutConfiguration.h", "VZVirtioConsolePortArray.h", "VZVirtioFileSystemDeviceConfiguration.h", "VZVirtioNetworkDeviceConfiguration.h", "VZVirtioSocketConnection.h", "VZVirtioSocketDevice.h", "VZVirtioSoundDeviceConfiguration.h", "VZVirtioSocketListener.h", "VZVirtioSoundDeviceInputStreamConfiguration.h", "VZVirtioSocketDeviceConfiguration.h", "VZVirtioSoundDeviceOutputStreamConfiguration.h", "VZVirtioSoundDeviceStreamConfiguration.h", "VZVirtioTraditionalMemoryBalloonDeviceConfiguration.h", "VZVirtualMachineDelegate.h", "VZVirtualMachineStartOptions.h", "VZVirtioTraditionalMemoryBalloonDevice.h", "VZVirtualMachine.h", "VZXHCIControllerConfiguration.h", "VZVirtualMachineView.h", "VZVirtualMachineConfiguration.h", "VZXHCIController.h", "x86_64-apple-macos.swiftinterface", "arm64e-apple-macos.swiftinterface", "module.modulemap", "Virtualization.tbd", "VideoToolbox.apinotes", "VideoToolbox.h", "VTBase.h", "VTDecompressionProperties.h", "VTCompressionSession.h", "VTErrors.h", "VTCompressionProperties.h", "VTDecompressionSession.h", "VTHDRPerFrameMetadataGenerationSession.h", "VTMultiPassStorage.h", "VTPixelRotationSession.h", "VTFrameSilo.h", "VTPixelRotationProperties.h", "VTPixelTransferSession.h", "VTProfessionalVideoWorkflow.h", "VTRAWProcessingProperties.h", "VTPixelTransferProperties.h", "VTSession.h", "VTUtilities.h", "VTVideoEncoderList.h", "VTRAWProcessingSession.h", "libvDSP.tbd", "SharedWithYouCore.h", "SWAction.h", "SWCollaborationActionHandler.h", "SWCollaborationCoordinator.h", "SWCollaborationMetadata.h", "SWCollaborationOption.h", "SWCollaborationOptionsPickerGroup.h", "SWCollaborationOptionsGroup.h", "SWCollaborationShareOptions.h", "SWDefines.h", "SWPersonIdentity.h", "SWPerson.h", "SWStartCollaborationAction.h", "SWPersonIdentityProof.h", "SWUpdateCollaborationParticipantsAction.h", "SharedWithYouCore.tbd", "ScriptingBridge.tbd", "SBElementArray.h", "ScriptingBridge.apinotes", "ScriptingBridge.h", "SBApplication.h", "SBObject.h", "SCScreenshotManager.h", "SCError.h", "SCRecordingOutput.h", "ScreenCaptureKit.h", "SCShareableContent.h", "SCContentSharingPicker.h", "SCStream.h", "Ruby.tbd", "rbLibXMLParser.rb", "rbCFPlistError.rb", "rbNokogiriParser.rb", "rbCFTypes.rb", "rbCFPropertyList.rb", "rbPlainCFPropertyList.rb", "rbBinaryCFPropertyList.rb", "rbREXMLParser.rb", "cfpropertylist.rb", "setup.rb", "libxml.rb", "xml.rb", "mini_portile_cmake.rb", "version.rb", "mini_portile.rb", "sqlite3.rb", "faq.rb", "exception.c", "backup.h", "backup.c", "database.h", "exception.h", "sqlite3_ruby.h", "statement.h", "extconf.rb", "sqlite3.c", "database.c", "statement.c", "nokogiri.rb", "ascii.c", "ascii.h", "char_ref.h", "attribute.h", "attribute.c", "error.h", "foreign_attrs.c", "insertion_mode.h", "error.c", "gumbo.h", "parser.h", "replacement.h", "parser.c", "string_buffer.h", "string_buffer.c", "string_piece.c", "macros.h", "svg_attrs.c", "tag_lookup.h", "svg_tags.c", "tag_lookup.c", "token_type.h", "tag.c", "token_buffer.h", "token_buffer.c", "tokenizer.h", "tokenizer.c", "utf8.c", "utf8.h", "util.c", "util.h", "tokenizer_states.h", "vector.c", "vector.h", "html4_document.c", "html4_entity_lookup.c", "html4_element_description.c", "html4_sax_push_parser.c", "libxml2_backwards_compat.c", "nokogiri.c", "test_global_handlers.c", "xml_attribute_decl.c", "nokogiri.h", "xml_attr.c", "xml_cdata.c", "xml_document_fragment.c", "xml_document.c", "xml_element_content.c", "html4_sax_parser_context.c", "xml_encoding_handler.c", "xml_element_decl.c", "xml_entity_decl.c", "xml_node_set.c", "xml_dtd.c", "gumbo.c", "xml_namespace.c", "xml_processing_instruction.c", "xml_reader.c", "xml_relax_ng.c", "xml_entity_reference.c", "xml_sax_parser.c", "xml_sax_push_parser.c", "xml_sax_parser_context.c", "xml_text.c", "xml_schema.c", "xml_xpath_context.c", "xslt_stylesheet.c", "xml_syntax_error.c", "xml_comment.c", "xml_node.c", "PushKit.tbd", "PKPushCredentials.h", "PKDefines.h", "PKPushPayload.h", "PushKit.h", "PKPushRegistry.h", "PushKit.apinotes", "OpenDirectory.tbd", "ODAttributeMap.h", "ODMappings.h", "NSOpenDirectory.h", "ODConfiguration.h", "ODQuery.h", "ODNode.h", "OpenDirectory.h", "ODRecordMap.h", "ODSession.h", "ODModuleEntry.h", "ODRecord.h", "CFODContext.h", "CFODSession.h", "CFOpenDirectory.h", "CFODQuery.h", "CFODNode.h", "CFODRecord.h", "CFOpenDirectoryConstants.h", "CFOpenDirectory.tbd", "OpenAL.tbd", "alc.h", "al.h", "alut.h", "OpenAL.h", "MacOSX_OALExtensions.h", "arm64e-apple-ios-macabi.swiftinterface", "x86_64-apple-ios-macabi.swiftinterface", "SwiftUI.swiftoverlay", "MTLAccelerationStructure.h", "Metal.h", "MTLAccelerationStructureTypes.h", "MTLAccelerationStructureCommandEncoder.h", "MTLArgumentEncoder.h", "MTLArgument.h", "MTLBinaryArchive.h", "Metal.apinotes", "MTLBlitPass.h", "MTLBuffer.h", "MTLCaptureManager.h", "MTLCaptureScope.h", "MTLAllocation.h", "MTLCommandEncoder.h", "MTLCommandBuffer.h", "MTLComputePass.h", "MTLBlitCommandEncoder.h", "MTLCommandQueue.h", "MTLDefines.h", "MTLDepthStencil.h", "MTLComputePipeline.h", "MTLDeviceCertification.h", "MTLDrawable.h", "MTLCounters.h", "MTLComputeCommandEncoder.h", "MTLDynamicLibrary.h", "MTLFence.h", "MTLFunctionConstantValues.h", "MTLFunctionDescriptor.h", "MTLFunctionLog.h", "MTLFunctionHandle.h", "MTLEvent.h", "MTLFunctionStitching.h", "MTLHeap.h", "MTLDevice.h", "MTLIndirectCommandBuffer.h", "MTLIntersectionFunctionTable.h", "MTLIOCommandQueue.h", "MTLLinkedFunctions.h", "MTLIOCommandBuffer.h", "MTLIOCompressor.h", "MTLParallelRenderCommandEncoder.h", "MTLLogState.h", "MTLPipeline.h", "MTLLibrary.h", "MTLPixelFormat.h", "MTLRasterizationRate.h", "MTLRenderPass.h", "MTLRenderPipeline.h", "MTLResidencySet.h", "MTLResourceStateCommandEncoder.h", "MTLResourceStatePass.h", "MTLResource.h", "MTLIndirectCommandEncoder.h", "MTLSampler.h", "MTLRenderCommandEncoder.h", "MTLStageInputOutputDescriptor.h", "MTLVisibleFunctionTable.h", "MTLTypes.h", "MTLVertexDescriptor.h", "MTLTexture.h", "WebKit.arm64e.bridgesupport", "WebKit.bridgesupport" ], "public": 1, "adversary": "DragonForce Hacker Group Malaysia", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "VZBootLoader", "display_name": "VZBootLoader", "target": null }, { "id": "TypeError", "display_name": "TypeError", "target": null }, { "id": "GC", "display_name": "GC", "target": null }, { "id": "CFTypeRef", "display_name": "CFTypeRef", "target": null } ], "attack_ids": [ { "id": "T1123", "name": "Audio Capture", "display_name": "T1123 - Audio Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1135", "name": "Network Share Discovery", "display_name": "T1135 - Network Share Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1124", "name": "System Time Discovery", "display_name": "T1124 - System Time Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1550", "name": "Use Alternate Authentication Material", "display_name": "T1550 - Use Alternate Authentication Material" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" } ], "industries": [ "Media" ], "TLP": "white", "cloned_from": null, "export_count": 49, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 346, "FileHash-SHA256": 272, "domain": 110, "hostname": 101, "email": 1, "CVE": 2, "FileHash-SHA1": 1 }, "indicator_count": 833, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "570 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6605781ad51380e5b1c22815", "name": "haul from the last two weeks of wrangling - presumed malware and IOC's found on my personal devices", "description": "nearing the two year mark of the first initial attack - unfortunately OTX was only able to pull domains from the large majority of files uploaded which seems to be a built in anti-debug feature and goes with the theme and \"look & feel\" of this latest iteration being that most of them were somehow someway remote and acting as a net file system on my machine", "modified": "2024-04-27T02:04:29.606000", "created": "2024-03-28T14:00:58.809000", "tags": [ "dddf", "target", "dddj", "path", "base o", "base", "backupfile", "base rw", "exit", "date", "hell", "gnu libtool", "please do", "linker", "lsmime3 lnss3", "lplc4 lnspr4", "ludev", "directory", "lmagic ljansson", "feugiat", "lorem ipsum", "nulla facilisi", "malesuada", "etiam tempor", "suspendisse", "consectetur", "bibendum", "amet", "eget aliquet", "basesectors", "date echo", "default", "label", "kernel", "append rhgb", "clsid", "systemroot", "webbrowser", "ispell", "imagemagick", "flex", "zle c", "whois", "locate", "rubber", "chown", "ruby", "ninja", "pacman", "restart", "kill", "django", "mark", "repl", "service", "term", "mkdir", "borg", "black", "conan", "dolphin", "dotnet", "hello", "john", "generic", "find", "shutdown", "mozilla", "first", "subsystem", "action", "goto", "load", "devtype", "idnetdriver", "drivers", "program", "interface", "nmunmanaged", "ethernet", "mac prefix", "attr", "virtualbox host", "mac address", "interface name", "hello world", "unit", "timer", "onbootsec5min", "install", "wait online", "networkmanager", "edit", "note", "typeoneshot", "cloud", "optin", "helper", "for testing", "only", "restrict", "grant", "enable debug", "trace", "killmodeprocess", "typedbus", "reload", "capdacoverride", "dhcp etc", "include", "yara", "cflags", "libs", "xxx remove", "the author", "this software", "isc license", "copyright", "schlueter", "permission", "software is", "provided", "as is", "disclaims all", "direct", "require", "semver", "comparator", "range", "releasetypes", "simple", "tilde", "09azaz", "prerelease", "same", "beta", "semverrangesgtr", "semverrangesltr", "coerce version", "ranges", "alpha", "standalone", "exits", "null", "false", "reverse", "compare", "a javascript", "copyright isaac", "typeerror", "maxsafeinteger", "maxlength", "break", "error", "number", "drop", "same direction", "symbol", "comp", "const", "caret", "flagloose", "xrange", "parse", "identifier", "object", "match", "string", "walk", "manually", "stop", "highhaspre", "major", "minor", "patch", "istanbul", "preminor", "index", "regexp", "build metadata", "meaning", "replace", "token", "zero", "star", "infinity", "return", "a cache", "build status", "coverage status", "the same", "options", "before", "lrulist", "cache", "length", "dispose", "maxage", "allowstale", "nodisposeonset", "yallist", "node", "array", "head", "function", "tail", "start", "insert", "just", "node object", "barbar", "array method", "default export", "any comparator", "complex range", "simple range", "c1 c2", "outer", "every simple", "ecomp", "must", "clone", "case", "ignore", "setmin", "determine", "version", "typeof", "contribute", "status", "node package", "manager", "benchmark suite", "installation", "direct download", "ql https", "node version", "usage", "project", "calendar", "package", "source", "license", "source form", "perl foundation", "distributor fee", "distribute", "standard", "neither", "module", "basecommand", "lifecyclecmd", "base command", "pacote", "browser", "workspace", "pkgname", "await", "boolean", "base class", "wrapwidth", "chalk", "command", "config", "npmcliconfig", "logfile", "timers", "display", "location", "audit", "arboristcmd", "arborist", "global", "whoami", "async", "json", "view", "pref", "pckmnt", "resolve", "utf8", "libnpmversion", "unstar", "update", "save", "omit", "packagelock", "dryrun", "force", "libnpmaccess", "spec", "uninstall", "todo", "enoent", "enotdir", "test", "scriptshell", "scope", "team", "create", "user", "libnpmteam", "destroy", "table", "list", "cidr", "stars", "eneedauth", "shrinkwrap", "rename", "npmcliarborist", "value", "unicode", "sbom", "cyclonedx", "build", "sbomformats", "response", "software bill", "look", "script", "runscript", "indent", "root", "minipass", "search", "pipeline", "filterstream", "libnpmsearch", "long", "grab", "packageurlcmd", "repo", "info", "repo const", "rebuild", "reifycmd", "publish", "libnpmpack", "npmclirunscript", "prune", "remove", "prefix", "args", "queryable", "packagejson", "pong", "cleanurl", "registry", "pack", "load tarball", "noise", "query", "edge", "etarget", "e403", "e404", "outdated", "homepage", "developer", "admin", "owner", "libnpmorg", "npmfetch", "logout", "getauth", "invalid", "parent", "depth", "type", "filteredby", "dedupe", "problems", "login", "link", "util", "installcitest", "runs", "prop", "password", "profile", "mode", "email", "twitter", "hook", "libnpmhook", "init", "wpath", "installtest", "complete", "globaltop", "help", "viewer", "glob", "pattern", "file", "globify", "explore", "shell", "handle", "fund", "which", "fundingsource", "archy", "explain", "helpsearch", "text", "part", "editor", "editor const", "childprocess", "check", "nodemodules", "docs", "promisify", "doctor", "cacache", "mask", "win32", "disttag", "packagespec", "semver range", "delete", "diff", "workspacepath", "actualtree", "libnpmdiff", "deprecate", "message", "write", "clean", "spawn", "compline", "comppoint", "compcword", "epipe", "completion", "compfish", "os x", "bugs", "report", "adduser", "exec", "libnpmexec", "localprefix", "runpath", "skip", "public key", "npmauditreport", "access", "item", "finddupes", "syntaxerror", "getcli", "eventemitter", "abort", "ssri", "columnify", "bundled", "tarball details", "sha1", "daily", "latest", "check daily", "weekly", "cyclonedxschema", "cyclonedxformat", "proppath", "propbundled", "propdevelopment", "propextraneous", "propprivate", "refvcs", "refwebsite", "crypto", "readpassword", "readusername", "reademail", "enter", "enter otp", "otpprompt", "afaf09", "passwordprompt", "auditerror", "getfundinginfo", "json output", "data", "append", "maybeindex", "ontimeend", "name", "returns", "noassertion", "spdxidentifer", "spdxdatalicense", "reldescribes", "reldep", "reftypepurl", "spdxid", "eotp", "e401", "setinterval", "npmlog", "proclog", "maxlogsperfile", "fsminipass", "open", "colmax", "colmin", "colgutter", "quick help", "convert", "b return", "mb return", "gb return", "sigint", "readline", "prompt", "promise", "eresolve error", "overridden", "peer", "extraneous", "optional", "isworkspace", "maxlen", "code", "unfinished", "notice", "isshellout", "matcherrorcode", "devnull", "npmcompletion", "compwords", "compreply", "o default", "f npmcompletion", "ifs compadd", "fish shell", "l cmd", "taken", "comp stuff", "lx compline", "abbrev", "please", "enyi", "json version", "cygwin", "c1 control", "numbers", "x09 x0a", "10000", "nodemodulesnpm", "builtin", "npmrc", "notsup", "notarget", "nospc", "rofs", "author", "npmclifs", "minimatch", "pathtofoo", "relative", "synopsis", "description", "field", "person", "configuration", "whether", "premajor", "prepatch", "prevents", "run git", "upgrade", "examples", "will", "shareman", "cidr whitelist", "please refer", "tokenid", "eslint", "c eslint", "compatibility", "older", "versions", "nodeoptions", "details", "output", "example", "posix", "unstarring", "lcall", "starring", "lock", "materials", "spdx", "lodash", "nodeenv", "initcwd", "boolean set", "boolean tells", "windows", "unix", "selector", "use cases", "queries", "equivalent", "boolean show", "nocolor environ", "cli look", "boolean force", "dependency", "json object", "production", "files", "cicd system", "property", "change", "url opener", "basic auth", "allow", "description a", "removes", "semvermajor", "ping https", "ping http", "found", "get http", "example add", "json format", "handy", "display prefix", "g usrlocal", "mycorp", "associate", "deprecated", "libnodemodules", "caveat note", "workspace usage", "string override", "tarball", "githubrepo", "initializer", "usrfoo", "forwarding", "suppose", "commandsnpm", "hooks", "url endpoint", "browse", "consider", "ci environment", "string optional", "promzard", "top level", "expect", "javascript", "it staff", "https", "cli team", "ecmascript", "readme", "package current", "latest location", "depended", "git repos", "git dependency", "newest version", "modify package", "description add", "show", "purpose tags", "tags", "keyvalue", "16 16", "boolean ignore", "boolean do", "string source", "treat", "example make", "grep", "travis ci", "details npm", "localappdata", "tab completion", "bulk advisory", "sha256publickey", "endpoint", "quick audit", "set access", "that user", "scoped", "python", "description npm", "node javascript", "important npm", "introduction", "c code", "unix system", "integrity", "provide", "facilitate", "cli tool", "handling old", "lockfiles", "file format", "legacy", "urls", "spdx license", "most", "barney rubble", "specify", "github", "dependencies", "github urls", "node installer", "linux", "overview", "windows node", "prefixetcnpmrc", "variablename", "home", "comments", "peruser config", "global config", "builtin config", "auth", "cycles", "local install", "global install", "appdata", "below", "please note", "stage", "after", "life cycle", "runs after", "post scripts", "scripts", "slate", "synopsis so", "rf usrlocal", "modules", "with", "laf usrlocal", "l npm", "description all", "installing", "myorgmypackage", "requiring", "publishing", "private modules", "scopes", "apis", "auth related", "does", "package name", "aliases", "folders", "os equivalent", "tarballs", "teams", "orgs", "super admin", "team admins", "developer guide", "description so", "be explicit", "blank", "standard glob", "link packages", "syntax", "selectors", "querying", "log file", "location all", "log levels", "information", "headers", "logs", "alias", "certificate", "format", "docext", "content", "descriptions", "shorthands", "keyb", "print", "dir1", "manual", "input", "line", "process", "display help", "dirs", "get contents", "maxdepth", "contents", "u2665 bxe5r", "ud834udf06 baz", "single", "cssesc", "usage arborist", "commands", "options most", "npm install", "npm rm", "time", "silent", "fetch", "conf", "handler", "extract", "additional", "jackspeak", "jack", "glob v", "expand", "drive letter", "never", "true", "rob browning", "gnu library", "general", "public license", "license file", "future import", "adderror", "cdfq", "charles levert", "egrep", "egrepegrep", "fgrepfgrep", "grepgrep", "svr4 grepegrep", "times", "attributeerror", "fixcygwinid", "enhanced", "false try", "false assert", "tsns", "inetaddress", "none", "return value", "unixaddress", "localrepo", "httpserver", "valueerror", "resourcepath", "exception", "eoferror", "c version", "bytesio", "offset", "binary", "ascii", "baseversion", "commit", "throw", "in n", "send", "data end", "if 10", "copy", "send logoutn", "exitatoi", "tmplink", "lcallc binls", "varlogsetup rm", "sf tmp", "slackware", "system console", "entry", "ansi mode", "b007e", "slackware ftp", "cdrom", "miquel van", "smoorenburg", "okay", "minix", "fixme", "overwrite", "connect", "ssh connection", "subcmd", "bbupttywidth", "bupforcetty", "hashsplitter", "b options", "false def", "hack", "kbytesr", "srcpath", "tmptagfiles", "device", "tmpreply", "reply", "including", "but not", "quotesplit", "quoteerror", "not word", "split line", "mainselect", "tpxetcfstab", "select", "slackware linux", "varlogmount", "anything", "tmpswapmsg", "swappart", "ndir", "swaplist", "tmpsetswap", "linux swap", "swap space", "redir", "linux fdisk", "tmptmpscript", "eof fi", "instsets", "gnome", "tmpsetds", "tmpsetseries", "gnu emacs", "gnome desktop", "linux kernel", "k desktop", "uucp", "tmp fi", "tmpsettpx", "tpxetcshadow", "root password", "detected", "internet", "press", "linux native", "partitions", "tmpreturn", "nodes", "nextpartition", "rootdevice", "mtpt", "size", "formatting", "doformat", "main", "done", "sourcemedia", "tmpmedia", "source media", "selection", "slackware cd", "network file", "tmpsetreturn", "maketag", "choice", "mount", "tagext", "tmpsetnewtag", "tmpsettagmake", "sorry", "tmpsetkeymap", "mapname", "moorhead", "keyboard map", "us keyboard", "updown", "copying", "kernel chmod", "kernel rdev", "lilo", "fullerr", "tmpsettestfull", "partition full", "setup", "altf2", "slackware setup", "dospart", "newdir", "tmptempscript", "tmpsetdos", "partition", "ntfs", "doslist", "installscripts", "tpxproc", "atapi cd", "kerberos", "file transfer", "iana", "appletalk", "network", "control", "secure shell", "chat", "contact", "prospero", "outtag", "outshift", "if 30", "conn", "setmode", "dumb", "smart", "clienterror", "rather", "stopiteration", "firstexclusion", "appendcommit", "firstbranchitem", "filterbranch", "origtip", "oldnew", "remoterepo", "group", "prevpath", "sisdir import", "dangerous", "count", "subcount", "ioerror", "oserror", "gitmodetree", "gitmodefile", "gitmodesymlink", "stack", "nonlocal", "revision", "presdir", "admdirpackages", "warn", "tmprequiredlist", "trigger", "arch", "procscsiscsi", "luns", "scsi", "ax1b", "skript", "scsi bus", "kurt garloff", "gnu gpl", "ieee1394", "l found0", "nextrepoid", "repoid", "realpath", "usb keyboard", "d libmodules", "nousb", "procbususb a", "procbususb fi", "load input", "q input", "inet system", "hostname", "attach", "etcmotd", "newdisk", "scan", "slackkernel", "ram disk", "r sbp2", "r ieee1394", "firewire", "noieee1394", "q ieee1394", "attempt", "use f", "none def", "return password", "return none", "passwd", "nametopwdcache", "gidtogrpcache", "nametogrpcache", "tagfile", "prompt mode", "help software", "less", "removepkg", "gnu cc", "linux source", "pkgtool", "proccmdline", "termvt100", "termlinux", "homeroot lessmm", "ps1u", "home path", "display less", "term ps1", "kind", "branch", "period", "tmpsetfdisk", "minor elif", "smashedline", "l dev", "tmpsetfdisk fi", "probe", "mylex", "raid", "disksets", "packagedir", "blurb", "sourcedir", "tmptmpmsg", "tmptagfile", "media", "pcmcia", "umountcdrom", "o ro", "floppy", "pcmcia andor", "cardbus", "usedflopfalse", "libdir", "libdir exedir", "bcmd", "exedir", "openssl set", "packageversion", "versiongreater", "invert", "optdict", "intify", "limited to", "sockets layer", "argv", "normally", "shutwr", "sigexception", "demuxconn", "pipe import", "demultiplex", "openssl", "debug", "opensslversion", "static imported", "target openssl", "cmake", "shared imported", "fatalerror", "obex", "import", "stringio import", "obex service", "bdaddr channeln", "ascii character", "alength", "notfoundreturn", "use nis", "nis version", "name service", "switch config", "legal", "use dns", "domain name", "os2 boot", "os2 fdisk", "partition magic", "boot manager", "tcpip subsystem", "nfs install", "network support", "make", "sample file", "zip disk", "zip drive", "first scsi", "first ide", "atari", "solaris", "drive x", "zip100", "linkdir", "linkdir fi", "tmp directory", "asap", "linkdir tmp", "indexerror", "want", "midxversion", "wrapper", "multiple index", "filename", "desiredhwm", "domidx", "exitstack", "total", "option", "c option", "vmsize", "vmrss", "vmdata", "vmstk", "majflt", "september", "guess object", "longmatch", "raid device", "devrd", "devname", "concord", "applyerror", "metadata", "einval", "macos", "frozen", "fifo", "common code", "faildelay", "faillogenab", "logunkfailenab", "logoklogins", "lastlogenab", "mailcheckenab", "quotasenab", "syslogsuenab", "syslogsgenab", "console console", "ttywidth", "baseexception", "pythonpath", "pipe", "sigismember", "xdropaqueauth", "libcpvalloc", "rtld", "gnu c", "library", "free software", "foundation", "gnu lesser", "general public", "merchantability", "refs", "keyerror", "important", "carefully", "kwargs", "super", "true result", "priority", "pmsg", "crunch", "tmptempmsg", "localnetmask", "localipaddr", "upnrun", "ip address", "localgateway", "kversion", "eof dialog", "tmpmask", "localnetwork", "slackdevice", "fgrep", "ftp site", "tmpsetmount", "reboot machine", "tmpwhichdrv", "tmpsetmount cat", "select floppy", "drive", "tmptempmsg exit", "tmptempmsg mv", "tmpsourcedir", "drivefound", "cddvd", "rdir", "cddvd drive", "tmpsetcddev", "ide bus", "tmperrordo exit", "third", "login binsh", "l ttys0", "l ttys1", "x0 s", "reboot", "stuff", "bupdir", "iterhelper", "next", "none d", "indexhdr", "ixexists", "ixhashvalid", "ixshamissing", "indexsig", "entlen", "footersig", "tmpdir", "experimental", "bdupcache", "brestore", "bindex", "agulbra", "tcpip", "linux box", "hlinkdb", "verify", "maxpertree", "bupblobbits", "buptreeblobbits", "giterror", "mpicount", "bupnormal", "bupchunked", "refresh", "close", "dump", "dest", "commonargs", "ref dest", "pick", "btree", "missingobject", "bloom filter", "existingcount", "idxlivecount", "ram budget", "bupfs", "importerror", "fuse", "verbose", "fakemetadata", "fsdecode", "ptraceerror", "ptracesetregs", "cpu64bits", "ptraceattach", "ptracedetach", "ptracesyscall", "cpuwordsize", "runningbsd", "ext2", "proc proc", "commanderror", "optionerror", "lcctype", "iso88591", "localrepo repo", "sbine2fsck", "bfailed", "elif", "bcanary", "posix acls", "linux partition", "move", "pgdnspace", "olargefile", "onofollow", "xdev", "xdevxdev", "dirlist", "prepend", "cyan", "white", "blue", "dialog box", "yellow", "active button", "inactive button", "search box", "input box", "green", "excluderxs", "doit", "s seed", "this command", "is extremely", "dangerous n", "chunksize", "socket", "return hex", "supports python", "rethrow", "hostrs", "bnone", "bload", "branchpath", "snapshotroot", "snapshot", "tmpidx", "bashsource", "bashlineno", "int dryrun", "importing", "ux f", "sbinbrc", "eof binsync", "unmounting file", "devnull echo", "rest", "first assert", "existing", "restcount", "none path", "maxbloombits", "bloomversion", "maxbitseach", "discussion", "k4 k5", "k6 k7", "k8 k9", "rvatoi", "exitrv", "exit 1", "noblock", "sisdir", "sislnk", "writetree", "rawtreeitem", "splittreeitem", "metadataro", "meta", "builtmodulename", "dkms", "packagename", "autoinstall", "kernelrelease", "kbuild", "kerneluname", "implementation", "murmurhash3", "jens taylor", "gary court", "austin appleby", "typeof h", "later", "tls1", "fbtfr", "fbfr", "apache http", "fbefr", "fbhfr", "fbabfr", "http", "keepalive", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "runtime data", "ansi", "getprocaddress", "access type", "ck id", "observed ja3", "mitre att", "show technique", "suspicious", "hybrid", "click", "delphi", "strings", "malicious", "february", "middle", "exploit", "gameover", "hybrid analysis", "api key", "vetting process", "ck matrix", "accept", "memoryfile scan", "invalid octet", "falcon sandbox", "tmpp59thrck", "informative", "name tactics" ], "references": [ "itl-logo.txt", "empty.exe", "libnm.la", "libyara.la", "sunjava_map.xml", "lorem.txt", "stage2", "q\u00e9\u00d5?e\u00ac\u00d2\u00b6.\u000f\u001c\u00cc", "syslinux.cfg", "x.jnlp", "desktop.ini", "a.txt", "a.txt:ads.txt", "dir:ads.txt", "b.txt:ads.txt", "no_ads.txt", ".:ads.txt", "b.txt", "nm-shared.xml", ".zcompdump-m1904-5.9", ".zcompdump", "90-nm-thunderbolt.rules", "84-nm-drivers.rules", "85-nm-unmanaged.rules", "???? ????????.txt", "notes.txt", "notes.txt:ads", "nm-cloud-setup.timer", "NetworkManager-wait-online.service", "nm-cloud-setup.service", "nm-priv-helper.service", "NetworkManager-dispatcher.service", "NetworkManager.service", "NetworkManager-ovs.conf", "nm-pppd-plugin.la", "yara.pc", "libnm.pc", "preload.js", "LICENSE", "index.js", "range.bnf", "package.json", "README.md", "semver.js", "comparator.js", "range.js", "valid.js", "sort.js", "satisfies.js", "rsort.js", "rcompare.js", "prerelease.js", "patch.js", "neq.js", "minor.js", "major.js", "lt.js", "inc.js", "parse.js", "gt.js", "eq.js", "gte.js", "compare-loose.js", "compare.js", "clean.js", "cmp.js", "coerce.js", "compare-build.js", "diff.js", "lte.js", "parse-options.js", "identifiers.js", "debug.js", "constants.js", "re.js", "yallist.js", "iterator.js", "subset.js", "to-comparators.js", "outside.js", "min-version.js", "min-satisfying.js", "max-satisfying.js", "ltr.js", "simplify.js", "intersects.js", "gtr.js", "npmrc", "cli.js", "lifecycle-cmd.js", "cli-entry.js", "package-url-cmd.js", "base-command.js", "npm.js", "arborist-cmd.js", "whoami.js", "view.js", "version.js", "unstar.js", "update.js", "unpublish.js", "uninstall.js", "test.js", "team.js", "stop.js", "start.js", "token.js", "stars.js", "shrinkwrap.js", "set.js", "star.js", "sbom.js", "run-script.js", "root.js", "search.js", "repo.js", "restart.js", "rebuild.js", "publish.js", "prune.js", "prefix.js", "pkg.js", "ping.js", "pack.js", "query.js", "outdated.js", "org.js", "owner.js", "logout.js", "ls.js", "ll.js", "login.js", "link.js", "install-ci-test.js", "profile.js", "hook.js", "init.js", "install-test.js", "install.js", "help.js", "explore.js", "fund.js", "explain.js", "help-search.js", "get.js", "edit.js", "docs.js", "doctor.js", "dist-tag.js", "dedupe.js", "deprecate.js", "ci.js", "config.js", "completion.js", "bugs.js", "adduser.js", "exec.js", "audit.js", "access.js", "cache.js", "find-dupes.js", "validate-engines.js", "web-auth.js", "tar.js", "update-notifier.js", "sbom-cyclonedx.js", "replace-info.js", "read-user-info.js", "reify-output.js", "queryable.js", "timers.js", "validate-lockfile.js", "sbom-spdx.js", "otplease.js", "pulse-till-done.js", "log-shim.js", "log-file.js", "npm-usage.js", "get-identity.js", "format-bytes.js", "open-url-prompt.js", "explain-eresolve.js", "explain-dep.js", "exit-handler.js", "open-url.js", "did-you-mean.js", "completion.sh", "completion.fish", "cmd-list.js", "auth.js", "audit-error.js", "is-windows.js", "display.js", "reify-finish.js", "error-message.js", "format-search-stream.js", "installed-shallow.js", "installed-deep.js", "update-workspaces.js", "get-workspaces.js", "npm-view.md", "npm-version.md", "npm-uninstall.md", "npm-token.md", "npx.md", "npm-team.md", "npm-stop.md", "npm-unstar.md", "npm-start.md", "npm-star.md", "npm-test.md", "npm-shrinkwrap.md", "npm-stars.md", "npm-sbom.md", "npm-root.md", "npm-run-script.md", "npm-restart.md", "npm-rebuild.md", "npm-query.md", "npm-search.md", "npm-prune.md", "npm-publish.md", "npm-profile.md", "npm-repo.md", "npm-whoami.md", "npm-pkg.md", "npm-pack.md", "npm-ping.md", "npm-org.md", "npm-owner.md", "npm-prefix.md", "npm-login.md", "npm-logout.md", "npm-link.md", "npm-install-ci-test.md", "npm-install.md", "npm-init.md", "npm-update.md", "npm-help-search.md", "npm-hook.md", "npm-help.md", "npm-find-dupes.md", "npm-explore.md", "npm-unpublish.md", "npm-exec.md", "npm-ls.md", "npm-edit.md", "npm-doctor.md", "npm-fund.md", "npm-outdated.md", "npm-docs.md", "npm-dist-tag.md", "npm-config.md", "npm-diff.md", "npm-ci.md", "npm-cache.md", "npm-bugs.md", "npm-completion.md", "npm-audit.md", "npm-access.md", "npm.md", "npm-install-test.md", "npm-adduser.md", "npm-dedupe.md", "package-lock-json.md", "package-json.md", "npm-shrinkwrap-json.md", "install.md", "npmrc.md", "folders.md", "workspaces.md", "scripts.md", "removal.md", "scope.md", "registry.md", "package-spec.md", "orgs.md", "developers.md", "dependency-selectors.md", "logging.md", "config.md", "node-which", "mkdirp", "qrcode-terminal", "installed-package-contents", "cssesc", "color-support", "arborist", "pacote", "glob", "empty", "xstat (2).py", "zgrep", "xstat.py", "wtmp", "web.py", "vt300", "vt300 (2)", "vt100 (3)", "vt100", "vint.py", "version (2).py", "version.py", "vdecmd", "unmigrate (2).sh", "unmigrate.sh", "tick.py", "termcap (2)", "termcap", "tag.py", "syslinux (2).cfg", "syslog.conf", "syslog (2).conf", "styles.css", "stdcrt (2)", "std (2)", "stage2 (3)", "stage2 (2)", "std", "ssh.py", "source_info.py", "split.py", "slackinstall", "stdcrt", "shells", "shells (2)", "shquote.py", "shadow (2)", "shadow", "setup (2)", "SeTswap (2)", "SeTPKG (2)", "setup", "SeTswap", "SeTpasswd (2)", "SeTpasswd", "SeTnopart (2)", "SeTpartitions (2)", "SeTnopart", "SeTPKG", "SeTmedia (2)", "SeTpartitions", "SeTmedia", "SeTmaketag", "slackinstall (2)", "SeTkeymap (2)", "SeTmaketag (2)", "SeTkernel", "SeTfull (2)", "SeTkernel (2)", "SeTfull", "SeTfdHELP", "SeTfdHELP (2)", "SeTkeymap", "SeTDOS (2)", "SeTconfig (2)", "services (2)", "SeTDOS", "SeTconfig", "services", "sendcmd.rc", "securetty (2)", "securetty", "server.py", "rm.py", "restore.py", "rm (2).py", "save.py", "removepkg", "rescan-scsi-bus", "removepkg (2)", "README (2)", "README", "repo.py", "rc.usb", "rc.inet1", "rc.S", "rc.ieee1394", "random.py", "pwdgrp.py", "PROMPThelp (2)", "profile (2)", "prune_older.py", "profile", "probe (2)", "probe", "pkgtool", "pkgtool (2)", "pcmcia", "path.py", "passwd (2)", "passwd", "OpenSSLConfigVersion.cmake", "options.py", "PROMPThelp", "openssl.pc", "openmachine.rc", "on__server.py", "on.py", "OpenSSLConfig.cmake", "obexstress", "nsswitch (2).conf", "nsswitch.conf", "nopartHELP (2)", "nopartHELP", "networks (2)", "networks", "network", "mux.py", "mtools (2).conf", "mtools.conf", "mtab (2)", "mtab", "motd (2)", "motd", "modules.pcimap", "modules.pnpbiosmap", "modules.parportmap", "modules.usbmap", "modules.isapnpmap", "modules.ieee1394map", "modules.generic_string", "modules.dep", "migrate (2).sh", "migrate.sh", "midx.py", "midx (2).py", "meta.py", "memtest.py", "margin.py", "makedevs (2).sh", "makedevs.sh", "metadata.py", "ls (2).py", "ls.py", "login (2).defs", "main.py", "login.defs", "list_idx.py", "libssl.pc", "libnm-wwan.la", "libnm-ppp-plugin.la", "libnm-device-plugin-wwan.la", "libnm-device-plugin-wifi.la", "libnm-device-plugin-team.la", "libnm-device-plugin-bluetooth.la", "libnm-device-plugin-ovs.la", "libnm-device-plugin-adsl.la", "libcrypto.pc", "libc6-i386_2.31-0ubuntu6_amd64.url", "libc6-i386_2.31-0ubuntu6_amd64.info", "libc6-i386_2.30-4_amd64.url", "libc6-i386_2.31-0ubuntu6_amd64.symbols", "libc6-i386_2.30-4_amd64.info", "libc6-i386_2.30-4_amd64.symbols", "libc6-i386_2.30-0ubuntu2_amd64.url", "libc6-i386_2.30-0ubuntu2_amd64.info", "libc6-i386_2.30-0ubuntu2.1_amd64.url", "libc6-i386_2.30-0ubuntu2_amd64.symbols", "libc6-i386_2.30-0ubuntu2.1_amd64.info", "libc6-i386_2.29-0ubuntu2_amd64.url", "libc6-i386_2.29-0ubuntu2_amd64.symbols", "libc6-i386_2.29-0ubuntu2_amd64.info", "libc6-i386_2.28-10_amd64.url", "libc6-i386_2.28-10_amd64.info", "libc6-i386_2.28-10_amd64.symbols", "libc6-i386_2.28-0ubuntu1_amd64.symbols", "libc6-i386_2.28-0ubuntu1_amd64.info", "libc6-i386_2.27-3ubuntu1_amd64.url", "libc6-i386_2.27-3ubuntu1_amd64.symbols", "libc6-i386_2.28-0ubuntu1_amd64.url", "libc6-i386_2.27-3ubuntu1_amd64.info", "libc6-i386_2.26-0ubuntu2_amd64.url", "libc6-i386_2.26-0ubuntu2_amd64.info", "libc6-i386_2.26-0ubuntu2_amd64.symbols", "libc6-i386_2.26-0ubuntu2.1_amd64.url", "libc6-i386_2.26-0ubuntu2.1_amd64.info", "libc6-i386_2.24-11+deb9u4_amd64.url", "libc6-i386_2.30-0ubuntu2.1_amd64.symbols", "libc6-i386_2.26-0ubuntu2.1_amd64.symbols", "libc6-i386_2.24-9ubuntu2_amd64.symbols", "libc6-i386_2.24-11+deb9u4_amd64.symbols", "libc6-i386_2.24-9ubuntu2_amd64.url", "libc6-i386_2.24-9ubuntu2_amd64.info", "libc6-i386_2.24-9ubuntu2.2_amd64.url", "libc6-i386_2.24-9ubuntu2.2_amd64.symbols", "libc6-i386_2.24-9ubuntu2.2_amd64.info", "libc6-i386_2.24-3ubuntu2.2_amd64.url", "libc6-i386_2.24-3ubuntu2.2_amd64.info", "libc6-i386_2.24-3ubuntu2.2_amd64.symbols", "libc6-i386_2.24-3ubuntu1_amd64.url", "libc6-i386_2.23-0ubuntu11_amd64.url", "libc6-i386_2.24-3ubuntu1_amd64.symbols", "libc6-i386_2.24-3ubuntu1_amd64.info", "libc6-i386_2.23-0ubuntu11_amd64.symbols", "libc6-i386_2.23-0ubuntu11_amd64.info", "libc6-i386_2.23-0ubuntu10_amd64.url", "libc6-i386_2.23-0ubuntu10_amd64.symbols", "libc6-i386_2.23-0ubuntu10_amd64.info", "libc6-i386_2.23-0ubuntu3_amd64.symbols", "libc6-i386_2.23-0ubuntu3_amd64.info", "libc6-i386_2.21-0ubuntu4_amd64.url", "libc6-i386_2.23-0ubuntu3_amd64.url", "libc6-i386_2.21-0ubuntu4_amd64.info", "libc6-i386_2.21-0ubuntu4.3_amd64.url", "libc6-i386_2.21-0ubuntu4_amd64.symbols", "libc6-i386_2.21-0ubuntu4.3_amd64.info", "libc6-i386_2.19-18+deb8u10_amd64.url", "libc6-i386_2.19-18+deb8u10_amd64.symbols", "libc6-i386_2.19-18+deb8u10_amd64.info", "libc6-i386_2.19-10ubuntu2_amd64.url", "libc6-i386_2.19-10ubuntu2_amd64.symbols", "libc6-i386_2.21-0ubuntu4.3_amd64.symbols", "libc6-i386_2.19-10ubuntu2_amd64.info", "libc6-i386_2.19-10ubuntu2.3_amd64.symbols", "libc6-i386_2.24-11+deb9u4_amd64.info", "libc6-i386_2.19-0ubuntu6_amd64.url", "libc6-i386_2.19-10ubuntu2.3_amd64.url", "libc6-i386_2.19-10ubuntu2.3_amd64.info", "libc6-i386_2.19-0ubuntu6_amd64.info", "libc6-i386_2.19-0ubuntu6_amd64.symbols", "libc6-i386_2.19-0ubuntu6.15_amd64.info", "libc6-i386_2.19-0ubuntu6.15_amd64.url", "libc6-i386_2.19-0ubuntu6.15_amd64.symbols", "libc6-i386_2.17-93ubuntu4_amd64.url", "libc6-i386_2.17-93ubuntu4_amd64.info", "libc6-i386_2.17-0ubuntu5_amd64.url", "libc6-i386_2.17-93ubuntu4_amd64.symbols", "libc6-i386_2.17-0ubuntu5_amd64.info", "libc6-i386_2.17-0ubuntu5.1_amd64.url", "libc6-i386_2.17-0ubuntu5_amd64.symbols", "libc6-i386_2.17-0ubuntu5.1_amd64.symbols", "libc6-i386_2.17-0ubuntu5.1_amd64.info", "libc6-i386_2.15-0ubuntu20_amd64.url", "libc6-i386_2.15-0ubuntu20.2_amd64.url", "libc6-i386_2.15-0ubuntu20_amd64.symbols", "libc6-i386_2.15-0ubuntu20.2_amd64.info", "libc6-i386_2.15-0ubuntu20.2_amd64.symbols", "libc6-i386_2.15-0ubuntu10_amd64.info", "libc6-i386_2.15-0ubuntu10_amd64.url", "libc6-i386_2.15-0ubuntu20_amd64.info", "libc6-i386_2.15-0ubuntu10.18_amd64.url", "libc6-i386_2.15-0ubuntu10_amd64.symbols", "libc6-i386_2.15-0ubuntu10.18_amd64.info", "libc6-i386_2.13-20ubuntu5_amd64.url", "libc6-i386_2.13-20ubuntu5_amd64.info", "libc6-i386_2.13-20ubuntu5_amd64.symbols", "libc6-i386_2.13-20ubuntu5.3_amd64.url", "libc6-i386_2.13-20ubuntu5.3_amd64.info", "libc6-i386_2.13-20ubuntu5.2_amd64.url", "libc6-i386_2.13-20ubuntu5.3_amd64.symbols", "libc6-i386_2.15-0ubuntu10.18_amd64.symbols", "libc6-i386_2.13-20ubuntu5.2_amd64.info", "libc6-i386_2.13-0ubuntu13_amd64.url", "libc6-i386_2.13-0ubuntu13_amd64.info", "libc6-i386_2.13-20ubuntu5.2_amd64.symbols", "libc6-i386_2.13-0ubuntu13.2_amd64.url", "libc6-i386_2.13-0ubuntu13_amd64.symbols", "libc6-i386_2.12.1-0ubuntu10.4_amd64.url", "libc6-i386_2.13-0ubuntu13.2_amd64.info", "libc6-i386_2.12.1-0ubuntu10.4_amd64.info", "libc6-i386_2.13-0ubuntu13.2_amd64.symbols", "libc6-i386_2.12.1-0ubuntu6_amd64.info", "libc6-i386_2.11.1-0ubuntu7_amd64.url", "libc6-i386_2.12.1-0ubuntu6_amd64.symbols", "libc6-i386_2.12.1-0ubuntu10.4_amd64.symbols", "libc6-i386_2.12.1-0ubuntu6_amd64.url", "libc6-i386_2.11.1-0ubuntu7_amd64.info", "libc6-i386_2.11.1-0ubuntu7.21_amd64.info", "libc6-i386_2.11.1-0ubuntu7.21_amd64.symbols", "libc6-i386_2.11.1-0ubuntu7.12_amd64.url", "libc6-i386_2.11.1-0ubuntu7_amd64.symbols", "libc6-i386_2.11.1-0ubuntu7.11_amd64.url", "libc6-i386_2.11.1-0ubuntu7.21_amd64.url", "libc6-i386_2.11.1-0ubuntu7.12_amd64.symbols", "libc6-i386_2.11.1-0ubuntu7.11_amd64.info", "libc6-i386_2.11.1-0ubuntu7.11_amd64.symbols", "libc6-i386_2.10.1-0ubuntu19_amd64.url", "libc6-i386_2.10.1-0ubuntu19_amd64.info", "libc6-i386_2.10.1-0ubuntu19_amd64.symbols", "libc6-i386_2.10.1-0ubuntu15_amd64.info", "libc6-i386_2.10.1-0ubuntu15_amd64.symbols", "libc6-i386_2.11.1-0ubuntu7.12_amd64.info", "libc6-i386_2.9-4ubuntu6_amd64.url", "libc6-i386_2.9-4ubuntu6_amd64.info", "libc6-i386_2.9-4ubuntu6_amd64.symbols", "libc6-i386_2.10.1-0ubuntu15_amd64.url", "libc6-i386_2.9-4ubuntu6.3_amd64.info", "libc6-i386_2.8~20080505-0ubuntu9_amd64.url", "libc6-i386_2.9-4ubuntu6.3_amd64.symbols", "libc6-i386_2.9-4ubuntu6.3_amd64.url", "libc6-i386_2.8~20080505-0ubuntu9_amd64.info", "libc6-i386_2.8~20080505-0ubuntu7_amd64.url", "libc6-i386_2.7-10ubuntu8.3_amd64.url", "libc6-i386_2.8~20080505-0ubuntu7_amd64.info", "libc6-i386_2.7-10ubuntu8.3_amd64.info", "libc6-i386_2.7-10ubuntu3_amd64.url", "libc6-i386_2.8~20080505-0ubuntu7_amd64.symbols", "libc6-i386_2.7-10ubuntu3_amd64.symbols", "libc6-i386_2.7-10ubuntu3_amd64.info", "libc6-i386_2.6.1-1ubuntu10_amd64.url", "libc6-i386_2.6.1-1ubuntu10_amd64.symbols", "libc6-i386_2.6.1-1ubuntu10_amd64.info", "libc6-i386_2.7-10ubuntu8.3_amd64.symbols", "libc6-i386_2.6.1-1ubuntu9_amd64.url", "libc6-i386_2.6.1-1ubuntu9_amd64.info", "libc6-i386_2.6.1-1ubuntu9_amd64.symbols", "libc6-i386_2.5-0ubuntu14_amd64.symbols", "libc6-i386_2.5-0ubuntu14_amd64.info", "libc6-i386_2.4-1ubuntu12_amd64.url", "libc6-i386_2.4-1ubuntu12_amd64.symbols", "libc6-i386_2.4-1ubuntu12_amd64.info", "libc6-i386_2.8~20080505-0ubuntu9_amd64.symbols", "libc6-i386_2.4-1ubuntu12.3_amd64.url", "libc6-i386_2.4-1ubuntu12.3_amd64.info", "libc6-i386_2.5-0ubuntu14_amd64.url", "libc6-i386_2.3.6-0ubuntu20_amd64.url", "libc6-i386_2.3.6-0ubuntu20_amd64.symbols", "libc6-i386_2.3.6-0ubuntu20_amd64.info", "libc6-i386_2.3.6-0ubuntu20.6_amd64.url", "libc6-i386_2.3.6-0ubuntu20.6_amd64.info", "libc6-i386_2.3.6-0ubuntu20.6_amd64.symbols", "ldd", "libc6-i386_2.4-1ubuntu12.3_amd64.symbols", "ld.so (2).conf", "ld.so.conf", "join.py", "itl-logo (3).txt", "itl-logo (2).txt", "issue", "issue (2)", "io.py", "installpkg", "INSNFS (2)", "installpkg (2)", "INSNFS", "INShd", "INShd (2)", "INSfd (2)", "INSfd", "INSdir (2)", "INSdir", "INSCD", "INSCD (2)", "inittab (2)", "inittab", "init.py", "__init__ (2).py", "__init__.py", "index (2).py", "index.py", "import_duplicity.py", "hosts (2)", "hosts", "host (2).conf", "host.conf", "HOSTNAME", "hlinkdb.py", "help.py", "helpers.py", "HOSTNAME (2)", "hashsplit.py", "group (2)", "group", "gc (2).py", "git.py", "get.py", "gc.py", "fuse.py", "func.py", "fstab (2)", "fstab", "ftp.py", "fsck (2).ext2", "fsck (2).ext3", "fsck.ext3", "fsck.ext2", "fsck.py", "filesize", "features.py", "fdisk (2)", "fdisk", "FDhelp (2)", "FDhelp", "empty (3)", "empty (2)", "drecurse.py", "dialogrc", "dialogrc (2)", "disk2 (2)", "drecurse (2).py", "disk2", "damage.py", "daemon.py", "compat.py", "closemachine.rc", "checkout_info.py", "cfdisk (2)", "client.py", "cfdisk", "cat_file.py", "bup-import-rsnapshot", "bup-import-rdiff-backup", "brc (2)", "brc", "bloom (2).py", "bloom.py", "asyncrecv.rc", "90-nm-cloud-setup.sh", "vfs.py", "tree.py", "template-WaR2X6", "a1676298638", "a4033901479", ".X1-lock", ".X0-lock", ".X1024-lock", "b3336837578", "MozillaUpdateLock-7A4D7A8EFFB43502", "imurmurhash.min.js", ".X1025-lock", "murmur2", "b529967783", "empty.lock~", "ab.1", "https://hybrid-analysis.com/sample/babc94597eadb83b520d6a46a57ef2ad963683aef1ff2fc6fa9ba5e98e78e008/65fcd2b1519a5f86d60eed63", "https://hybrid-analysis.com/file-collection/6604df33503d4a306e01c776", "https://hybrid-analysis.com/sample/babc94597eadb83b520d6a46a57ef2ad963683aef1ff2fc6fa9ba5e98e78e008/6604e16b6b94878cbb062194", "https://hybrid-analysis.com/file-collection/6604df4bb797f028b4065601", "https://hybrid-analysis.com/sample/2eaba531c48445e241c116f61653649e403d4b1ef07bfc96390e986e1eeb5b83/6604e230edf88ab15b0d83fc", "https://hybrid-analysis.com/file-collection/66057525d9b81759df06c4b5", "https://hybrid-analysis.com/sample/d714e2a850645f9a0f8f3785dd0eedd47a417417bed470b968e0f6a1a2e746e6/652cf1f4243d9d03b90f74a1", "https://www.virustotal.com/gui/file/ea8490563a229b89f2b779217938f9eb2bcf93dd89de9f7fc5c035632f0934b5/relations" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1489", "name": "Service Stop", "display_name": "T1489 - Service Stop" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" }, { "id": "T1030", "name": "Data Transfer Size Limits", "display_name": "T1030 - Data Transfer Size Limits" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 36, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Merkd1904", "id": "196517", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 297, "email": 8, "hostname": 204, "URL": 382, "FileHash-SHA1": 7, "CVE": 2, "FileHash-MD5": 45, "FileHash-SHA256": 5 }, "indicator_count": 950, "is_author": false, "is_subscribing": null, "subscriber_count": 72, "modified_text": "765 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708ea5a3214f63e1d6d94f", "name": "lumen.me Honeybadger", "description": "", "modified": "2023-12-06T15:09:25.749000", "created": "2023-12-06T15:09:25.749000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 475, "hostname": 315, "domain": 233, "URL": 1133 }, "indicator_count": 2156, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708e2d7cb4228401888b63", "name": "possibly a central bank", "description": "", "modified": "2023-12-06T15:07:25.990000", "created": "2023-12-06T15:07:25.990000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 622, "domain": 2558, "URL": 4203, "hostname": 1221, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708e0d95a8c74cc715f7a2", "name": "West.cn", "description": "", "modified": "2023-12-06T15:06:53.350000", "created": "2023-12-06T15:06:53.350000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 208, "domain": 533, "hostname": 757, "URL": 1861, "FileHash-MD5": 1 }, "indicator_count": 3360, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c534aadf7adf4f27d77", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "", "modified": "2023-12-06T14:59:31.122000", "created": "2023-12-06T14:59:31.122000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 302, "domain": 634, "URL": 2988, "hostname": 1208 }, "indicator_count": 5132, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708beba2ba8bcfb1d10237", "name": "hostkey - Industroyer&ReduceRight", "description": "", "modified": "2023-12-06T14:57:47.430000", "created": "2023-12-06T14:57:47.430000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 304, "hostname": 563, "domain": 407, "URL": 1776, "FileHash-SHA1": 2 }, "indicator_count": 3052, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708bbc4c8bf557c17688e1", "name": "\u9ad8\u5c71tv,\u9ad8\u5c71tv,\u9ad8\u5c71tv\u5f71\u9662,\u9ad8\u5c71tv\u770b\u7247\u7f51", "description": "", "modified": "2023-12-06T14:57:00.280000", "created": "2023-12-06T14:57:00.280000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 233, "domain": 361, "hostname": 563, "URL": 1374, "FileHash-SHA1": 1, "FileHash-MD5": 1 }, "indicator_count": 2534, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708bae2f0c59d34f050b9e", "name": "Malware and bots", "description": "", "modified": "2023-12-06T14:56:46.779000", "created": "2023-12-06T14:56:46.779000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 168, "hostname": 427, "domain": 214, "URL": 1188, "FileHash-MD5": 1, "FileHash-SHA1": 1, "email": 1 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "628af7e3df399fbe9095245f", "name": "lumen.me Honeybadger", "description": "window.ju_sha256, a new type of code, is written by the same characters:var l,b,c,g,p,a,h,d, c.", "modified": "2022-06-21T00:01:09.886000", "created": "2022-05-23T02:56:35.154000", "tags": [ "reduceright", "lj", "number", "query", "string", "trackevent", "date", "u003e div", "simulator", "error", "regexp", "pageview", "path", "void", "code", "l420", "g5vs2ll0p80", "copyright", "json", "uint8array", "ssnull", "script", "closure library", "xdfunction", "adfunction", "typeof t", "typeof symbol", "typeof", "window", "value", "function", "customevent", "image", "null", "sbfu", "typeof n", "object", "array", "control", "other", "android", "x3e div", "gtmnwh4dh2", "host", "page title", "page path", "typeerror", "promise", "typeof e", "typeof window", "aggregateerror", "math", "target", "rangeerror", "buffer", "index", "attempt", "argument", "google", "link", "ad tech", "providers", "ffffff", "ip address", "combine", "accept", "save", "explorer", "cookie", "back", "iframe", "blank", "position", "juorderid", "justuno", "body", "juorigtop", "event", "follow", "post", "config", "click", "local", "fast", "comp", "form", "unknown", "push", "trcimpl", "trcwarn" ], "references": [ "https://cdn.taboola.com/scripts/cds-pips.js", "https://www.iubenda.com/cookie-solution/confs/js/53119375.js", "https://cdn.jst.ai/mwgt_4.1.js?v=5.28", "https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.38.0/core-en.js", "https://s.pinimg.com/ct/lib/main.32155010.js", "https://analytics.tiktok.com/i18n/pixel/config.js?sdkid=C3I4VUA8DUF9JOO44QC0&hostname=lumen.me", "https://js.pvd.to/c/v1/pixel-1sdz.js?t=1653350400000", "https://cdn.jst.ai/vck.js", "https://www.googletagmanager.com/gtm.js?id=GTM-NWH4DH2", "https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C3I4VUA8DUF9JOO44QC0&lib=ttq", "https://cdn.taboola.com/libtrc/unip/1262365/tfa.js", "https://s.pinimg.com/ct/core.js", "https://www.googleoptimize.com/optimize.js?id=OPT-TQC6JW4", "https://www.googletagmanager.com/gtag/js?id=G-5VS2LL0P80&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtm.js?id=GTM-PF3JNK2>m_auth=a6AgvzJ0SAOcyjADNwrdlQ>m_preview=env-1>m_cookies_win=x" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Lj", "display_name": "Lj", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1134, "hostname": 315, "domain": 233, "FileHash-SHA256": 475 }, "indicator_count": 2157, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "1441 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://ww38.ui.input.text.enter.item.name", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://ww38.ui.input.text.enter.item.name", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780329277.4521587 }