{ "type": "URL", "indicator": "https://www.iana.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://www.iana.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 2897618932, "indicator": "https://www.iana.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 19, "pulses": [ { "id": "69e49bea0264fa25070a3dad", "name": "20.42.65.92 - 172.16.10.101 clone dorkingbeauty1", "description": "", "modified": "2026-04-19T12:07:02.826000", "created": "2026-04-19T09:10:02.057000", "tags": [ "tls callback", "static parser", "000040fea7dbc370886d902adcd976e7c18703a9bba57409f4fcf1473a8f00f2", "20.42.65.92" ], "references": [ "000040fea7dbc370886d902adcd976e7c18703a9bba57409f4fcf1473a8f00f2" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "621ef2c06e9f5e7c4676d39d", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 434, "FileHash-SHA256": 1071, "URL": 1377, "domain": 135, "JA3": 1 }, "indicator_count": 3018, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "23 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b235439d56630943ea31e6", "name": "Clone by Q Vashti (excellent systemic analyzer I may add)", "description": "", "modified": "2026-04-10T22:04:28.607000", "created": "2026-03-12T03:38:43.171000", "tags": [ "\u9ed1\u6599", "\u5403\u74dc", "\u5403\u74dc\u7f51", "51\u5403\u74dc", "\u9ed1\u6599\u4e0d\u6253\u70ca", "\u9ed1\u6599\u5403\u74dc\u7f51", "\u70ed\u95e8\u5927\u74dc", "\u660e\u661f\u8d44\u8baf", "\u7f51\u7ea2\u9ed1\u6599", "\u5185\u6db5\u6bb5\u5b50", "\u4eca\u65e5\u5403\u74dc", "\u5403\u74dc\u65b0\u95fb", "\u9ed1\u6599\u66dd\u5149", "\u516b\u5366\u65b0\u95fb", "\u793e\u4f1a\u70ed\u70b9", "\u5403\u74dc\u7fa4\u4f17", "\u70ed\u70b9\u4e8b\u4ef6", "\u6bcf\u65e5\u5403\u74dc", "\u7f51\u7ea2\u5403\u74dc", "\u4eca\u65e5\u5927\u74dc", "\u5403\u74dc\u7206\u6599", "\u5403\u74dc\u4e2d\u5fc3", "\u4eca\u65e5\u70ed\u74dc", "\u5403\u74dc\u9ed1\u6599", "\u9ed1\u6599\u6cc4\u5bc6", "\u91cd\u78c5\u9ed1\u6599", "\u5403\u74dc\u6cc4\u5bc6", "\u4eca\u65e5\u9ed1\u6599", "\u6700\u65b0\u9ed1\u6599", "\u5403\u74dc\u66dd\u5149", "\u5403\u74dc\u8d44\u6e90", "\u91cd\u78c5\u5403\u74dc", "\u5a31\u4e50\u70ed\u74dc", "chrome", "cos ai", "a serif", "sans serif", "top10", "openclaw", "21200", "onlyfans", "strong", "dmca copyright", "address google", "safe browsing", "data upload", "extraction", "lte all", "enter sc", "type o", "extra", "referen https", "lte o", "type", "extr data", "include review", "exclude sugges", "failed", "hong kong", "passive dns", "otx logo", "all ipv4", "url analysis", "urls", "files", "location hong", "value", "march", "0x1595 function", "0x19b5 object", "tracker", "base64 object", "cookie function", "mlog", "localconst", "style function", "reverse dns", "general full", "url https", "resource", "software", "hash", "security tls", "singapore", "asn139341", "aceasap ace", "ip address", "cloudflare", "report", "whois", "as13335", "name lookup", "website", "kong", "ssl certificate", "http", "request chain", "nl redirected", "http redirect", "kb script", "protocol h3", "security quic", "seychelles", "asn13335", "cloudflarenet", "js function", "portable descr", "internet", "iana", "iana web", "stepgo limited", "assigned pa", "afrinic", "filtered parent", "ebene", "mahe", "stepgo", "united", "unknown ns", "script script", "moved", "record value", "title", "0 lte", "find s", "size", "mitre att", "ck id", "ck matrix", "root", "hybrid", "general", "path", "click", "strings", "yrbyd", "learn", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "initial access", "lalal.ai", "record type", "ttl value", "thumbprint", "ios ping", "defense evasion", "id name", "malicious", "t1055.015 list planting", "sha1", "copy md5", "sha256", "pattern match", "show technique", "unknown", "accept", "date", "local", "starfield", "encrypt", "iframe", "prometheus intelligence technology", "apple", "cyber attacks", "usptracker.com", "android" ], "references": [ "https://airline.cmntgoyq.com/ | Prometheus Intelligence Technology", "lalal.ai", "logstream-mystifying-tharp-7si72pw.cribl.cloud", "quantum-staging.emsbk.com", "spf.google.com", "Amazon.com", "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru", "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/", "api-cookie.click", "delete-me.bgs.beanie.cloud", "bridge-websocket-evolosciuc.devint01.goodleap.com", "https://bombing.gwuzafo.cc/", "test-ssa.pineapples.dev", "sso.dev.applemarketingtools.com", "containers-oceanus.palantirsec.com", "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14", "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com", "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject", "Will sort to identify malware", "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1048", "name": "Exfiltration Over Alternative Protocol", "display_name": "T1048 - Exfiltration Over Alternative Protocol" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1048.003", "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol", "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" } ], "industries": [], "TLP": "white", "cloned_from": "69b1f368db0d00947ef729c2", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4097, "domain": 849, "hostname": 2440, "FileHash-MD5": 149, "FileHash-SHA1": 131, "FileHash-SHA256": 955, "CIDR": 5, "email": 6, "SSLCertFingerprint": 8 }, "indicator_count": 8640, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "9 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b1f368db0d00947ef729c2", "name": "\u5403\u74dc\u770b\u9ed1\u6599\u5c31\u4e0a - \u9ed1\u6599\u5403\u74dc\u7f51 | \u70ed\u95e8\u4e8b\u4ef6\u7206\u6599\u4e0e\u771f\u76f8", "description": "Why is this type of malicious found on a US citizens device? Found in a link extracted from a glitching device.. Palantir\u2019s Prometheus Intelligence Technology tracking and AI at work.\n#tracker #http_redirect #onlyfans_? #bombing #airlines #lalal.ai #openclaw #targeted", "modified": "2026-04-10T22:04:28.607000", "created": "2026-03-11T22:57:44.584000", "tags": [ "\u9ed1\u6599", "\u5403\u74dc", "\u5403\u74dc\u7f51", "51\u5403\u74dc", "\u9ed1\u6599\u4e0d\u6253\u70ca", "\u9ed1\u6599\u5403\u74dc\u7f51", "\u70ed\u95e8\u5927\u74dc", "\u660e\u661f\u8d44\u8baf", "\u7f51\u7ea2\u9ed1\u6599", "\u5185\u6db5\u6bb5\u5b50", "\u4eca\u65e5\u5403\u74dc", "\u5403\u74dc\u65b0\u95fb", "\u9ed1\u6599\u66dd\u5149", "\u516b\u5366\u65b0\u95fb", "\u793e\u4f1a\u70ed\u70b9", "\u5403\u74dc\u7fa4\u4f17", "\u70ed\u70b9\u4e8b\u4ef6", "\u6bcf\u65e5\u5403\u74dc", "\u7f51\u7ea2\u5403\u74dc", "\u4eca\u65e5\u5927\u74dc", "\u5403\u74dc\u7206\u6599", "\u5403\u74dc\u4e2d\u5fc3", "\u4eca\u65e5\u70ed\u74dc", "\u5403\u74dc\u9ed1\u6599", "\u9ed1\u6599\u6cc4\u5bc6", "\u91cd\u78c5\u9ed1\u6599", "\u5403\u74dc\u6cc4\u5bc6", "\u4eca\u65e5\u9ed1\u6599", "\u6700\u65b0\u9ed1\u6599", "\u5403\u74dc\u66dd\u5149", "\u5403\u74dc\u8d44\u6e90", "\u91cd\u78c5\u5403\u74dc", "\u5a31\u4e50\u70ed\u74dc", "chrome", "cos ai", "a serif", "sans serif", "top10", "openclaw", "21200", "onlyfans", "strong", "dmca copyright", "address google", "safe browsing", "data upload", "extraction", "lte all", "enter sc", "type o", "extra", "referen https", "lte o", "type", "extr data", "include review", "exclude sugges", "failed", "hong kong", "passive dns", "otx logo", "all ipv4", "url analysis", "urls", "files", "location hong", "value", "march", "0x1595 function", "0x19b5 object", "tracker", "base64 object", "cookie function", "mlog", "localconst", "style function", "reverse dns", "general full", "url https", "resource", "software", "hash", "security tls", "singapore", "asn139341", "aceasap ace", "ip address", "cloudflare", "report", "whois", "as13335", "name lookup", "website", "kong", "ssl certificate", "http", "request chain", "nl redirected", "http redirect", "kb script", "protocol h3", "security quic", "seychelles", "asn13335", "cloudflarenet", "js function", "portable descr", "internet", "iana", "iana web", "stepgo limited", "assigned pa", "afrinic", "filtered parent", "ebene", "mahe", "stepgo", "united", "unknown ns", "script script", "moved", "record value", "title", "0 lte", "find s", "size", "mitre att", "ck id", "ck matrix", "root", "hybrid", "general", "path", "click", "strings", "yrbyd", "learn", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "initial access", "lalal.ai", "record type", "ttl value", "thumbprint", "ios ping", "defense evasion", "id name", "malicious", "t1055.015 list planting", "sha1", "copy md5", "sha256", "pattern match", "show technique", "unknown", "accept", "date", "local", "starfield", "encrypt", "iframe", "prometheus intelligence technology", "apple", "cyber attacks", "usptracker.com", "android" ], "references": [ "https://airline.cmntgoyq.com/ | Prometheus Intelligence Technology", "lalal.ai", "logstream-mystifying-tharp-7si72pw.cribl.cloud", "quantum-staging.emsbk.com", "spf.google.com", "Amazon.com", "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru", "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/", "api-cookie.click", "delete-me.bgs.beanie.cloud", "bridge-websocket-evolosciuc.devint01.goodleap.com", "https://bombing.gwuzafo.cc/", "test-ssa.pineapples.dev", "sso.dev.applemarketingtools.com", "containers-oceanus.palantirsec.com", "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14", "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com", "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject", "Will sort to identify malware", "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1048", "name": "Exfiltration Over Alternative Protocol", "display_name": "T1048 - Exfiltration Over Alternative Protocol" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1048.003", "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol", "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4097, "domain": 849, "hostname": 2440, "FileHash-MD5": 149, "FileHash-SHA1": 131, "FileHash-SHA256": 955, "CIDR": 5, "email": 6, "SSLCertFingerprint": 8 }, "indicator_count": 8640, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "9 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "684a93360163e8802e213158", "name": "ELF:Mirai AMAZON-02 - Autonomous System 65.0.0.0/14", "description": "ELF:Mirai-BHZ\\ [Trj]\t\n65.0.0.0/14\nAutonomous System Number\n16509\nAutonomous System Label\nAMAZON-02\nRelated to \u2022 103.252.236.26 | \n\u2022 sr2.reliedhosting.com | \n.\u2022 http://planitair.com/ |\n\u2022 bgptools-wildcard-confirmed.acemalibu.com | \n\u2022 https://www.anyxxxtube.net/search-porn/tsara-brashears/ | \t\t\t\n\u2022 static.ads-twitter.com\t\n\u2022 https://twitter.com/PORNO_SEXYBABES\t\n\u2022 analytics.twitter.com\n\u2022 appleupdate.org\n\u2022 apps.apple.com\n\u2022 pin.it |\n\u2022 https://pin.it/ |\n\u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian Critical issue. Cyber weaponry [Unclear] Stealth contractual US cyber defense entity, endless DGA\u2019s. India IP block.\nAdversary named by bupyeongop:\n\ubd80\ud3c9\uc624\ud53c \ucd9c\uc7a5\ub9c8\uc0ac\uc9c0\uc548\ub0b4.COM \ubd80\ud3c9OP (massage service?)\n*DoS with many OTX features", "modified": "2025-07-12T07:04:05.635000", "created": "2025-06-12T08:43:34.719000", "tags": [ "thumbprint", "apnic", "apnic whois", "database", "please", "arin whois", "north america", "caribbean", "africa", "internet", "iana", "address range", "cidr", "network name", "allocation type", "whois server", "algorithm", "v3 serial", "number", "cbe oglobalsign", "r6 alphassl", "validity", "subject public", "key info", "key algorithm", "key identifier", "link", "search", "united", "a domains", "ip address", "creation date", "record value", "date", "showing", "india unknown", "status", "passive dns", "ipv4 add", "pulse submit", "url analysis", "urls", "files", "location india", "india asn", "as133296 web", "dns resolutions" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "APNIC", "display_name": "APNIC", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 27, "domain": 2499, "hostname": 2651, "URL": 10986, "CIDR": 2, "FileHash-SHA256": 3596, "email": 1, "FileHash-MD5": 23, "CVE": 7 }, "indicator_count": 19792, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "282 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67f5555b6ce863d998e83e26", "name": "macOS Threat Infrastructure Leveraging Remote Agents via remotewd.com and rtmsprod.net", "description": "This pulse identifies an actively observed macOS-focused remote access infrastructure abusing trusted native Apple agents (ARDAgent.app, SSMenuAgent.app) and communicating with a distributed network of C2-like endpoints under domains such as remotewd.com, idsremoteurlconnectionagent.app, and rtmsprod.net.\n\nThe infrastructure is composed of dynamically generated subdomains \u2014 many in the form of device-.remotewd.com \u2014 indicative of automated deployment, system tracking, or per-host remote access configurations.\n\nAdditional indicators include HTTP/S URLs pointing directly to embedded binary paths within macOS agents, suggesting possible delivery vectors, staging, or persistence techniques.\n\nThis campaign shows signs of structured, programmatic targeting and is highly likely to be pre-operational infrastructure for wide-scale surveillance or access operations. All listed indicators should be considered high-risk. If observed in your environment, initiate a full forensic and IR process immediately.", "modified": "2025-05-11T19:03:59.885000", "created": "2025-04-08T16:56:59.641000", "tags": [ "generated from", "do not", "edit uri", "urls", "edit", "rewriteengine", "rewritecond", "rewriterule", "r301", "xml2encalias", "beralloct", "berbvarrayadd", "berbvarrayfree", "berbvdup", "berbvecadd", "berbvecfree", "berbvfree", "berdump", "berdup", "berdupbv", "laerrordomain", "laerrornoncekey", "lamechanismtree", "lacontext", "ladomainstate", "laenvironment", "lanotification", "laprivatekey", "lapublickey", "laright", "apple swift", "o librarylevel", "combine import", "foundation", "swift import", "mcpeerid", "mcsession", "property", "copyright", "protocol", "class", "bonjour", "ascii lowercase", "abc company", "section", "bonjour txt", "note", "ui element", "utf8 encoding", "nscopying", "nsdictionary", "nsstring", "mcextern", "attribute", "mcextern extern", "mcexternweak", "nsenum", "nsinteger", "mcerrorcode", "mcerrorunknown", "mcerrortimedout", "peer", "example", "bonjour apis", "stop", "tags", "session", "nsprogress", "nserror", "nsurl", "nsarray", "create", "nsuinteger", "notifies", "mcsession api", "interface", "dbictrace", "dbivporth", "dbictracelevel", "dbdtffoo", "dbihseterrchar", "dbicstate", "dbictraceflags", "provides macros", "dbi release", "only", "sqlsuccess", "odbc", "sqlok", "tim bunce", "england", "sql cli", "sql datatype", "sqlguid", "sqlwlongvarchar", "main", "beware", "sv sth", "sv dbh", "impsth", "impdbh", "sv keysv", "sv params", "sv attr", "sv attribs", "sv drh", "void", "fri jul", "mixed", "dbixsrevision", "plsvundef", "license", "spagain", "perlioprintf", "dbiclogpio", "putback", "ireland", "gnu general", "super", "magic", "dbicflags", "dbis", "svrv", "null", "imp2com", "dbicactivekids", "dbicfiadestroy", "sv h", "dbicdbistate", "code", "copy", "refer", "trace", "error", "unknown", "hookopcheckh", "startexternc", "hookopcheckcb", "userdata", "endexternc", "isinternalbuild", "kickmcxdforuid", "loadappkit", "ardconfig", "authenticator", "dsauthenticator", "dsnode", "dsrecord", "group", "hostconfig", "apfsvolumelock", "apfsvolumerole", "aoskgetosinfo", "aoskgetuserinfo", "aosaddappleid", "aosdisablepcs", "aosenablepcs", "aoslog", "aoslogforce", "aosrelaycookie", "didfailcallback", "kaosaccountkey", "kapcsbundle", "kapcspath", "kjsonextension", "apcsbucketid", "apcsreports", "apconfiguration", "apversiondata", "apversionhelper", "systemvolumesvm", "name size", "identifier", "gb disk0s3", "devdisk3", "apfs container", "scheme", "physical store", "macintosh hd", "apfs snapshot", "preboot", "refs address", "size wired", "name", "version", "uuid", "linked against", "renderer", "helper", "chrome helper", "contains", "cloud ui", "macintosh", "khtml", "gecko", "ui helper", "plugin", "service", "good", "battery power", "apfs encryption", "jumpcloud go", "chrome web", "store", "privacy badger", "flowcrypt", "encrypt gmail", "simple", "google", "b2b phone", "number", "apollo", "future", "exccrash", "sigkill", "code signature", "invalid", "sigabrt", "protonvpn", "excguard", "excbreakpoint", "sigtrap", "excbadaccess", "appl", "english", "adobe crash", "adobe", "acrobat dcadobe", "processor", "uninstaller", "assistant", "install", "cloud", "dock", "calendar", "music", "terminal", "tips", "installer", "updater", "proton", "tools", "stub", "python", "clock", "powershell", "team", "rave scout", "cookies", "public folder", "key cert", "sign", "crl sign", "root ca", "authority", "public primary", "global root", "verisign", "academic", "premium", "adaptive", "interactive", "background", "standard", "launchd sandbox", "s mdworker", "agent", "command line", "progress", "yubico", "macos13action", "disableoverride", "disableairdrop", "denyactivation", "enable", "loginwindowtext", "jumpcloud", "autoupdate", "loggingoption", "enablefirewall", "arm64e", "apple m2", "mac142", "kjqqtw7pqt", "daemon", "server", "open directory", "user", "account", "kerberos admin", "kerberos change", "device daemon", "network", "desktop", "screensaver", "bridge", "aesxtsarm", "aesecbarm", "sha512vngarmhw", "sha384vngarmhw", "sha256vngarm", "sha1vngarm", "darwin kernel", "wed mar", "wkarraycreate", "wkbooleancreate", "wkcontextcreate", "wkdatacreate", "wkdatagettypeid", "wkdoublecreate", "wkframecopyurl", "wkgettypeid", "wkimagecreate", "wkpagecandelete", "webview", "notice", "this software", "including", "but not", "limited to", "redistribution", "is provided", "by apple", "direct", "damage", "apiavailable", "webkit", "nsswiftname", "document", "a block", "as is", "hasinclude", "wkdownload", "abstract", "wkerrorcode", "wkerrorunknown", "discussion", "bool", "whether", "wkcontentworld", "wkwebview", "javascript", "nsunavailable", "vaargs", "nsswiftasync", "wkswiftasync", "wkcookiepolicy", "wkswiftuiactor", "nshttpcookie", "targetosiphone", "wknavigation", "decides", "boolean value", "apideprecated", "methodkind", "wkerrordomain", "wkscriptmessage", "promise", "fulfill", "const", "url scheme", "mark", "wkuserscript", "targetosvision", "param", "wkframeinfo", "targetosios", "pass", "window", "mime type", "link", "nsimage", "returns", "nsset", "checks", "matches", "a boolean", "defaults", "wkwebextension", "cgsize", "uiimage", "apis", "nsdate", "wkcontentmode", "wkextern", "possible", "cgfloat", "media", "cgrect", "apiunavailable", "framework", "nsswiftuiactor", "targetoswatch", "confirms", "apple upgrade", "nsstring user", "nsobject", "provider", "apple", "password", "uicontrol", "nscontrol", "asuseragerange", "check", "opaque user", "apple id", "initiate", "asauthorization", "operation", "state", "nserrorenum", "nsdata", "relying party", "asapiavailable", "perform", "realm", "http response", "authorization", "http", "oauth", "saml", "a byte", "nsdata userid", "relying", "a string", "nsdata readdata", "bool didwrite", "a cose", "nsdata first", "nsdata second", "nsstring name", "bool appid", "targetosxr", "nsstring appid", "bluetooth", "mdm profile", "nsurl url", "returns yes", "a state", "a json", "web token", "private seckeys", "enables", "keychain", "asswiftsendable", "cose algorithm", "ecdsa", "sha256", "cose curve", "p256", "nullable", "bool success", "remove", "call", "complete", "initializes", "time code", "extensions", "asextern extern", "asextern", "nsswiftsendable", "prepare", "list", "nsextension", "attempt", "nsstring label", "creates", "nsstring code", "a key", "webauthn", "nssecurecoding", "input", "output", "initialize", "nsinteger rank", "json", "inputs", "hash", "nsstring origin", "settings app", "extension", "https urls", "safari", "cancel", "nsuuid uuid", "r uftpexu", "nsmutabledata", "vnsdate", "mprcjy", "postfix", "domain", "canonical", "tables", "ldap", "post", "replace user", "address", "wietse venema", "bugs", "mail", "aliases", "postfix version", "restrict", "sample", "person", "basic system", "general", "reject empty", "postfix smtp", "ipv6 host", "reject", "reply", "access", "prior", "hold", "info", "mail delivery", "charset", "system", "report", "postfix dsn", "mail returned", "this", "generic", "smtp", "isp mail", "mime", "headerchecks", "readme files", "filters while", "posix", "empty", "body", "write", "date", "smtp server", "specify", "mx host", "unix password", "user unknown", "pathbin", "postfix queue", "unix", "cyrus", "path", "uucp", "shell", "local", "program", "agreement", "contributor", "recipient", "contribution", "the program", "corporation", "contributors", "product x", "as expressly", "arch", "arch x8664", "pipe wall", "wimplicit", "ranlib", "warn", "switch", "start", "systype", "outlook", "postfix master", "begin", "server admin", "mail backend", "modern smtp", "iana", "many", "postfix pipe", "recent cyrus", "amos gouaux", "old example", "or even", "lutz jaenicke", "technology", "cottbus", "germany", "openssl package", "openssl project", "europe", "remember that", "use of", "file", "update", "usrsbin", "file format", "no group", "daemondirectory", "deliver mail", "transport", "description", "result format", "virtual", "virtual alias", "redirect mail", "relocated", "matches user", "synopsis", "lastname", "firstname", "apple computer", "tcpip", "supported", "quantum", "facility", "level", "level info", "broadcast", "ignore", "rules", "sender", "automounter map", "use directory", "get home", "home autohome", "true", "t option", "mount", "force", "environment", "automountdenv", "promptcommand", "shellsessiondir", "histfile", "histfilesize", "myvar", "histtimeformat", "arrange", "bashrematch", "tell", "ps1h", "make bash", "s checkwinsize", "etcbashrc", "termprogram", "inpck", "nnnbaud", "berkeley", "parity", "pc entry", "pass8", "parenb istrip", "fixed speed", "entry", "clocal mode", "maxhistsize", "promptmode", "verbose end", "etcirbrcloaded", "default", "setup", "history file", "kernel", "readline", "jabber", "group database", "dovecot", "postfix scsd", "networkd", "searchpaths", "freebsd", "tmpdir", "fcodes", "prunepaths", "vartmp", "prunedirs", "filesystems", "nroff", "manpath", "uncomment", "manpager", "whatispager", "manlocale", "every", "manpath optman", "maybe", "troff", "status mailfrom", "returnpath via", "pidfile", "flags", "bcgjnuwz", "bin usrsbin", "sbin", "default pf", "care", "audio", "user database", "unix copy", "gate daemon", "bashno", "r etcbashrc", "rfc1323", "m1460", "macos x", "signature", "linux", "opera", "xp sp1", "windows sp1", "nmap syn", "m265", "synack", "mind", "macos", "warp", "ipv6", "internet", "icmp", "cisco", "monitoring", "argus", "chaos", "rsvp", "encapsulation", "aris", "isis", "netbootmount", "netbootshadow", "computername", "localonly", "localnetbootdir", "netboot", "define", "purpose", "networkonly", "waiting", "networkup", "term", "devnull", "common setup", "configure", "set command", "dns hostname", "dns query", "see also", "kame", "sunnet manager", "rpcsrc", "netlicense", "ftpd", "bindash binksh", "binsh bintcsh", "jumpcloud ldap", "smb2", "security", "workgroup", "standalone", "samba server", "enforce", "smb3", "example share", "improper use", "ctrlc", "none", "fax reception", "hardwired", "0007", "must", "visudo", "blocksize", "charset lang", "language lcall", "lines columns", "lscolors", "sshauthsock", "orion", "setup user", "home", "zdotdir", "delete", "beep", "vendor", "kf10", "kf11", "kf12", "kf13", "backspace", "insert", "resume", "termsessionid", "savehist", "sharehistory", "h do", "volume", "de l", "l uuid", "m tra", "n est", "suuid", "prfen", "fusion", "syst", "look", "executant", "alla", "over", "test", "overie", "zapis", "rapid", "disco usa", "de macos", "nie s", "i denne", "adgjmpsvx", "diskgthis disk", "01k8x j", "34disk", "levy kytt", "dict", "array", "plist", "apple root", "code signing", "inode64r", "xofkoxzh", "integer", "doctype", "brain", "abcd", "ogwo", "boaw", "cobwa", "uhawavauatsh", "ip bitmap", "foewdc", "could", "ip block", "funcs", "cogwo", "trash", "double", "hunt", "affa", "carr", "crypto", "docwbac", "q1b0", "q1 0", "h h5", "docwbag", "slice", "format", "zero", "alfa", "hera", "lelei", "hehe", "hisp", "fail", "katy", "zakk", "eodwcbgao", "hhk8di", "alma", "topo", "open", "huhk", "piper", "hehx", "eh ui", "h20hph", "hif h", "hmhhihqhyla hq", "r11b0", "target", "uus10u", "hifh", "loghookfailed", "loghook", "hell", "q1b 0", "f duh", "aqw1", "1160" ], "references": [ "index.html.en", "bind.html", "caching.html", "BUILDING", "configuring.html", "content-negotiation.html", "custom-error.html", "convenience.map", "LDAP.tbd", "lber.h", "ldap.h", "LocalAuthentication.tbd", "arm64e-apple-macos.swiftinterface", "x86_64-apple-ios-macabi.swiftinterface", "arm64e-apple-ios-macabi.swiftinterface", "x86_64-apple-macos.swiftinterface", "MultipeerConnectivity.tbd", "module.modulemap", "MCNearbyServiceAdvertiser.h", "MCPeerID.h", "MCError.h", "MCNearbyServiceBrowser.h", "MCAdvertiserAssistant.h", "MultipeerConnectivity.apinotes", "MultipeerConnectivity.h", "MCSession.h", "MCBrowserViewController.h", "dbivport.h", "dbi_sql.h", "dbd_xsh.h", "dbixs_rev.h", "Driver_xst.h", "DBIXS.h", "hook_op_check.h", "Admin.tbd", "AirPlayReceiver.tbd", "apfs_boot_mount.tbd", "AOSKit.tbd", "APConfigurationSystem.tbd", "AppleFirmwareUpdate.tbd", "launchdaemons.txt", "preboot_archive_errors.log", "mounts.txt", "launchagents.txt", "disk_structure.txt", "user_launchagents.txt", "security_status.txt", "kexts.txt", "process_list.txt", "battery.csv", "diskEncryption.csv", "chromeExtensions.csv", "crashes.csv", "interfaceAddrs.csv", "kernel.csv", "interfaceDetails.csv", "etcHosts.csv", "applications.csv", "mounts.csv", "sharedFolders.csv", "certificates.csv", "sharingPreferences.csv", "launchD.csv", "usbDevices.csv", "managedPolicies.csv", "systemInfo.csv", "users.csv", "sipConfig.csv", "systemControls.csv", "canonical", "aliases", "custom_header_checks", "access", "bounce.cf.default", "generic", "header_checks", "main.cf.default", "LICENSE", "makedefs.out", "main.cf", "master.cf.default", "main.cf.proto", "master.cf.proto", "master.cf", "TLS_LICENSE", "postfix-files", "transport", "virtual", "relocated", "afpovertcp.cfg", "asl.conf", "auto_home", "auto_master", "autofs.conf", "bashrc_Apple_Terminal", "com.apple.screensharing.agent.launchd", "bashrc", "command_args.json", "csh.cshrc", "csh.login", "find.codes", "csh.logout", "ftpusers", "gettytab", "irbrc", "kern_loader.conf", "group", "locate.rc", "man.conf", "mail.rc", "manpaths", "networks", "nfs.conf", "newsyslog.conf", "ntp_opendirectory.conf", "ntp.conf", "notify.conf", "paths", "pf.conf", "passwd", "profile", "pf.os", "protocols", "rc.netboot", "rc.common", "rmtab", "resolv.conf", "rtadvd.conf", "rpc", "shells", "smb.conf", "sudo_lecture", "ttys", "syslog.conf", "xtab", "sudoers", "zprofile", "zshrc", "zshrc_Apple_Terminal", "CodeResources", "version.plist", "Info.plist" ], "public": 1, "adversary": "DragonForce Malaysia Hacker Group", "targeted_countries": [], "malware_families": [ { "id": "Lastname", "display_name": "Lastname", "target": null }, { "id": "Firstname", "display_name": "Firstname", "target": null } ], "attack_ids": [ { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 66, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ilyailya", "id": "298851", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 4449, "domain": 3847, "URL": 14263, "FileHash-SHA256": 2356, "FileHash-MD5": 223, "FileHash-SHA1": 523, "email": 223, "CVE": 40, "CIDR": 12, "SSLCertFingerprint": 302 }, "indicator_count": 26238, "is_author": false, "is_subscribing": null, "subscriber_count": 35, "modified_text": "343 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67a801c7a6074eb73a688c51", "name": "#OpsBedil Targeted Attack: Malicious Windows Spyware VIM on OS", "description": "The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines; including: \nT1027 - Obfuscated Files or Information\nT1030 - Data Transfer Size Limits\nT1036 - Masquerading\nT1056 - Input Capture\nT1059 - Command and Scripting Interpreter\nT1070 - Indicator Removal on Host\nT1105 - Ingress Tool Transfer\nT1106 - Native API\nT1119 - Automated Collection\nT1134 - Access Token Manipulation\nT1140 - Deobfuscate/Decode Files or Information\nT1176 - Browser Extensions\nT1547 - Boot or Logon Autostart Execution", "modified": "2025-03-11T00:00:59.533000", "created": "2025-02-09T01:15:51.632000", "tags": [ "code", "range", "file offset", "ecxedi20xa", "edi0x6d", "ebp20x20", "esi0x67", "edx0x6f", "esi0x61", "ebp20x62", "hopper", "cve20072438", "normally", "use vim", "checkfile", "vimruntime", "checkdir", "vim project", "https", "bram moolenaar", "bram", "files", "silent", "insert mode", "down", "pumvisible", "vim script", "evim", "maintainer", "spellpopupmenu", "aunmenu", "tlunmenu", "loadbuffermenu", "revert", "difforig", "show", "ctrlu", "diffthis", "bail", "win32", "vim support", "remove", "comment", "genericname", "name", "keywords", "gvim", "edit", "zhcn", "editor", "metin", "rediger", "loadftplugin", "filetype", "expand", "amatch", "make", "sinsert", "middlemouse", "unix", "amiga", "mswindows", "loadindent", "end def", "visual mode", "shiftdel", "copy", "vim default", "selectmode", "insert", "load", "detectfiletype", "addoption", "optiong", "binoptiong", "optionl", "binoptionl", "header", "space", "python", "find", "open", "mark", "shell", "ruby", "install", "vim desktop", "substitute", "vunmenu", "paste", "script", "selectall", "word", "popup", "menu", "line", "close", "window", "back", "toolbar", "compiler", "next", "hack", "vimvimrc", "haiku", "openvms", "setsyn", "lang", "syntax menu", "description", "define", "setsyn function", "assembly", "maya", "bufnewfile", "bufread", "starsetf", "setf", "language", "visual basic", "xml au", "latex", "setfiletypesh", "endif", "lilo", "apache", "postscript", "rexx", "atom", "meta", "clipper", "desktop", "gift", "hercules", "julia", "mercurial", "pacman", "trigger", "puppet", "path", "powershell", "info", "ziggy", "speedup", "systemd", "form", "format", "calendar", "dracula", "config", "sfile", "esc", "iconv", "psflags", "if defined", "newitem force", "itemtype file", "iso88591 t", "utf8", "utf8 t", "iconvpath", "t iso88591", "makefile", "converted", "bob ware", "colorado school", "mines", "vim editor", "on your", "original copy", "please", "golden", "translation", "lesson", "enter", "type", "filename", "press", "normal mode", "repeat", "summary", "notice", "ruler", "test", "letzn", "mrkl", "zeil", "strg", "bewg nn", "end von", "druck", "dautticht", "zipf", "zaichen", "netty", "moveu el", "entrar", "premeu", "fitxer", "normal", "prova", "repetiu", "sumari", "desprs", "ara premeu", "cont", "ctrl", "ctrld", "append", "ctrlr", "ctrli", "shift", "backspace", "lekce", "napi", "dek oznaen", "normlnm mdu", "pesu", "stla", "soubor", "pesu kurzor", "opakuj", "toto", "lektion", "flyt", "skriv", "tryk p", "gentag", "bemrk", "filnavn", "nr der", "tryk", "zeile", "bewege den", "tippe", "zeichen", "cursor zu", "cursor zum", "kommandos", "cursor", "null", "tutor", "ctrlg", "shiftg", "shiftn", "msdos", "vimtutor", "capslock", "michael", "movu la", "leciono", "enenklavo", "kursoron al", "tajpu", "kursoron e", "testo", "premu", "dosiernomo", "resumo", "nova", "anon", "leccin", "mueva el", "intro", "pulse", "escriba", "para", "ahora", "insertar", "esto", "repita", "antes", "tenga", "como", "este", "leon", "tapez", "dplacez", "entre", "chap", "insertion", "puis tapez", "rptez", "appuyez", "lekcija", "otipkajte", "pritisnite", "ponovite", "kako bi", "insert mod", "prijeite", "saetak", "imedatoteke", "note", "windows", "yank", "mozgassuk", "fjlnv", "parancs", "lecke", "teszt", "j sort", "nyomja meg", "norml mdban", "ismtelje", "muovi il", "batti", "lezione", "invio", "premi", "ripeti i", "nomefile", "modalit normale", "adesso batti", "nota", "alla", "stata", "replace", "change", "subtitute", "school", "emiau", "spustelkite", "testas", "pirmj", "failovardas", "fail", "normalij", "santrauka", "ymeklis", "raid", "ramen", "tagad", "ievadiet", "piemram", "apkopojums", "lai izdzstu", "lai ievietotu", "ievadot", "ievrojiet", "js varat", "macos", "leksjon", "flytt", "trykk", "slette", "repeter", "erstatte", "sette", "kommandoen", "sett", "tips", "vise", "druk", "het commando", "herhaal de", "als je", "deze", "de cursor", "gebruik", "voeg", "bestandsnaam", "zorg", "mova", "digite", "teste", "agora", "pressione", "insero", "mais", "lekcja", "przenie kursor", "wcinij", "vima", "wpisz", "teraz", "powtarzaj", "nazwapliku", "uwaga", "jest", "dmesine", "ders", "ilk satra", "bu satrda", "normal kipe", "normal kipte", "daha fazla", "pomerite kursor", "otkucajte", "preite", "imefajla", "rezime lekcije", "za zamenu", "flytta", "filnamn", "normallge", "tryck", "om du", "sammanfattning", "genom", "lekcia", "presu kurzor", "presu", "napsanie", "zopakuj", "poznmka", "lcmessages", "lcall", "slovak tutor", "vim tutor", "amatria", "thevimproject", "slovak", "czech", "number", "motion", "ignore", "hjkl", "by gi", "di chuyn", "cu lnh", "u tin", "thay", "tntptin", "nu bn", "tng kt", "vim c", "lodi", "caps", "lock", "abc de", "command", "krishna", "spellerrors", "display dpy", "none", "false", "xfree", "sendinit", "isserialname", "staticspace", "xsync", "sendtovim", "main", "k command", "shell script", "vt100", "term vt100w", "dec locator", "vsnet", "tools", "external tools", "title", "arguments", "curline", "itempath", "init dir", "empty", "fbshtagsfp", "create", "options", "tags", "bourne shell", "perl", "fbkshfp korn", "tcl shell", "tk windowing", "parse", "new buffer", "buildcasetable", "printf", "buildwidthtable", "keys", "parsefoldprops", "parsewidthprops", "variabletags", "argv", "stephen riehm", "david woodfall", "getopt", "v include", "print version", "suppress", "reason", "file", "severity", "o ccfilter", "following", "this first", "ccfilter", "quickfix format", "though", "start", "john lange", "primitivem", "errorformat", "perl script", "executecore", "aerts", "sw developer", "sony telecom", "europe", "b1130 brussels", "belgium", "port", "host", "server", "vim channel", "chopen", "localhost8765", "json message", "linelength", "compilernames", "irix", "solaris", "hpux", "pablo ariel", "c compiler", "compilerqty", "usage", "project", "collector", "written", "ives aerts", "notes", "r decrement", "v verbose", "outputs", "o treat", "program", "q errorfile", "stdout", "copyright", "joerg ziefle", "perl w", "first", "maketag", "version", "exuberant ctags", "statement", "loop", "michael schaap", "support", "packagename", "look", "february", "push", "sgi mipspro", "error int", "error", "doit", "vim9 function", "nr2char", "c program", "vim quickfix", "awk script", "dec terminal", "make vim", "errors", "begin", "kirchgatterer", "opcodes syn", "addresses", "numbers", "types syn", "blocks syn", "strings syn", "program counter", "hilo byte", "quit", "todo todo", "aappythonscript", "python line", "python block", "blockline", "abap", "statement hi", "string hi", "structure", "vim abap", "abapr4", "marius piedallu", "james allwright", "april", "klmpqwvw", "comment hi", "type hi", "identifier hi", "constant let", "abel", "john cook", "johncook3", "a bunch", "todo xxx", "fixme", "c style", "abaqus", "carl osterwisch", "costerwi", "remark", "abaqus comment", "abaqus keyword", "include hi", "todo hi", "acedb model", "stewart morris", "thu apr", "syntax file", "acedb software", "xref syn", "rest", "preproc hi", "delimiter hi", "nikolai weibull", "include", "useroption", "options medium", "defaultprinter", "outputfirstline", "filecommand", "todo fixme", "martin krischik", "kind", "keyword", "mk bram", "standard", "character", "stype", "date", "vim syn", "altera ahdl", "x syn", "todo", "xnor syn", "specialchar hi", "builtin", "define hi", "builtin rect", "operator hi", "special hi", "dbus", "g3drop", "builtin dump", "builtin number", "builtin call", "redir", "stream", "screen", "function hi", "aflex", "lex syntax", "mathieu clabaut", "lastchange", "ada syntax", "aflex stuff", "patterns", "dominique pelle", "storageclass hi", "keyword let", "endlet", "htmlformat", "htmlcolor", "span", "htmlformatn", "foldcolumnbuild", "css1", "foldedid", "html", "generator", "fixme todo", "xxx note", "spell", "amigados", "campbell", "former url", "syntaxamiga", "krief david", "display drop", "beta cauchy", "irand224 syn", "normal poisson", "antlr4", "another tool", "yinzuo jiang", "jiangyinzuo", "july", "option value", "ben rubson", "hammers", "changelog", "option value1", "option", "value1", "david necas", "yeti", "base", "xxx not", "core", "antlr", "javacc parser", "azaz09", "parserend", "parserbegin", "token skip", "antsyntaxscript", "doug kearns", "zellner", "xmlcdatastart", "xmlcdataend", "xmltag", "xmlendtag", "ayer", "atch", "orkspace", "ngle", "rity", "mbol", "ffset", "istory", "osition", "xport", "stack", "tack", "digi", "flip", "shade", "cluster", "keyb", "arch", "moran", "ecode", "gnu arch", "source", "keyword hi", "simulate", "aptitude", "state", "yann amar", "quidame", "aptconf", "incomplete", "ebug", "autodetect", "fast", "marker", "score", "arduino", "hoff", "october", "license", "vim license", "arduino ide", "erik nomitch", "adam obeng", "artenterprise", "dorai sitaram", "ds26", "thilo six", "number hi", "edfghprs", "gnu assembler", "erik wognsen", "kdahlhaus", "kevin", "label hi", "macro hi", "title hi", "deprecated", "skip", "none hi", "claudio fleiner", "claudio", "end imports", "exports from", "implicitstags", "explicitstags", "absent present", "size universal", "strings", "aspperlscript", "perlscript", "aaron hope", "constant hi", "bwlsdxp", "macro", "specialchar", "error hi", "aspvbserror", "aspvbsfunction", "aspvbsmethods", "aspvbsstatement", "aspvbsnumber", "aspvbscript", "aspvbscomment", "aspvbs", "exits", "floating point", "asterisk", "tilghman lesher", "corydon76", "zonemessages", "atlas", "inaki saez", "jisaez", "flags bef", "orange syn", "containsasytodo", "asymptote", "avid seeker", "c syntax", "autodoc", "berg", "xml dl", "display", "contains", "borz", "kdpds", "oneline", "hotstring", "comspec", "hotkey", "reload", "common", "autoit", "soundplay", "autoit v3", "jared breland", "ping", "shutdown", "vim maintainers", "john williams", "action", "makefile syntax", "avenue", "arcview", "wagner", "esri", "string", "integer number", "operator syn", "xor mod", "hitachi h8300h", "xorc syn", "identifier let", "avr assembler", "avra", "avra home", "avra version", "marius ghita", "mhitza", "gawk ref", "functions syn", "awk ref", "effective awk", "programming", "keeps", "astro", "style", "fold", "enable", "astrojavascript", "htmlpreproc", "wuelner martnez", "html tag", "azaz", "ayaccuniongroup", "ayacc", "clusters", "aunis", "bash", "a formal", "method", "contributor", "csaba hoch", "undef", "defaultchar", "startstartfont", "bdfboundingbox", "containsbdftodo", "bibtex", "bernd feige", "ignore case", "xdata customa", "xref", "ams mref", "data", "basic", "quickbasic", "trim", "metacommands", "kill", "zonenumber", "bind zone", "mehnle", "slava gorbanev", "generates syn", "bcall", "vlado", "keywords syn", "string syn", "comment syn", "parent", "sulejman", "blank", "xspo", "bitbake", "chris larson", "kergoth", "daniel kho", "bsdl", "vhdl syntax", "tim pope", "vimnospam", "highlight", "imperfect", "bstnumber", "entry function", "integers macro", "bazel", "david barnett", "label", "digit", "john leo", "spetz", "boolean", "statuses", "bazaar", "dmitry vasiliev", "dima", "diff", "nospell", "synchronization", "baanerror", "selecteos", "updateerror", "d rows", "default", "selectempty", "selecterror", "updateempty", "union", "hooks", "normal hi", "case", "haskell cabal", "build file", "profunctor", "benchmark", "import", "cabalconfigpath", "cabal config", "original author", "cabalconfigkey", "false ghc", "cabal project", "true false", "cabalprojectnat", "boolean hi", "cparengroup", "cstringgroup", "ccommentgroup", "clabelgroup", "iso c99", "elifs", "ifndef", "ccppoutingroup", "optional", "accept", "public dtddecl", "entity catalog", "errormsg hi", "cdlcommentgroup", "raul segura", "acevedo", "xcheck", "childsname", "parentsname", "grpsdescription", "fixme xxx", "fullburn", "readdriver", "writedevice", "readdevice", "cfgcomment", "uncpath", "cfgstring", "cfgsection", "prischepoff", "on off", "yes no", "dos drive", "zhenyu", "documentation", "and fold", "operator", "punctuation", "transparent", "region and", "cfmlcorekeyword", "linden", "coldfusion", "skipwhite", "nextgroup", "cdrtoctrack", "cdtext", "performer", "silence", "zero", "softintegration", "cc interpreter", "declspec", "exception hi", "structure let", "built", "chaiscript", "jason turner", "lefticus", "escape", "web changes", "andreas scherer", "details", "cweb", "knuth", "silvio levy", "webcweb", "november", "haskell", "armin sander", "changelog file", "menesis", "vinschen", "june", "chatito", "observeroftime", "import syn", "intent syn", "slot syn", "cheetah", "max ischenko", "matches", "precondit hi", "evan hanson", "scheme", "chicken", "repository", "scheme syntax", "lighten", "heredocs", "cc syntax", "hse1", "chorus", "startofverse", "startofbridge", "startoftab", "startofabc", "startofly", "chordfont", "chill", "repeat hi", "avoid", "youngsang yoon", "image", "ccitt high", "this", "ember", "sifs0", "sinclude", "calendarinclude", "andrea callea", "chuck", "object event", "ugen array", "pieter van", "engelen", "arthur van", "leeuwen", "start syn", "int real", "char bool", "zamana", "flagship", "mario eusebio", "accept append", "blank from", "highlight value", "cmake", "comments", "match key", "cmakecachekey", "advanced", "highlight str", "stringstr", "nickspoons", "internal", "clever language", "clever", "multibase", "philip uren", "philuspax", "cmod", "cmodautodoc", "supports", "init init", "exit gcrecurse", "browser", "cocor", "shukla", "any characters", "context end", "from if", "nested pragmas", "to tokens", "cword", "fnameescape", "supplement", "must", "dgacfbe", "clojuretop", "arraychunk", "vecnode", "vecseq", "x00x7f", "partstart", "gondi", "inst", "etcdisktab", "acmsg", "acmsgtype", "hammesr", "yngve inntjore", "levinsen", "khym chanur", "james mccoy", "well", "anything", "conary recipe", "addallflags syn", "run automake", "makeinstall syn", "install copy", "move symlink", "link remove", "doc syn", "crm114", "modemsg hi", "imported", "target", "true", "interface", "quiet", "private", "write", "multi", "never", "unknown", "fatalerror", "sensitive", "android", "download", "guard", "exact", "locale", "trace", "alphabet", "john hoelzel", "hours days", "commands", "llll", "hminsmsusnsi", "ffll", "ken shan", "ccshan", "context", "synname", "startstartz", "endstopz1", "mptop", "luatop", "csccommentgroup", "if else", "endif elseif", "lev sy", "iallancestors", "curgen sy", "warningmsg hi", "essbase", "prior", "descendants", "cshell", "syntaxcsh", "variables", "luul", "csall", "srecord", "az09", "processes", "amsettimer", "sdlmatch", "default hi", "fdr input", "maxim kim", "habamax", "functions", "predefined term", "end predefined", "term variables", "century term", "csdl", "jacek artymiak", "c22032019", "call", "replacing", "comp", "recognize", "ascii", "existing syntax", "ctrlhbold", "ctrlh", "module level", "prop", "media", "cuda", "nvidia compute", "unified device", "architecture", "terriberry", "device global", "host managed", "shared syn", "restrict", "cupl simulation", "cupl syntax", "matt dunford", "sat nov", "statement let", "tex syntax", "cweb source", "cc material", "webincludedc", "double", "rc file", "dada", "dadas", "etant", "scen", "regel", "pero", "esquema", "tapi", "kada", "dados", "maka", "fono", "cupl", "valid integer", "signal", "phil derrick", "phild", "cynpp", "cynlib", "cynlib syntax", "posedge negedge", "changed syn", "instantiate", "out inst", "url http", "default cynscon", "standard syntax", "include debian", "match uri", "addremove", "byhash", "christopher", "dcod trts", "tnxt crlf", "labl syn", "cequ cneq", "cgte clte", "cbit clse", "dcomment", "jason", "pragma", "4857", "digital command", "sword", "mine", "conditional hi", "dart", "eugene pr3d4t0r", "ciurana", "former", "gerfried fuchs", "alpha", "rust", "datascript", "dscommentgroup", "comment let", "debcopyright", "orig author", "rob brady", "robb", "wu yongwei", "library stub", "code windows", "dos syn", "exports imports", "dep3 patch", "gabriel filion", "gabster", "specification", "authorfrom", "adminemail", "lockfile", "matthijs", "match", "ttext", "ccategory", "fflag", "llicense", "rock linux", "ren rebe", "spell syn", "lastline syn", "filter", "disablestrat", "s un", "r en", "jakson alves", "ansi sgr", "ansi sgr8", "jan larres", "term left", "black", "green", "contact", "charityware", "uganda", "entry", "block", "parasitic", "parameter", "devicemos", "rules", "device", "diva", "toby schaffer", "categories", "exectryexec", "unmounticon", "at wp", "chat", "django", "django template", "dave hodder", "dnsbind zone", "docbook sgml", "cest let", "docbook xml", "docbook", "devin weaver", "shlomi fish", "auto detect", "syntax xml", "sgml", "syntax sgml", "rory hunter", "json", "dockerfiles", "honza pokorny", "onbuilds", "from", "add arg", "cmd copy", "mike williams", "mrmrdubya", "windows nt", "msdosms windows", "mckee", "nima talebi", "hong xu", "sept", "keyword hilink", "hilink", "error hilink", "nargs hilink", "markus mottl", "enclosing", "scott bordelon", "wed apr", "cadence", "automation", "design rule", "checking", "layout", "schematic", "dsssl", "cest", "example", "xmlregionhook", "dtml", "dtml syntax", "zope", "markup language", "jordaan", "doxygenhtmltop", "synlink", "link", "syncolor", "strong", "reflink", "cpreprocgroup", "actions", "dtrace d", "d script", "solaris dynamic", "tracing guide", "nicolas weber", "nicolasweber", "first line", "probe", "turn", "entity", "matchgroupnone", "document type", "definition", "brabandt", "dune", "anton kochkov", "samuel hym", "simon cruanes", "kawahara satoru", "urkedal", "etienne millon", "dylan", "justus", "fri sep", "include let", "dylan library", "interface files", "brent fulgham", "bfulgham", "string let", "fulgham", "dnsmasqkeyword", "dnsmasqrange", "editorconfig", "anders", "edif version", "edif", "artem zankovich", "zartem", "5481988", "john beppu", "beppu", "ecd file", "embedix linux", "elm filter", "syntaxelmfilt", "elmfiltnumber", "brssow", "environments", "wraparound", "elinksnumber", "elinkscolor", "savingstylew", "imagelinksuffix", "homepage", "current void", "selse", "sthen", "eiffel", "joseph hager", "ajhager", "typedef hi", "lambda", "xxxx", "kresimir marzic", "oscar hellstrm", "oscar", "kornel", "syntax", "label highlight", "type highlight", "identifier", "george", "exec sql", "preproc let", "esterel", "luca necchi", "nikos andrikos", "esterel regions", "esterel types", "esterel comment", "identifiers", "euphoria", "builtins", "function", "reset", "should suffice", "etermgeneral", "d0xx", "mod5", "rubytop", "eruby", "erubysubtypezsw", "conventional", "text", "generated file", "david nev", "setup", "expect", "normal expect", "ralph jennings", "knowbudy", "user", "sysv", "bsd isms", "syntaxexports", "optset", "eviews", "vaidotas zemlys", "zemlys", "az4857", "assembler", "fasm", "ron aaron", "vim url", "fasm home", "fasm version", "xmm0 xmm1", "xmm2 xmm3", "dwayne bailey", "dwayne", "fdcc", "definitions", "iso tr", "unicode", "shell command", "output", "array", "fantom", "service", "bridle", "informix", "update", "abort abs", "absolute accept", "access acos", "add after", "allocate alter", "drop", "fishnext", "fishstatement", "fishterminator", "fishargument", "nicholas boyle", "flexwiki", "reilly", "home", "fuse", "modify", "table", "pascal makefile", "sections", "comments syn", "forth79", "forth83", "char", "forth83 syn", "body", "noname", "class", "local", "tung", "thu oct", "thomas reiter", "manipulation", "book", "document", "textfile", "apply", "formats", "popu", "crea", "modi", "memo", "defi", "disp", "dele", "appe", "repl", "proj", "alia", "cmon", "nvert", "mwin", "uniq", "blin", "carr", "story", "mult", "rator", "fortran", "ends", "cray", "ulllull", "stop", "fvwmm4", "mainsyntax", "fvwm2m4", "include m4", "include fvwm2", "fvwm1", "hss1", "general syn", "szsw", "check", "journal", "hold", "fvwm", "cursormove", "edgeresistance", "modulepath", "noborder", "windowlistskip", "backcolor", "sticky", "refresh", "buttons", "exclam", "slash", "gdmo", "iso101654", "guidelines", "managed object", "gyuman", "chester", "godot resource", "section syn", "ssss", "gdb command", "simon sobisch", "isplay", "unset", "linkurl", "gemtext markup", "suneel freimuth", "heading", "list", "quote", "heading special", "list statement", "godot", "bug hack", "gitdiff", "dddd", "endt", "commit", "question hi", "giftcef", "linenr hi", "giftceffw", "giftce", "conceal hi", "gedcom", "paul johnson", "december", "abbr addr", "adop adr1", "adr2 afn", "godot gdscript", "website", "pattern", "attribute syn", "macro syn", "gitcommitdiff", "your", "todo let", "crrw", "creator", "xexec", "syn match", "az4857 syn", "adam monsen", "opengl shading", "modified", "godoc", "title let", "gocommentgroup", "chan", "foldenable", "packagecomment", "integer hi", "todo regexp", "todos", "josh wainwright", "dot ja", "at gmail", "dot com", "karim belabas", "texstyle syntax", "todo syntax", "todd zullinger", "daniel kahn", "gillmor", "containsgpgtodo", "gprof output", "flat profile", "gretl", "gretl genr", "variable", "grads", "fronzek", "grid analysis", "display system", "grads scripting", "variables syn", "gnashkeyword", "gnashcomment", "gnashtodo", "solreadonly", "solsafedir", "john marshall", "jmarshall", "pedro alejandro", "lpezvalencia", "ddd0xx", "pager", "terminal", "chainloader", "groovytop", "exception", "groovy", "debug hi", "gtk theme", "packer", "conceal", "json syntax", "single", "trailing commas", "fixme note", "gnu server", "pages", "source html", "include java", "redefine", "argc argv", "begin begg", "end endg", "graph", "vim source", "matchlist", "vimsrcdir", "both", "getqflist", "cent", "kword", "c function", "small", "light", "vimcontinue", "endstr", "gensynvim", "vim9 syn", "vimexprlist", "magic", "hamlrubytop", "hamlcomponent", "hamltop", "haml", "hamlhtmltop", "david fishburn", "sun oct", "hamster classic", "hamster", "harepostfix", "hare", "vim syntax", "amelia clarke", "selene", "haredoc", "miscellaneous", "haste", "vlsi ic", "c preprocessor", "09afaf", "treat", "varid", "error let", "hbfilename", "hbhtmlstring", "hbhtmltagn", "hbhtmltag", "hbdirectivelib", "hbdirectiveset", "hbdirectiveout", "kkmmgg", "upstream", "a block", "szskkzes", "vim program", "restorer", "defunct", "aprl", "helplang", "intel hex", "sams ricahrd", "data digit", "folding data", "records", "record syn", "ignore hi", "vim help", "ident", "dana edwards", "danaedwards", "ic design", "preprocessor", "spacings", "resolutions", "ranges", "slhg", "hgcommitdiff", "sapling", "ken takata", "kentkt", "max coplan", "float hi", "hls playlist", "benot ryder", "comment line", "hogvar", "hogopnot", "hognumber", "hogipaddr", "hogcomment", "hogport", "hogoprange", "hogcomment syn", "hogstring", "bind", "elseif", "html template", "dennis", "htmltop", "htmljavascript", "onas", "htmlxml", "idem", "aria", "m4top", "htmlm4", "htmlos", "repeat syn", "aestiva", "jason rust", "jrust", "django html", "scomment", "i3configident", "i3configstrin", "i3configvalue", "focus", "i3configsh", "i3configstrvar", "i3configcommand", "i3configcolvar", "moving", "itanium", "parth malwankar", "pmalwankar", "file version", "masm syntax", "mark manning", "markem", "allan kelly", "ibasic file", "icewm menu", "james mahler", "fri apr", "icewm", "ids menu", "icon special", "icemenu", "data language", "ajelenak", "paren hi", "paren", "billshannon", "nlps", "npro", "graphics", "iconpregroup", "icon", "wendell turner", "prelude", "inbpc", "ddspe", "leaderscopy", "fontname", "badness", "elan ruusame", "shtop", "value", "args", "substituted", "macros", "ipfspecial", "ipftodo todo", "hendrik scholz", "hendrik", "openbsd pf", "ipfcomment", "xxx fixme", "donovan keohane", "syndisplay", "global", "verbextend", "double2", "snote", "david brgin", "dbuergin", "continuedoelse", "argv binpath", "cr crlf", "del debug", "eav empty", "inno setup", "my innosetup", "jason mills", "enterdisk syn", "sdsetuptype syn", "ifdef", "elif", "else", "cortopassi", "istoutspec", "peter meszaros", "pmeszaros", "istinpspec", "istcharacter", "istnumber", "istcomment", "jamcommentgroup", "jamparengroup", "ralf lemke", "xxx syn", "jargon file", "dan church", "label let", "javascript", "jls17", "see https", "javatop", "javadoctags", "javahtml", "tx0cr", "javamarkdown", "markdowninline", "jinja", "jinja template", "names syn", "standard jess", "jess", "paul baleme", "pbaleme", "jonas munsin", "xaxis yaxis", "x cross", "number let", "javacc", "java compiler", "javasoft", "vim compiler", "vito", "doc comment", "note xxx", "jspjava", "java server", "rgarciasuarez", "darren greaves", "patch", "thomas kimpton", "software", "eli parra", "json keywords", "jsonc", "izhak jakov", "izhak724", "acknowledgement", "kevin locke", "remove syntax", "json5", "mazunki hoksaas", "guten ye", "ywzhaifei", "syntax setup", "endz1", "kconfigconfigif", "abstract", "juliaexprsnodot", "regex", "naninf", "kdlnumber", "kdlnumber d", "aram drevekenin", "kotlin", "generated", "annotation syn", "kix2001 syn", "kixtart", "handle", "trap", "michael piefel", "entwurf", "cpp mode", "preproc", "error highlight", "storageclass", "delimiter", "sysvars", "false true", "kivy", "corey prophitt", "corey", "load python", "kivy language", "define kivy", "lace", "jocelyn fiat", "constants syn", "latte", "nick moffitt", "pre tag", "elsa", "glapagrossklag", "riley bruins", "ribru17", "keywords syntax", "sections memory", "overlay phdrs", "version include", "absolute addr", "names", "ldapconfcomment", "iso dialect", "modula2 dialect", "modula2 input", "styles", "error endif", "august", "pim dialect", "modula2", "longbitset", "procedure", "r10 dialect", "sto dos", "ldap ldif", "zak johnson", "zakj", "less", "jenoma", "todo optimize", "orce", "arset", "prox", "cache", "agent", "haskelltop", "lhstexcontainer", "ian lynagh", "tex markup", "bird style", "markdown style", "tex style", "lexccode", "user code", "flex", "van engelen", "patrick texier", "lifelines", "xref tag", "liquid", "liquidstatement", "yaml front", "matter", "liquidyamltop", "acdfmnrstuklp", "lilonumber hi", "number list", "niels horn", "lite", "liteinside", "lutz eymers", "ixtab", "email", "sql syntax", "errmsg", "livebook syntax", "lisplistcluster", "clisp ffi", "standard lisp", "keyword lispkey", "litestepdir", "litestep rc", "nethood", "winnt", "lotos", "is8807 syn", "specifications", "is8807", "daniel amyot", "damyot", "wed aug", "except", "logtalk", "logtalk entity", "term", "logic", "chfnauth", "chshauth", "createhome", "defaulthome", "lout", "report", "lambdaprolog", "teyjus", "vim version", "general", "lpccommentgroup", "lpcefungroup", "nodule", "lpcparengroup", "lpcpreprocgroup", "echo", "poet", "timo frenay", "timo", "labels syn", "lotusscript", "taryn east", "ultraedit", "textpad", "activateapp as", "base beep", "call case", "scott bigham", "colorterm", "luau", "marcus aurelius", "farias", "carlos augusto", "collapsebrtags", "lynx web", "lynx", "todo note", "uploader", "lyrics", "lrcnumber", "quake", "operators", "hascbackend", "pkg syn", "definelib syn", "definepgm syn", "importm3lib syn", "fleiner", "mainsyntaxm4", "mailquoteexps", "mail", "felix von", "leitner", "am est", "ascii character", "froms", "mallard", "jhradilek", "mallard markup", "draft", "skipnl", "roland hieber", "overrule", "ostype", "manconfcomment", "build", "suffix", "mason", "perltop", "hinrik rn", "sigursson", "pentium", "abgl", "ceopsz", "offset", "align", "floatingpoint", "vpmaxsq syn", "integer", "maple", "release", "focus master", "define syntax", "filename suffix", "segname segtype", "mtaddon", "matlab", "alex burka", "bbddeess", "all functions", "except keywords", "maxima", "robert dodier", "mermaid", "craig maceahern", "4857192255", "self", "accdescr", "click", "meson", "liam beguin", "zpetkovic", "disabler", "wikitop", "containshtmltag", "wikitableformat", "mediawiki", "yakov lerner", "rfc3339", "james vega", "melgroup", "maya extension", "robert minsk", "jason franklin", "sunghyun nam", "goweol", "mudunuri", "version info", "ctrlh syntax", "markdown", "matchstr", "metafont", "page", "latest revision", "magic point", "spam", "xfont vfont", "gero kuhlmann", "gero", "snmpv1", "snmpv2 mib", "martin smat", "msmat", "david pascoe", "pascoedj", "ax16", "donald knuth", "taocp", "mmix", "dirk hsken", "knuthstyle", "precondit endif", "pcimapfile", "parportmapfile", "model", "nil nil", "true syn", "symbols", "mmatop", "stub", "peter funk", "getdialect", "timo pedersen", "dat97tpe", "whitespace", "any array", "mookeyword", "dilnt", "multiplication", "mojonumber", "mojo", "stuff", "monk", "seebeyond", "mike litherland", "dirk van", "deun", "metapost", "manual", "autosync", "dumpvideo", "loadidx", "rawvideo", "tsprog", "color", "tabtitle", "am cdt", "pm est", "dummy", "ms message", "kwl7", "common ms", "messages", "ms idl", "vadim zeitlin", "vadim", "msql", "env variables", "inlclude", "modsim iii", "philipp jocham", "march", "actid all", "and as", "murphi model", "diego ongaro", "integers", "nspemit", "switch", "mushcode syntax", "rick bird", "clock", "dbck", "dump", "hook", "motd", "notify", "nuke", "restart", "snoop", "stats", "teleport", "attributes", "prettyprint", "libpath", "promylibdir", "attributes syn", "mupad source", "dave silvia", "dsilvia", "ymwd", "cciskaf", "float", "mysql", "pronovici", "encrypt", "namednotnumber", "nick hibma", "location", "marcin", "chaos", "dmap", "modules", "control section", "nastran", "tom kowalski", "any integer", "n1ql", "eugene ciurana", "merge syn", "nest syn", "pr3d4t0r", "vim command", "natural", "nasm", "iend", "movs", "time", "interval", "size", "directory cache", "cache buffers", "minimum file", "count", "daylight", "miner", "keith smiley", "login", "netrwtreegroup", "diffchange hi", "netrw listing", "toplevel", "readtoken", "nixexpr", "daiderd jordan", "daiderd", "region match", "bufenter", "syntax event", "synset", "checked", "muttvars", "neomutt", "bounce", "nsisanyopt", "statements", "nsis", "music", "rcx2", "scout syn", "rcx2 syn", "nqcparengroup", "rcx syn", "nqccommentgroup", "modes", "scout", "stefan", "module", "nginx module", "nginx", "http", "gost", "comet", "speed", "sphinx", "curv", "mtllibs", "exmaintainer", "anthony hodsdon", "objc syntax", "odin", "ms44", "and or", "occamnumber", "group", "omnimark", "paul terray", "mailto", "activate again", "catch clear", "close copy", "ocamltypeexpr", "ocamlallerrs", "jon parise", "ondirshell", "operator let", "objc type", "smes12", "qualifiers", "smes7", "smes19", "preparation", "protected", "structure hi", "openscad", "niklas adam", "luis moreno", "abort all", "alter and", "any as", "asc at", "oplstatement", "oplnumber", "open psion", "epoc16epoc32", "af09", "openvpn", "openvpnnumber", "openvpnsignal", "hupinttermuser", "containstop", "keepend", "eval", "menumode", "endurance", "blade", "illusion", "sneak", "onload", "disablemouse", "getclass", "notes todo", "containsallbut", "spells", "ronan pigott", "ronan", "alpm", "tcpip", "gclckprocs syn", "oracle config", "sandor kopanyi", "oraall", "protocol syn", "bequeath syn", "latest change", "haochen tong", "withconceal", "inlinecode", "super", "pappperl", "papphtml", "cdata", "perlinterpdq", "marc lehmann", "perlexpr", "config file", "lennart schultz", "string keywords", "protobuf text", "lakshay garg", "crgut", "tim chase", "austin", "pcctsinrule", "cpptoplevel", "pccts", "nextstep syn", "openbsd packet", "lauri tirkkonen", "sloadsanchor", "phtml", "perlinterpsq", "perlinterpmatch", "perlinterpslash", "perldata", "portb syn", "intcon syn", "gie eeie", "t0ie inte", "rbie t0if", "intf rbif", "microchip", "pdfxml", "nrtbf", "font", "palm os", "schau", "font id", "beware", "data syn", "postfix", "kelemen peter", "peter", "kelemen", "anton shestakov", "pikestmt", "pikebadgroup", "pike", "pine", "thu feb", "macro let", "httpviewer", "infopath", "longmanuallinks", "filter0xb7", "plaintexmath", "glue", "acute", "cdhoopstuvijll", "rrowvert", "skewsqrt", "mega", "phpinnerhtmltop", "phpclfunction", "phpcltop", "refer", "cphil", "number support", "c language", "does", "address and", "dword", "juerd", "plpperl", "plpend syn", "counter syn", "pl1commentgroup", "pl1parengroup", "declare dcl", "procedure proc", "loops", "podformat", "ibsclfx", "perl pod", "poe item", "show hide", "minimal", "address", "obsolete", "openclose", "bjoern jacke", "bjacke", "povray", "syntax syn", "off true", "false yes", "ppwizard", "dennis bareis", "ppwizargval", "constants", "plsqlparengroup", "oracle", "plsql", "klaus muth", "klaus", "altf amcr", "arc asfn", "astk barc", "blk box", "call syn", "cass cir", "melchior franz", "mfranz", "sonia heimann", "todo tbd", "privoxy", "prolog", "promela", "mon oct", "thu aug", "promela types", "class linking", "ps ll3", "dsc comment", "device gstate", "ps level", "postscrstring", "escaped", "matrix", "courier", "buffers", "redistributions", "this software", "including", "but not", "limited to", "pbcommentgrp", "google", "az09az", "posix", "rex barzee", "rexbarzee", "aclqrv", "a af", "ag ax", "e ef", "eg ex", "certain", "ps1comment", "purify header", "informational", "warning", "corrupting", "fatal", "haakon riiser", "hakonrk", "c syn", "pypa", "commands syn", "globs", "line break", "pyrex", "marco barisione", "python syntax", "olor", "chars", "progress", "ation", "progressdebug", "progressnumber", "edure", "progresstodo", "eter", "daniel", "sage", "widget", "rage", "python library", "reference", "quarto", "aquino", "vim runtime", "quickfix", "directory hi", "hee1", "lookdown lookup", "quakeoctalerror", "quake12command", "noprefix", "console", "onoff", "qb64", "z2z1", "qmlexpr", "radiance scene", "georg mischler", "radiance", "greg ward", "surface", "raccruby", "rule", "racc input", "dobie", "xdobie", "handling", "vector", "types syntax", "raml", "restful api", "hopkins", "rofi advanced", "pierguill", "common rc", "resource", "heiko erhardt", "language syn", "bitmap icon", "cursor cursor", "cmash", "ratpoison", "magnus woldrich", "djkea2", "bulls eye", "force control", "number syn", "rapid", "azazxc0xff", "azazxc0xff09", "rakuinterpqq", "rakuregexen", "rakuregexp5", "rcs log", "joe karthauser", "rcs file", "revision", "yyyy", "rebol", "yer todo", "words syn", "view", "view tabs", "spaces", "vicharsearch", "viprevword", "viendword", "visearchagain", "vinextword", "registry key", "registry export", "ulitin", "head", "regedit4", "win9", "bytes", "paths", "xxx bug", "davide alberani", "remind", "ben orchard", "rem omit", "mit license", "raimon49", "permission", "software is", "resolvipcluster", "ipv6 support", "09azaz", "radu dineiu", "hidesymbol", "r help", "r code", "epsilon", "kappa", "slabelsk", "over", "relax ng", "containsrnctodo", "rnoweb", "highlighting", "rnowebr", "ranke", "ferraz pereira", "rosa", "extension", "bytestream", "andrew bromage", "frameend", "worldbegin", "worldend", "attributebegin", "attributeend", "todo improve", "handles", "todo are", "redif", "axel castellane", "templatetype", "and add", "alex zvoleff", "configuration", "r syntax", "syntaxrpcgen", "mikrotik", "cidr notation", "cycle", "exit", "catch", "rpl2", "rmdlatex", "yaml header", "highlight code", "rmdr", "text format", "rich text", "control words", "new control", "rstcruft", "salt state", "jinja runtime", "star", "disallow syn", "disallow", "samba", "new maintainer", "ntlmv2 syn", "synfold", "rubymodifier", "sasbasicsyntax", "add syntax", "sasgraph", "yrdif yyq", "template", "mixin", "extend", "return", "steven dobay", "stevendobay", "sather", "science", "institute", "dede", "scilab", "benoit hamelin", "containedgroup", "preproc syn", "aclchg", "acldel", "aclgrp", "aclumask", "lockscreen", "zombie", "scss", "puria nafisi", "azizi", "always", "ip adresses", "verify", "synopsys design", "constraints", "tcl vim", "thu mar", "tcl syntax", "tcl extension", "xor syn", "task else", "nextstate syn", "in out", "with from", "ebcdic", "closedelay", "txtrigger", "spdnormal", "portd", "comment hilink", "sexplib", "atoms syn", "lists", "clst", "sgml charset", "capacity scope", "features", "baseset descset", "simple", "shfoldheredoc", "shfoldifdofor", "shlooplist", "shfunctionlist", "shidlist", "shecholist", "shcaselist", "shdblquotelist", "provides", "sgml specific", "space crlf", "dquote syn", "percent", "mp luacall", "alephversion", "uchar", "udelimiterunder", "umathchardef", "umathruleheight", "umathstackvgap", "umathxscale", "uoverwithdelims", "hai tp", "bestanden", "hanya dalam", "fiierele", "tp tin", "aemacron amstex", "aacute", "abrevehook", "afterpar", "agrave ahook", "amstex amacron", "atilde", "beforepar beta", "bigm", "delta", "oldstable", "experimental", "bullseye", "trixie", "forky", "focal", "jammy", "devel", "buzz", "maverick", "keyword syntax", "typescriptvalue", "title syntax", "typescripttype", "blabla", "sicad", "zbranyiczky", "irpt", "irptl", "mes1", "swift project", "simula", "simula syn", "keyword end", "when", "nagle", "main url", "comparison", "load sinda", "on si", "off eng", "sieve", "skill", "nsqn", "dirfile", "pnamestring", "pathversion", "schemeskill", "afterbefore", "tolist", "renderman", "dan piponi", "specialkey hi", "headers", "nontext hi", "jan hlavacek", "xuserblock", "for loop", "userblock", "null syn", "tracedrop", "daheartbeat", "slpregcomment", "spi file", "private public", "slrn score", "preben peppe", "guldberg", "age bytes", "syntaxsm", "smarty", "mon nov", "constant", "slice", "zeroc", "morel bodin", "smcl", "stata markup", "jeff pitblado", "jpitblado", "statasmcl", "directive", "smith", "smil", "herve foucher", "smil boston", "animation syn", "smlallerrs", "smlaenoparen", "fabrizio zeno", "cornelli", "zeno", "snns network", "snns http", "lln lun", "toff soff", "ctype syn", "snns", "maximum", "maximum output", "stringcomment", "initvalvalstr", "mono", "snobol4", "rafal sulejman", "site", "csnobol", "parens", "cothi", "afpnumkg", "spice circuit", "noam halevy", "insensitive syn", "spice", "splintallstuff", "splintannotelem", "ralf wildenhues", "splint home", "c code", "purpose", "buildinstall", "linux rpm", "freund", "ormeir", "wed oct", "spyce", "rimon barr", "rimon", "spupordinary", "input output", "spuptextproc", "type stream", "bugs", "execution", "snns result", "fishburn", "thu sep", "sqloracle", "buffer", "sqlforms", "austin ziegler", "prev change", "todo find", "xpos", "java syntax", "sqlj", "sap hana", "upper case", "upper", "schema syn", "user syn", "memory database", "sql syn", "spl syn", "comment syntax", "query language", "adaptive server", "anywhere", "xpscanf syn", "methods syn", "starea syn", "stcentroid syn", "stperimeter syn", "paul moore", "oracle nquote", "diffadd hi", "diffchange let", "section", "query report", "writer", "nathan stratton", "treadway", "jeff lanzarotta", "squid", "thanksto", "ilya sher", "iso8601", "subrip", "range syn", "ddd skipwhite", "bold", "sections syn", "override", "smalltalk", "arndt hesse", "hesse", "openssh client", "jakub jelen", "jakuje", "dominik fischer", "openssh server", "conditional", "repeats", "types", "globals", "statafuncgroup", "statamacrogroup", "stataparengroup", "rmcoll syn", "invftail", "invibeta", "haseprop", "mata", "structurizr dsl", "venthur", "hsiaoming yang", "lepture", "marc harter", "sudoersuser", "lazy", "generic", "swig", "julien marrec", "apache license", "runtime library", "vim maintainer", "emir sari", "nowarn", "i3confignumvar", "endze", "josef litos", "james eapen", "nargs syncolor", "nargs synlink", "syncolor type", "syncolor ignore", "syncolor added", "preproc synlink", "type synlink", "special synlink", "budden", "ingo karkat", "myk taylor", "install syntax", "syntax au", "systemverilog", "verilog syntax", "tads", "amir karger", "karger", "history info", "syntaxtags", "tak2", "tak3", "tak2000", "tak compare", "tak output", "load tak", "tar listing", "type let", "john florian", "wed jul", "key names", "values", "characters", "uuids syn", "rufus cable", "verbose tap", "rufus", "tap output", "pass", "foolman", "cmovsetj", "borland", "united force", "vector graphics", "verbose", "known template", "xfire user", "tcshvarlist", "tcsh", "gautam iyer", "ttlconstant", "term language", "tera term", "kcpy kcrt", "eenlrtbfs", "xhp xhpa", "xt xenl", "msgr", "tclspecialc", "tcltk", "taylor venable", "taylor", "system", "geometry", "tss syn", "typescript", "kao weiko", "jose elera", "campana", "zhao yi", "scott shattuck", "irc channel", "freenode", "vim filetype", "andy lester", "tt2topcluster", "typescriptreact", "react", "strpart", "include perl", "rawperl", "moriki", "atsushi", "ucnumber", "unrealscript", "openwrt unified", "colin caine", "fancy", "normal let", "typstcode", "matchgroupnoise", "noise highlight", "hashtag", "typstmarkup", "noise", "motif uil", "user interface", "thomas koehler", "september", "import hi", "anton", "prunefs", "prunenames", "prunepaths", "prunebindmounts", "upstart", "upstart job", "michael biebl", "biebl", "james hunt", "archivebit syn", "datelimit syn", "daysold syn", "deleted syn", "destination syn", "dirsonly syn", "drivealias syn", "filedate syn", "filedelete syn", "files syn", "msid", "innovation data", "rob owens", "ull ulls", "msg types", "ip address", "agtpcsrv", "profile", "version date", "ms windows", "action devpath", "valgrind memory", "debugger output", "roger luethi", "program url", "christoph gysin", "valve data", "tag syn", "wend", "prather", "pratam", "minor", "iskeyword", "xnor xor", "veraparengroup", "veralabelgroup", "vhdl", "linting", "vhsic", "high speed", "new style", "verilog", "mun johl", "485763", "vos cm", "andrew mcgill", "az syn", "bwlfdgh", "fdgh", "bwlqofdgh", "psect", "virata aconfig", "virata", "viratahexnumber", "execoptions", "ewind", "uffer", "malt", "wind", "vrmlevents", "vrmlfields", "vrmlcomment", "vrmlprotos", "vrmlnodes start", "externproto", "proto", "vgrindefs", "vgrindefs file", "profilesetzss", "java source", "parmp", "novimmain", "extern", "mswin", "featguimswin", "vimdll", "editnone", "level", "heading level", "vimtestsetup", "noop", "java language", "nontext", "returns", "chapter", "annotations", "labels", "text text", "tag head", "void", "htmlsnippets", "object", "object apply", "object bb", "no operation", "u003b", "n value", "pair", "long", "generics", "predicate", "vimtestsetup hi", "error import", "nontext class", "see jls", "declaration", "taggable", "binaryoperator", "i1 x", "i1 y", "string str", "taggable i1", "letters", "letters alpha", "letters beta", "tag tail", "use identity", "supplier", "tests", "identity", "comparable", "intfunction", "a dummy", "tggabl", "string s", "string tostring", "do not", "this file", "indent4", "indent2", "indent8", "tggabls", "fields", "classlock", "defines demo", "testable", "serviceloader", "malformed", "woof", "string s1", "string s2", "browns", "jumpss", "string s4", "string s6", "string apply", "string bay", "as quick", "woofs", "beta", "yieldable", "t yield", "other", "colon", "arrow", "unfoldenable", "italic", "strikethrough", "bold italic", "foobar", "modula2 pim", "test file", "colouring", "is licensed", "under the", "from system", "modula2 iso", "retain", "to do", "modula2 r10", "unsafe", "cardinal", "var abc", "variableb", "variablec", "var3", "var4", "var5", "var6", "variablea", "variabled", "variablee", "variable3", "varb", "variable1", "variable2", "varc", "vard", "variable4", "function1", "function4", "function2", "function3", "eq ne", "gt ge", "le lt", "ne gt", "ge le", "variableathis", "valsubfunc", "below", "reply", "issue", "cfoo", "ifoo", "interrupt", "ctrlc", "e123 catch", "varvalue", "cdpath", "backuptype", "defaultdevice", "executefbackup", "shall", "please wait", "buffer foo", "nargs range", "completer1 foo", "completer2 foo", "foo2", "bang", "nargs foo", "foo delcommand", "multiline", "commenttitle", "end augroup", "autocmd", "fixme call", "matched", "start not", "end not", "end call", "xterm call", "givename", "vim9", "test const", "foo def", "ex command", "dict", "end endfunction", "end enddef", "answer", "warningmsg", "endwhile", "dotest3", "dotest4", "dotest5", "dotest6", "test1", "test2", "test3", "test4", "test5", "funa", "dofuna", "funb", "dofunb", "func", "dofunc", "fund", "dofund", "foo delfunction", "foo function", "foo comment", "foo none", "guifg", "comment none", "ctermfgcyan", "end end", "end let", "end line", "end line1", "a basic", "rhs map", "foo bar", "fubar", "needle", "foogroup foo", "foogroup", "homeinclude", "defabc", "snomagicfoobar", "smagicfoobar", "special", "line comment", "b special", "char0x0044", "testcluster", "cchar", "keywords list", "vim line", "element", "x1f xf", "31 3", "u02a4 u000002a4", "string escape", "hexadecimal", "0xff echo", "decimal", "octal echo", "0377 echo", "vim shebang", "instance", "pairclasstest", "vim keymap", "end const", "expr", "foo unlet", "vim comment", "vim9 ex", "end foo", "xterm foo", "eof foo", "vim9script", "s vim9script", "12345", "0b10101010", "192939", "0777", "0o777", "0xabcdef00", "0x12345678", "runtest", "rticle", "syntax test", "file 0", "dougkearns", "2024 jun", "13 0", "test failures", "when comparing", "italicized text", "eading level", "igure", "eader", "frame", "diomatic text", "nput", "utput", "icture", "rogres", "cript", "earch", "ection", "elect", "reformat", "failure 0", "egend", "oscript", "bject", "ptgroup", "ption", "trong", "tyle", "able", "emplate", "extarea", "itle", "ource", "olgroup", "atalist", "etails", "ialog", "ieldset", "igcaption", "eleted text", "mphasis", "mbed", "side", "udio", "lockquote", "anvas", "aption", "ring at", "ideo", "cronym", "rame", "rameset", "arque", "enuitem", "rack", "narticulated an", "oframes", "trike", "ortal", "aram", "trikethrough", "highlighted", "elements have", "never be", "mage", "interface 0", "efault 0", "mport 0", "redundant", "tail", "alue", "nterface 0", "primer", "label 0", "tatic 0", "oid 0", "edundant", "identity cast", "expres", "to nest", "typeuse an", "htmlcom", "here is", "snip", "tmlsnip", "egion 0", "literal", "html com", "no entry", "point method", "code main", "return 0", "code nul", "eturn 0", "noop1", "may be", "used after", "noop2", "literalu0", "is proces", "return 8", "noop5", "nbsp", "noop6", "noop7", "link j0", "javaignorej0", "vimtestsetup s0", "fen 0", "nt 0", "majorversion", "empty string", "rotected 0", "compares this", "instance with", "the pas", "code that", "no period", "for the", "above sum", "rivate 0", "htmlsnip", "return an", "link m0", "execute", "match visual", "fen c0", "ref0", "literals", "clas", "tostring", "start 0", "ostring 0", "replace 0", "ubstring 0", "noop8", "noop9", "markdowncom", "arkdownsnip", "markdown com", "code public", "the method", "must be", "declared", "code 0", "the major", "java version", "used with", "inal 0", "markdownsnip", "blanks and", "re 0", "static void", "param a0", "rgs 0", "optional c0", "arguments 0", "invoke", "nontext 0", "hrow 0", "ew 0", "object module", "object open", "exports opens", "requires", "bject 0", "eplacement 0", "ar 0", "opens", "object opens", "object provides", "object requires", "object to", "uses", "xtends 0", "mplements 0", "ealed 0", "ermits 0", "bstract 0", "c1 i0", "noop3", "noop4", "a sum", "foldingtests", "static", "object b", "escapestests", "static final", "string hel", "har 0", "0ffffff0", "1200", "1210", "1230", "1240", "1250", "1260", "1270", "1300", "1310", "2040", "3240", "0100", "0120", "0130", "0140", "0150", "0160", "0170", "0200", "0210", "0230", "biginteger", "t1 x", "uper 0", "e element", "radix", "ecord 0", "tatic", "t dum", "isempty", "ublic 0", "ase 0", "ong 0", "witch 0", "genericstests", "todo 0", "3400", "3410", "3420", "3430", "3450", "3460", "3470", "3500", "3510", "3520", "sempty", "opal", "opsome", "ushal", "ushsome", "adix", "romdecimal", "lambdaexpres", "leftconst07", "leftconst08", "leftconst09", "i1 0", "leftconst10", "leftconst1", "leftconst01", "leftconst02", "leftconst03", "leftconst04", "leftconst05", "leftconst06", "leftconst", "const1", "const2", "witch", "hen 0", "alpha w0", "beta w0", "equals", "leftconst12", "typearguments", "identifier 0", "nteger", "ashcode", "omparable", "ry 0", "atch 0", "unction", "tring", "length", "ntfunction", "intsup", "clone", "naryoperator", "alueof", "quals", "redicate", "equalist", "gymnastics for", "ipredicate", "superequalist", "ethodhandle", "invokepredicate", "methodhandle mh", "throwable th", "a dum", "b dum", "t extends", "stringer", "ostring", "ntvalue", "onsumer", "println", "uperequalist", "nvokepredicate", "ethodhandle mh", "remember", "num 0", "asci", "stylable", "t e0", "tringer", "ative 0", "ynchronized 0", "trictfp 0", "thread", "qualist", "ransient 0", "methodstests", "string t0", "la s", "string name", "equires 0", "odule 0", "this module", "to the", "sample project", "published at", "mport m0", "related sup", "ransitive 0", "xports 0", "pens 0", "jdk 23", "ses 0", "rovides 0", "ith 0", "doautocmd", "syntax 0", "0xp0", "ouble 0", "minusoned", "xap1", "doto", "numberstests", "ouble", "loat 0", "maxdecf", "maxhexf", "mindecf", "minhexfa", "minhexfb", "maxdecd", "maxhexd", "minhex", "minoct", "minbin", "minusonehex", "minusoneoct", "minusonebin", "maxhexl", "maxoctl", "minusonehexl", "minusoneoctl", "minusonebinl", "jdk 21", "object o", "rue 0", "alse 0", "stringtests", "a quick", "brown fox", "jumps over", "the lazy", "there are", "lf after", "jumps0", "ver the0", "a nested", "string ap", "brown", "jumps", "over the", "nested com", "switchtests", "ield", "a or", "ield 0", "yte 0", "1let", "hort", "hort 0", "nofoldenable 0", "0000 0", "unfoldingtests", "reak 0", "old italic", "s1024", "talic", "inheritdoc", "object ap", "hile 0", "for vim", "file is", "licensed under", "the vim", "license 0", "efinition 0", "rom 0", "predefined", "ype 0", "ointer 0", "il 0", "nter", "ninter", "octal", "pragmas", "with emphasis", "opyright 0", "uthor 0", "fred flintstone", "icense 0", "baz bam", "ispose 0", "oc 0", "ord 0", "dr 0", "ast 0", "size 0", "rocedure 0", "egin 0", "nd 0", "ixme 0", "eprecated 0", "procedures", "ewfo", "nteger 0", "disabled", "hile fo", "do 0", "while", "synonyms", "itset 0", "roc 0", "roces", "ewproces", "ransfer 0", "ystem 0", "ongcard 0", "bozo bim", "dada jingle", "etbar", "lias 0", "defined pragmas", "numeric", "xcafed0", "inline", "noinline", "implementation", "cho 0", "this for", "done", "is a", "very handy", "solution and", "no real", "replacement", "available", "unction1", "a text", "shel", "his is", "home 0", "ariable10", "this is", "with a", "nset 0", "962 0", "f true", "unab", "abclear 0", "bclear 0", "java module", "changefilename", "restorefilename", "todo highlight", "author", "antonio colombo", "delete", "processing", "hebrew", "complete", "separate", "usercomplete", "matchitem", "cargo", "utility call", "trim trailing", "nvim", "linenr", "newcolumn", "columnnr", "wordregex", "gnat", "atomic", "timeslice", "structmembers", "nextitem", "col2", "typename", "typeref", "mpkeywords", "ctxkeywords", "binarysearch", "contextcmd", "omnisyntaxlist", "vim completion", "alex vear", "sung pae", "clojure version", "emptynode", "unitname", "setsession", "dec ada", "switchsession", "zat line", "vim adadec", "synidattr", "strridx", "auto", "nfz62010", "mdn css", "mask", "mnem", "setprojectfile", "pretty", "project file", "bufreadpost", "vim autoload", "decho", "dret", "getonescript", "e486", "dredir", "buffer test", "beginning", "prevnonblank", "getline", "xhtml", "dot pl", "doctype", "completetags", "harepath", "finddir", "attempt", "hare module", "java", "strive to", "for at", "least vim", "e121", "dialect", "setdialect", "hide", "bruno sutic", "blur", "accesskey", "onblur", "onfocus", "select", "tosource", "anchor", "cookie", "iframe", "checkbox", "codebase", "infinity", "foreign", "dorec", "lexer", "panic", "netrw", "charles e", "win9x", "dfunc", "systemroot", "nfhhtml", "nfhhtm", "nfhjpg", "toolbar menu", "synstack", "indent", "quote handling", "extraoemake", "hostcc", "buildcc", "buildcflags", "buildldflags", "freebasic", "precedence", "searchbracket", "plnum", "shiftwidth", "extrafunc", "python task", "parlnum", "commenttodo", "omni completion", "xml directory", "scope", "abbr", "fixed", "findmatch", "matchmax", "findbracket", "lispword", "isforfold", "inherestring", "nulldict", "column", "rstfoldcache", "cacherstfold", "rstfold", "antony lee", "helper", "getcurpos", "endfunction", "getpos", "shelltokenize", "withpath", "fnamemodify", "jump", "warningmsg echo", "emit", "play", "defpython", "rustfmtcommand", "runrustfmt", "detectversion", "split", "getconfigvar", "stephen sugden", "stephen", "save rustfmt", "vrustfmt", "nread", "loadfile", "getdirchoices", "yesn", "winbufnr", "vimspell", "bufwinnr", "index", "sqlcwarningmsg", "sqlcgetcolumns", "sqlcerrormsg", "compltype", "omni", "allow user", "synlist", "problem", "snum", "lnum", "isinclassdef", "isposinclassdef", "getrubyvartype", "getoption", "tohtml", "diff2html", "jumptoline", "mime charset", "latin1", "typst", "echoerr", "echomsg", "typeset", "echowarn", "getrunningjobs", "tex root", "addjob", "removejob", "showmesg", "chgdir", "vimball", "decompress", "vimballhome", "mkvimball", "restoresettings", "mkdir", "item", "emptystackp", "getlastopentag", "vimxmlattrinfo", "vimxmltaginfo", "tagstack", "istag", "endtag", "decreaseindent", "textwidth", "emptytag", "starttag", "browse", "setsaneopts", "restoreopts", "extract", "adacore", "cmdpre", "makeprg", "cargo file", "cmdpost", "basefont", "samp", "cite", "applet", "input", "middle", "acronym", "button", "gamma", "theta", "omega", "apos", "cong", "legend", "annotation", "attributegroup", "choice", "selector", "field", "choose", "foreach", "sort", "param", "stripspace", "all rights", "apple system", "tmpdir", "containerdir", "supportawdd", "supportbtserver", "apple", "rights", "file system", "fontd", "bookmark", "securityscope", "directory", "utility", "regularfile", "packagekit", "darwincachedir", "store database", "allow", "security", "reboot", "os x", "homedir", "realhomedir", "usersbasedir", "usercachedir", "audio", "callkit", "datacloudkit", "workaround", "rdar", "ckassets", "mmcs", "anyuuid", "caches", "allow fsctl", "fontvalidator", "frameworks", "coreservices", "carbon", "lsarpc", "dssetup sandbox", "squash", "readonly", "deny write", "issue sandbox", "network stack", "services lookup", "readwrite file", "system keychain", "wkssvc sandbox", "brlm", "byte range", "lock manager", "allow smbd", "allow wsp", "allow launchd", "netfsserver", "allow file", "sandbox profile", "ipv4", "ipv6", "netcore", "afsystem", "sysprotocontrol", "edge cache", "video", "allow access", "sandbox", "pkrecipt", "cachedir", "cmds", "applesmcclient", "smt isolation", "verw", "tempdir", "byhost", "sigkill", "sysmacsyscall", "sysaccess", "sysclose", "syscsrctl", "sysfchmod", "sysfsetxattr", "sysfsgetpath", "sysfstat64", "sysfstatat64", "darwintempdir", "reserve", "parampath", "mailv2", "mail importer", "allow mail", "library", "appcontainer", "document being", "quick look", "manage", "carbon noise", "make sure", "opengl", "plugin", "movie", "safari", "unix domain", "uuid cache", "redistribution", "is provided", "direct", "cfnetwork", "satellite", "files access", "daemon", "webdav file", "sharing", "sysgethostuuid", "gr ucs", "freebsd", "netbsd", "ucs gb2312", "cp932vdc", "ucs cp932vdc", "gb2312", "gbk ucs", "gb18030 ucs", "gb18030", "cpucs", "grucs", "appleucs", "gr mapperzone", "iso8859ucs", "big5ucs", "jisucs", "cnsucs", "appleinternal", "applications", "volumes", "gregory mcgarry", "coff dsp21k", "risc os", "programmer", "appendix e", "packdir", "git pack", "acorn", "chunk file", "from risc", "os programmer", "corrupted", "infocom", "david griffith", "glulx", "text adventure", "game", "adventure game", "allen garvin", "dave chapeskie", "aes crypt", "encrypted data", "joerg jenderek", "createdby", "createdby b", "windows gui", "alliant", "alliant fx", "fx series", "allegro", "toby deshane", "algol", "4 string", "bmode", "proc", "defmens vendors", "procedure b", "bref", "bflex", "bsdos", "bsdi", "unix32v", "sunos", "again", "hive rc", "sequence", "avro", "parquet", "apache hadoop", "apache big", "obj apache", "orc apache", "par1 apache", "pitentry", "android vdex", "android backup", "0 dalvik", "android bootimg", "password salt", "hidden", "loki", "apl workspace", "module sound", "density", "amigaos", "postma", "soundmon module", "trid", "amiga disk", "dos disk", "application", "mpeg v4", "dmb maf", "ycbcr", "cmaf media", "monaural", "heif image", "apple quicktime", "mike", "codec", "live", "applixware", "peter soos", "words words", "raster bitmap", "macro macro", "builder builder", "mac os", "ii image", "disk image", "blocks", "apple dos", "appleworks word", "spreadsheet", "sweet", "bernie", "rescue", "corrupt", "bobo", "amanda", "tapestart date", "file dump", "arm coff", "aarch64", "arm thumb", "armv7 thumb", "apt cache", "second", "bits per", "image width", "per meter", "asfdataobject", "time offset", "data length", "colors", "040t", "asterx", "guy harris", "word words", "grap graphic", "macr macro", "asterx version", "words document", "graphic", "coff", "we32000 coff", "mau hardware", "sccs", "we32k", "bbxpro5files", "oliver dammer", "dammer", "beetle vm", "beetle", "cable", "box router", "fritz", "box fritz", "password b", "oem b", "language b", "thu jun", "x tap", "sender", "x5fx81x44", "batch", "notification", "georg sauthoff", "gsma", "gsm association", "cdrs", "bflt", "philippe de", "muyter", "blockhashloc", "marco pontello", "sam alignment", "bgzf", "samtools", "binary call", "binary sequence", "fasta", "iupac", "blocked gnu", "patchmaster", "binary format", "alois schloegl", "medica soft", "axgr biosigaxg", "biosigaxg", "ircam file", "adpcm", "david korth", "song", "atari st", "ache", "david", "bonk", "insane", "pokey", "otto", "zbot", "blcr", "uncomment", "vma06", "kernel", "berkeley lab", "c000r000 blcr", "sparc", "armeb", "sparc64", "blender", "native format", "glob chunk", "blender3d", "scripts", "bpy blender3d", "bpython script", "blackberry file", "blackberry rim", "etp file", "0x10", "greg roelofs", "gnu tar", "ascii null", "compress", "0x04", "openoffice", "freeze", "archiver", "designer", "spark", "hpack", "oblivion", "zpack", "blink", "npack", "xpack", "blit mpxmux", "blit", "vaxorder", "blit stuff", "ttcomp", "ttcomp archive", "need", "we32 dmd", "birtual machine", "oses", "sparc demand", "4096", "sparc pure", "chiasmus", "federal", "office", "bundesamt", "sicherheit", "xia1r chiasmus", "xis chiasmus", "btsnoop", "hci uart", "hci bcsp", "hci serial", "mikhail gusarov", "dottedmag", "nekovm", "neko nekovm", "resilient logic", "guile file", "goof", "le b", "be b", "cbor", "concise binary", "raw tape", "cbm basic", "dirk jagdmann", "d64 image", "d71 image", "d81 image", "c64 emultar", "cartridge image", "c source", "bcpl source", "bcpl", "libhdr", "java se", "java bytecode", "macho", "java class", "cpu type", "cafe babes", "java start", "x version", "tablature file", "chord music", "file format", "chord text", "powertab", "jelmer vernooij", "jelmer", "powertab v3", "runect citrus", "lcctype", "ctrsme citrus", "ctrsmo citrus", "lcmonetary", "ctrsnu citrus", "lcnumeric", "ctrsti citrus", "lctime", "cddb", "cd player", "developer", "julien blache", "database", "keyindex", "help", "systems", "microcode", "netbsdalpha", "ios microcode", "kompas", "vrml", "xml document", "reserved", "applicationtype", "autocad dwg", "schema", "scanline", "alliance", "claris", "claris clip", "377377377377001", "claris works", "c1 r1", "c2 r1", "c3 r1", "intergraph", "clipper coff", "fairchild", "clipper use", "hitachi sh", "common object", "coff intel", "intel", "files format", "djgpp", "clojure script", "clojure", "jason felice", "clojure module", "convex", "convex soff", "convex storage", "convexes", "added", "core file", "third", "idc file", "suiteid", "chart", "debacle", "ttcn", "tree", "notation", "suite ttcn", "abstract test", "suite", "boseos", "snmperrnoerror", "commitrow", "readcreate", "retlen", "writecreate", "mydata", "putindexdata", "snmpsetvarvalue", "checkfnslocal", "not be", "note note", "decides", "snmp error", "requestvb", "asnoctetstr", "asnobjectid", "logerr", "undoinfo", "rcsfile", "end code", "debugmsgtl", "initialize", "allowcreation", "adding", "oidlength", "handler", "snmperrgenerr", "colnum", "break", "current", "snmp", "dodescr", "nodeinfo", "calldefine", "doformatedtext", "startperl", "perleval", "mib type", "oids", "const", "register", "asn type", "rorw status", "generating code", "mib tree", "netsnmp style", "getnext", "mib table", "tabledata", "container", "mibs", "print", "please specify", "send", "memcpy", "rscreateandgo", "writemethod", "findvarmethod", "variablesoid", "substr", "varlen", "sprintmaxlen", "datacontext", "mode", "freeundoinfo", "reallyreally", "initializingn", "handlercanronly", "netsnmp", "emitindexvars", "enddefine", "emitgetargs", "emitloaddata", "emitindexinfo", "output skeleton", "loader", "Aishah Siti Lazim", "194 Green Street" ], "references": [ "vimrc", "bugreport.vim", "evim.vim", "delmenu.vim", "defaults.vim", "ftplugof.vim", "ftoff.vim", "gvim.desktop", "ftplugin.vim", "gvimrc_example.vim", "indent.vim", "indoff.vim", "mswin.vim", "scripts.vim", "optwin.vim", "vim.desktop", "menu.vim", "vimrc_example.vim", "synmenu.vim", "filetype.vim", "Make_mvc.mak", "Make_all.mak", "README.ru.utf-8.txt", "README.txt", "tutor", "tutor.bar.utf-8", "tutor.ca.utf-8", "tutor.bg.utf-8", "tutor.cs.utf-8", "tutor.da.utf-8", "tutor.de.utf-8", "tutor.el.utf-8", "tutor.eo.utf-8", "tutor.es.utf-8", "tutor.fr.utf-8", "tutor.hr.utf-8", "tutor.ja.utf-8", "tutor.hu.utf-8", "tutor.it.utf-8", "tutor.ko", "tutor.ko.utf-8", "tutor.lt.utf-8", "tutor.lv.utf-8", "tutor.nb.utf-8", "tutor.nl.utf-8", "tutor.no.utf-8", "tutor.pt.utf-8", "tutor.pl.utf-8", "tutor.ru.utf-8", "tutor.tr.utf-8", "tutor.sr.utf-8", "tutor.sv.utf-8", "tutor.sk.utf-8", "tutor.vim", "tutor.zh_cn.utf-8", "tutor.utf-8", "tutor.vi.utf-8", "tutor.uk.utf-8", "tutor.zh_tw.utf-8", "tutor.zh.utf-8", "vimspell.txt", "xcmdsrv_client.c", "ref", "vim132", "vimm", "vim_vs_net.cmd", "shtags.1", "unicode.vim", "shtags.pl", "ccfilter_README.txt", "blink.c", "efm_filter.txt", "demoserver.py", "ccfilter.c", "efm_filter.pl", "ccfilter.1", "efm_perl.pl", "pltags.pl", "mve.txt", "emoji_list.vim", "mve.awk", "a65.vim", "aap.vim", "abap.vim", "abc.vim", "abel.vim", "abaqus.vim", "acedb.vim", "a2ps.vim", "ada.vim", "ahdl.vim", "8th.vim", "aflex.vim", "aidl.vim", "2html.vim", "alsaconf.vim", "amiga.vim", "ampl.vim", "antlr4.vim", "apachestyle.vim", "apache.vim", "antlr.vim", "ant.vim", "aml.vim", "arch.vim", "aptconf.vim", "arduino.vim", "art.vim", "asm.vim", "asciidoc.vim", "asn.vim", "aspperl.vim", "asm68k.vim", "aspvbs.vim", "asteriskvm.vim", "atlas.vim", "asy.vim", "autodoc.vim", "autohotkey.vim", "autoit.vim", "automake.vim", "ave.vim", "asmh8300.vim", "avra.vim", "awk.vim", "astro.vim", "ayacc.vim", "asterisk.vim", "bash.vim", "b.vim", "bdf.vim", "bib.vim", "basic.vim", "bindzone.vim", "bc.vim", "blank.vim", "bitbake.vim", "bsdl.vim", "bst.vim", "bzl.vim", "btm.vim", "bzr.vim", "baan.vim", "cabal.vim", "cabalconfig.vim", "cabalproject.vim", "c.vim", "catalog.vim", "cdl.vim", "cdrdaoconf.vim", "cfg.vim", "cgdbrc.vim", "cf.vim", "cdrtoc.vim", "ch.vim", "chaiscript.vim", "change.vim", "chaskell.vim", "changelog.vim", "chatito.vim", "cheetah.vim", "chicken.vim", "chordpro.vim", "chill.vim", "calendar.vim", "chuck.vim", "clean.vim", "clipper.vim", "cmakecache.vim", "cl.vim", "cmod.vim", "cmusrc.vim", "coco.vim", "colortest.vim", "clojure.vim", "conf.vim", "config.vim", "confini.vim", "conaryrecipe.vim", "crm.vim", "cmake.vim", "crontab.vim", "cpp.vim", "context.vim", "csc.vim", "csh.vim", "cs.vim", "csp.vim", "csv.vim", "cterm.vim", "csdl.vim", "cobol.vim", "ctrlh.vim", "css.vim", "cuda.vim", "cuplsim.vim", "cvs.vim", "cweb.vim", "cvsrc.vim", "cucumber.vim", "cupl.vim", "cynpp.vim", "cynlib.vim", "deb822sources.vim", "dcd.vim", "d.vim", "dcl.vim", "dart.vim", "debchangelog.vim", "debcontrol.vim", "datascript.vim", "debcopyright.vim", "def.vim", "dep3patch.vim", "denyhosts.vim", "debsources.vim", "desc.vim", "dictconf.vim", "dictdconf.vim", "diff.vim", "dircolors.vim", "dirpager.vim", "diva.vim", "desktop.vim", "django.vim", "dns.vim", "docbksgml.vim", "docbkxml.vim", "docbk.vim", "dockerfile.vim", "dosbatch.vim", "dosini.vim", "dot.vim", "dracula.vim", "dsl.vim", "dtml.vim", "doxygen.vim", "dts.vim", "dtrace.vim", "dtd.vim", "dune.vim", "dylanintr.vim", "dylanlid.vim", "dylan.vim", "dnsmasq.vim", "editorconfig.vim", "edif.vim", "ecd.vim", "elmfilt.vim", "elf.vim", "elinks.vim", "eiffel.vim", "elm.vim", "erlang.vim", "esmtprc.vim", "esqlc.vim", "esterel.vim", "euphoria3.vim", "eterm.vim", "eruby.vim", "euphoria4.vim", "exim.vim", "expect.vim", "exports.vim", "eviews.vim", "fasm.vim", "fdcc.vim", "falcon.vim", "fan.vim", "fetchmail.vim", "fgl.vim", "fish.vim", "flexwiki.vim", "focexec.vim", "fpcmake.vim", "forth.vim", "form.vim", "framescript.vim", "foxpro.vim", "fortran.vim", "freebasic.vim", "fvwm2m4.vim", "fstab.vim", "fvwm.vim", "gdmo.vim", "gdresource.vim", "gdb.vim", "gemtext.vim", "gdshader.vim", "git.vim", "gift.vim", "gedcom.vim", "gdscript.vim", "gitattributes.vim", "gitcommit.vim", "gitconfig.vim", "gitignore.vim", "gitolite.vim", "gitrebase.vim", "gitsendemail.vim", "gkrellmrc.vim", "goaccess.vim", "glsl.vim", "godoc.vim", "go.vim", "gnuplot.vim", "gp.vim", "gpg.vim", "gprof.vim", "gretl.vim", "grads.vim", "gnash.vim", "groff.vim", "grub.vim", "groovy.vim", "gtkrc.vim", "group.vim", "gyp.vim", "gsp.vim", "gvpr.vim", "update_date.vim", "README.md", "gen_syntax_vim.vim", "vim.vim.base", "haml.vim", "hamster.vim", "hare.vim", "haredoc.vim", "haste.vim", "haskell.vim", "hastepreproc.vim", "hb.vim", "hcl.vim", "help_ru.vim", "hex.vim", "help.vim", "hercules.vim", "hgcommit.vim", "hitest.vim", "hlsplaylist.vim", "hog.vim", "hostsaccess.vim", "hostconf.vim", "htmlcheetah.vim", "htmlangular.vim", "html.vim", "htmlm4.vim", "htmlos.vim", "htmldjango.vim", "i3config.vim", "ia64.vim", "ibasic.vim", "icemenu.vim", "idlang.vim", "idl.vim", "icon.vim", "initex.vim", "initng.vim", "ipfilter.vim", "inittab.vim", "inform.vim", "j.vim", "iss.vim", "ishd.vim", "jal.vim", "ist.vim", "jam.vim", "jargon.vim", "javascript.vim", "javascriptreact.vim", "java.vim", "jinja.vim", "jess.vim", "jgraph.vim", "javacc.vim", "jq.vim", "jsp.vim", "json.vim", "jsonc.vim", "json5.vim", "kconfig.vim", "julia.vim", "kdl.vim", "kotlin.vim", "kix.vim", "kwt.vim", "krl.vim", "kscript.vim", "kivy.vim", "lace.vim", "latte.vim", "lc.vim", "ld.vim", "ldapconf.vim", "iso.vim", "pim.vim", "r10.vim", "ldif.vim", "less.vim", "lftp.vim", "lhaskell.vim", "libao.vim", "lex.vim", "lifelines.vim", "liquid.vim", "limits.vim", "lilo.vim", "lite.vim", "livebook.vim", "lisp.vim", "litestep.vim", "lotos.vim", "loginaccess.vim", "logtalk.vim", "logindefs.vim", "lout.vim", "lprolog.vim", "lpc.vim", "lsl.vim", "lscript.vim", "lss.vim", "luau.vim", "lua.vim", "lynx.vim", "lyrics.vim", "m3quake.vim", "m3build.vim", "m4.vim", "mailaliases.vim", "mail.vim", "mailcap.vim", "mallard.vim", "make.vim", "manual.vim", "manconf.vim", "mason.vim", "masm.vim", "maple.vim", "master.vim", "matlab.vim", "maxima.vim", "mermaid.vim", "meson.vim", "mediawiki.vim", "messages.vim", "mel.vim", "man.vim", "markdown.vim", "mf.vim", "mgp.vim", "mgl.vim", "mib.vim", "mix.vim", "mmix.vim", "mmp.vim", "modconf.vim", "model.vim", "mma.vim", "modula2.vim", "modula3.vim", "moo.vim", "mojo.vim", "monk.vim", "mp.vim", "mplayerconf.vim", "mrxvtrc.vim", "msmessages.vim", "msidl.vim", "msql.vim", "modsim3.vim", "murphi.vim", "mush.vim", "mupad.vim", "muttrc.vim", "mysql.vim", "named.vim", "nanorc.vim", "nastran.vim", "n1ql.vim", "natural.vim", "nasm.vim", "ncf.vim", "netrc.vim", "netrw.vim", "ninja.vim", "nix.vim", "nosyntax.vim", "nroff.vim", "neomuttrc.vim", "nsis.vim", "nqc.vim", "nginx.vim", "obj.vim", "objcpp.vim", "odin.vim", "occam.vim", "omnimark.vim", "ocaml.vim", "ondir.vim", "objc.vim", "openscad.vim", "openroad.vim", "opl.vim", "openvpn.vim", "obse.vim", "opam.vim", "pamenv.vim", "pacmanlog.vim", "ora.vim", "pamconf.vim", "pandoc.vim", "papp.vim", "pcap.vim", "pbtxt.vim", "pascal.vim", "passwd.vim", "pccts.vim", "pf.vim", "phtml.vim", "perl.vim", "pic.vim", "pdf.vim", "pilrc.vim", "pfmain.vim", "pike.vim", "pine.vim", "pinfo.vim", "plaintex.vim", "php.vim", "plm.vim", "plp.vim", "pli.vim", "pod.vim", "poefilter.vim", "po.vim", "ppd.vim", "pov.vim", "povini.vim", "ppwiz.vim", "plsql.vim", "prescribe.vim", "procmail.vim", "privoxy.vim", "prolog.vim", "promela.vim", "postscr.vim", "protocols.vim", "proto.vim", "psf.vim", "psl.vim", "ps1.vim", "purifylog.vim", "ptcap.vim", "pymanifest.vim", "pyrex.vim", "progress.vim", "python.vim", "python2.vim", "quarto.vim", "qf.vim", "quake.vim", "qb64.vim", "r.vim", "qml.vim", "radiance.vim", "racc.vim", "racket.vim", "raml.vim", "rasi.vim", "rc.vim", "ratpoison.vim", "rapid.vim", "raku.vim", "rcslog.vim", "rcs.vim", "rebol.vim", "readline.vim", "registry.vim", "rego.vim", "remind.vim", "requirements.vim", "reva.vim", "resolv.vim", "rhelp.vim", "rexx.vim", "rnc.vim", "rng.vim", "rnoweb.vim", "rib.vim", "redif.vim", "rrst.vim", "rpcgen.vim", "routeros.vim", "rpl.vim", "rmd.vim", "rtf.vim", "rst.vim", "salt.vim", "robots.vim", "samba.vim", "ruby.vim", "sas.vim", "sass.vim", "rust.vim", "sbt.vim", "scdoc.vim", "sather.vim", "scilab.vim", "scala.vim", "scheme.vim", "screen.vim", "scss.vim", "sd.vim", "sdc.vim", "sdl.vim", "sensors.vim", "sed.vim", "services.vim", "sendpr.vim", "setserial.vim", "sexplib.vim", "sgmldecl.vim", "sgmllnx.vim", "sh.vim", "sgml.vim", "context-data-metafun.vim", "context-data-tex.vim", "hgcommitDiff.vim", "context-data-context.vim", "context-data-interfaces.vim", "debversions.vim", "typescriptcommon.vim", "sicad.vim", "sil.vim", "simula.vim", "sinda.vim", "sindacmp.vim", "sindaout.vim", "sieve.vim", "skill.vim", "sl.vim", "sisu.vim", "slang.vim", "slpconf.vim", "slpreg.vim", "slpspi.vim", "slrnsc.vim", "sm.vim", "smarty.vim", "slice.vim", "smcl.vim", "smith.vim", "smil.vim", "sml.vim", "snnsnet.vim", "snnspat.vim", "slrnrc.vim", "snobol4.vim", "solidity.vim", "spice.vim", "splint.vim", "spec.vim", "specman.vim", "spyce.vim", "spup.vim", "snnsres.vim", "sql.vim", "sqlforms.vim", "sqlj.vim", "sqlhana.vim", "sqlinformix.vim", "sqlanywhere.vim", "sqloracle.vim", "srec.vim", "sqr.vim", "squirrel.vim", "squid.vim", "srt.vim", "ssa.vim", "st.vim", "sshconfig.vim", "sshdconfig.vim", "stp.vim", "stata.vim", "strace.vim", "structurizr.vim", "stylus.vim", "sudoers.vim", "swift.vim", "swig.vim", "swiftgyb.vim", "swayconfig.vim", "syncolor.vim", "svn.vim", "synload.vim", "sysctl.vim", "systemverilog.vim", "tads.vim", "tags.vim", "tak.vim", "takcmp.vim", "takout.vim", "tar.vim", "taskdata.vim", "taskedit.vim", "tap.vim", "tasm.vim", "svg.vim", "syntax.vim", "template.vim", "tcsh.vim", "teraterm.vim", "terminfo.vim", "terraform.vim", "systemd.vim", "tcl.vim", "tssgm.vim", "typescript.vim", "tsv.vim", "tt2js.vim", "tssop.vim", "typescriptreact.vim", "tt2.vim", "tt2html.vim", "uc.vim", "uci.vim", "typst.vim", "udevconf.vim", "udevperm.vim", "uil.vim", "unison.vim", "updatedb.vim", "upstart.vim", "upstreamdat.vim", "upstreaminstalllog.vim", "upstreamlog.vim", "upstreamrpt.vim", "usw2kagtlog.vim", "urlshortcut.vim", "udevrules.vim", "valgrind.vim", "vdf.vim", "vb.vim", "verilogams.vim", "vera.vim", "vhdl.vim", "viminfo.vim", "verilog.vim", "voscm.vim", "vmasm.vim", "virata.vim", "vim.vim", "vrml.vim", "vgrindefs.vim", "usserverlog.vim", "c.c", "html.html", "java_comments_markdown.java", "java_annotations_signature.java", "java_comments.java", "java_enfoldment.java", "java_escapes.java", "java_generics_signature.java", "java_generics.java", "java_contextual_keywords.java", "java_lambda_expressions_signature.java", "java_annotations.java", "java_lambda_expressions.java", "java_method_references_signature.java", "java_methods_indent4.java", "java_methods_indent2.java", "java_methods_indent4_signature.java", "java_methods_indent2_signature.java", "java_methods_indent8_signature.java", "java_methods_style.java", "java_module_info.java", "java_methods_style_signature.java", "java_numbers.java", "java_previews_430.java", "java_string.java", "java_previews_455.java", "java_switch.java", "java_methods_indent8.java", "java_unfoldment.java", "markdown_conceal.markdown", "modula2_pim.def", "modula2_iso.def", "modula2_r10.def", "progress_comments.p", "sh_02.sh", "sh_01.sh", "sh_04.sh", "sh_03.sh", "sh_05.sh", "sh_07.sh", "sh_09.sh", "sh_08.sh", "sh_10.sh", "sh_11.sh", "vim_ex_abbreviate.vim", "vim_ex_behave.vim", "vim_ex_call.vim", "vim_ex_catch.vim", "sh_06.sh", "vim_ex_command.vim", "vim_ex_comment_strings.vim", "vim_ex_comment-vim9.vim", "vim_ex_comment.vim", "vim_ex_augroup.vim", "vim_ex_commands.vim", "vim_ex_def_nested.vim", "vim_ex_def_nested_fold.vim", "vim_ex_def_fold.vim", "vim_ex_def.vim", "vim_ex_echo.vim", "vim_ex_execute.vim", "vim_ex_function_def_tail_comment_errors.vim", "vim_ex_function_def_tail_comments.vim", "vim_ex_function_nested_fold.vim", "vim_ex_function_nested.vim", "vim_ex_function_fold.vim", "vim_ex_highlight.vim", "vim_ex_let_heredoc.vim", "vim_ex_loadkeymap_after_bar.vim", "vim_ex_loadkeymap_after_colon.vim", "vim_ex_map.vim", "vim_ex_function.vim", "vim_ex_menu.vim", "vim_ex_menutranslate.vim", "vim_ex_no_comment_strings.vim", "vim_ex_match.vim", "vim_ex_range.vim", "vim_ex_set.vim", "vim_ex_sleep.vim", "vim_ex_substitute.vim", "vim_ex_throw.vim", "vim_keymap.vim", "vim_ex_syntax.vim", "vim_key_notation.vim", "vim_line_continuation.vim", "vim_expr.vim", "vim_new.vim", "vim_shebang.vim", "vim_object_methods.vim", "vim_variables.vim", "vim9_ex_comment_strings.vim", "vim9_ex_commands.vim", "vim9_ex_no_comment_strings.vim", "vim9_ex_function_def_tail_comments.vim", "vim9_expr.vim", "vim9_keymap.vim", "vim9_ex_function_def_tail_comment_errors.vim", "vim9_legacy_header_fold.vim", "vim9_legacy_header.vim", "vim9_shebang.vim", "yaml.yaml", "dots_03", "dots_05", "dots_02", "dots_04", "dots_01", "dots_06", "dots_08", "dots_09", "dots_10", "dots_07", "dots_11", "dots_12", "dots_14", "dots_13", "dots_15", "dots_16", "dots_17", "dots_18", "dots_19", "dots_20", "html_00.dump", "html_03.dump", "html_05.dump", "html_04.dump", "html_06.dump", "html_02.dump", "html_01.dump", "html_07.dump", "html_08.dump", "java_annotations_01.dump", "java_annotations_00.dump", "java_annotations_02.dump", "java_annotations_03.dump", "java_annotations_04.dump", "java_annotations_signature_00.dump", "java_annotations_signature_02.dump", "java_annotations_signature_01.dump", "java_annotations_signature_03.dump", "java_annotations_signature_04.dump", "java_comments_html_01.dump", "java_comments_html_02.dump", "java_comments_html_03.dump", "java_comments_html_00.dump", "java_comments_html_04.dump", "java_comments_html_05.dump", "java_comments_markdown_00.dump", "java_comments_html_07.dump", "java_comments_markdown_03.dump", "java_comments_markdown_01.dump", "java_comments_html_06.dump", "java_comments_markdown_04.dump", "java_comments_markdown_02.dump", "java_comments_markdown_05.dump", "java_comments_markdown_06.dump", "java_comments_markdown_07.dump", "java_contextual_keywords_00.dump", "java_comments_markdown_08.dump", "java_contextual_keywords_01.dump", "java_contextual_keywords_02.dump", "java_enfoldment_01.dump", "java_contextual_keywords_03.dump", "java_enfoldment_00.dump", "java_enfoldment_02.dump", "java_escapes_00.dump", "java_escapes_01.dump", "java_escapes_03.dump", "java_escapes_05.dump", "java_escapes_07.dump", "java_escapes_02.dump", "java_escapes_06.dump", "java_generics_01.dump", "java_generics_03.dump", "java_generics_02.dump", "java_generics_04.dump", "java_generics_05.dump", "java_generics_07.dump", "java_generics_00.dump", "java_generics_06.dump", "java_escapes_04.dump", "java_generics_signature_00.dump", "java_generics_signature_01.dump", "java_generics_signature_02.dump", "java_generics_signature_03.dump", "java_generics_signature_04.dump", "java_generics_signature_05.dump", "java_generics_signature_07.dump", "java_generics_signature_06.dump", "java_lambda_expressions_00.dump", "java_lambda_expressions_01.dump", "java_lambda_expressions_03.dump", "java_lambda_expressions_02.dump", "java_lambda_expressions_04.dump", "java_lambda_expressions_05.dump", "java_lambda_expressions_06.dump", "java_lambda_expressions_07.dump", "java_lambda_expressions_08.dump", "java_lambda_expressions_signature_00.dump", "java_lambda_expressions_signature_01.dump", "java_lambda_expressions_signature_02.dump", "java_lambda_expressions_signature_03.dump", "java_lambda_expressions_signature_04.dump", "java_lambda_expressions_signature_05.dump", "java_lambda_expressions_signature_06.dump", "java_lambda_expressions_signature_07.dump", "java_lambda_expressions_signature_08.dump", "java_method_references_00.dump", "java_method_references_01.dump", "java_method_references_03.dump", "java_method_references_04.dump", "java_method_references_06.dump", "java_method_references_05.dump", "java_method_references_07.dump", "java_method_references_08.dump", "java_method_references_09.dump", "java_method_references_10.dump", "java_method_references_signature_00.dump", "java_method_references_signature_01.dump", "java_method_references_02.dump", "java_method_references_signature_02.dump", "java_method_references_signature_03.dump", "java_method_references_signature_04.dump", "java_method_references_signature_05.dump", "java_method_references_signature_07.dump", "java_method_references_signature_08.dump", "java_method_references_signature_09.dump", "java_methods_indent2_00.dump", "java_methods_indent2_00.vim", "java_methods_indent2_01.dump", "java_methods_indent2_01.vim", "java_methods_indent2_02.dump", "java_methods_indent2_02.vim", "java_method_references_signature_10.dump", "java_methods_indent2_03.vim", "java_methods_indent2_03.dump", "java_methods_indent2_04.dump", "java_methods_indent2_04.vim", "java_methods_indent2_05.dump", "java_methods_indent2_05.vim", "java_method_references_signature_06.dump", "java_methods_indent2_signature_00.vim", "java_methods_indent2_signature_01.dump", "java_methods_indent2_signature_01.vim", "java_methods_indent2_signature_02.dump", "java_methods_indent2_signature_02.vim", "java_methods_indent2_signature_03.dump", "java_methods_indent2_signature_03.vim", "java_methods_indent2_signature_04.dump", "java_methods_indent2_signature_04.vim", "java_methods_indent2_signature_05.dump", "java_methods_indent2_signature_05.vim", "java_methods_indent4_00.vim", "java_methods_indent4_01.vim", "java_methods_indent4_01.dump", "java_methods_indent4_02.dump", "java_methods_indent2_signature_00.dump", "java_methods_indent4_02.vim", "java_methods_indent4_03.vim", "java_methods_indent4_03.dump", "java_methods_indent4_04.dump", "java_methods_indent4_04.vim", "java_methods_indent4_05.dump", "java_methods_indent4_06.dump", "java_methods_indent4_05.vim", "java_methods_indent4_signature_00.dump", "java_methods_indent4_signature_01.dump", "java_methods_indent4_signature_01.vim", "java_methods_indent4_signature_02.dump", "java_methods_indent4_signature_02.vim", "java_methods_indent4_signature_03.dump", "java_methods_indent4_signature_03.vim", "java_methods_indent4_signature_04.dump", "java_methods_indent4_signature_04.vim", "java_methods_indent4_signature_05.dump", "java_methods_indent4_signature_05.vim", "java_methods_indent8_00.dump", "java_methods_indent4_signature_06.dump", "java_methods_indent8_00.vim", "java_methods_indent8_01.dump", "java_methods_indent8_01.vim", "java_methods_indent4_signature_00.vim", "java_methods_indent8_02.dump", "java_methods_indent8_02.vim", "java_methods_indent8_03.dump", "java_methods_indent8_03.vim", "java_methods_indent8_04.dump", "java_methods_indent8_05.dump", "java_methods_indent8_06.dump", "java_methods_indent8_05.vim", "java_methods_indent8_signature_00.dump", "java_methods_indent8_signature_01.dump", "java_methods_indent8_signature_01.vim", "java_methods_indent8_signature_02.dump", "java_methods_indent8_signature_02.vim", "java_methods_indent8_signature_00.vim", "java_methods_indent8_signature_03.dump", "java_methods_indent8_signature_03.vim", "java_methods_indent8_signature_04.dump", "java_methods_indent8_signature_04.vim", "java_methods_indent8_signature_05.vim", "java_methods_indent8_signature_05.dump", "java_methods_indent8_signature_06.dump", "java_methods_indent8_signature_06.vim", "java_methods_style_00.dump", "java_methods_style_00.vim", "java_methods_style_01.vim", "java_methods_style_02.vim", "java_methods_indent8_04.vim", "java_methods_style_03.dump", "java_methods_style_04.dump", "java_methods_style_02.dump", "java_methods_style_signature_00.dump", "java_methods_style_signature_00.vim", "java_methods_style_signature_01.vim", "java_methods_style_03.vim", "java_methods_style_signature_02.vim", "java_methods_style_01.dump", "java_methods_style_signature_03.dump", "java_methods_style_signature_03.vim", "java_methods_style_signature_04.dump", "java_methods_style_signature_01.dump", "java_module_info_00.dump", "java_methods_style_04.vim", "java_module_info_01.dump", "java_module_info_02.dump", "java_numbers_01.dump", "java_numbers_02.dump", "java_methods_style_signature_04.vim", "java_numbers_00.dump", "java_numbers_03.dump", "java_numbers_04.dump", "java_numbers_05.dump", "java_previews_430_00.dump", "java_previews_455_00.dump", "java_previews_455_01.dump", "java_previews_455_02.dump", "java_previews_455_03.dump", "java_methods_style_signature_02.dump", "java_methods_indent4_00.dump", "java_string_00.dump", "java_string_01.dump", "java_string_02.dump", "java_string_04.dump", "java_string_03.dump", "java_string_05.dump", "java_switch_00.dump", "java_switch_02.dump", "java_switch_01.dump", "java_switch_04.dump", "java_switch_03.dump", "java_switch_05.dump", "java_switch_07.dump", "java_unfoldment_00.dump", "java_switch_06.dump", "java_unfoldment_01.dump", "java_unfoldment_05.dump", "java_unfoldment_02.dump", "markdown_conceal_00.dump", "java_unfoldment_03.dump", "modula2_iso_00.dump", "modula2_iso_01.dump", "modula2_iso_03.dump", "modula2_iso_02.dump", "modula2_iso_04.dump", "modula2_iso_05.dump", "modula2_pim_00.dump", "modula2_iso_06.dump", "modula2_pim_01.dump", "modula2_pim_02.dump", "modula2_pim_03.dump", "modula2_pim_04.dump", "modula2_pim_06.dump", "modula2_pim_05.dump", "modula2_r10_00.dump", "modula2_r10_03.dump", "sh_07_01.dump", "sh_08_02.dump", "sh_11_00.dump", "vim_ex_abbreviate_01.dump", "vim_ex_command_00.dump", "java_module_info.vim", "markdown_conceal.vim", "cleanadd.vim", "yi.vim", "he.vim", "adacomplete.vim", "cargo.vim", "ccomplete.vim", "clojurecomplete.vim", "decada.vim", "contextcomplete.vim", "csscomplete.vim", "gnat.vim", "gzip.vim", "getscript.vim", "htmlcomplete.vim", "javaformat.vim", "netrw_gitignore.vim", "javascriptcomplete.vim", "haskellcomplete.vim", "netrwSettings.vim", "netrwFileHandlers.vim", "paste.vim", "pythoncomplete.vim", "RstFold.vim", "python3complete.vim", "rustfmt.vim", "spellfile.vim", "sqlcomplete.vim", "syntaxcomplete.vim", "rubycomplete.vim", "tohtml.vim", "typeset.vim", "vimball.vim", "xmlcomplete.vim", "xmlformat.vim", "zip.vim", "quickfix.vim", "html32.vim", "html40f.vim", "html40s.vim", "html40t.vim", "html401f.vim", "html401t.vim", "xhtml10f.vim", "xhtml10s.vim", "xsd.vim", "xhtml10t.vim", "html401s.vim", "xhtml11.vim", "xsl.vim", "airportd.sb", "awdd.sb", "bluetoothd.sb", "com.apple.atsd.internal.sb", "BTLEServer.sb", "com.apple.atsd.support.sb", "com.apple.bootinstalld.sb", "com.apple.ckdiscretionaryd.sb", "com.apple.CommCenter.sb", "com.apple.cloudd.sb", "com.apple.fontd.internal.sb", "com.apple.corespotlightservice.sb", "com.apple.FontValidator.sb", "com.apple.fontd.support.sb", "com.apple.genatsdb.internal.sb", "com.apple.managedcorespotlightd.sb", "com.apple.msrpc.lsarpc.sb", "com.apple.msrpc.mdssvc.sb", "com.apple.mobileassetd.sb", "com.apple.msrpc.netlogon.sb", "com.apple.msrpc.srvsvc.sb", "com.apple.msrpc.wkssvc.sb", "com.apple.smbd.sb", "com.apple.netbiosd.sb", "com.apple.softwareupdate_firstrun_tasks.sb", "com.apple.taskgated-helper.sb", "com.apple.spotlightknowledged.importer.sb", "com.apple.USBAgent.sb", "com.apple.softwareupdated.sb", "com.apple.xscertd-helper.sb", "com.apple.usbd.sb", "com.apple.xscertd.sb", "cvmsCompAgent.sb", "cvmsServer.sb", "fontmover.sb", "fontmoverinternal.sb", "fontworkerinternal.sb", "gss-acceptor.sb", "gss-initiator.sb", "kadmind.sb", "kcm.sb", "mdflagwriter.sb", "kdc.sb", "ftp-proxy.sb", "mds.sb", "mdworker-bundle.sb", "mds_stores.sb", "mdworker-mail.sb", "mdworker-sizing.sb", "mdworker-scan.sb", "mdworker.sb", "natpmpd.sb", "qlmanage.sb", "pfd.sb", "quicklook-satellite-general.sb", "mDNSResponder.sb", "quicklook-satellite.sb", "quicklook-satellite-personal.sb", "quicklookd-job-creation.sb", "webdav_agent.sb", "quicklookd.sb", "watool.sb", "wfs.sb", "wifivelocityd.sb", "Mac-CAD6701F7CEA0921.plist", "Mac-FFE5EF870D7BA81A.plist", "Mac-7DF21CB3ED6977E5.plist", "Mac-35C5E08120C7EEAF.plist", "Mac-2BD1B31983FE1663.plist", "Mac-42FD25EABCABB274.plist", "Mac-35C1E88140C3E6CF.plist", "Mac-27ADBB7B4CEE8E61.plist", "Mac-66E35819EE2D0D05.plist", "Mac-473D31EABEB93F9B.plist", "Mac-06F11FD93F0323C5.plist", "Mac-4B682C642B45593E.plist", "Mac-031B6874CF7F642A.plist", "Mac-551B86E5744E2388.plist", "Mac-A369DDC4E67F1C45.plist", "Mac-BE0E8AC46FE800CC.plist", "Mac-E43C1C25D4880AD6.plist", "default.plist", "Mac-BE088AF8C5EB4FA2.plist", "Mac-EE2EBD4B90B839A8.plist", "Mac-3CBD00234E554E41.plist", "Mac-77EB7D7DAF985301.plist", "Mac-189A3D4F975D5FFC.plist", "Mac-B809C3757DA9BB8D.plist", "Mac-DB15BD556843C820.plist", "Mac-06F11F11946D27C5.plist", "Mac-9F18E312C5C2BF0B.plist", "Mac-9AE82516C7C6B903.plist", "Mac-B4831CEBD52A0C4C.plist", "Mac-FA842E06C61E91C5.plist", "charset.pivot", "mapper.dir", "firmlinks", "Stopwords.plist", "adi", "acorn", "adventure", "aes", "alliant", "allegro", "algol68", "aout", "apache", "android", "apl", "amigaos", "application", "animation", "applix", "apple", "amanda", "arm", "apt", "asf", "assembler", "asterix", "att3b", "basis", "beetle", "avm", "ber", "bflt", "bhl", "bioinformatics", "biosig", "audio", "blcr", "blender", "blackberry", "archive", "blit", "bm", "bout", "bsdi", "bsi", "btsnoop", "bytecode", "cbor", "c64", "c-lang", "cafebabe", "chord", "citrus", "cddb", "clarion", "cisco", "cad", "claris", "clipper", "coff", "clojure", "convex", "communications", "dicrc", "mib2c.access_functions.conf", "mib2c.check_values.conf", "mib2c.check_values_local.conf", "mib2c.column_defines.conf", "mib2c.array-user.conf", "mib2c.column_enums.conf", "mib2c.column_storage.conf", "mib2c.create-dataset.conf", "mib2c.container.conf", "mib2c.genhtml.conf", "mib2c.int_watch.conf", "mib2c.conf", "mib2c.mfd.conf", "mib2c.notify.conf", "mib2c.iterate.conf", "mib2c.old-api.conf", "mib2c.iterate_access.conf", "mib2c.scalar.conf", "mib2c.perl.conf" ], "public": 1, "adversary": "DragonForce Malaysia", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Esc", "display_name": "Esc", "target": null }, { "id": "SelectAll", "display_name": "SelectAll", "target": null }, { "id": "Vim Tutor", "display_name": "Vim Tutor", "target": null }, { "id": "Todo", "display_name": "Todo", "target": null }, { "id": "AdaCore", "display_name": "AdaCore", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1030", "name": "Data Transfer Size Limits", "display_name": "T1030 - Data Transfer Size Limits" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 109, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ilyailya", "id": "298851", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "email": 635, "hostname": 840, "URL": 2021, "FileHash-SHA1": 6, "domain": 378, "FileHash-SHA256": 548 }, "indicator_count": 4430, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "405 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "678d3ad53ba37ac1825e3d2c", "name": "Aishah Lazim", "description": "Domestic cyberterrorism", "modified": "2025-02-21T00:57:53.601000", "created": "2025-01-19T17:48:05.477000", "tags": [ "filesystem", "timestamp", "plugin", "event", "mcdp29xxisp", "mcdp29xxapp", "mcdp29xx", "slam", "debug", "info", "stix2", "wisemo", "findmykids", "shutdownlog", "chromefavicon", "firefoxfavicon", "interactionc", "whatsapp", "predator", "flexispy", "cerberus", "metasploit", "theonespy", "netspy", "mobilespy", "webwatcher", "observer", "phonespy", "spynote", "ahmyth", "droidwatcher", "lovespy", "onespy", "safenet", "calendar", "f2c43", "timezonedb", "runningboard", "aspsnapshots", "wifi", "safari", "GUANGZHOU FIVE SIX TECHNOLOGY CO L", "194 Green Street", "Brooklyn" ], "references": [ "info.json", "timeline.csv", "filesystem.json", "command.log", "DiskMountConditioner.json" ], "public": 1, "adversary": "Dragonforce Malaysia Hacker Group", "targeted_countries": [ "United States of America", "Bahrain", "France" ], "malware_families": [ { "id": "", "display_name": "", "target": null } ], "attack_ids": [ { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" } ], "industries": [ "Media" ], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ilyailya", "id": "298851", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 923, "FileHash-MD5": 12, "FileHash-SHA1": 39, "domain": 817, "FileHash-SHA256": 422, "URL": 1543, "CIDR": 4, "email": 68, "SSLCertFingerprint": 387, "CVE": 5 }, "indicator_count": 4220, "is_author": false, "is_subscribing": null, "subscriber_count": 32, "modified_text": "423 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "671fd3b07ffb71116f2db7fa", "name": "dragonforce.io", "description": "Throw your MacBook in the trash, where the hackers belong.", "modified": "2024-11-27T17:01:13.516000", "created": "2024-10-28T18:10:56.355000", "tags": [ "copyright", "apple computer", "tcpip", "supported", "quantum", "postfix", "mail", "aliases", "postfix version", "restrict", "wietse venema", "sample", "note", "person", "basic system", "general", "column", "tiff", "linus walleij", "triad", "greg roelofs", "html", "daniel quinlan", "aiff", "music", "wave", "formats", "magic", "form", "crunch", "freeze", "maker", "format", "postscript", "this", "ifmodule", "include", "virtualhost", "directory", "require", "serverroot", "listen", "ifdefine", "loadmodule", "errordocument", "apache", "win32", "example", "main", "webdav", "internet", "mime type", "xlm xla", "xlc xlt", "xlam", "xlsb", "xlsm", "xltm", "z7 z8", "xhtml xht", "addiconbytype", "adddescription", "fancyindexed", "gzip", "indexignore", "indexes", "versionsort", "fancyindexing", "alias icons", "full", "minrate500", "keepalive", "prod", "email", "apache http", "server", "timeout", "number", "minimal", "major", "addlanguage", "addcharset", "defaultlanguage", "fallback", "polish", "addlanguage pl", "catalan", "english", "greekmodern", "korean", "turkish", "browsermatch", "davlockdb", "requireany", "usergroup", "alias", "authtype digest", "davupload admin", "authuserfile", "errorhttp", "http", "yourincludepath", "apache version", "serversignature", "alias error", "addhandler", "threadsperchild", "startservers", "minsparethreads", "maxsparethreads", "maximum number", "pidfile", "mpms", "threadstacksize", "extendedstatus", "change", "sethandler", "require host", "get information", "allow server", "allow", "userdir sites", "control access", "userdir", "sslsessioncache", "configure", "ocsp stapling", "ssl engine", "sslrequire", "ssltls standard", "prng", "sslrandomseed", "openssl", "high", "first", "refer", "servername", "virtualhost 80", "serveradmin", "documentroot", "errorlog", "customlog", "hosts", "please", "almost", "loadfile c", "proxyhtmllinks", "ascii", "unicode", "windows", "must", "location", "w3c html", "directoryindex", "allowoverride", "manual", "provide access", "options indexes", "files", "removetype tr", "traditionally", "addlanguage da", "addtype", "a facility", "claim", "file", "level error", "sender", "store", "level", "facility", "category", "time", "host", "threadid", "function", "line", "message", "guest", "access", "kernel", "usereventagent", "springboard", "message sep", "message mc", "message secure", "ca message", "multitouchhid", "use directory", "home autohome", "automounter map", "get home", "ps1h", "make bash", "s checkwinsize", "etcbashrc", "termprogram", "level info", "broadcast", "ignore", "rules", "true", "t option", "mount", "force", "environment", "automountdenv", "promptcommand", "shellsessiondir", "histfile", "histfilesize", "terminal", "myvar", "histtimeformat", "arrange", "bashrematch", "tell", "limit", "order deny", "authtype", "default require", "require user", "owner", "authkey", "lpadmin", "order", "system", "local", "cups scheduler", "list", "synconclose no", "default user", "user lp", "group lp", "group value", "restrict access", "cups", "inpck", "nnnbaud", "berkeley", "parity", "pc entry", "pass8", "parenb istrip", "fixed speed", "entry", "clocal mode", "host database", "maxhistsize", "promptmode", "verbose end", "etcirbrcloaded", "default", "setup", "history file", "readline", "error", "searchpaths", "freebsd", "tmpdir", "fcodes", "prunepaths", "vartmp", "prunedirs", "filesystems", "status mailfrom", "returnpath via", "open directory", "jabber", "group database", "cyrus", "calendar", "dovecot", "postfix scsd", "networkd", "nroff", "manpath", "uncomment", "manpager", "whatispager", "manlocale", "every", "manpath optman", "maybe", "troff", "flags", "bcgjnuwz", "d0 j", "ldap defaults", "base dcexample", "uri ldap", "sizelimit", "timelimit", "deref", "syntax", "kerberos", "name", "corba object", "desc", "schema", "openldap", "redistribution", "public license", "license", "collective", "shall not", "ldap", "co llective", "equality", "sup name", "structural must", "singlevalue", "auxiliary must", "auxiliary may", "guid", "desc account", "desc mount", "desc password", "service", "info", "tiger", "multi", "d esc", "rfc1274", "structural may", "quality", "substr caseigno", "corba", "ldap directory", "reserved", "ldap server", "dynamic group", "netscape", "not recommended", "for production", "attribute", "name managedby", "name leaf", "duas", "internetdrafts", "coast", "project", "java object", "java class", "de sc", "pkcs", "inetorgperson", "rfc2798", "signeddata", "smime", "openldap note", "hold", "code", "java", "jndi reference", "jndi", "with syntax", "definitions", "kerberos v", "kdc schema", "oid base", "size", "subclass of", "may contain", "objectclass", "must contain", "matches for", "obsolete", "des c", "abstract must", "sup person", "microsoft", "advanced server", "schema mapping", "netinfo", "config", "groups", "netinfo preset", "crypt", "netinfo rpcs", "rpcs number", "oncrpcnumber", "ipnetmasknumber", "assistant", "may description", "rfc2307", "rfc2252", "match syntax", "openldaproot", "openldaporg", "openldapou", "equal ity", "kind", "rule", "attcertpath", "rolesyntax", "ldif", "blank", "ldap entry", "spaces", "cosine pilot", "directory forum", "password policy", "false", "april", "auxiliary", "passwd", "account", "desc pool", "unix", "structural", "sup rpcentry", "sup container", "abstract may", "sup ipsecbase", "Chelsea Manning Help Me", "Aishah Siti Lazim", "Aishah Lazim", "194 Green Street", "Human Subjects", "cybernetic", "RNA molecule", "matches", "postfix smtp", "domain", "ipv6 host", "reject", "reply", "prior", "bugs", "reject empty", "canonical", "tables", "post", "replace user", "address", "generic", "smtp", "isp mail", "mail delivery", "charset", "report", "postfix dsn", "mail returned", "only", "mime", "headerchecks", "readme files", "filters while", "posix", "empty", "body", "pass", "write", "date", "program", "agreement", "contributor", "recipient", "contribution", "the program", "corporation", "contributors", "product x", "as expressly", "arch", "arch x8664", "pipe wall", "wimplicit", "ranlib", "warn", "switch", "start", "systype", "smtp server", "specify", "mx host", "unix password", "user unknown", "pathbin", "postfix queue", "path", "beware", "class", "uucp", "shell", "outlook", "postfix master", "begin", "server admin", "mail backend", "modern smtp", "iana", "many", "postfix pipe", "recent cyrus", "amos gouaux", "old example", "update", "usrsbin", "file format", "no group", "daemondirectory", "relocated", "matches user", "synopsis", "or even", "lutz jaenicke", "technology", "cottbus", "germany", "openssl package", "openssl project", "europe", "remember that", "use of", "virtual", "virtual alias", "redirect mail", "deliver mail", "transport", "description", "result format", "bashno", "r etcbashrc", "protocol", "ipv6", "icmp", "cisco", "monitoring", "argus", "chaos", "rsvp", "encapsulation", "aris", "isis", "kame", "id key", "specification", "auto exit", "vpn socket", "networkup", "term", "devnull", "common setup", "set command", "sunnet manager", "rpcsrc", "netlicense", "apple", "netbootmount", "netbootshadow", "computername", "localonly", "localnetbootdir", "netboot", "define", "purpose", "networkonly", "waiting", "auditing", "solaris", "openbsm", "secsrvr", "allocation", "bsm event", "solaris kernel", "openbsm kernel", "solaris auemac", "solaris umount", "integer", "array", "data", "state", "opendirectoryd", "ipv4", "plist", "dict", "session", "commcenter", "airport", "cfbasichash", "thread", "cfrunloop", "cfrunloopmode", "usrbinsudo", "usrsbinnetbiosd", "removed" ], "references": [ "afpovertcp.cfg", "aliases", "magic", "httpd.conf", "mime.types", "httpd-autoindex.conf", "httpd-default.conf", "httpd-languages.conf", "httpd-dav.conf", "httpd-multilang-errordoc.conf", "httpd-mpm.conf", "httpd-info.conf", "httpd-userdir.conf", "httpd-ssl.conf", "httpd-vhosts.conf", "proxy-html.conf", "httpd-manual.conf", "php7.conf", "mpm.conf", "com.apple.eventmonitor", "com.apple.authd", "com.apple.cdscheduler", "com.apple.contacts.ContactsAutocomplete", "com.apple.install", "com.apple.coreduetd", "com.apple.login.guest", "com.apple.mkb", "com.apple.mail", "com.apple.MessageTracer", "com.apple.mkb.internal", "com.apple.iokit.power", "com.apple.performance", "com.apple.networking.boringssl", "auto_master", "auto_home", "bashrc", "asl.conf", "autofs.conf", "bashrc_Apple_Terminal", "csh.cshrc", "csh.logout", "com.apple.screensharing.agent.launchd", "csh.login", "cupsd.conf", "cups-files.conf.default", "cupsd.conf.O", "cupsd.conf.default", "cups-files.conf", "snmp.conf", "snmp.conf.default", "dragonforce.io", "find.codes", "ftpusers", "hosts.equiv", "gettytab", "hosts", "kern_loader.conf", "irbrc", "locate.rc", "mail.rc", "group", "man.conf", "networks", "manpaths", "newsyslog.conf", "com.apple.slapconfig.conf", "files.conf", "com.apple.xscertd.conf", "wifi.conf", "com.apple.slapd.conf", "nfs.conf", "ntp.conf", "notify.conf", "ntp_opendirectory.conf", "AppleOpenLDAP.plist", "ldap.conf", "ldap.conf.default", "apple_auxillary.schema", "corba.ldif", "collective.schema", "collective.ldif", "core.ldif", "apple.schema", "cosine.ldif", "core.schema", "corba.schema", "duaconf.ldif", "dyngroup.ldif", "fmserver.schema", "duaconf.schema", "java.ldif", "inetorgperson.schema", "inetorgperson.ldif", "java.schema", "krb5-kdc.schema", "cosine.schema", "misc.ldif", "microsoft.std.schema", "misc.schema", "netinfo.schema", "nis.schema", "nis.ldif", "openldap.schema", "dyngroup.schema", "pmi.ldif", "ppolicy.ldif", "pmi.schema", "openldap.ldif", "README", "ppolicy.schema", "samba.schema", "microsoft.schema", "access", "custom_header_checks", "canonical", "generic", "bounce.cf.default", "header_checks", "LICENSE", "makedefs.out", "main.cf", "master.cf.default", "master.cf", "main.cf.proto", "master.cf.proto", "postfix-files", "relocated", "TLS_LICENSE", "virtual", "main.cf.default", "transport", "profile", "protocols", "racoon.conf", "rmtab", "rc.common", "rpc", "rtadvd.conf", "rc.netboot", "audit_class", "audit_warn", "audit_event", "audit_control" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Bahrain", "Israel", "India" ], "malware_families": [ { "id": "DirectoryIndex", "display_name": "DirectoryIndex", "target": null }, { "id": "AllowOverride", "display_name": "AllowOverride", "target": null }, { "id": "Malaysia, Truly Asia", "display_name": "Malaysia, Truly Asia", "target": null }, { "id": "9002 RAT", "display_name": "9002 RAT", "target": null }, { "id": "Virus:DOS/PSMPC_386", "display_name": "Virus:DOS/PSMPC_386", "target": "/malware/Virus:DOS/PSMPC_386" }, { "id": "TEL:TrojanSpy:Win32/KediRat", "display_name": "TEL:TrojanSpy:Win32/KediRat", "target": null }, { "id": "TrojanSpy:iOS/XcodeGhost", "display_name": "TrojanSpy:iOS/XcodeGhost", "target": "/malware/TrojanSpy:iOS/XcodeGhost" }, { "id": "ALF:HSTR:TrojanSpy:MSIL/KeyLogger", "display_name": "ALF:HSTR:TrojanSpy:MSIL/KeyLogger", "target": null }, { "id": "Ultra VNC", "display_name": "Ultra VNC", "target": null }, { "id": "TrojanDownloader:Win32/Bridge", "display_name": "TrojanDownloader:Win32/Bridge", "target": "/malware/TrojanDownloader:Win32/Bridge" }, { "id": "Virus:DOS/Cyberwar_5300", "display_name": "Virus:DOS/Cyberwar_5300", "target": "/malware/Virus:DOS/Cyberwar_5300" }, { "id": "Backdoor:Win32/Espion", "display_name": "Backdoor:Win32/Espion", "target": "/malware/Backdoor:Win32/Espion" }, { "id": "Pegasus for iOS - S0289", "display_name": "Pegasus for iOS - S0289", "target": null }, { "id": "Pegasus - MOB-S0005", "display_name": "Pegasus - MOB-S0005", "target": null }, { "id": "Pegasus for Android - S0316", "display_name": "Pegasus for Android - S0316", "target": null }, { "id": "ALF:HeraklezEval:Backdoor:Linux/Mirai", "display_name": "ALF:HeraklezEval:Backdoor:Linux/Mirai", "target": null }, { "id": "ALF:HeraklezEval:BackdoorLinux/Mirai", "display_name": "ALF:HeraklezEval:BackdoorLinux/Mirai", "target": null }, { "id": "ALF:HeraklezEval:Backdoor:Linux/Tsunami", "display_name": "ALF:HeraklezEval:Backdoor:Linux/Tsunami", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1404", "name": "Exploit OS Vulnerability", "display_name": "T1404 - Exploit OS Vulnerability" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1001.002", "name": "Steganography", "display_name": "T1001.002 - Steganography" }, { "id": "T1003.004", "name": "LSA Secrets", "display_name": "T1003.004 - LSA Secrets" }, { "id": "T1001.001", "name": "Junk Data", "display_name": "T1001.001 - Junk Data" }, { "id": "T1003.001", "name": "LSASS Memory", "display_name": "T1003.001 - LSASS Memory" }, { "id": "T1003.005", "name": "Cached Domain Credentials", "display_name": "T1003.005 - Cached Domain Credentials" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1026", "name": "Multiband Communication", "display_name": "T1026 - Multiband Communication" }, { "id": "T1562.004", "name": "Disable or Modify System Firewall", "display_name": "T1562.004 - Disable or Modify System Firewall" }, { "id": "T1025", "name": "Data from Removable Media", "display_name": "T1025 - Data from Removable Media" }, { "id": "T1055.002", "name": "Portable Executable Injection", "display_name": "T1055.002 - Portable Executable Injection" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1021.006", "name": "Windows Remote Management", "display_name": "T1021.006 - Windows Remote Management" }, { "id": "T1021", "name": "Remote Services", "display_name": "T1021 - Remote Services" } ], "industries": [ "Media", "LGBTQ+ Activists", "Technology", "Telecommunications", "Hospitality", "Energy", "NGO", "Semiconductor", "Human Subjects" ], "TLP": "white", "cloned_from": null, "export_count": 35, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 669, "URL": 1976, "email": 21, "hostname": 1198, "FileHash-SHA256": 277, "CVE": 2, "CIDR": 3 }, "indicator_count": 4146, "is_author": false, "is_subscribing": null, "subscriber_count": 35, "modified_text": "508 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "671fd3afa974b93284d6bac1", "name": "dragonforce.io", "description": "Throw your MacBook in the trash, where the hackers belong.", "modified": "2024-11-27T17:01:13.516000", "created": "2024-10-28T18:10:55.712000", "tags": [ "copyright", "apple computer", "tcpip", "supported", "quantum", "postfix", "mail", "aliases", "postfix version", "restrict", "wietse venema", "sample", "note", "person", "basic system", "general", "column", "tiff", "linus walleij", "triad", "greg roelofs", "html", "daniel quinlan", "aiff", "music", "wave", "formats", "magic", "form", "crunch", "freeze", "maker", "format", "postscript", "this", "ifmodule", "include", "virtualhost", "directory", "require", "serverroot", "listen", "ifdefine", "loadmodule", "errordocument", "apache", "win32", "example", "main", "webdav", "internet", "mime type", "xlm xla", "xlc xlt", "xlam", "xlsb", "xlsm", "xltm", "z7 z8", "xhtml xht", "addiconbytype", "adddescription", "fancyindexed", "gzip", "indexignore", "indexes", "versionsort", "fancyindexing", "alias icons", "full", "minrate500", "keepalive", "prod", "email", "apache http", "server", "timeout", "number", "minimal", "major", "addlanguage", "addcharset", "defaultlanguage", "fallback", "polish", "addlanguage pl", "catalan", "english", "greekmodern", "korean", "turkish", "browsermatch", "davlockdb", "requireany", "usergroup", "alias", "authtype digest", "davupload admin", "authuserfile", "errorhttp", "http", "yourincludepath", "apache version", "serversignature", "alias error", "addhandler", "threadsperchild", "startservers", "minsparethreads", "maxsparethreads", "maximum number", "pidfile", "mpms", "threadstacksize", "extendedstatus", "change", "sethandler", "require host", "get information", "allow server", "allow", "userdir sites", "control access", "userdir", "sslsessioncache", "configure", "ocsp stapling", "ssl engine", "sslrequire", "ssltls standard", "prng", "sslrandomseed", "openssl", "high", "first", "refer", "servername", "virtualhost 80", "serveradmin", "documentroot", "errorlog", "customlog", "hosts", "please", "almost", "loadfile c", "proxyhtmllinks", "ascii", "unicode", "windows", "must", "location", "w3c html", "directoryindex", "allowoverride", "manual", "provide access", "options indexes", "files", "removetype tr", "traditionally", "addlanguage da", "addtype", "a facility", "claim", "file", "level error", "sender", "store", "level", "facility", "category", "time", "host", "threadid", "function", "line", "message", "guest", "access", "kernel", "usereventagent", "springboard", "message sep", "message mc", "message secure", "ca message", "multitouchhid", "use directory", "home autohome", "automounter map", "get home", "ps1h", "make bash", "s checkwinsize", "etcbashrc", "termprogram", "level info", "broadcast", "ignore", "rules", "true", "t option", "mount", "force", "environment", "automountdenv", "promptcommand", "shellsessiondir", "histfile", "histfilesize", "terminal", "myvar", "histtimeformat", "arrange", "bashrematch", "tell", "limit", "order deny", "authtype", "default require", "require user", "owner", "authkey", "lpadmin", "order", "system", "local", "cups scheduler", "list", "synconclose no", "default user", "user lp", "group lp", "group value", "restrict access", "cups", "inpck", "nnnbaud", "berkeley", "parity", "pc entry", "pass8", "parenb istrip", "fixed speed", "entry", "clocal mode", "host database", "maxhistsize", "promptmode", "verbose end", "etcirbrcloaded", "default", "setup", "history file", "readline", "error", "searchpaths", "freebsd", "tmpdir", "fcodes", "prunepaths", "vartmp", "prunedirs", "filesystems", "status mailfrom", "returnpath via", "open directory", "jabber", "group database", "cyrus", "calendar", "dovecot", "postfix scsd", "networkd", "nroff", "manpath", "uncomment", "manpager", "whatispager", "manlocale", "every", "manpath optman", "maybe", "troff", "flags", "bcgjnuwz", "d0 j", "ldap defaults", "base dcexample", "uri ldap", "sizelimit", "timelimit", "deref", "syntax", "kerberos", "name", "corba object", "desc", "schema", "openldap", "redistribution", "public license", "license", "collective", "shall not", "ldap", "co llective", "equality", "sup name", "structural must", "singlevalue", "auxiliary must", "auxiliary may", "guid", "desc account", "desc mount", "desc password", "service", "info", "tiger", "multi", "d esc", "rfc1274", "structural may", "quality", "substr caseigno", "corba", "ldap directory", "reserved", "ldap server", "dynamic group", "netscape", "not recommended", "for production", "attribute", "name managedby", "name leaf", "duas", "internetdrafts", "coast", "project", "java object", "java class", "de sc", "pkcs", "inetorgperson", "rfc2798", "signeddata", "smime", "openldap note", "hold", "code", "java", "jndi reference", "jndi", "with syntax", "definitions", "kerberos v", "kdc schema", "oid base", "size", "subclass of", "may contain", "objectclass", "must contain", "matches for", "obsolete", "des c", "abstract must", "sup person", "microsoft", "advanced server", "schema mapping", "netinfo", "config", "groups", "netinfo preset", "crypt", "netinfo rpcs", "rpcs number", "oncrpcnumber", "ipnetmasknumber", "assistant", "may description", "rfc2307", "rfc2252", "match syntax", "openldaproot", "openldaporg", "openldapou", "equal ity", "kind", "rule", "attcertpath", "rolesyntax", "ldif", "blank", "ldap entry", "spaces", "cosine pilot", "directory forum", "password policy", "false", "april", "auxiliary", "passwd", "account", "desc pool", "unix", "structural", "sup rpcentry", "sup container", "abstract may", "sup ipsecbase", "Chelsea Manning Help Me", "Aishah Siti Lazim", "Aishah Lazim", "194 Green Street", "Human Subjects", "cybernetic", "RNA molecule", "matches", "postfix smtp", "domain", "ipv6 host", "reject", "reply", "prior", "bugs", "reject empty", "canonical", "tables", "post", "replace user", "address", "generic", "smtp", "isp mail", "mail delivery", "charset", "report", "postfix dsn", "mail returned", "only", "mime", "headerchecks", "readme files", "filters while", "posix", "empty", "body", "pass", "write", "date", "program", "agreement", "contributor", "recipient", "contribution", "the program", "corporation", "contributors", "product x", "as expressly", "arch", "arch x8664", "pipe wall", "wimplicit", "ranlib", "warn", "switch", "start", "systype", "smtp server", "specify", "mx host", "unix password", "user unknown", "pathbin", "postfix queue", "path", "beware", "class", "uucp", "shell", "outlook", "postfix master", "begin", "server admin", "mail backend", "modern smtp", "iana", "many", "postfix pipe", "recent cyrus", "amos gouaux", "old example", "update", "usrsbin", "file format", "no group", "daemondirectory", "relocated", "matches user", "synopsis", "or even", "lutz jaenicke", "technology", "cottbus", "germany", "openssl package", "openssl project", "europe", "remember that", "use of", "virtual", "virtual alias", "redirect mail", "deliver mail", "transport", "description", "result format", "bashno", "r etcbashrc", "protocol", "ipv6", "icmp", "cisco", "monitoring", "argus", "chaos", "rsvp", "encapsulation", "aris", "isis", "kame", "id key", "specification", "auto exit", "vpn socket", "networkup", "term", "devnull", "common setup", "set command", "sunnet manager", "rpcsrc", "netlicense", "apple", "netbootmount", "netbootshadow", "computername", "localonly", "localnetbootdir", "netboot", "define", "purpose", "networkonly", "waiting", "auditing", "solaris", "openbsm", "secsrvr", "allocation", "bsm event", "solaris kernel", "openbsm kernel", "solaris auemac", "solaris umount", "integer", "array", "data", "state", "opendirectoryd", "ipv4", "plist", "dict", "session", "commcenter", "airport", "cfbasichash", "thread", "cfrunloop", "cfrunloopmode", "usrbinsudo", "usrsbinnetbiosd", "removed" ], "references": [ "afpovertcp.cfg", "aliases", "magic", "httpd.conf", "mime.types", "httpd-autoindex.conf", "httpd-default.conf", "httpd-languages.conf", "httpd-dav.conf", "httpd-multilang-errordoc.conf", "httpd-mpm.conf", "httpd-info.conf", "httpd-userdir.conf", "httpd-ssl.conf", "httpd-vhosts.conf", "proxy-html.conf", "httpd-manual.conf", "php7.conf", "mpm.conf", "com.apple.eventmonitor", "com.apple.authd", "com.apple.cdscheduler", "com.apple.contacts.ContactsAutocomplete", "com.apple.install", "com.apple.coreduetd", "com.apple.login.guest", "com.apple.mkb", "com.apple.mail", "com.apple.MessageTracer", "com.apple.mkb.internal", "com.apple.iokit.power", "com.apple.performance", "com.apple.networking.boringssl", "auto_master", "auto_home", "bashrc", "asl.conf", "autofs.conf", "bashrc_Apple_Terminal", "csh.cshrc", "csh.logout", "com.apple.screensharing.agent.launchd", "csh.login", "cupsd.conf", "cups-files.conf.default", "cupsd.conf.O", "cupsd.conf.default", "cups-files.conf", "snmp.conf", "snmp.conf.default", "dragonforce.io", "find.codes", "ftpusers", "hosts.equiv", "gettytab", "hosts", "kern_loader.conf", "irbrc", "locate.rc", "mail.rc", "group", "man.conf", "networks", "manpaths", "newsyslog.conf", "com.apple.slapconfig.conf", "files.conf", "com.apple.xscertd.conf", "wifi.conf", "com.apple.slapd.conf", "nfs.conf", "ntp.conf", "notify.conf", "ntp_opendirectory.conf", "AppleOpenLDAP.plist", "ldap.conf", "ldap.conf.default", "apple_auxillary.schema", "corba.ldif", "collective.schema", "collective.ldif", "core.ldif", "apple.schema", "cosine.ldif", "core.schema", "corba.schema", "duaconf.ldif", "dyngroup.ldif", "fmserver.schema", "duaconf.schema", "java.ldif", "inetorgperson.schema", "inetorgperson.ldif", "java.schema", "krb5-kdc.schema", "cosine.schema", "misc.ldif", "microsoft.std.schema", "misc.schema", "netinfo.schema", "nis.schema", "nis.ldif", "openldap.schema", "dyngroup.schema", "pmi.ldif", "ppolicy.ldif", "pmi.schema", "openldap.ldif", "README", "ppolicy.schema", "samba.schema", "microsoft.schema", "access", "custom_header_checks", "canonical", "generic", "bounce.cf.default", "header_checks", "LICENSE", "makedefs.out", "main.cf", "master.cf.default", "master.cf", "main.cf.proto", "master.cf.proto", "postfix-files", "relocated", "TLS_LICENSE", "virtual", "main.cf.default", "transport", "profile", "protocols", "racoon.conf", "rmtab", "rc.common", "rpc", "rtadvd.conf", "rc.netboot", "audit_class", "audit_warn", "audit_event", "audit_control" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Bahrain", "Israel", "India" ], "malware_families": [ { "id": "DirectoryIndex", "display_name": "DirectoryIndex", "target": null }, { "id": "AllowOverride", "display_name": "AllowOverride", "target": null }, { "id": "Malaysia, Truly Asia", "display_name": "Malaysia, Truly Asia", "target": null }, { "id": "9002 RAT", "display_name": "9002 RAT", "target": null }, { "id": "Virus:DOS/PSMPC_386", "display_name": "Virus:DOS/PSMPC_386", "target": "/malware/Virus:DOS/PSMPC_386" }, { "id": "TEL:TrojanSpy:Win32/KediRat", "display_name": "TEL:TrojanSpy:Win32/KediRat", "target": null }, { "id": "TrojanSpy:iOS/XcodeGhost", "display_name": "TrojanSpy:iOS/XcodeGhost", "target": "/malware/TrojanSpy:iOS/XcodeGhost" }, { "id": "ALF:HSTR:TrojanSpy:MSIL/KeyLogger", "display_name": "ALF:HSTR:TrojanSpy:MSIL/KeyLogger", "target": null }, { "id": "Ultra VNC", "display_name": "Ultra VNC", "target": null }, { "id": "TrojanDownloader:Win32/Bridge", "display_name": "TrojanDownloader:Win32/Bridge", "target": "/malware/TrojanDownloader:Win32/Bridge" }, { "id": "Virus:DOS/Cyberwar_5300", "display_name": "Virus:DOS/Cyberwar_5300", "target": "/malware/Virus:DOS/Cyberwar_5300" }, { "id": "Backdoor:Win32/Espion", "display_name": "Backdoor:Win32/Espion", "target": "/malware/Backdoor:Win32/Espion" }, { "id": "Pegasus for iOS - S0289", "display_name": "Pegasus for iOS - S0289", "target": null }, { "id": "Pegasus - MOB-S0005", "display_name": "Pegasus - MOB-S0005", "target": null }, { "id": "Pegasus for Android - S0316", "display_name": "Pegasus for Android - S0316", "target": null }, { "id": "ALF:HeraklezEval:Backdoor:Linux/Mirai", "display_name": "ALF:HeraklezEval:Backdoor:Linux/Mirai", "target": null }, { "id": "ALF:HeraklezEval:BackdoorLinux/Mirai", "display_name": "ALF:HeraklezEval:BackdoorLinux/Mirai", "target": null }, { "id": "ALF:HeraklezEval:Backdoor:Linux/Tsunami", "display_name": "ALF:HeraklezEval:Backdoor:Linux/Tsunami", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1404", "name": "Exploit OS Vulnerability", "display_name": "T1404 - Exploit OS Vulnerability" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1001.002", "name": "Steganography", "display_name": "T1001.002 - Steganography" }, { "id": "T1003.004", "name": "LSA Secrets", "display_name": "T1003.004 - LSA Secrets" }, { "id": "T1001.001", "name": "Junk Data", "display_name": "T1001.001 - Junk Data" }, { "id": "T1003.001", "name": "LSASS Memory", "display_name": "T1003.001 - LSASS Memory" }, { "id": "T1003.005", "name": "Cached Domain Credentials", "display_name": "T1003.005 - Cached Domain Credentials" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1026", "name": "Multiband Communication", "display_name": "T1026 - Multiband Communication" }, { "id": "T1562.004", "name": "Disable or Modify System Firewall", "display_name": "T1562.004 - Disable or Modify System Firewall" }, { "id": "T1025", "name": "Data from Removable Media", "display_name": "T1025 - Data from Removable Media" }, { "id": "T1055.002", "name": "Portable Executable Injection", "display_name": "T1055.002 - Portable Executable Injection" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1021.006", "name": "Windows Remote Management", "display_name": "T1021.006 - Windows Remote Management" }, { "id": "T1021", "name": "Remote Services", "display_name": "T1021 - Remote Services" } ], "industries": [ "Media", "LGBTQ+ Activists", "Technology", "Telecommunications", "Hospitality", "Energy", "NGO", "Semiconductor", "Human Subjects" ], "TLP": "white", "cloned_from": null, "export_count": 34, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 669, "URL": 1976, "email": 21, "hostname": 1198, "FileHash-SHA256": 277, "CVE": 2, "CIDR": 3 }, "indicator_count": 4146, "is_author": false, "is_subscribing": null, "subscriber_count": 33, "modified_text": "508 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66f837de06233b5ccdd84a81", "name": "The Real Jane Doe Syndrome Files", "description": "An array of scripts and files designed to completely compromise your MacBook and effectively erase your digital identity from the internet exists. This type of targeted attack is perpetrated by various groups for political or monetary agendas. It gradually takes over your devices and consumes your energy, time, career, and overall quality of life. In my case, the adversary involved is the DragonForce Malaysia Hacker Group.", "modified": "2024-10-28T16:02:26.345000", "created": "2024-09-28T17:07:42.479000", "tags": [ "copyright", "apple computer", "tcpip", "supported", "quantum", "automounter map", "use directory", "get home", "home autohome", "facility", "file", "level", "access", "level info", "broadcast", "store", "ignore", "rules", "sender", "true", "t option", "mount", "force", "environment", "automountdenv", "promptcommand", "shellsessiondir", "histfile", "histfilesize", "terminal", "myvar", "histtimeformat", "arrange", "bashrematch", "tell", "postfix", "mail", "aliases", "postfix version", "restrict", "wietse venema", "sample", "note", "person", "basic system", "general", "host database", "inpck", "nnnbaud", "berkeley", "parity", "pc entry", "pass8", "parenb istrip", "fixed speed", "entry", "clocal mode", "open directory", "jabber", "group database", "cyrus", "calendar", "dovecot", "postfix scsd", "networkd", "searchpaths", "freebsd", "tmpdir", "fcodes", "prunepaths", "vartmp", "prunedirs", "filesystems", "status mailfrom", "returnpath via", "maxhistsize", "promptmode", "verbose end", "etcirbrcloaded", "default", "setup", "history file", "kernel", "readline", "error", "nroff", "manpath", "uncomment", "manpager", "whatispager", "manlocale", "every", "manpath optman", "maybe", "troff", "refer", "pidfile", "flags", "bcgjnuwz", "ps1h", "make bash", "s checkwinsize", "etcbashrc", "termprogram", "daemon", "service", "server", "user", "audio", "user database", "unix copy", "protocol", "gate daemon", "desktop", "agent", "bridge", "bin usrsbin", "sbin", "default pf", "care", "bashno", "r etcbashrc", "ipv6", "internet", "icmp", "cisco", "monitoring", "argus", "chaos", "rsvp", "encapsulation", "aris", "isis", "rfc1323", "m1460", "macos x", "signature", "linux", "opera", "xp sp1", "windows sp1", "nmap syn", "m265", "direct", "unknown", "synack", "mind", "macos", "warp", "generic", "networkup", "term", "devnull", "common setup", "configure", "set command", "pathbin", "path", "netbootmount", "netbootshadow", "computername", "localonly", "localnetbootdir", "netboot", "define", "purpose", "networkonly", "waiting", "sunnet manager", "rpcsrc", "netlicense", "apple", "notice", "dns hostname", "dns query", "see also", "kame", "ftpd", "bindash binksh", "binsh bintcsh", "none", "fax reception", "hardwired", "0007", "setup user", "home", "zdotdir", "delete", "beep", "vendor", "kf10", "kf11", "kf12", "kf13", "backspace", "insert", "resume", "termsessionid", "savehist", "sharehistory", "addiconbytype", "adddescription", "directory", "fancyindexed", "gzip", "indexignore", "indexes", "versionsort", "fancyindexing", "alias icons", "format", "browsermatch", "davlockdb", "requireany", "webdav", "usergroup", "alias", "authtype digest", "davupload admin", "authuserfile", "apache", "full", "minrate500", "keepalive", "prod", "email", "apache http", "timeout", "number", "minimal", "major", "manual", "provide access", "options indexes", "require", "sethandler", "files", "removetype tr", "traditionally", "addlanguage da", "extendedstatus", "change", "require host", "get information", "allow server", "allow", "addlanguage", "addcharset", "defaultlanguage", "fallback", "polish", "addlanguage pl", "catalan", "english", "greekmodern", "korean", "turkish", "ifmodule", "threadsperchild", "startservers", "minsparethreads", "maxsparethreads", "maximum number", "mpms", "threadstacksize", "loadfile c", "html", "proxyhtmllinks", "first", "ascii", "unicode", "windows", "must", "location", "w3c html", "example", "sslsessioncache", "ocsp stapling", "ssl engine", "sslrequire", "ssltls standard", "prng", "sslrandomseed", "openssl", "high", "userdir sites", "control access", "userdir", "virtualhost", "servername", "virtualhost 80", "serveradmin", "documentroot", "errorlog", "customlog", "hosts", "please", "almost", "errorhttp", "http", "yourincludepath", "apache version", "serversignature", "alias error", "addhandler", "include", "serverroot", "listen", "ifdefine", "loadmodule", "errordocument", "win32", "main", "addtype", "directoryindex", "claim", "category", "time", "host", "threadid", "function", "line", "message", "level error", "a facility", "guest", "springboard", "message sep", "message mc", "message secure", "ca message", "multitouchhid", "usereventagent", "cups", "hp envy", "high duplex", "none colormodel", "gray gamma", "env10", "envc6", "envchou3", "envchou4", "envdl", "isob5", "false", "cups scheduler", "list", "synconclose no", "default user", "user lp", "group lp", "system", "group value", "limit", "order deny", "require user", "owner", "authtype", "default require", "authkey", "lpadmin", "restrict access", "d0 j", "acl account", "touch id", "airdrop anchor", "reject empty", "domain", "canonical", "tables", "ldap", "post", "replace user", "address", "bugs", "matches", "postfix smtp", "ipv6 host", "reject", "reply", "prior", "hold", "info", "smtp", "isp mail", "name", "mail delivery", "charset", "report", "postfix dsn", "mail returned", "this", "only", "program", "agreement", "contributor", "recipient", "contribution", "the program", "corporation", "contributors", "product x", "as expressly", "arch", "arch x8664", "pipe wall", "wimplicit", "ranlib", "warn", "switch", "start", "systype", "mime", "headerchecks", "readme files", "filters while", "posix", "empty", "body", "pass", "write", "date", "smtp server", "specify", "mx host", "unix password", "user unknown", "postfix queue", "unix", "beware", "class", "uucp", "shell", "local", "outlook", "postfix master", "begin", "server admin", "mail backend", "modern smtp", "iana", "many", "postfix pipe", "recent cyrus", "amos gouaux", "old example", "relocated", "matches user", "synopsis", "or even", "lutz jaenicke", "technology", "cottbus", "germany", "openssl package", "openssl project", "europe", "remember that", "use of", "virtual", "virtual alias", "redirect mail", "deliver mail", "transport", "description", "result format", "update", "usrsbin", "file format", "no group", "daemondirectory", "id key", "specification", "auto exit", "vpn socket", "ipv4v6", "userfqdn", "fqdn", "auditing", "solaris", "reserved", "openbsm", "secsrvr", "allocation", "bsm event", "solaris kernel", "openbsm kernel", "solaris auemac", "solaris umount", "removed", "Aishah Siti Lazim" ], "references": [ "afpovertcp.cfg", "auto_home", "auto_master", "asl.conf", "autofs.conf", "com.apple.screensharing.agent.launchd", "bashrc_Apple_Terminal", "csh.cshrc", "csh.login", "aliases", "csh.logout", "find.codes", "ftpusers", "hosts", "gettytab", "hosts.equiv", "kern_loader.conf", "group", "locate.rc", "mail.rc", "irbrc", "manpaths", "man.conf", "networks", "newsyslog.conf", "nfs.conf", "bashrc", "ntp_opendirectory.conf", "nsmb.conf", "ntp.conf", "passwd", "paths", "pf.conf", "profile", "notify.conf", "protocols", "pf.os", "rc.common", "rc.netboot", "rpc", "rmtab", "resolv.conf", "rtadvd.conf", "shells", "syslog.conf", "ttys", "xtab", "zprofile", "zshrc", "zshrc_Apple_Terminal", "httpd-autoindex.conf", "httpd-dav.conf", "httpd-default.conf", "httpd-manual.conf", "httpd-info.conf", "httpd-languages.conf", "httpd-mpm.conf", "proxy-html.conf", "httpd-ssl.conf", "httpd-userdir.conf", "httpd-vhosts.conf", "httpd-multilang-errordoc.conf", "httpd.conf", "mpm.conf", "php7.conf", "johndoe.conf", "com.apple.cdscheduler", "com.apple.contacts.ContactsAutocomplete", "com.apple.authd", "com.apple.eventmonitor", "com.apple.mail", "com.apple.iokit.power", "com.apple.MessageTracer", "com.apple.login.guest", "com.apple.install", "com.apple.networking.boringssl", "com.apple.performance", "com.apple.mkb.internal", "com.apple.coreduetd", "com.apple.mkb", "snmp.conf", "snmp.conf.default", "HP_ENVY_6000_series__3D66E1_.ppd", "cups-files.conf", "cups-files.conf.default", "cupsd.conf.default", "cupsd.conf", "com.apple.slapd.conf", "com.apple.xscertd.conf", "files.conf", "com.apple.slapconfig.conf", "authorization", "authorization_la", "authorization_ctk", "authorization_aks", "checkpw", "authorization_lacont", "chkpasswd", "cups", "login.term", "login", "other", "screensaver", "screensaver_new", "screensaver_aks", "screensaver_la", "screensaver_new_ctk", "screensaver_new_la", "screensaver_new_aks", "smbd", "sshd", "screensaver_ctk", "su", "sudo", "sudo_local.template", "10-cryptex", "com.apple", "custom_header_checks", "canonical", "access", "generic", "bounce.cf.default", "LICENSE", "makedefs.out", "header_checks", "main.cf", "main.cf.proto", "master.cf.default", "master.cf.proto", "main.cf.default", "master.cf", "relocated", "TLS_LICENSE", "virtual", "transport", "postfix-files", "racoon.conf", "psk.txt", "audit_warn", "audit_class", "audit_event", "audit_user", "audit_control.example" ], "public": 1, "adversary": "DragonForce Hacker Group Malaysia, Al-Arqam", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 36, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 285, "URL": 618, "hostname": 306, "email": 21, "FileHash-SHA256": 219, "CIDR": 3 }, "indicator_count": 1452, "is_author": false, "is_subscribing": null, "subscriber_count": 32, "modified_text": "538 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66ce3eb4b4f1fc9eafb4b572", "name": "DDoS:Linux/Lightaidra | Mirai Botnet on US a State Computer", "description": "*Mirai Botnet on Colorado State computer. Im starting to wonder if potential problem cases are diverted to a botnet.\n1. Overlaps with a Colorado victim. Similar issues. I Recently became a senior in expensive Colorado, never compensated for workers compensation injury exacerbated when suddenly tossed a 60 lb weighted ball under care. Denied diagnoses of severe injury after toss. Complained, case closed, lawyers denied case after accepting case. Referred to JeffCo seeking assisted living resources. Was sent various packets with a variety of phone numbers, email addresses, etc. She keeps speaking to same man no matter what option chosen. Denied workforce training due to severity of injuries, No SSI or SSDI until years later. \n2. I can't pulse half of what I've researched without using multiple resources. No more 'contacted' made when new serious issues found. Pulses being modified. I rarely modify any pulse.", "modified": "2024-09-26T20:01:27.723000", "created": "2024-08-27T21:01:40.251000", "tags": [ "memcommit", "read c", "nospltezraxuf", "writeconsolea", "write", "CVE-2023-22518", "tesla", "ye ye", "incapril", "yed ye", "yet ye", "yexe ye", "security", "search", "function read", "dll read", "installer", "april", "copy", "win32", "template", "creation date", "servers", "passive dns", "urls", "name servers", "scan endpoints", "all scoreblue", "hostname", "pulse pulses", "date", "windows", "medium", "shellexecuteexw", "hash", "show", "writeconsolew", "entries", "displayname", "sddl", "service", "august", "malware", "url http", "http", "ip address", "related nids", "files location", "domain", "status", "nxdomain", "whitelisted", "certificate", "backdoor", "record value", "body", "as15133 verizon", "united", "unknown", "mtb aug", "gmt server", "ecacc sed5906", "ransom", "trojan", "high", "cname", "as8075", "ipv4", "files", "asn as55720", "date hash", "default", "delete", "yara detections", "msvisualcpp60", "related pulses", "rootkit", "as16276", "canada unknown", "pulses", "expiration date", "exploit", "showing", "aaaa", "france unknown", "mtb sep", "worm", "msil", "mirai", "as36081 state", "reverse dns", "port", "destination", "south korea", "taiwan as3462", "as4766 korea", "asnone", "japan as17676", "china as4134", "china as4837", "file samples", "files matching", "next", "copyright", "levelblue", "as20940", "as15169 google", "ave suite", "purpose p5", "country united", "code us", "as41231", "united kingdom", "ddos", "sha256", "filehash", "av detections", "location london", "great britain", "gnulinux apt", "yara rule", "ids detections", "top source", "address", "as23969", "thailand" ], "references": [ "In this instance a senior citizen needing assisted living resources redirected & social engineered by addresses originated from: jefferson.co.us", "Noted: Calls redirected, call jumps ahead of 25+ callers in wait, keeps getting same agent, told approved for services never applied for or received", "Exploits: IPv4 20.99.186.246 | 52.109.0.140 | CVE CVE-2023-22518 | Trojans: AgentTesla.KM , Cobalt Strike , Ransom: WannaCrypt , Malware: Dxqo", "Domain Name: IUQERFSODP9IFJAPOSDFJHGOSURIJFAEWRWERGWEA.COM Emails: BotnetSinkhole@gmail.com", "Emails: abuse@namecheap.com Name: Botnet Sinkhole | Address: Botnet Sinkhole City: Los Angeles Country: USA", "Dnssec:Unsigned | Name Servers | BRUCE.NS.CLOUDFLARE.COM", "Notable: Mirai - 192.70.175.110 Security Operations (DORA?) oit_isocsecurity@state.co.us | state.co.us | Reverse DNS dns1.state.co.us", "Unix.Trojan.Mirai-6976991-0 : FileHash-SHA256 a282f250e59f8754335993293bfbfcc154cdb67ff0e234162f40a6cce5c4290c", "ELF:Mirai-AII\\ [Trj] | FileHash-SHA256 760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9", "Overlaps: 4 others mailed information email address.", "Ransom:Win32/WannaCrypt.H", "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com | CVE-2017-0147", "AS36081 State of Colorado General Government Computer", "Yara Detections Mirai_Botnet_Malware Alerts: dead_host network_icmp osquery_detection nolookup_communication", "ELF:Mirai-AII\\ [Trj] | FileHash-SHA256: 760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9", "Detections Executable and linking format (ELF) file download Over HTTP |", "FileHash-SHA256 : 256760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9", "Yara Detections: UPXProtectorv10x2 , UPX , ELFHighEntropy , elf_empty_sections Alerts: dead_host | ELF:Mirai-AII\\ [Trj]", "77882 IP\u2019s Contacted: 1.1.69.67 1.10.237.208 1.101.233.31 1.102.46.59 1.103.37.126 1.105.106.252 1.106.108.182 1.106.193.143 1.109.132.165 1.11.116.209", "Domains Contacted: ntp.ubuntu.com | IDS Detections GNU/Linux APT User-Agent Outbound likely related to package management | 91.189.89.198", "Yara Detections: gafgyt IP\u2019s Contacted: 91.189.89.198 Domains Contacted :ntp.ubuntu.com", "FileHash-SHA256: a0f50a7b0f9717589000b3414017bdcfcb9d3f6a3e5e03fe49c4dc8035e0d25c", "Related Domains: townofignacio.com | coloradoagriculture.com | coloradoworkforce.com | coworkforce.com | coloradoccjj.com | dns1.state.co.us", "https://www.rapidinterviews.com/api/jobs/redirect/public-transit-bus-drivers-with-utah-transit-authority-in-stansbury-park-apc-1932", "https://us.thebigjobsite.com/redirectfeedjob?jobid=2A5F97A6BAE0AA90DC418C2119E1E0EB&source=onestepjobsxmlus&utm_source=onestepjobsxmlus&jobSiteK", "redirect.wuxs.icu", "https://a-a.redirector.navexglobal.com/navex_hosting/404.html", "https://engage.navexglobal.com/topclass1/login.do?redirectTo=/expand.do?template=JasperReports&view=library" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "ALF:Trojan:MSIL/AgentTesla.KM", "display_name": "ALF:Trojan:MSIL/AgentTesla.KM", "target": null }, { "id": "Win.Trojan.CobaltStrike-9044898-1", "display_name": "Win.Trojan.CobaltStrike-9044898-1", "target": null }, { "id": "Win.Malware.Dxqo-6984072-0", "display_name": "Win.Malware.Dxqo-6984072-0", "target": null }, { "id": "Ransom:Win32/WannaCrypt", "display_name": "Ransom:Win32/WannaCrypt", "target": "/malware/Ransom:Win32/WannaCrypt" }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Backdoor:Win32/Fynloski", "display_name": "Backdoor:Win32/Fynloski", "target": "/malware/Backdoor:Win32/Fynloski" }, { "id": "Worm:Win32/Mofksys", "display_name": "Worm:Win32/Mofksys", "target": "/malware/Worm:Win32/Mofksys" }, { "id": "TELPER:DDoS:Linux/Lightaidra", "display_name": "TELPER:DDoS:Linux/Lightaidra", "target": null } ], "attack_ids": [ { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1036.004", "name": "Masquerade Task or Service", "display_name": "T1036.004 - Masquerade Task or Service" }, { "id": "T1009", "name": "Binary Padding", "display_name": "T1009 - Binary Padding" }, { "id": "T1499", "name": "Endpoint Denial of Service", "display_name": "T1499 - Endpoint Denial of Service" }, { "id": "T1498", "name": "Network Denial of Service", "display_name": "T1498 - Network Denial of Service" }, { "id": "T1464", "name": "Jamming or Denial of Service", "display_name": "T1464 - Jamming or Denial of Service" } ], "industries": [ "Telecom" ], "TLP": "green", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-MD5": 675, "FileHash-SHA1": 664, "FileHash-SHA256": 3327, "URL": 2448, "domain": 656, "hostname": 1281, "email": 11 }, "indicator_count": 9064, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "570 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65fc4d4c24f2000879921be5", "name": "The Org : FormBook CnC | Pykspa", "description": "Front Facing Description: 'TheOrg' (https://theorg.com) The Org\nThe Org is an online professional community platform. It helps organizations get more exposure externally and operate more efficiently internally. | efficiently internally | Nefarious scheme? Unclear. Possible visa, immigration scheme. | Pykspa is a piece of malware that can be used to remotely control infected systems. It also enables attackers to. download other malware or extract personal data. || Dark. | Score 100% Falcon Sandbox | Evasive. Moved permanently 03/21/2024 | FormBook is an infostealer of browser cached credentials , screenshots, keystrokes. | Tags auto populated", "modified": "2024-04-20T14:04:02.366000", "created": "2024-03-21T15:07:56.415000", "tags": [ "q https", "https", "enablement", "org log", "sign", "contact", "right person", "explore", "start", "grafana labs", "ogilvy", "figma", "find", "apollo", "http", "span", "learn", "html", "expiry", "form", "label", "youtube video", "linkedin", "input", "pixel", "legend", "cookie", "march", "de indicators", "domains", "hashes", "gmbh version", "status page", "service privacy", "legal", "impressum", "reverse dns", "general full", "url https", "protocol h2", "security tls", "united", "resource", "asn16509", "amazon02", "name value", "main", "ssl certificate", "whois record", "whois whois", "resolutions", "threat roundup", "communicating", "referrer", "subdomains", "historical ssl", "collections", "june", "february", "blister", "cobalt strike", "phishing", "formbook", "contacted", "ip check", "adult content", "divergent", "hacktool", "copy", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers age", "cachecontrol", "connection", "tsara brashears", "malicious", "life", "core", "dns replication", "date", "win32 exe", "files", "detections type", "name", "wininit", "office open", "xml document", "qiwi hack", "android", "mgeinteg", "html info", "title", "org meta", "tags viewport", "org twitter", "org og", "the org", "utc google", "tag manager", "g5nxq655fgp", "domain", "search", "status", "scan endpoints", "all scoreblue", "hostname", "pulse pulses", "passive dns", "urls", "bhagam bhag", "home screen", "entries", "createdate", "title bhagam", "select xmp", "filehash", "malware", "format", "unknown", "meta", "as44273 host", "creation date", "moved", "encrypt", "district", "body", "window", "hall law", "a domains", "script urls", "datalayer", "registrar", "next", "accept encoding", "showing", "yara rule", "http host", "worm", "high", "possible", "win32", "bits", "cname", "as396982 google", "redacted for", "expiration date", "div div", "as26710 icann", "script domains", "citadel", "indonesia", "get updates", "write c", "create c", "read c", "show", "default", "common upatre", "upatre", "downloader", "zeus", "write", "execution", "regsetvalueexa", "regdword", "module load", "dock", "persistence", "as54113", "github pages", "formbook cnc", "checkin", "lowfi", "class", "trojan", "accept", "visa scheme", "mtb feb", "mtb jan", "romeo scheme", "exploitation", "pattern match", "command decode", "mitre att", "suricata ipv4", "ck id", "show technique", "ck matrix", "suricata udpv4", "facebook", "hybrid", "general", "model", "comspec", "click", "strings", "footer", "michelle", "nora", "hallrender", "name servers", "record value", "emails", "servers", "found", "gmt content", "error", "code", "men", "man", "woman", "hit", "sreredrum", "honey client", "hiv", "threat", "paste", "iocs", "urls https", "malicious site", "phishing site", "blockchain", "unsafe", "malware site", "malicious url", "phishtank", "cyber threat", "artemis", "asyncrat", "team", "cisco umbrella", "site", "safe site", "heur", "million", "xrat", "downldr", "union", "bank", "gvt google video transcoding", "malvertizing", "targeting", "target", "yandex dropper extend", "remote procedure call", "identity_helper.exe", "cookie bot" ], "references": [ "https://theorg.com", "Ransom: CVE-2023-4966", "Ransom: ransomed.vc", "FormBook: a4ec4c6ea1c92e2e6.awsglobalaccelerator.com", "Malware: http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel | 103.246.145.111", "Malware: 0a6e883228a04a6e8738511a6210914dea1773d88cf57950c83e092f02c7f3bf - Other:Malware-gen\\ [Trj]", "Yara Detections invalid_trailer_structure , multiple_versions", "Malware Hosting IP addresses: 141.193.213.20 | 185.199.108.153| 185.199.110.153 | 185.199.111.153", "https://otx.alienvault.com/indicator/url/https://theorg.com/_next/data/Gh7c6NpBHZESb74aisPB8/org/springboard-collaborative.json?companySlug=springboard-collaborative", "Scanning host: 31.214.178.54 , 37.152.88.54", "Yara Detections: vad_contains_network_strings information | HackToolWin32Patch CodeOverlap | PWSWin32Phorex CodeOverlap", "Yara: TrojanDropperWin32Ropest | CodeOverlap TrojanWin32Gatsorm | CodeOverlap TrojanWinNTConficker | CodeOverlap Alerts: WormWin32Pykspa", "Aspnet collect: https://otx.alienvault.com/otxapi/indicators/file/screenshot/000444cc67b97f45f11e1fdf89ad8f5127c87aa858fe151fa9c4975276f53b42", "development.digitalphotogallery.com _YandexDropperExtend", "Emotet: FileHash-MD5 bafae95c36402dfc1ea5fa04523e4e81", "Emotet: FileHash-SHA256 db9d59b0f192c91f8ecf939c415b3252b13b0fb052d4a66ceefb80dfb43d6e8a |", "Emotet: FileHash-SHA1\t19c14ab0aaab2c1dd922f0baca3cf64056f80acc", "thevisafirm.com | Immigration Lawyers Capital Immigration Lawyers Green Card Lawyer [ London, DC] malicious", "www.hallinjurylaw.com |\tMinneapolis Personal Injury Lawyer Personal Injury Law Experts", "Malvertizing, Phishing, Botnet PWD: https://pin.it/ | https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | www.pornhub.com", "Phishing, Botnet PWD:https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing | https://www.sweetheartvideo.com/tsara-brashears/ | www.sweetheartvideo.com", "https://hybrid-analysis.com/sample/ac09d7f6b26675a529a366b47bc09b3fd776576fb099c020f57204ff7b4ea31c", "CVE-2007-3896 | CVE-2023-22518 | CVE-2023-4966", "jpocxaar1---r3---sn-jpocxaa-a03e.gvt1.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "United Kingdom of Great Britain and Northern Ireland" ], "malware_families": [ { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Win32:Renos-KY\\ [Trj]", "display_name": "Win32:Renos-KY\\ [Trj]", "target": null }, { "id": "Win.Worm.Pykspa-1", "display_name": "Win.Worm.Pykspa-1", "target": null }, { "id": "Worm:Win32/Pykspa.C", "display_name": "Worm:Win32/Pykspa.C", "target": "/malware/Worm:Win32/Pykspa.C" }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Ransom", "display_name": "Ransom", "target": null }, { "id": "ApolloLocker", "display_name": "ApolloLocker", "target": null }, { "id": "TrojanDropper:Win32", "display_name": "TrojanDropper:Win32", "target": null }, { "id": "Other:Malware-gen\\ [Trj]", "display_name": "Other:Malware-gen\\ [Trj]", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1059.006", "name": "Python", "display_name": "T1059.006 - Python" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [ "Media", "Immigration", "Technology", "Government" ], "TLP": "green", "cloned_from": null, "export_count": 55, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4567, "domain": 2576, "hostname": 1212, "FileHash-SHA256": 3836, "FileHash-MD5": 744, "FileHash-SHA1": 724, "CVE": 5, "email": 9, "SSLCertFingerprint": 1 }, "indicator_count": 13674, "is_author": false, "is_subscribing": null, "subscriber_count": 232, "modified_text": "729 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65e57f32581a900dfb272d05", "name": "FormBook | 172.31.13.249", "description": "", "modified": "2024-04-03T05:03:03.527000", "created": "2024-03-04T07:58:42.074000", "tags": [ "resolutions", "referrer", "siblings", "asn owner", "historical ssl", "contacted", "high level", "hackers", "formbook", "name verdict", "falcon sandbox", "report", "united", "registrar", "creation date", "search", "emails", "name", "name servers", "showing", "unknown", "scan endpoints", "date", "next", "root ca", "pattern match", "authority", "beginstring", "class", "mitre att", "global root", "ck id", "show technique", "ck matrix", "null", "accept", "refresh", "span", "error", "tools", "body", "look", "verify", "restart", "hybrid", "local", "click", "strings", "files files", "ssl certificate", "tsara brashears", "highly targeted", "ransomware", "dark power", "play ransomware", "malware", "core", "installer", "awful", "snatch", "metro", "service", "critical", "copy", "execution", "location united", "asn as15169", "less whois", "as15169 google", "status", "entries", "record value", "servers", "trojan", "win32", "aaaa", "worm", "passive dns", "gmt cache", "sameorigin", "all scoreblue", "ipv4", "lowfi", "domain related", "urls", "domain", "nxdomain", "hostname", "users", "yara detections", "alerts", "high", "filehash", "pulse pulses", "av detections", "ids detections", "musicmaid", "reader", "office standard", "high process", "injection t1055", "t1055", "x00x00", "icmp traffic", "injection", "hijacker", "password", "stealer", "corruption", "targeting", "172.31.13.249" ], "references": [ "gstatic.com", "Unsupported/Fake Windows NT Version 5.0", "Login privileges", "172.31.13.249" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Worm:Win32/Mofksys.RND!MTB", "display_name": "Worm:Win32/Mofksys.RND!MTB", "target": "/malware/Worm:Win32/Mofksys.RND!MTB" }, { "id": "Trojan:Win32/Dorv.B!rfn", "display_name": "Trojan:Win32/Dorv.B!rfn", "target": "/malware/Trojan:Win32/Dorv.B!rfn" }, { "id": "Trojan:Win32/Zombie.A", "display_name": "Trojan:Win32/Zombie.A", "target": "/malware/Trojan:Win32/Zombie.A" }, { "id": "Trojan:Win32/QQpass", "display_name": "Trojan:Win32/QQpass", "target": "/malware/Trojan:Win32/QQpass" }, { "id": "Trojan:Win32/Antavmu.D", "display_name": "Trojan:Win32/Antavmu.D", "target": "/malware/Trojan:Win32/Antavmu.D" }, { "id": "PWS:MSIL/Dcstl.GD!MTB", "display_name": "PWS:MSIL/Dcstl.GD!MTB", "target": "/malware/PWS:MSIL/Dcstl.GD!MTB" }, { "id": "#Lowfi:HSTR:MSIL/PossibleDownloader.S01", "display_name": "#Lowfi:HSTR:MSIL/PossibleDownloader.S01", "target": null }, { "id": "Win32:MalwareX-gen\\ [Trj]", "display_name": "Win32:MalwareX-gen\\ [Trj]", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1100", "name": "Web Shell", "display_name": "T1100 - Web Shell" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1110.002", "name": "Password Cracking", "display_name": "T1110.002 - Password Cracking" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1070.004", "name": "File Deletion", "display_name": "T1070.004 - File Deletion" }, { "id": "T1107", "name": "File Deletion", "display_name": "T1107 - File Deletion" }, { "id": "T1447", "name": "Delete Device Data", "display_name": "T1447 - Delete Device Data" }, { "id": "T1114.002", "name": "Remote Email Collection", "display_name": "T1114.002 - Remote Email Collection" }, { "id": "T1002", "name": "Data Compressed", "display_name": "T1002 - Data Compressed" } ], "industries": [], "TLP": "white", "cloned_from": "65e576d419524d75af35a36e", "export_count": 45, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3117, "FileHash-MD5": 280, "FileHash-SHA1": 286, "FileHash-SHA256": 3773, "domain": 1264, "hostname": 1595, "email": 6, "CVE": 5 }, "indicator_count": 10326, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "747 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65e576d419524d75af35a36e", "name": "FormBook", "description": "FormBook is an infostealer malware (malicious spyware). malicious code uses various hooks to gain access to keystrokes, screenshots, and other functions. The malware can also receive commands from its operator to steal information from browsers or download and execute other malware. As a MaaS offering, FormBook malware may be deployed by various threat actors. It's currently being use by a ,legal teams masquerading as government (might be \nlegitimate attorneys) law firm modifying and deleting front facing threats on various platforms. One firm has very poor reviews Corrupt. Others initiate malicious prosecution law suits. Social; engineering , intertwining malicious behavior.in every aspect of targets life from business banking, ancestry to aggressive match making attempts.", "modified": "2024-04-03T05:03:03.527000", "created": "2024-03-04T07:23:00.177000", "tags": [ "resolutions", "referrer", "siblings", "asn owner", "historical ssl", "contacted", "high level", "hackers", "formbook", "name verdict", "falcon sandbox", "report", "united", "registrar", "creation date", "search", "emails", "name", "name servers", "showing", "unknown", "scan endpoints", "date", "next", "root ca", "pattern match", "authority", "beginstring", "class", "mitre att", "global root", "ck id", "show technique", "ck matrix", "null", "accept", "refresh", "span", "error", "tools", "body", "look", "verify", "restart", "hybrid", "local", "click", "strings", "files files", "ssl certificate", "tsara brashears", "highly targeted", "ransomware", "dark power", "play ransomware", "malware", "core", "installer", "awful", "snatch", "metro", "service", "critical", "copy", "execution", "location united", "asn as15169", "less whois", "as15169 google", "status", "entries", "record value", "servers", "trojan", "win32", "aaaa", "worm", "passive dns", "gmt cache", "sameorigin", "all scoreblue", "ipv4", "lowfi", "domain related", "urls", "domain", "nxdomain", "hostname", "users", "yara detections", "alerts", "high", "filehash", "pulse pulses", "av detections", "ids detections", "musicmaid", "reader", "office standard", "high process", "injection t1055", "t1055", "x00x00", "icmp traffic", "injection", "hijacker", "password", "stealer", "corruption", "targeting", "172.31.13.249" ], "references": [ "gstatic.com", "Unsupported/Fake Windows NT Version 5.0", "Login privileges", "172.31.13.249" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Worm:Win32/Mofksys.RND!MTB", "display_name": "Worm:Win32/Mofksys.RND!MTB", "target": "/malware/Worm:Win32/Mofksys.RND!MTB" }, { "id": "Trojan:Win32/Dorv.B!rfn", "display_name": "Trojan:Win32/Dorv.B!rfn", "target": "/malware/Trojan:Win32/Dorv.B!rfn" }, { "id": "Trojan:Win32/Zombie.A", "display_name": "Trojan:Win32/Zombie.A", "target": "/malware/Trojan:Win32/Zombie.A" }, { "id": "Trojan:Win32/QQpass", "display_name": "Trojan:Win32/QQpass", "target": "/malware/Trojan:Win32/QQpass" }, { "id": "Trojan:Win32/Antavmu.D", "display_name": "Trojan:Win32/Antavmu.D", "target": "/malware/Trojan:Win32/Antavmu.D" }, { "id": "PWS:MSIL/Dcstl.GD!MTB", "display_name": "PWS:MSIL/Dcstl.GD!MTB", "target": "/malware/PWS:MSIL/Dcstl.GD!MTB" }, { "id": "#Lowfi:HSTR:MSIL/PossibleDownloader.S01", "display_name": "#Lowfi:HSTR:MSIL/PossibleDownloader.S01", "target": null }, { "id": "Win32:MalwareX-gen\\ [Trj]", "display_name": "Win32:MalwareX-gen\\ [Trj]", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1100", "name": "Web Shell", "display_name": "T1100 - Web Shell" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1110.002", "name": "Password Cracking", "display_name": "T1110.002 - Password Cracking" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1070.004", "name": "File Deletion", "display_name": "T1070.004 - File Deletion" }, { "id": "T1107", "name": "File Deletion", "display_name": "T1107 - File Deletion" }, { "id": "T1447", "name": "Delete Device Data", "display_name": "T1447 - Delete Device Data" }, { "id": "T1114.002", "name": "Remote Email Collection", "display_name": "T1114.002 - Remote Email Collection" }, { "id": "T1002", "name": "Data Compressed", "display_name": "T1002 - Data Compressed" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 45, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3117, "FileHash-MD5": 280, "FileHash-SHA1": 286, "FileHash-SHA256": 3773, "domain": 1264, "hostname": 1595, "email": 6, "CVE": 5 }, "indicator_count": 10326, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "747 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65aaba128167bfe90a0ab7e8", "name": "LockBit | Apple iOS HackTool | CVE 2023-4966 (Citrix Bleed)", "description": "", "modified": "2024-02-17T02:03:48.897000", "created": "2024-01-19T18:06:10.095000", "tags": [ "ssl certificate", "network", "malware", "contacted", "referrer", "whois record", "communicating", "highly targeted", "apple ios", "tsara brashears", "core", "hacktool", "emotet", "copy", "installer", "formbook", "ransomware", "critical", "benjamin", "phishing", "trojan", "worm", "date", "passive dns", "urls", "search", "status", "nxdomain", "scan endpoints", "all octoseek", "hostname", "pulse submit", "name verdict", "falcon sandbox", "reports", "falcon", "getprocaddress", "windir", "json data", "localappdata", "ascii text", "unicode text", "pattern match", "file", "indicator", "mitre att", "path", "factory", "hybrid", "general", "united", "as40528 icann", "unknown", "as26710 icann", "pulse pulses", "showing", "as16876 icann", "aaaa", "certificate", "domain", "gandi sas", "files", "adware", "cybercrime", "malvertizing", "password stealer", "ios unlocker", "beautiful", "model", "songwriter", "pornhub", "fireeye", "espionage", "targeting" ], "references": [ "http://103.246.145.111/gate.php?hwid=WALKER-PC-WALKER&os=Windows%207%20Enterprise&cpu=Intel", "nr-data.net [Apple Private Data Collection]", "https://stackabuse.com/assets/images/apple", "https://hybrid-analysis.com/sample/772d7c597071913ba41e1b0f6b24bbb9d512cbe8f884e482a2d187f5a95281bc/65a880b7d29f11c8c30ad32e", "CVE-2023-4966", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a", "What Is LockBit Ransomware? BlackBerry https://www.blackberry.com \u203a ransomware-protection", "https://github.com/MISP/misp-galaxy/blame/master/clusters/threat-actor.json" ], "public": 1, "adversary": "LockBit 3.0 Ransomware Affiliates", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Worm:Win32/Benjamin", "display_name": "Worm:Win32/Benjamin", "target": "/malware/Worm:Win32/Benjamin" }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "LockBit", "display_name": "LockBit", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" } ], "industries": [ "Government", "Civil society", "Private Sector", "Telecommunications" ], "TLP": "white", "cloned_from": "65a89d024f9153ccae3a8500", "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 48, "FileHash-SHA1": 46, "FileHash-SHA256": 2869, "URL": 2492, "CVE": 2, "domain": 1079, "hostname": 817, "SSLCertFingerprint": 2, "email": 3 }, "indicator_count": 7358, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "793 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65aaba12436a318c6567cba8", "name": "LockBit | Apple iOS HackTool | CVE 2023-4966 (Citrix Bleed)", "description": "", "modified": "2024-02-17T02:03:48.897000", "created": "2024-01-19T18:06:10.934000", "tags": [ "ssl certificate", "network", "malware", "contacted", "referrer", "whois record", "communicating", "highly targeted", "apple ios", "tsara brashears", "core", "hacktool", "emotet", "copy", "installer", "formbook", "ransomware", "critical", "benjamin", "phishing", "trojan", "worm", "date", "passive dns", "urls", "search", "status", "nxdomain", "scan endpoints", "all octoseek", "hostname", "pulse submit", "name verdict", "falcon sandbox", "reports", "falcon", "getprocaddress", "windir", "json data", "localappdata", "ascii text", "unicode text", "pattern match", "file", "indicator", "mitre att", "path", "factory", "hybrid", "general", "united", "as40528 icann", "unknown", "as26710 icann", "pulse pulses", "showing", "as16876 icann", "aaaa", "certificate", "domain", "gandi sas", "files", "adware", "cybercrime", "malvertizing", "password stealer", "ios unlocker", "beautiful", "model", "songwriter", "pornhub", "fireeye", "espionage", "targeting" ], "references": [ "http://103.246.145.111/gate.php?hwid=WALKER-PC-WALKER&os=Windows%207%20Enterprise&cpu=Intel", "nr-data.net [Apple Private Data Collection]", "https://stackabuse.com/assets/images/apple", "https://hybrid-analysis.com/sample/772d7c597071913ba41e1b0f6b24bbb9d512cbe8f884e482a2d187f5a95281bc/65a880b7d29f11c8c30ad32e", "CVE-2023-4966", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a", "What Is LockBit Ransomware? BlackBerry https://www.blackberry.com \u203a ransomware-protection", "https://github.com/MISP/misp-galaxy/blame/master/clusters/threat-actor.json" ], "public": 1, "adversary": "LockBit 3.0 Ransomware Affiliates", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Worm:Win32/Benjamin", "display_name": "Worm:Win32/Benjamin", "target": "/malware/Worm:Win32/Benjamin" }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "LockBit", "display_name": "LockBit", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" } ], "industries": [ "Government", "Civil society", "Private Sector", "Telecommunications" ], "TLP": "white", "cloned_from": "65a89d024f9153ccae3a8500", "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 48, "FileHash-SHA1": 46, "FileHash-SHA256": 2869, "URL": 2492, "CVE": 2, "domain": 1079, "hostname": 817, "SSLCertFingerprint": 2, "email": 3 }, "indicator_count": 7358, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "793 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65aaba0fe5834eef98066f6e", "name": "LockBit | Apple iOS HackTool | CVE 2023-4966 (Citrix Bleed)", "description": "", "modified": "2024-02-17T02:03:48.897000", "created": "2024-01-19T18:06:07.730000", "tags": [ "ssl certificate", "network", "malware", "contacted", "referrer", "whois record", "communicating", "highly targeted", "apple ios", "tsara brashears", "core", "hacktool", "emotet", "copy", "installer", "formbook", "ransomware", "critical", "benjamin", "phishing", "trojan", "worm", "date", "passive dns", "urls", "search", "status", "nxdomain", "scan endpoints", "all octoseek", "hostname", "pulse submit", "name verdict", "falcon sandbox", "reports", "falcon", "getprocaddress", "windir", "json data", "localappdata", "ascii text", "unicode text", "pattern match", "file", "indicator", "mitre att", "path", "factory", "hybrid", "general", "united", "as40528 icann", "unknown", "as26710 icann", "pulse pulses", "showing", "as16876 icann", "aaaa", "certificate", "domain", "gandi sas", "files", "adware", "cybercrime", "malvertizing", "password stealer", "ios unlocker", "beautiful", "model", "songwriter", "pornhub", "fireeye", "espionage", "targeting" ], "references": [ "http://103.246.145.111/gate.php?hwid=WALKER-PC-WALKER&os=Windows%207%20Enterprise&cpu=Intel", "nr-data.net [Apple Private Data Collection]", "https://stackabuse.com/assets/images/apple", "https://hybrid-analysis.com/sample/772d7c597071913ba41e1b0f6b24bbb9d512cbe8f884e482a2d187f5a95281bc/65a880b7d29f11c8c30ad32e", "CVE-2023-4966", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a", "What Is LockBit Ransomware? BlackBerry https://www.blackberry.com \u203a ransomware-protection", "https://github.com/MISP/misp-galaxy/blame/master/clusters/threat-actor.json" ], "public": 1, "adversary": "LockBit 3.0 Ransomware Affiliates", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Worm:Win32/Benjamin", "display_name": "Worm:Win32/Benjamin", "target": "/malware/Worm:Win32/Benjamin" }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "LockBit", "display_name": "LockBit", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" } ], "industries": [ "Government", "Civil society", "Private Sector", "Telecommunications" ], "TLP": "white", "cloned_from": "65a89d024f9153ccae3a8500", "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 48, "FileHash-SHA1": 46, "FileHash-SHA256": 2869, "URL": 2492, "CVE": 2, "domain": 1079, "hostname": 817, "SSLCertFingerprint": 2, "email": 3 }, "indicator_count": 7358, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "793 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65a89d024f9153ccae3a8500", "name": "LockBit | Apple iOS HackTool | CVE 2023-4966 (Citrix Bleed)", "description": "LockBit seeks initial access to target networks primarily through purchased access, unpatched vulnerabilities, insider access, and zero-day exploits. \n\nCVE 2023-4966 (Citrix Bleed) to bypass password requirements and multifactor authentication (MFA), leading to successful session hijacking of legitimate user sessions on Citrix NetScaler web application delivery control (ADC) and Gateway appliances.", "modified": "2024-02-17T02:03:48.897000", "created": "2024-01-18T03:37:38.334000", "tags": [ "ssl certificate", "network", "malware", "contacted", "referrer", "whois record", "communicating", "highly targeted", "apple ios", "tsara brashears", "core", "hacktool", "emotet", "copy", "installer", "formbook", "ransomware", "critical", "benjamin", "phishing", "trojan", "worm", "date", "passive dns", "urls", "search", "status", "nxdomain", "scan endpoints", "all octoseek", "hostname", "pulse submit", "name verdict", "falcon sandbox", "reports", "falcon", "getprocaddress", "windir", "json data", "localappdata", "ascii text", "unicode text", "pattern match", "file", "indicator", "mitre att", "path", "factory", "hybrid", "general", "united", "as40528 icann", "unknown", "as26710 icann", "pulse pulses", "showing", "as16876 icann", "aaaa", "certificate", "domain", "gandi sas", "files", "adware", "cybercrime", "malvertizing", "password stealer", "ios unlocker", "beautiful", "model", "songwriter", "pornhub", "fireeye", "espionage", "targeting" ], "references": [ "http://103.246.145.111/gate.php?hwid=WALKER-PC-WALKER&os=Windows%207%20Enterprise&cpu=Intel", "nr-data.net [Apple Private Data Collection]", "https://stackabuse.com/assets/images/apple", "https://hybrid-analysis.com/sample/772d7c597071913ba41e1b0f6b24bbb9d512cbe8f884e482a2d187f5a95281bc/65a880b7d29f11c8c30ad32e", "CVE-2023-4966", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a", "What Is LockBit Ransomware? BlackBerry https://www.blackberry.com \u203a ransomware-protection", "https://github.com/MISP/misp-galaxy/blame/master/clusters/threat-actor.json" ], "public": 1, "adversary": "LockBit 3.0 Ransomware Affiliates", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Worm:Win32/Benjamin", "display_name": "Worm:Win32/Benjamin", "target": "/malware/Worm:Win32/Benjamin" }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "LockBit", "display_name": "LockBit", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" } ], "industries": [ "Government", "Civil society", "Private Sector", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 48, "FileHash-SHA1": 46, "FileHash-SHA256": 2869, "URL": 2492, "CVE": 2, "domain": 1079, "hostname": 817, "SSLCertFingerprint": 2, "email": 3 }, "indicator_count": 7358, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "793 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621ef2c06e9f5e7c4676d39d", "name": "20.42.65.92 - 172.16.10.101", "description": "", "modified": "2022-03-31T00:02:44.795000", "created": "2022-03-02T04:29:52.073000", "tags": [ "tls callback", "static parser", "000040fea7dbc370886d902adcd976e7c18703a9bba57409f4fcf1473a8f00f2", "20.42.65.92" ], "references": [ "000040fea7dbc370886d902adcd976e7c18703a9bba57409f4fcf1473a8f00f2" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 434, "FileHash-SHA256": 1071, "URL": 1377, "domain": 135 }, "indicator_count": 3017, "is_author": false, "is_subscribing": null, "subscriber_count": 393, "modified_text": "1481 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "perl.vim", "livebook.vim", "cuplsim.vim", "java_comments_html_06.dump", "quickfix.vim", "nginx.vim", "authorization_ctk", "mib.vim", "Unix.Trojan.Mirai-6976991-0 : FileHash-SHA256 a282f250e59f8754335993293bfbfcc154cdb67ff0e234162f40a6cce5c4290c", "rpl.vim", "com.apple.msrpc.srvsvc.sb", "logstream-mystifying-tharp-7si72pw.cribl.cloud", "java_annotations.java", "msql.vim", "tt2.vim", "vim_variables.vim", "LDAP.tbd", "java_lambda_expressions_signature_00.dump", "filesystem.json", "blender", "falcon.vim", "clipper", "What Is LockBit Ransomware? BlackBerry https://www.blackberry.com \u203a ransomware-protection", "esterel.vim", "forth.vim", "routeros.vim", "bytecode", "preboot_archive_errors.log", "FileHash-SHA256 : 256760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9", "raku.vim", "def.vim", "dylan.vim", "sil.vim", "vim_ex_no_comment_strings.vim", "reva.vim", "vim_ex_def.vim", "java_unfoldment_01.dump", "snnspat.vim", "grads.vim", "progress.vim", "hgcommit.vim", "netrwSettings.vim", "x86_64-apple-macos.swiftinterface", "Domain Name: IUQERFSODP9IFJAPOSDFJHGOSURIJFAEWRWERGWEA.COM Emails: BotnetSinkhole@gmail.com", "Domains Contacted: ntp.ubuntu.com | IDS Detections GNU/Linux APT User-Agent Outbound likely related to package management | 91.189.89.198", "rib.vim", "elmfilt.vim", "java_numbers_05.dump", "cl.vim", "vimm", "java_lambda_expressions_signature.java", "java_methods_indent8_signature_00.vim", "java_generics_signature_01.dump", "gdscript.vim", "vim9_ex_comment_strings.vim", "cterm.vim", "hook_op_check.h", "javascriptcomplete.vim", "https://hybrid-analysis.com/sample/772d7c597071913ba41e1b0f6b24bbb9d512cbe8f884e482a2d187f5a95281bc/65a880b7d29f11c8c30ad32e", "sisu.vim", "inetorgperson.schema", "java_generics_05.dump", "xtab", "dots_14", "he.vim", "java_previews_455_01.dump", "docbksgml.vim", "misc.ldif", "tutor.de.utf-8", "screensaver", "login", "smil.vim", "java_methods_indent8.java", "diff.vim", "murphi.vim", "charset.pivot", "chaskell.vim", "ch.vim", "java_comments_html_01.dump", "aes", "pmi.ldif", "profile", "sdl.vim", "MultipeerConnectivity.tbd", "com.apple.softwareupdate_firstrun_tasks.sb", "gvimrc_example.vim", "version.plist", "vim_ex_syntax.vim", "abap.vim", "com.apple.mkb.internal", "java_methods_indent4_signature_01.vim", "amanda", "java_comments_html_02.dump", "dyngroup.ldif", "catalog.vim", "initex.vim", "nfs.conf", "etcHosts.csv", "Exploits: IPv4 20.99.186.246 | 52.109.0.140 | CVE CVE-2023-22518 | Trojans: AgentTesla.KM , Cobalt Strike , Ransom: WannaCrypt , Malware: Dxqo", "ld.vim", "sso.dev.applemarketingtools.com", "automake.vim", "com.apple.cdscheduler", "vim_ex_function_fold.vim", "Make_mvc.mak", "smb.conf", "psk.txt", "sgml.vim", "java_numbers_01.dump", "inform.vim", "cabal.vim", "Make_all.mak", "com.apple.managedcorespotlightd.sb", "Mac-BE088AF8C5EB4FA2.plist", "process_list.txt", "com.apple.atsd.internal.sb", "sindaout.vim", "Detections Executable and linking format (ELF) file download Over HTTP |", "screensaver_aks", "README.txt", "chaiscript.vim", "java_escapes_07.dump", "terminfo.vim", "css.vim", "mib2c.int_watch.conf", "pf.vim", "ELF:Mirai-AII\\ [Trj] | FileHash-SHA256: 760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9", "group", "com.apple.ckdiscretionaryd.sb", "master.cf.default", "command.log", "wifivelocityd.sb", "snmp.conf.default", "launchdaemons.txt", "phtml.vim", "java_lambda_expressions_signature_01.dump", "tutor.el.utf-8", "sudoers.vim", "convenience.map", "nix.vim", "kscript.vim", "vim_ex_function_def_tail_comments.vim", "java_unfoldment_03.dump", "fvwm2m4.vim", "java_module_info.java", "asmh8300.vim", "amigaos", "Mac-35C1E88140C3E6CF.plist", "dots_10", "tutor.zh_cn.utf-8", "com.apple.atsd.support.sb", "apache", "aml.vim", "systemInfo.csv", "desktop.vim", "afpovertcp.cfg", "java_module_info_00.dump", "java_annotations_00.dump", "ftplugin.vim", "scilab.vim", "html_00.dump", "johndoe.conf", "timeline.csv", "sudo", "pfmain.vim", "scdoc.vim", "bzl.vim", "vhdl.vim", "htmlangular.vim", "slpspi.vim", "DiskMountConditioner.json", "httpd-dav.conf", "mib2c.iterate_access.conf", "openscad.vim", "java_methods_indent2_signature_03.vim", "bugreport.vim", "asm68k.vim", "tutor.it.utf-8", "vim_ex_augroup.vim", "README.md", "dyngroup.schema", "jam.vim", "b.vim", "fontmoverinternal.sb", "cvsrc.vim", "Mac-EE2EBD4B90B839A8.plist", "antlr4.vim", "rcslog.vim", "aliases", "jgraph.vim", "specman.vim", "vb.vim", "taskdata.vim", "gitsendemail.vim", "https://a-a.redirector.navexglobal.com/navex_hosting/404.html", "pdf.vim", "dsl.vim", "core.ldif", "modula3.vim", "java_lambda_expressions_05.dump", "passwd.vim", "java_escapes_00.dump", "sshconfig.vim", "Mac-66E35819EE2D0D05.plist", "java_methods_style_03.dump", "audit_user", "java_previews_430_00.dump", "apple_auxillary.schema", "mDNSResponder.sb", "sinda.vim", "com.apple.slapconfig.conf", "com.apple.msrpc.wkssvc.sb", "uci.vim", "java_method_references_01.dump", "java_methods_indent8_signature_06.dump", "rust.vim", "dicrc", "gdshader.vim", "module.modulemap", "takcmp.vim", "java_module_info_02.dump", "vim_ex_command_00.dump", "html_06.dump", "vim_ex_command.vim", "mds.sb", "csp.vim", "Ransom: ransomed.vc", "dtml.vim", "structurizr.vim", "crashes.csv", "rustfmt.vim", "misc.schema", "netinfo.schema", "ruby.vim", "java_methods_style_signature_02.dump", "asterix", "gsp.vim", "tutor.no.utf-8", "groff.vim", "lber.h", "pbtxt.vim", "mermaid.vim", "context.vim", "gitcommit.vim", "context-data-interfaces.vim", "APConfigurationSystem.tbd", "java_methods_style_00.dump", "java_annotations_signature_00.dump", "sudo_local.template", "gdmo.vim", "rrst.vim", "shtags.pl", "tutor.bar.utf-8", "tutor.ca.utf-8", "java_methods_style_signature_04.vim", "litestep.vim", "exim.vim", "Emails: abuse@namecheap.com Name: Botnet Sinkhole | Address: Botnet Sinkhole City: Los Angeles Country: USA", "openldap.schema", "java_methods_indent8_01.dump", "bluetoothd.sb", "java_comments_html_04.dump", "asteriskvm.vim", "http://103.246.145.111/gate.php?hwid=WALKER-PC-WALKER&os=Windows%207%20Enterprise&cpu=Intel", "upstreaminstalllog.vim", "find.codes", "chkpasswd", "vim_ex_abbreviate.vim", "watool.sb", "ftp-proxy.sb", "scala.vim", "tutor.cs.utf-8", "java_methods_indent2_signature_00.dump", "procmail.vim", "gemtext.vim", "tutor.vim", "nr-data.net [Apple Private Data Collection]", "java_method_references_signature_02.dump", "httpd-autoindex.conf", "hamster.vim", "java_unfoldment.java", "java_annotations_03.dump", "command_args.json", "Mac-B4831CEBD52A0C4C.plist", "java_methods_indent8_signature_00.dump", "Notable: Mirai - 192.70.175.110 Security Operations (DORA?) oit_isocsecurity@state.co.us | state.co.us | Reverse DNS dns1.state.co.us", "coco.vim", "java_methods_indent2_04.vim", "java_lambda_expressions_08.dump", "asf", "vim_ex_behave.vim", "quicklookd-job-creation.sb", "bm", "login.term", "shells", "lex.vim", "debcopyright.vim", "microsoft.std.schema", "srec.vim", "occam.vim", "vim_ex_function_def_tail_comment_errors.vim", "btm.vim", "tads.vim", "sdc.vim", "gss-acceptor.sb", "httpd-info.conf", "htmlcomplete.vim", "html40f.vim", "dots_02", "Mac-9AE82516C7C6B903.plist", "elm.vim", "netrc.vim", "nis.schema", "java_methods_indent2.java", "erlang.vim", "Mac-031B6874CF7F642A.plist", "mgp.vim", "httpd-mpm.conf", "verilog.vim", "cabalproject.vim", "dots_18", "java_generics_02.dump", "vim_ex_substitute.vim", "java_lambda_expressions_06.dump", "jargon.vim", "nroff.vim", "tutor.fr.utf-8", "xsl.vim", "omnimark.vim", "java_string_05.dump", "javacc.vim", "java_method_references_06.dump", "nsmb.conf", "lout.vim", "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com | CVE-2017-0147", "java_comments_markdown_06.dump", "com.apple.iokit.power", "racc.vim", "java_methods_style_signature_03.vim", "airportd.sb", "update_date.vim", "dots_09", "arm", "mib2c.mfd.conf", "blit", "systemd.vim", "java_methods_indent8_05.dump", "swayconfig.vim", "ccfilter.1", "resolv.conf", "snmp.conf", "sshd", "vrml.vim", "apfs_boot_mount.tbd", "dirpager.vim", "java_switch_03.dump", "att3b", "mib2c.column_storage.conf", "html40t.vim", "groovy.vim", "Yara Detections: gafgyt IP\u2019s Contacted: 91.189.89.198 Domains Contacted :ntp.ubuntu.com", "java_method_references_signature_04.dump", "tutor.sr.utf-8", "java_method_references_signature_09.dump", "ocaml.vim", "crm.vim", "pim.vim", "mime.types", "java_string_04.dump", "com.apple.FontValidator.sb", "https://otx.alienvault.com/indicator/url/https://theorg.com/_next/data/Gh7c6NpBHZESb74aisPB8/org/springboard-collaborative.json?companySlug=springboard-collaborative", "fetchmail.vim", "authorization_aks", "tcl.vim", "logindefs.vim", "indoff.vim", "upstart.vim", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a", "8th.vim", "java_methods_indent8_04.vim", "auto_master", "plm.vim", "yaml.yaml", "java_switch_07.dump", "dictdconf.vim", "Mac-189A3D4F975D5FFC.plist", "rpc", "qlmanage.sb", "coff", "gtkrc.vim", "MCError.h", "aout", "mounts.csv", "audit_warn", "vim_ex_highlight.vim", "mounts.txt", "antlr.vim", "tutor.nb.utf-8", "make.vim", "java_methods_indent2_signature.java", "dockerfile.vim", "java_generics_signature_05.dump", "java_methods_indent2_signature_02.vim", "citrus", "sendpr.vim", "changelog.vim", "xhtml10f.vim", "ldap.conf.default", "https://github.com/MISP/misp-galaxy/blame/master/clusters/threat-actor.json", "sh_03.sh", "psf.vim", "ELF:Mirai-AII\\ [Trj] | FileHash-SHA256 760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9", "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db", "java_numbers_04.dump", "java_methods_indent8_signature_06.vim", "ist.vim", "pamconf.vim", "java_methods_indent8_signature_04.vim", "qml.vim", "sqlhana.vim", "ahdl.vim", "java_generics_signature_02.dump", "tutor.es.utf-8", "zprofile", "modula2_r10_00.dump", "quicklookd.sb", "sieve.vim", "cleanadd.vim", "java_method_references_07.dump", "java_methods_style.java", "vim_ex_commands.vim", "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com", "st.vim", "Phishing, Botnet PWD:https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing | https://www.sweetheartvideo.com/tsara-brashears/ | www.sweetheartvideo.com", "html_07.dump", "aflex.vim", "mailaliases.vim", "CVE-2007-3896 | CVE-2023-22518 | CVE-2023-4966", "vimball.vim", "com.apple.mail", "progress_comments.p", "java_methods_indent8_01.vim", "java_numbers_03.dump", "lilo.vim", "spf.google.com", "focexec.vim", "tcsh.vim", "audit_control", "bflt", "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru", "java_module_info.vim", "smcl.vim", "mib2c.access_functions.conf", "networks", "dot.vim", "pamenv.vim", "master.cf", "nasm.vim", "java_methods_indent8_05.vim", "jpocxaar1---r3---sn-jpocxaa-a03e.gvt1.com", "mail.vim", "java_contextual_keywords.java", "mel.vim", "java_lambda_expressions_signature_05.dump", "spellfile.vim", "java_methods_indent4_signature_06.dump", "mve.txt", "java_methods_style_signature_02.vim", "gift.vim", "vim_ex_let_heredoc.vim", "svn.vim", "com.apple.CommCenter.sb", "java_methods_indent4_02.dump", "vim_vs_net.cmd", "tutor.tr.utf-8", "java_methods_style_signature_00.vim", "rnc.vim", "swig.vim", "ampl.vim", "tssop.vim", "rtf.vim", "eruby.vim", "apachestyle.vim", "tap.vim", "audit_control.example", "AOSKit.tbd", "mdworker.sb", "mediawiki.vim", "clojure.vim", "77882 IP\u2019s Contacted: 1.1.69.67 1.10.237.208 1.101.233.31 1.102.46.59 1.103.37.126 1.105.106.252 1.106.108.182 1.106.193.143 1.109.132.165 1.11.116.209", "java_previews_455_00.dump", "claris", "blackberry", "tutor.hr.utf-8", "html_04.dump", "mp.vim", "MCAdvertiserAssistant.h", "cuda.vim", "sicad.vim", "php7.conf", "kernel.csv", "java_annotations_signature.java", "cafebabe", "swift.vim", "mib2c.conf", "000040fea7dbc370886d902adcd976e7c18703a9bba57409f4fcf1473a8f00f2", "asm.vim", "django.vim", "rst.vim", "privoxy.vim", "java_generics_00.dump", "java_lambda_expressions.java", "tutor.hu.utf-8", "form.vim", "Yara: TrojanDropperWin32Ropest | CodeOverlap TrojanWin32Gatsorm | CodeOverlap TrojanWinNTConficker | CodeOverlap Alerts: WormWin32Pykspa", "vim_ex_map.vim", "hog.vim", "pic.vim", "monk.vim", "clean.vim", "bashrc_Apple_Terminal", "adventure", "access", "sqlcomplete.vim", "java_comments.java", "Noted: Calls redirected, call jumps ahead of 25+ callers in wait, keeps getting same agent, told approved for services never applied for or received", "ipfilter.vim", "com.apple.xscertd.sb", "com.apple.screensharing.agent.launchd", "i3config.vim", "json5.vim", "natural.vim", "Stopwords.plist", "audit_event", "checkpw", "aspvbs.vim", "relocated", "debversions.vim", "java_method_references_08.dump", "lisp.vim", "bounce.cf.default", "Login privileges", "htmlos.vim", "main.cf", "tutor.bg.utf-8", "dots_13", "docbkxml.vim", "MCPeerID.h", "vim9_ex_function_def_tail_comment_errors.vim", "sd.vim", "c64", "mib2c.column_defines.conf", "dcd.vim", "java_method_references_signature_01.dump", "security_status.txt", "https://www.rapidinterviews.com/api/jobs/redirect/public-transit-bus-drivers-with-utah-transit-authority-in-stansbury-park-apc-1932", "httpd-languages.conf", "animation", "fstab.vim", "slrnrc.vim", "dbivport.h", "bashrc", "java_methods_indent8_06.dump", "fan.vim", "java_methods_indent2_02.vim", "abc.vim", "java_annotations_signature_01.dump", "https://theorg.com", "com.apple", "lhaskell.vim", "hb.vim", "man.vim", "slrnsc.vim", "mdworker-bundle.sb", "acedb.vim", "mojo.vim", "mib2c.genhtml.conf", "mysql.vim", "liquid.vim", "swiftgyb.vim", "java_switch.java", "vim_ex_menutranslate.vim", "java_methods_indent4_signature_01.dump", "java_method_references_05.dump", "pike.vim", "hosts.equiv", "group.vim", "svg.vim", "nsis.vim", "chill.vim", "java_generics_07.dump", "autofs.conf", "java_methods_indent2_03.vim", "prescribe.vim", "AppleFirmwareUpdate.tbd", "purifylog.vim", "java_method_references_00.dump", "deb822sources.vim", "c-lang", "mdworker-mail.sb", "asciidoc.vim", "java_enfoldment_01.dump", "java_string_03.dump", "protocols.vim", "locate.rc", "java_switch_05.dump", "dots_06", "java_lambda_expressions_signature_04.dump", "Mac-2BD1B31983FE1663.plist", "msmessages.vim", "java_methods_indent8_signature_04.dump", "java_method_references_signature_00.dump", "vim9_legacy_header_fold.vim", "rc.vim", "registry.vim", "main.cf.proto", "mma.vim", "java_string.java", "dosini.vim", "syncolor.vim", "Mac-E43C1C25D4880AD6.plist", "fasm.vim", "vim_shebang.vim", "dtd.vim", "ptcap.vim", "ayacc.vim", "vim_ex_echo.vim", "dbixs_rev.h", "screensaver_new", "neomuttrc.vim", "gitattributes.vim", "virata.vim", "jinja.vim", "basic.vim", "samba.schema", "solidity.vim", "typeset.vim", "clojure", "named.vim", "chordpro.vim", "readline.vim", "java_generics_04.dump", "Mac-7DF21CB3ED6977E5.plist", "j.vim", "com.apple.softwareupdated.sb", "tohtml.vim", "snnsres.vim", "java_switch_00.dump", "ssa.vim", "stylus.vim", "Amazon.com", "java_methods_indent8_signature_03.dump", "mib2c.container.conf", "java_methods_indent2_02.dump", "ntp.conf", "haskell.vim", "mf.vim", "resolv.vim", "https://stackabuse.com/assets/images/apple", "Malware Hosting IP addresses: 141.193.213.20 | 185.199.108.153| 185.199.110.153 | 185.199.111.153", "modula2_r10_03.dump", "robots.vim", "asterisk.vim", "java_methods_indent2_04.dump", "autodoc.vim", "screen.vim", "salt.vim", "dots_03", "java_methods_style_02.vim", "uc.vim", "sqlanywhere.vim", "java_methods_style_signature.java", "python3complete.vim", "Dnssec:Unsigned | Name Servers | BRUCE.NS.CLOUDFLARE.COM", "application", "README", "quantum-staging.emsbk.com", "lyrics.vim", "java_string_02.dump", "tutor", "httpd-default.conf", "haskellcomplete.vim", "bout", "lite.vim", "alsaconf.vim", "java_lambda_expressions_00.dump", "TLS_LICENSE", "getscript.vim", "com.apple.fontd.support.sb", "indent.vim", "gitolite.vim", "java_methods_indent2_signature_04.vim", "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/", "cisco", "markdown.vim", "wfs.sb", "btsnoop", "libao.vim", "prolog.vim", "radiance.vim", "vmasm.vim", "vim9_ex_no_comment_strings.vim", "psl.vim", "docbk.vim", "pltags.pl", "paths", "smith.vim", "java_methods_indent4_signature_05.dump", "cargo.vim", "containers-oceanus.palantirsec.com", "vim_ex_function_nested.vim", "vim_ex_sleep.vim", "java_methods_indent4_signature_02.dump", "html_03.dump", "natpmpd.sb", "sharingPreferences.csv", "certificates.csv", "maple.vim", "vim9_ex_function_def_tail_comments.vim", "java_methods_indent8_00.vim", "screensaver_new_la", "defaults.vim", "bind.html", "su", "manpaths", "bitbake.vim", "lpc.vim", "idlang.vim", "editorconfig.vim", "java_comments_markdown.java", "cgdbrc.vim", "taskedit.vim", "java_generics_signature_04.dump", "authorization_la", "clipper.vim", "Mac-9F18E312C5C2BF0B.plist", "kivy.vim", "cs.vim", "java_method_references_signature_07.dump", "com.apple.msrpc.lsarpc.sb", "AppleOpenLDAP.plist", "valgrind.vim", "com.apple.authd", "vim_key_notation.vim", "setserial.vim", "rego.vim", "BTLEServer.sb", "markdown_conceal.vim", "MultipeerConnectivity.apinotes", "java_methods_style_signature_03.dump", "biosig", "java_escapes_04.dump", "objc.vim", "gprof.vim", "java_methods_indent2_05.vim", "bindzone.vim", "muttrc.vim", "mib2c.old-api.conf", "gdresource.vim", "com.apple.xscertd.conf", "moo.vim", "markdown_conceal.markdown", "avm", "vim132", "smbd", "MCBrowserViewController.h", "ftpusers", "sass.vim", "ncf.vim", "java_methods_style_signature_00.dump", "Mac-77EB7D7DAF985301.plist", "Yara Detections: vad_contains_network_strings information | HackToolWin32Patch CodeOverlap | PWSWin32Phorex CodeOverlap", "sensors.vim", "limits.vim", "java_comments_html_07.dump", "java_switch_01.dump", "https://bombing.gwuzafo.cc/", "cfg.vim", "diva.vim", "povini.vim", "remind.vim", "sgmldecl.vim", "template.vim", "java_contextual_keywords_01.dump", "java_escapes_05.dump", "vim_ex_match.vim", "wifi.conf", "java_methods_indent2_signature_02.dump", "javaformat.vim", "Mac-4B682C642B45593E.plist", "mmix.vim", "nqc.vim", "teraterm.vim", "redirect.wuxs.icu", "help_ru.vim", "java_lambda_expressions_07.dump", "java_methods_indent8_03.vim", "vim_ex_comment-vim9.vim", "julia.vim", "confini.vim", "dots_05", "hostsaccess.vim", "gss-initiator.sb", "shtags.1", "unison.vim", "java_unfoldment_00.dump", "demoserver.py", "java_methods_style_00.vim", "tutor.lt.utf-8", "plsql.vim", "ldap.h", "esqlc.vim", "csscomplete.vim", "cupl.vim", "html401f.vim", "dns.vim", "kern_loader.conf", "firmlinks", "sexplib.vim", "modula2_r10.def", "idl.vim", "csh.cshrc", "tutor.eo.utf-8", "com.apple.USBAgent.sb", "dots_08", "ftoff.vim", "java_methods_indent8_signature_03.vim", "java_methods_style_04.dump", "sh_11_00.dump", "java_method_references_signature_05.dump", "MCNearbyServiceAdvertiser.h", "vim.vim", "openroad.vim", "sbt.vim", "tt2js.vim", "java_methods_style_signature_01.vim", "freebasic.vim", "com.apple.contacts.ContactsAutocomplete", "opam.vim", "rebol.vim", "pccts.vim", "dosbatch.vim", "java_unfoldment_05.dump", "users.csv", "audit_class", "README.ru.utf-8.txt", "awdd.sb", "cvs.vim", "elinks.vim", "javascript.vim", "fontworkerinternal.sb", "euphoria3.vim", "hlsplaylist.vim", "main.cf.default", "communications", "java_methods_indent2_signature_01.vim", "Mac-CAD6701F7CEA0921.plist", "java_comments_markdown_07.dump", "Overlaps: 4 others mailed information email address.", "unicode.vim", "sl.vim", "vim9_expr.vim", "other", "172.31.13.249", "aptconf.vim", "diskEncryption.csv", "aidl.vim", "gnat.vim", "java_annotations_signature_02.dump", "MCSession.h", "java_numbers_00.dump", "java_methods_indent4_01.vim", "java_comments_markdown_00.dump", "gvim.desktop", "ecd.vim", "gen_syntax_vim.vim", "java_enfoldment_00.dump", "cupsd.conf.default", "sm.vim", "hosts", "audio", "Scanning host: 31.214.178.54 , 37.152.88.54", "snnsnet.vim", "https://us.thebigjobsite.com/redirectfeedjob?jobid=2A5F97A6BAE0AA90DC418C2119E1E0EB&source=onestepjobsxmlus&utm_source=onestepjobsxmlus&jobSiteK", "markdown_conceal_00.dump", "Mac-B809C3757DA9BB8D.plist", "dbd_xsh.h", "abaqus.vim", "cups", "java_methods_indent4_04.vim", "lifelines.vim", "haml.vim", "latte.vim", "proxy-html.conf", "sh_05.sh", "modula2_iso_02.dump", "expect.vim", "Mac-A369DDC4E67F1C45.plist", "java_generics_signature_07.dump", "bdf.vim", "sh_07_01.dump", "cupsd.conf.O", "euphoria4.vim", "upstreamdat.vim", "java_methods_indent8_signature_05.vim", "services.vim", "java_methods_indent8_signature_02.vim", "html32.vim", "Malware: 0a6e883228a04a6e8738511a6210914dea1773d88cf57950c83e092f02c7f3bf - Other:Malware-gen\\ [Trj]", "java_generics.java", "com.apple.spotlightknowledged.importer.sb", "java_methods_indent4_signature_03.dump", "sh_07.sh", "nis.ldif", "dylanlid.vim", "openldap.ldif", "vim_keymap.vim", "java_methods_indent8_signature.java", "files.conf", "uil.vim", "header_checks", "html401t.vim", "vim9_keymap.vim", "dots_17", "modula2_pim_02.dump", "kexts.txt", "sql.vim", "pine.vim", "typescript.vim", "tutor.lv.utf-8", "ftplugof.vim", "Aspnet collect: https://otx.alienvault.com/otxapi/indicators/file/screenshot/000444cc67b97f45f11e1fdf89ad8f5127c87aa858fe151fa9c4975276f53b42", "tutor.ko", "chatito.vim", "java_comments_markdown_04.dump", "tutor.sk.utf-8", "generic", "urlshortcut.vim", "Mac-42FD25EABCABB274.plist", "java_methods_indent2_05.dump", "vim.desktop", "go.vim", "cups-files.conf", "gp.vim", "cddb", "decada.vim", "sgmllnx.vim", "Mac-BE0E8AC46FE800CC.plist", "modula2_pim_04.dump", "com.apple.networking.boringssl", "newsyslog.conf", "a2ps.vim", "ibasic.vim", "gpg.vim", "java_methods_style_04.vim", "com.apple.smbd.sb", "framescript.vim", "requirements.vim", "cf.vim", "Mac-DB15BD556843C820.plist", "java_previews_455_03.dump", "jsp.vim", "java_annotations_02.dump", "java_switch_02.dump", "rpcgen.vim", "contextcomplete.vim", "kadmind.sb", "launchD.csv", "java_methods_style_signature_04.dump", "ondir.vim", "gzip.vim", "ttys", "cdl.vim", "cdrdaoconf.vim", "vim_object_methods.vim", "sh_02.sh", "tar.vim", "ppolicy.schema", "apl", "default.plist", "java_methods_indent4_signature_04.dump", "info.json", "sqloracle.vim", "samba.vim", "csh.login", "java_method_references_09.dump", "cmakecache.vim", "com.apple.performance", "java_comments_html_03.dump", "matlab.vim", "verilogams.vim", "java_comments_html_05.dump", "conf.vim", "java_methods_indent4_signature_00.vim", "com.apple.coreduetd", "duaconf.schema", "vimrc", "fontmover.sb", "colortest.vim", "yi.vim", "json.vim", "java_methods_indent4_signature_00.dump", "index.html.en", "rapid.vim", "strace.vim", "sh_01.sh", "qb64.vim", "udevconf.vim", "notify.conf", "com.apple.xscertd-helper.sb", "vim_ex_abbreviate_01.dump", "java_generics_06.dump", "c.vim", "zshrc_Apple_Terminal", "maxima.vim", "efm_filter.txt", "dart.vim", "vim_ex_comment_strings.vim", "java_contextual_keywords_02.dump", "api-cookie.click", "aspperl.vim", "htmlm4.vim", "virtual", "Ransom:Win32/WannaCrypt.H", "dots_16", "pythoncomplete.vim", "iss.vim", "godoc.vim", "java.schema", "obj.vim", "autohotkey.vim", "java_annotations_01.dump", "cabalconfig.vim", "mail.rc", "java_methods_indent4_03.dump", "com.apple.mkb", "quicklook-satellite-general.sb", "vgrindefs.vim", "sharedFolders.csv", "java_escapes.java", "pfd.sb", "dbi_sql.h", "java_method_references_signature_06.dump", "modula2_iso_03.dump", "glsl.vim", "pacmanlog.vim", "haste.vim", "openvpn.vim", "apple", "vim_ex_function.vim", "tutor.sv.utf-8", "terraform.vim", "tsv.vim", "clarion", "bc.vim", "gstatic.com", "protocols", "content-negotiation.html", "iso.vim", "inetorgperson.ldif", "cpp.vim", "caching.html", "tutor.ko.utf-8", "jq.vim", "gyp.vim", "tutor.ru.utf-8", "dots_11", "pcap.vim", "cmusrc.vim", "configuring.html", "gretl.vim", "httpd-ssl.conf", "splint.vim", "lsl.vim", "pinfo.vim", "sh_10.sh", "vim_ex_call.vim", "bash.vim", "Mac-35C5E08120C7EEAF.plist", "sshdconfig.vim", "papp.vim", "autoit.vim", "bst.vim", "rng.vim", "Mac-FFE5EF870D7BA81A.plist", "bsi", "cmod.vim", "html_02.dump", "slice.vim", "tutor.vi.utf-8", "vim_ex_def_nested_fold.vim", "netrw.vim", "modula2_iso_05.dump", "poefilter.vim", "ninja.vim", "java_generics_signature_00.dump", "manconf.vim", "dracula.vim", "quake.vim", "dircolors.vim", "basis", "loginaccess.vim", "hcl.vim", "icemenu.vim", "apple.schema", "fvwm.vim", "mib2c.scalar.conf", "java_unfoldment_02.dump", "syntaxcomplete.vim", "xmlcomplete.vim", "rasi.vim", "modula2_iso_00.dump", "vim_line_continuation.vim", "dragonforce.io", "java_comments_markdown_05.dump", "java_methods_indent8_signature_05.dump", "com.apple.usbd.sb", "m3quake.vim", "chord", "mib2c.column_enums.conf", "java_annotations_04.dump", "hostconf.vim", "html401s.vim", "skill.vim", "java_methods_indent4_02.vim", "java_methods_indent4_signature_04.vim", "bsdl.vim", "vim_ex_loadkeymap_after_bar.vim", "vim9_shebang.vim", "html40s.vim", "plp.vim", "mailcap.vim", "takout.vim", "snobol4.vim", "gedcom.vim", "ratpoison.vim", "BUILDING", "gnash.vim", "java_comments_html_00.dump", "jsonc.vim", "sh_08_02.dump", "bsdi", "initng.vim", "html_05.dump", "mrxvtrc.vim", "ctrlh.vim", "acorn", "nastran.vim", "messages.vim", "java_methods_indent2_01.vim", "ntp_opendirectory.conf", "launchagents.txt", "cosine.ldif", "modula2_iso_06.dump", "simula.vim", "gitrebase.vim", "java_methods_indent4_06.dump", "lprolog.vim", "postscr.vim", "java_numbers_02.dump", "cynlib.vim", "Mac-3CBD00234E554E41.plist", "slpreg.vim", "gitconfig.vim", "modula2_pim_03.dump", "java_contextual_keywords_03.dump", "asy.vim", "java_module_info_01.dump", "tasm.vim", "blcr", "java_methods_indent4_03.vim", "hitest.vim", "lc.vim", "alliant", "ldif.vim", "Yara Detections invalid_trailer_structure , multiple_versions", "racket.vim", "gettytab", "objcpp.vim", "r.vim", "zip.vim", "vimspell.txt", "r10.vim", "mdworker-sizing.sb", "modsim3.vim", "vim_ex_execute.vim", "gvpr.vim", "LICENSE", "vim_ex_def_fold.vim", "MCNearbyServiceBrowser.h", "Mac-06F11FD93F0323C5.plist", "authorization", "mush.vim", "syslog.conf", "icon.vim", "config.vim", "java_escapes_03.dump", "less.vim", "ant.vim", "msidl.vim", "Mac-06F11F11946D27C5.plist", "chromeExtensions.csv", "sudo_lecture", "opl.vim", "tutor.zh_tw.utf-8", "modula2.vim", "vim_ex_set.vim", "spup.vim", "Mac-27ADBB7B4CEE8E61.plist", "upstreamlog.vim", "model.vim", "xhtml10s.vim", "Mac-FA842E06C61E91C5.plist", "httpd-multilang-errordoc.conf", "scss.vim", "lscript.vim", "lace.vim", "irbrc", "java_methods_style_01.vim", "vim_ex_function_nested_fold.vim", "meson.vim", "quicklook-satellite.sb", "tutor.nl.utf-8", "fortran.vim", "cheetah.vim", "transport", "sindacmp.vim", "java_methods_indent4_04.dump", "tak.vim", "cvmsServer.sb", "mib2c.notify.conf", "eviews.vim", "m4.vim", "paste.vim", "screensaver_la", "mds_stores.sb", "magic", "dylanintr.vim", "sipConfig.csv", "synmenu.vim", "java_method_references_signature.java", "lalal.ai", "kdc.sb", "java.vim", "delmenu.vim", "qf.vim", "custom-error.html", "vim_ex_menu.vim", "typescriptreact.vim", "java_previews_430.java", "sas.vim", "menu.vim", "plaintex.vim", "java_comments_markdown_03.dump", "duaconf.ldif", "lftp.vim", "com.apple.netbiosd.sb", "Admin.tbd", "sqlinformix.vim", "java_method_references_04.dump", "cbor", "raml.vim", "javascriptreact.vim", "goaccess.vim", "kix.vim", "awk.vim", "delete-me.bgs.beanie.cloud", "dnsmasq.vim", "vim_ex_comment.vim", "java_escapes_02.dump", "java_methods_indent4_05.dump", "com.apple.login.guest", "ber", "microsoft.schema", "gnuplot.vim", "vim9_legacy_header.vim", "optwin.vim", "sml.vim", "java.ldif", "android", "odin.vim", "screensaver_new_ctk", "com.apple.corespotlightservice.sb", "hercules.vim", "manual.vim", "Ransom: CVE-2023-4966", "efm_perl.pl", "foxpro.vim", "java_switch_06.dump", "html.html", "ccomplete.vim", "hgcommitDiff.vim", "FormBook: a4ec4c6ea1c92e2e6.awsglobalaccelerator.com", "interfaceDetails.csv", "Emotet: FileHash-SHA256 db9d59b0f192c91f8ecf939c415b3252b13b0fb052d4a66ceefb80dfb43d6e8a |", "syntax.vim", "promela.vim", "usbDevices.csv", "desc.vim", "luau.vim", "vim9_ex_commands.vim", "corba.ldif", "asn.vim", "Related Domains: townofignacio.com | coloradoagriculture.com | coloradoworkforce.com | coworkforce.com | coloradoccjj.com | dns1.state.co.us", "com.apple.fontd.internal.sb", "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject", "cobol.vim", "mplayerconf.vim", "change.vim", "java_methods_indent4_signature_03.vim", "amiga.vim", "viminfo.vim", "mmp.vim", "python2.vim", "sh_11.sh", "dune.vim", "vim_ex_catch.vim", "com.apple.install", "java_methods_indent2_signature_05.vim", "applix", "mix.vim", "ppolicy.ldif", "assembler", "java_generics_signature.java", "development.digitalphotogallery.com _YandexDropperExtend", "ref", "cvmsCompAgent.sb", "fmserver.schema", "java_previews_455.java", "obse.vim", "java_annotations_signature_03.dump", "java_lambda_expressions_signature_07.dump", "authorization_lacont", "java_methods_indent2_03.dump", "mapper.dir", "AS36081 State of Colorado General Government Computer", "java_methods_indent2_00.dump", "java_escapes_06.dump", "ldapconf.vim", "java_generics_03.dump", "2html.vim", "python.vim", "vimrc_example.vim", "archive", "java_methods_indent4_00.vim", "rcs.vim", "evim.vim", "mib2c.iterate.conf", "sqr.vim", "squirrel.vim", "java_methods_indent2_signature_00.vim", "scripts.vim", "postfix-files", "html_01.dump", "java_methods_indent2_01.dump", "collective.ldif", "java_contextual_keywords_00.dump", "java_methods_indent4_00.dump", "pod.vim", "modula2_iso_04.dump", "doxygen.vim", "modula2_pim_00.dump", "thevisafirm.com | Immigration Lawyers Capital Immigration Lawyers Green Card Lawyer [ London, DC] malicious", "modula2_pim.def", "gdb.vim", "webdav_agent.sb", "vdf.vim", "modula2_iso_01.dump", "astro.vim", "csdl.vim", "tutor.ja.utf-8", "debchangelog.vim", "sysctl.vim", "kcm.sb", "mpm.conf", "java_lambda_expressions_signature_06.dump", "java_lambda_expressions_signature_03.dump", "https://hybrid-analysis.com/sample/ac09d7f6b26675a529a366b47bc09b3fd776576fb099c020f57204ff7b4ea31c", "mib2c.perl.conf", "modconf.vim", "java_lambda_expressions_02.dump", "makedefs.out", "java_methods_indent2_signature_03.dump", "dots_07", "blank.vim", "slang.vim", "context-data-metafun.vim", "haredoc.vim", "sh_09.sh", "srt.vim", "cupsd.conf", "modula2_pim_05.dump", "tt2html.vim", "conaryrecipe.vim", "tags.vim", "java_methods_indent2_signature_05.dump", "dep3patch.vim", "java_methods_indent8_02.vim", "httpd-vhosts.conf", "cdrtoc.vim", "avra.vim", "In this instance a senior citizen needing assisted living resources redirected & social engineered by addresses originated from: jefferson.co.us", "rtadvd.conf", "a65.vim", "debcontrol.vim", "https://airline.cmntgoyq.com/ | Prometheus Intelligence Technology", "MultipeerConnectivity.h", "crontab.vim", "chuck.vim", "com.apple.MessageTracer", "rexx.vim", "ppd.vim", "mgl.vim", "lynx.vim", "mswin.vim", "git.vim", "sather.vim", "disk_structure.txt", "kdl.vim", "Info.plist", "abel.vim", "kwt.vim", "java_lambda_expressions_signature_02.dump", "www.hallinjurylaw.com |\tMinneapolis Personal Injury Lawyer Personal Injury Law Experts", "dots_01", "htmldjango.vim", "xsd.vim", "mdflagwriter.sb", "com.apple.taskgated-helper.sb", "eterm.vim", "hastepreproc.vim", "java_annotations_signature_04.dump", "ccfilter.c", "rc.netboot", "beetle", "debsources.vim", "mve.awk", "systemControls.csv", "DBIXS.h", "LocalAuthentication.tbd", "rhelp.vim", "jess.vim", "exports.vim", "tutor.uk.utf-8", "dots_04", "nosyntax.vim", "algol68", "java_comments_markdown_02.dump", "fgl.vim", "pyrex.vim", "Yara Detections Mirai_Botnet_Malware Alerts: dead_host network_icmp osquery_detection nolookup_communication", "Yara Detections: UPXProtectorv10x2 , UPX , ELFHighEntropy , elf_empty_sections Alerts: dead_host | ELF:Mirai-AII\\ [Trj]", "com.apple.genatsdb.internal.sb", "mdworker-scan.sb", "sh_04.sh", "https://engage.navexglobal.com/topclass1/login.do?redirectTo=/expand.do?template=JasperReports&view=library", "atlas.vim", "apache.vim", "java_methods_indent4.java", "screensaver_new_aks", "d.vim", "sudoers", "fish.vim", "pf.conf", "Mac-551B86E5744E2388.plist", "smarty.vim", "stp.vim", "nanorc.vim", "java_method_references_signature_03.dump", "java_escapes_01.dump", "context-data-tex.vim", "httpd-manual.conf", "racoon.conf", "arm64e-apple-ios-macabi.swiftinterface", "bridge-websocket-evolosciuc.devint01.goodleap.com", "dots_20", "java_string_01.dump", "modula2_pim_01.dump", "com.apple.cloudd.sb", "sh_06.sh", "csc.vim", "adacomplete.vim", "10-cryptex", "pandoc.vim", "httpd-userdir.conf", "efm_filter.pl", "java_methods_indent4_signature.java", "master.cf.proto", "eiffel.vim", "sqlforms.vim", "Emotet: FileHash-MD5 bafae95c36402dfc1ea5fa04523e4e81", "com.apple.eventmonitor", "ppwiz.vim", "java_methods_style_signature_01.dump", "vim_expr.vim", "slpconf.vim", "modula2_pim_06.dump", "redif.vim", "battery.csv", "java_lambda_expressions_signature_08.dump", "htmlcheetah.vim", "java_lambda_expressions_01.dump", "mib2c.check_values_local.conf", "cups-files.conf.default", "Emotet: FileHash-SHA1\t19c14ab0aaab2c1dd922f0baca3cf64056f80acc", "java_methods_indent4_signature_05.vim", "arm64e-apple-macos.swiftinterface", "java_methods_indent2_signature_01.dump", "csh.logout", "dts.vim", "hex.vim", "interfaceAddrs.csv", "bzr.vim", "filetype.vim", "java_string_00.dump", "httpd.conf", "clojurecomplete.vim", "php.vim", "gitignore.vim", "FileHash-SHA256: a0f50a7b0f9717589000b3414017bdcfcb9d3f6a3e5e03fe49c4dc8035e0d25c", "java_methods_indent4_05.vim", "tutor.da.utf-8", "core.schema", "mupad.vim", "CodeResources", "vim_ex_def_nested.vim", "java_methods_indent4_signature_02.vim", "java_methods_style_03.vim", "blink.c", "java_enfoldment.java", "AirPlayReceiver.tbd", "spec.vim", "esmtprc.vim", "user_launchagents.txt", "dots_19", "ccfilter_README.txt", "vim_new.vim", "com.apple.slapd.conf", "bib.vim", "java_method_references_signature_08.dump", "x86_64-apple-ios-macabi.swiftinterface", "java_lambda_expressions_04.dump", "java_methods_indent2_signature_04.dump", "vim.vim.base", "tssgm.vim", "usserverlog.vim", "screensaver_ctk", "inittab.vim", "Malvertizing, Phishing, Botnet PWD: https://pin.it/ | https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | www.pornhub.com", "modula2_iso.def", "systemverilog.vim", "proto.vim", "java_switch_04.dump", "flexwiki.vim", "java_methods_indent8_04.dump", "rubycomplete.vim", "rmd.vim", "chicken.vim", "cmake.vim", "mib2c.create-dataset.conf", "adi", "upstreamrpt.vim", "n1ql.vim", "com.apple.mobileassetd.sb", "ave.vim", "pf.os", "rmtab", "ada.vim", "Will sort to identify malware", "pascal.vim", "fpcmake.vim", "custom_header_checks", "squid.vim", "auto_home", "collective.schema", "pli.vim", "sqlj.vim", "java_generics_signature_06.dump", "hare.vim", "tutor.utf-8", "pymanifest.vim", "sed.vim", "datascript.vim", "java_methods_indent8_00.dump", "cosine.schema", "calendar.vim", "dictconf.vim", "stata.vim", "com.apple.bootinstalld.sb", "corba.schema", "dtrace.vim", "lss.vim", "krb5-kdc.schema", "grub.vim", "lua.vim", "passwd", "java_methods_indent8_signature_01.vim", "arduino.vim", "elf.vim", "kconfig.vim", "context-data-context.vim", "java_methods_indent2_00.vim", "typst.vim", "ia64.vim", "dots_15", "netrwFileHandlers.vim", "udevperm.vim", "netrw_gitignore.vim", "applications.csv", "ora.vim", "html_08.dump", "ldap.conf", "java_methods_indent8_signature_02.dump", "java_previews_455_02.dump", "xhtml11.vim", "c.c", "baan.vim", "xmlformat.vim", "Driver_xst.h", "voscm.vim", "aap.vim", "tutor.pt.utf-8", "java_enfoldment_02.dump", "masm.vim", "denyhosts.vim", "synload.vim", "java_methods_indent4_01.dump", "usw2kagtlog.vim", "m3build.vim", "java_numbers.java", "java_method_references_signature_10.dump", "java_methods_indent8_signature_01.dump", "po.vim", "managedPolicies.csv", "java_lambda_expressions_03.dump", "zshrc", "convex", "sh_08.sh", "java_generics_01.dump", "mib2c.check_values.conf", "dots_12", "canonical", "ps1.vim", "sh.vim", "edif.vim", "pilrc.vim", "cucumber.vim", "spice.vim", "art.vim", "java_method_references_03.dump", "asl.conf", "vim_ex_range.vim", "xcmdsrv_client.c", "master.vim", "typescriptcommon.vim", "java_comments_markdown_01.dump", "scheme.vim", "vera.vim", "java_comments_markdown_08.dump", "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14", "kotlin.vim", "cweb.vim", "ishd.vim", "man.conf", "logtalk.vim", "fdcc.vim", "bioinformatics", "Malware: http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel | 103.246.145.111", "lotos.vim", "bhl", "tutor.zh.utf-8", "pmi.schema", "csv.vim", "java_method_references_02.dump", "vim_ex_loadkeymap_after_colon.vim", "Unsupported/Fake Windows NT Version 5.0", "arch.vim", "test-ssa.pineapples.dev", "com.apple.msrpc.netlogon.sb", "pov.vim", "spyce.vim", "mason.vim", "rnoweb.vim", "mallard.vim", "cynpp.vim", "csh.vim", "jal.vim", "help.vim", "vim_ex_throw.vim", "xhtml10t.vim", "apt", "mib2c.array-user.conf", "updatedb.vim", "krl.vim", "java_methods_style_01.dump", "cad", "html.vim", "java_methods_indent8_03.dump", "java_methods_style_02.dump", "rc.common", "gkrellmrc.vim", "java_method_references_10.dump", "java_generics_signature_03.dump", "allegro", "Mac-473D31EABEB93F9B.plist", "dcl.vim", "tutor.pl.utf-8", "quarto.vim", "HP_ENVY_6000_series__3D66E1_.ppd", "quicklook-satellite-personal.sb", "RstFold.vim", "udevrules.vim", "com.apple.msrpc.mdssvc.sb", "emoji_list.vim", "CVE-2023-4966", "java_methods_indent8_02.dump" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "DragonForce Malaysia", "LockBit 3.0 Ransomware Affiliates", "DragonForce Hacker Group Malaysia, Al-Arqam", "Dragonforce Malaysia Hacker Group", "DragonForce Malaysia Hacker Group" ], "malware_families": [ "", "Trojan:win32/dorv.b!rfn", "Win.malware.dxqo-6984072-0", "Pegasus for ios - s0289", "Allowoverride", "Firstname", "Trojan:win32/antavmu.d", "Mirai", "Trojan:win32/zombie.a", "Apollolocker", "9002 rat", "Formbook", "Apnic", "Esc", "Alf:trojan:msil/agenttesla.km", "Trojandropper:win32", "Win32:malwarex-gen\\ [trj]", "Alf:heraklezeval:backdoor:linux/tsunami", "Hacktool", "Worm:win32/mofksys", "Worm:win32/pykspa.c", "Alf:heraklezeval:backdoorlinux/mirai", "Backdoor:win32/fynloski", "Virus:dos/psmpc_386", "Tel:trojanspy:win32/kedirat", "Pegasus for android - s0316", "Win.worm.pykspa-1", "Pegasus - mob-s0005", "Directoryindex", "Ransomware", "Alf:heraklezeval:backdoor:linux/mirai", "Redline stealer", "Backdoor:win32/espion", "Ransom", "Trojandownloader:win32/bridge", "Lastname", "Trojan:win32/qqpass", "Win.trojan.cobaltstrike-9044898-1", "Selectall", "Worm:win32/mofksys.rnd!mtb", "Malware", "Virus:dos/cyberwar_5300", "Ransom:win32/wannacrypt", "Malaysia, truly asia", "Worm:win32/benjamin", "#lowfi:hstr:msil/possibledownloader.s01", "Lockbit", "Win32:renos-ky\\ [trj]", "Emotet", "Telper:ddos:linux/lightaidra", "Alf:hstr:trojanspy:msil/keylogger", "Vim tutor", "Adacore", "Todo", "Ultra vnc", "Other:malware-gen\\ [trj]", "Pws:msil/dcstl.gd!mtb", "Trojanspy:ios/xcodeghost" ], "industries": [ "Human subjects", "Telecom", "Telecommunications", "Semiconductor", "Media", "Lgbtq+ activists", "Hospitality", "Government", "Technology", "Civil society", "Immigration", "Private sector", "Energy", "Ngo" ], "unique_indicators": 102860 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/iana.com", "whois": "http://whois.domaintools.com/iana.com", "domain": "iana.com", "hostname": "www.iana.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 19, "pulses": [ { "id": "69e49bea0264fa25070a3dad", "name": "20.42.65.92 - 172.16.10.101 clone dorkingbeauty1", "description": "", "modified": "2026-04-19T12:07:02.826000", "created": "2026-04-19T09:10:02.057000", "tags": [ "tls callback", "static parser", "000040fea7dbc370886d902adcd976e7c18703a9bba57409f4fcf1473a8f00f2", "20.42.65.92" ], "references": [ "000040fea7dbc370886d902adcd976e7c18703a9bba57409f4fcf1473a8f00f2" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "621ef2c06e9f5e7c4676d39d", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 434, "FileHash-SHA256": 1071, "URL": 1377, "domain": 135, "JA3": 1 }, "indicator_count": 3018, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "23 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b235439d56630943ea31e6", "name": "Clone by Q Vashti (excellent systemic analyzer I may add)", "description": "", "modified": "2026-04-10T22:04:28.607000", "created": "2026-03-12T03:38:43.171000", "tags": [ "\u9ed1\u6599", "\u5403\u74dc", "\u5403\u74dc\u7f51", "51\u5403\u74dc", "\u9ed1\u6599\u4e0d\u6253\u70ca", "\u9ed1\u6599\u5403\u74dc\u7f51", "\u70ed\u95e8\u5927\u74dc", "\u660e\u661f\u8d44\u8baf", "\u7f51\u7ea2\u9ed1\u6599", "\u5185\u6db5\u6bb5\u5b50", "\u4eca\u65e5\u5403\u74dc", "\u5403\u74dc\u65b0\u95fb", "\u9ed1\u6599\u66dd\u5149", "\u516b\u5366\u65b0\u95fb", "\u793e\u4f1a\u70ed\u70b9", "\u5403\u74dc\u7fa4\u4f17", "\u70ed\u70b9\u4e8b\u4ef6", "\u6bcf\u65e5\u5403\u74dc", "\u7f51\u7ea2\u5403\u74dc", "\u4eca\u65e5\u5927\u74dc", "\u5403\u74dc\u7206\u6599", "\u5403\u74dc\u4e2d\u5fc3", "\u4eca\u65e5\u70ed\u74dc", "\u5403\u74dc\u9ed1\u6599", "\u9ed1\u6599\u6cc4\u5bc6", "\u91cd\u78c5\u9ed1\u6599", "\u5403\u74dc\u6cc4\u5bc6", "\u4eca\u65e5\u9ed1\u6599", "\u6700\u65b0\u9ed1\u6599", "\u5403\u74dc\u66dd\u5149", "\u5403\u74dc\u8d44\u6e90", "\u91cd\u78c5\u5403\u74dc", "\u5a31\u4e50\u70ed\u74dc", "chrome", "cos ai", "a serif", "sans serif", "top10", "openclaw", "21200", "onlyfans", "strong", "dmca copyright", "address google", "safe browsing", "data upload", "extraction", "lte all", "enter sc", "type o", "extra", "referen https", "lte o", "type", "extr data", "include review", "exclude sugges", "failed", "hong kong", "passive dns", "otx logo", "all ipv4", "url analysis", "urls", "files", "location hong", "value", "march", "0x1595 function", "0x19b5 object", "tracker", "base64 object", "cookie function", "mlog", "localconst", "style function", "reverse dns", "general full", "url https", "resource", "software", "hash", "security tls", "singapore", "asn139341", "aceasap ace", "ip address", "cloudflare", "report", "whois", "as13335", "name lookup", "website", "kong", "ssl certificate", "http", "request chain", "nl redirected", "http redirect", "kb script", "protocol h3", "security quic", "seychelles", "asn13335", "cloudflarenet", "js function", "portable descr", "internet", "iana", "iana web", "stepgo limited", "assigned pa", "afrinic", "filtered parent", "ebene", "mahe", "stepgo", "united", "unknown ns", "script script", "moved", "record value", "title", "0 lte", "find s", "size", "mitre att", "ck id", "ck matrix", "root", "hybrid", "general", "path", "click", "strings", "yrbyd", "learn", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "initial access", "lalal.ai", "record type", "ttl value", "thumbprint", "ios ping", "defense evasion", "id name", "malicious", "t1055.015 list planting", "sha1", "copy md5", "sha256", "pattern match", "show technique", "unknown", "accept", "date", "local", "starfield", "encrypt", "iframe", "prometheus intelligence technology", "apple", "cyber attacks", "usptracker.com", "android" ], "references": [ "https://airline.cmntgoyq.com/ | Prometheus Intelligence Technology", "lalal.ai", "logstream-mystifying-tharp-7si72pw.cribl.cloud", "quantum-staging.emsbk.com", "spf.google.com", "Amazon.com", "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru", "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/", "api-cookie.click", "delete-me.bgs.beanie.cloud", "bridge-websocket-evolosciuc.devint01.goodleap.com", "https://bombing.gwuzafo.cc/", "test-ssa.pineapples.dev", "sso.dev.applemarketingtools.com", "containers-oceanus.palantirsec.com", "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14", "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com", "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject", "Will sort to identify malware", "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1048", "name": "Exfiltration Over Alternative Protocol", "display_name": "T1048 - Exfiltration Over Alternative Protocol" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1048.003", "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol", "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" } ], "industries": [], "TLP": "white", "cloned_from": "69b1f368db0d00947ef729c2", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4097, "domain": 849, "hostname": 2440, "FileHash-MD5": 149, "FileHash-SHA1": 131, "FileHash-SHA256": 955, "CIDR": 5, "email": 6, "SSLCertFingerprint": 8 }, "indicator_count": 8640, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "9 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b1f368db0d00947ef729c2", "name": "\u5403\u74dc\u770b\u9ed1\u6599\u5c31\u4e0a - \u9ed1\u6599\u5403\u74dc\u7f51 | \u70ed\u95e8\u4e8b\u4ef6\u7206\u6599\u4e0e\u771f\u76f8", "description": "Why is this type of malicious found on a US citizens device? Found in a link extracted from a glitching device.. Palantir\u2019s Prometheus Intelligence Technology tracking and AI at work.\n#tracker #http_redirect #onlyfans_? #bombing #airlines #lalal.ai #openclaw #targeted", "modified": "2026-04-10T22:04:28.607000", "created": "2026-03-11T22:57:44.584000", "tags": [ "\u9ed1\u6599", "\u5403\u74dc", "\u5403\u74dc\u7f51", "51\u5403\u74dc", "\u9ed1\u6599\u4e0d\u6253\u70ca", "\u9ed1\u6599\u5403\u74dc\u7f51", "\u70ed\u95e8\u5927\u74dc", "\u660e\u661f\u8d44\u8baf", "\u7f51\u7ea2\u9ed1\u6599", "\u5185\u6db5\u6bb5\u5b50", "\u4eca\u65e5\u5403\u74dc", "\u5403\u74dc\u65b0\u95fb", "\u9ed1\u6599\u66dd\u5149", "\u516b\u5366\u65b0\u95fb", "\u793e\u4f1a\u70ed\u70b9", "\u5403\u74dc\u7fa4\u4f17", "\u70ed\u70b9\u4e8b\u4ef6", "\u6bcf\u65e5\u5403\u74dc", "\u7f51\u7ea2\u5403\u74dc", "\u4eca\u65e5\u5927\u74dc", "\u5403\u74dc\u7206\u6599", "\u5403\u74dc\u4e2d\u5fc3", "\u4eca\u65e5\u70ed\u74dc", "\u5403\u74dc\u9ed1\u6599", "\u9ed1\u6599\u6cc4\u5bc6", "\u91cd\u78c5\u9ed1\u6599", "\u5403\u74dc\u6cc4\u5bc6", "\u4eca\u65e5\u9ed1\u6599", "\u6700\u65b0\u9ed1\u6599", "\u5403\u74dc\u66dd\u5149", "\u5403\u74dc\u8d44\u6e90", "\u91cd\u78c5\u5403\u74dc", "\u5a31\u4e50\u70ed\u74dc", "chrome", "cos ai", "a serif", "sans serif", "top10", "openclaw", "21200", "onlyfans", "strong", "dmca copyright", "address google", "safe browsing", "data upload", "extraction", "lte all", "enter sc", "type o", "extra", "referen https", "lte o", "type", "extr data", "include review", "exclude sugges", "failed", "hong kong", "passive dns", "otx logo", "all ipv4", "url analysis", "urls", "files", "location hong", "value", "march", "0x1595 function", "0x19b5 object", "tracker", "base64 object", "cookie function", "mlog", "localconst", "style function", "reverse dns", "general full", "url https", "resource", "software", "hash", "security tls", "singapore", "asn139341", "aceasap ace", "ip address", "cloudflare", "report", "whois", "as13335", "name lookup", "website", "kong", "ssl certificate", "http", "request chain", "nl redirected", "http redirect", "kb script", "protocol h3", "security quic", "seychelles", "asn13335", "cloudflarenet", "js function", "portable descr", "internet", "iana", "iana web", "stepgo limited", "assigned pa", "afrinic", "filtered parent", "ebene", "mahe", "stepgo", "united", "unknown ns", "script script", "moved", "record value", "title", "0 lte", "find s", "size", "mitre att", "ck id", "ck matrix", "root", "hybrid", "general", "path", "click", "strings", "yrbyd", "learn", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "initial access", "lalal.ai", "record type", "ttl value", "thumbprint", "ios ping", "defense evasion", "id name", "malicious", "t1055.015 list planting", "sha1", "copy md5", "sha256", "pattern match", "show technique", "unknown", "accept", "date", "local", "starfield", "encrypt", "iframe", "prometheus intelligence technology", "apple", "cyber attacks", "usptracker.com", "android" ], "references": [ "https://airline.cmntgoyq.com/ | Prometheus Intelligence Technology", "lalal.ai", "logstream-mystifying-tharp-7si72pw.cribl.cloud", "quantum-staging.emsbk.com", "spf.google.com", "Amazon.com", "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru", "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/", "api-cookie.click", "delete-me.bgs.beanie.cloud", "bridge-websocket-evolosciuc.devint01.goodleap.com", "https://bombing.gwuzafo.cc/", "test-ssa.pineapples.dev", "sso.dev.applemarketingtools.com", "containers-oceanus.palantirsec.com", "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14", "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com", "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject", "Will sort to identify malware", "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1048", "name": "Exfiltration Over Alternative Protocol", "display_name": "T1048 - Exfiltration Over Alternative Protocol" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1048.003", "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol", "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4097, "domain": 849, "hostname": 2440, "FileHash-MD5": 149, "FileHash-SHA1": 131, "FileHash-SHA256": 955, "CIDR": 5, "email": 6, "SSLCertFingerprint": 8 }, "indicator_count": 8640, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "9 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "684a93360163e8802e213158", "name": "ELF:Mirai AMAZON-02 - Autonomous System 65.0.0.0/14", "description": "ELF:Mirai-BHZ\\ [Trj]\t\n65.0.0.0/14\nAutonomous System Number\n16509\nAutonomous System Label\nAMAZON-02\nRelated to \u2022 103.252.236.26 | \n\u2022 sr2.reliedhosting.com | \n.\u2022 http://planitair.com/ |\n\u2022 bgptools-wildcard-confirmed.acemalibu.com | \n\u2022 https://www.anyxxxtube.net/search-porn/tsara-brashears/ | \t\t\t\n\u2022 static.ads-twitter.com\t\n\u2022 https://twitter.com/PORNO_SEXYBABES\t\n\u2022 analytics.twitter.com\n\u2022 appleupdate.org\n\u2022 apps.apple.com\n\u2022 pin.it |\n\u2022 https://pin.it/ |\n\u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian Critical issue. Cyber weaponry [Unclear] Stealth contractual US cyber defense entity, endless DGA\u2019s. India IP block.\nAdversary named by bupyeongop:\n\ubd80\ud3c9\uc624\ud53c \ucd9c\uc7a5\ub9c8\uc0ac\uc9c0\uc548\ub0b4.COM \ubd80\ud3c9OP (massage service?)\n*DoS with many OTX features", "modified": "2025-07-12T07:04:05.635000", "created": "2025-06-12T08:43:34.719000", "tags": [ "thumbprint", "apnic", "apnic whois", "database", "please", "arin whois", "north america", "caribbean", "africa", "internet", "iana", "address range", "cidr", "network name", "allocation type", "whois server", "algorithm", "v3 serial", "number", "cbe oglobalsign", "r6 alphassl", "validity", "subject public", "key info", "key algorithm", "key identifier", "link", "search", "united", "a domains", "ip address", "creation date", "record value", "date", "showing", "india unknown", "status", "passive dns", "ipv4 add", "pulse submit", "url analysis", "urls", "files", "location india", "india asn", "as133296 web", "dns resolutions" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "APNIC", "display_name": "APNIC", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 27, "domain": 2499, "hostname": 2651, "URL": 10986, "CIDR": 2, "FileHash-SHA256": 3596, "email": 1, "FileHash-MD5": 23, "CVE": 7 }, "indicator_count": 19792, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "282 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67f5555b6ce863d998e83e26", "name": "macOS Threat Infrastructure Leveraging Remote Agents via remotewd.com and rtmsprod.net", "description": "This pulse identifies an actively observed macOS-focused remote access infrastructure abusing trusted native Apple agents (ARDAgent.app, SSMenuAgent.app) and communicating with a distributed network of C2-like endpoints under domains such as remotewd.com, idsremoteurlconnectionagent.app, and rtmsprod.net.\n\nThe infrastructure is composed of dynamically generated subdomains \u2014 many in the form of device-.remotewd.com \u2014 indicative of automated deployment, system tracking, or per-host remote access configurations.\n\nAdditional indicators include HTTP/S URLs pointing directly to embedded binary paths within macOS agents, suggesting possible delivery vectors, staging, or persistence techniques.\n\nThis campaign shows signs of structured, programmatic targeting and is highly likely to be pre-operational infrastructure for wide-scale surveillance or access operations. All listed indicators should be considered high-risk. If observed in your environment, initiate a full forensic and IR process immediately.", "modified": "2025-05-11T19:03:59.885000", "created": "2025-04-08T16:56:59.641000", "tags": [ "generated from", "do not", "edit uri", "urls", "edit", "rewriteengine", "rewritecond", "rewriterule", "r301", "xml2encalias", "beralloct", "berbvarrayadd", "berbvarrayfree", "berbvdup", "berbvecadd", "berbvecfree", "berbvfree", "berdump", "berdup", "berdupbv", "laerrordomain", "laerrornoncekey", "lamechanismtree", "lacontext", "ladomainstate", "laenvironment", "lanotification", "laprivatekey", "lapublickey", "laright", "apple swift", "o librarylevel", "combine import", "foundation", "swift import", "mcpeerid", "mcsession", "property", "copyright", "protocol", "class", "bonjour", "ascii lowercase", "abc company", "section", "bonjour txt", "note", "ui element", "utf8 encoding", "nscopying", "nsdictionary", "nsstring", "mcextern", "attribute", "mcextern extern", "mcexternweak", "nsenum", "nsinteger", "mcerrorcode", "mcerrorunknown", "mcerrortimedout", "peer", "example", "bonjour apis", "stop", "tags", "session", "nsprogress", "nserror", "nsurl", "nsarray", "create", "nsuinteger", "notifies", "mcsession api", "interface", "dbictrace", "dbivporth", "dbictracelevel", "dbdtffoo", "dbihseterrchar", "dbicstate", "dbictraceflags", "provides macros", "dbi release", "only", "sqlsuccess", "odbc", "sqlok", "tim bunce", "england", "sql cli", "sql datatype", "sqlguid", "sqlwlongvarchar", "main", "beware", "sv sth", "sv dbh", "impsth", "impdbh", "sv keysv", "sv params", "sv attr", "sv attribs", "sv drh", "void", "fri jul", "mixed", "dbixsrevision", "plsvundef", "license", "spagain", "perlioprintf", "dbiclogpio", "putback", "ireland", "gnu general", "super", "magic", "dbicflags", "dbis", "svrv", "null", "imp2com", "dbicactivekids", "dbicfiadestroy", "sv h", "dbicdbistate", "code", "copy", "refer", "trace", "error", "unknown", "hookopcheckh", "startexternc", "hookopcheckcb", "userdata", "endexternc", "isinternalbuild", "kickmcxdforuid", "loadappkit", "ardconfig", "authenticator", "dsauthenticator", "dsnode", "dsrecord", "group", "hostconfig", "apfsvolumelock", "apfsvolumerole", "aoskgetosinfo", "aoskgetuserinfo", "aosaddappleid", "aosdisablepcs", "aosenablepcs", "aoslog", "aoslogforce", "aosrelaycookie", "didfailcallback", "kaosaccountkey", "kapcsbundle", "kapcspath", "kjsonextension", "apcsbucketid", "apcsreports", "apconfiguration", "apversiondata", "apversionhelper", "systemvolumesvm", "name size", "identifier", "gb disk0s3", "devdisk3", "apfs container", "scheme", "physical store", "macintosh hd", "apfs snapshot", "preboot", "refs address", "size wired", "name", "version", "uuid", "linked against", "renderer", "helper", "chrome helper", "contains", "cloud ui", "macintosh", "khtml", "gecko", "ui helper", "plugin", "service", "good", "battery power", "apfs encryption", "jumpcloud go", "chrome web", "store", "privacy badger", "flowcrypt", "encrypt gmail", "simple", "google", "b2b phone", "number", "apollo", "future", "exccrash", "sigkill", "code signature", "invalid", "sigabrt", "protonvpn", "excguard", "excbreakpoint", "sigtrap", "excbadaccess", "appl", "english", "adobe crash", "adobe", "acrobat dcadobe", "processor", "uninstaller", "assistant", "install", "cloud", "dock", "calendar", "music", "terminal", "tips", "installer", "updater", "proton", "tools", "stub", "python", "clock", "powershell", "team", "rave scout", "cookies", "public folder", "key cert", "sign", "crl sign", "root ca", "authority", "public primary", "global root", "verisign", "academic", "premium", "adaptive", "interactive", "background", "standard", "launchd sandbox", "s mdworker", "agent", "command line", "progress", "yubico", "macos13action", "disableoverride", "disableairdrop", "denyactivation", "enable", "loginwindowtext", "jumpcloud", "autoupdate", "loggingoption", "enablefirewall", "arm64e", "apple m2", "mac142", "kjqqtw7pqt", "daemon", "server", "open directory", "user", "account", "kerberos admin", "kerberos change", "device daemon", "network", "desktop", "screensaver", "bridge", "aesxtsarm", "aesecbarm", "sha512vngarmhw", "sha384vngarmhw", "sha256vngarm", "sha1vngarm", "darwin kernel", "wed mar", "wkarraycreate", "wkbooleancreate", "wkcontextcreate", "wkdatacreate", "wkdatagettypeid", "wkdoublecreate", "wkframecopyurl", "wkgettypeid", "wkimagecreate", "wkpagecandelete", "webview", "notice", "this software", "including", "but not", "limited to", "redistribution", "is provided", "by apple", "direct", "damage", "apiavailable", "webkit", "nsswiftname", "document", "a block", "as is", "hasinclude", "wkdownload", "abstract", "wkerrorcode", "wkerrorunknown", "discussion", "bool", "whether", "wkcontentworld", "wkwebview", "javascript", "nsunavailable", "vaargs", "nsswiftasync", "wkswiftasync", "wkcookiepolicy", "wkswiftuiactor", "nshttpcookie", "targetosiphone", "wknavigation", "decides", "boolean value", "apideprecated", "methodkind", "wkerrordomain", "wkscriptmessage", "promise", "fulfill", "const", "url scheme", "mark", "wkuserscript", "targetosvision", "param", "wkframeinfo", "targetosios", "pass", "window", "mime type", "link", "nsimage", "returns", "nsset", "checks", "matches", "a boolean", "defaults", "wkwebextension", "cgsize", "uiimage", "apis", "nsdate", "wkcontentmode", "wkextern", "possible", "cgfloat", "media", "cgrect", "apiunavailable", "framework", "nsswiftuiactor", "targetoswatch", "confirms", "apple upgrade", "nsstring user", "nsobject", "provider", "apple", "password", "uicontrol", "nscontrol", "asuseragerange", "check", "opaque user", "apple id", "initiate", "asauthorization", "operation", "state", "nserrorenum", "nsdata", "relying party", "asapiavailable", "perform", "realm", "http response", "authorization", "http", "oauth", "saml", "a byte", "nsdata userid", "relying", "a string", "nsdata readdata", "bool didwrite", "a cose", "nsdata first", "nsdata second", "nsstring name", "bool appid", "targetosxr", "nsstring appid", "bluetooth", "mdm profile", "nsurl url", "returns yes", "a state", "a json", "web token", "private seckeys", "enables", "keychain", "asswiftsendable", "cose algorithm", "ecdsa", "sha256", "cose curve", "p256", "nullable", "bool success", "remove", "call", "complete", "initializes", "time code", "extensions", "asextern extern", "asextern", "nsswiftsendable", "prepare", "list", "nsextension", "attempt", "nsstring label", "creates", "nsstring code", "a key", "webauthn", "nssecurecoding", "input", "output", "initialize", "nsinteger rank", "json", "inputs", "hash", "nsstring origin", "settings app", "extension", "https urls", "safari", "cancel", "nsuuid uuid", "r uftpexu", "nsmutabledata", "vnsdate", "mprcjy", "postfix", "domain", "canonical", "tables", "ldap", "post", "replace user", "address", "wietse venema", "bugs", "mail", "aliases", "postfix version", "restrict", "sample", "person", "basic system", "general", "reject empty", "postfix smtp", "ipv6 host", "reject", "reply", "access", "prior", "hold", "info", "mail delivery", "charset", "system", "report", "postfix dsn", "mail returned", "this", "generic", "smtp", "isp mail", "mime", "headerchecks", "readme files", "filters while", "posix", "empty", "body", "write", "date", "smtp server", "specify", "mx host", "unix password", "user unknown", "pathbin", "postfix queue", "unix", "cyrus", "path", "uucp", "shell", "local", "program", "agreement", "contributor", "recipient", "contribution", "the program", "corporation", "contributors", "product x", "as expressly", "arch", "arch x8664", "pipe wall", "wimplicit", "ranlib", "warn", "switch", "start", "systype", "outlook", "postfix master", "begin", "server admin", "mail backend", "modern smtp", "iana", "many", "postfix pipe", "recent cyrus", "amos gouaux", "old example", "or even", "lutz jaenicke", "technology", "cottbus", "germany", "openssl package", "openssl project", "europe", "remember that", "use of", "file", "update", "usrsbin", "file format", "no group", "daemondirectory", "deliver mail", "transport", "description", "result format", "virtual", "virtual alias", "redirect mail", "relocated", "matches user", "synopsis", "lastname", "firstname", "apple computer", "tcpip", "supported", "quantum", "facility", "level", "level info", "broadcast", "ignore", "rules", "sender", "automounter map", "use directory", "get home", "home autohome", "true", "t option", "mount", "force", "environment", "automountdenv", "promptcommand", "shellsessiondir", "histfile", "histfilesize", "myvar", "histtimeformat", "arrange", "bashrematch", "tell", "ps1h", "make bash", "s checkwinsize", "etcbashrc", "termprogram", "inpck", "nnnbaud", "berkeley", "parity", "pc entry", "pass8", "parenb istrip", "fixed speed", "entry", "clocal mode", "maxhistsize", "promptmode", "verbose end", "etcirbrcloaded", "default", "setup", "history file", "kernel", "readline", "jabber", "group database", "dovecot", "postfix scsd", "networkd", "searchpaths", "freebsd", "tmpdir", "fcodes", "prunepaths", "vartmp", "prunedirs", "filesystems", "nroff", "manpath", "uncomment", "manpager", "whatispager", "manlocale", "every", "manpath optman", "maybe", "troff", "status mailfrom", "returnpath via", "pidfile", "flags", "bcgjnuwz", "bin usrsbin", "sbin", "default pf", "care", "audio", "user database", "unix copy", "gate daemon", "bashno", "r etcbashrc", "rfc1323", "m1460", "macos x", "signature", "linux", "opera", "xp sp1", "windows sp1", "nmap syn", "m265", "synack", "mind", "macos", "warp", "ipv6", "internet", "icmp", "cisco", "monitoring", "argus", "chaos", "rsvp", "encapsulation", "aris", "isis", "netbootmount", "netbootshadow", "computername", "localonly", "localnetbootdir", "netboot", "define", "purpose", "networkonly", "waiting", "networkup", "term", "devnull", "common setup", "configure", "set command", "dns hostname", "dns query", "see also", "kame", "sunnet manager", "rpcsrc", "netlicense", "ftpd", "bindash binksh", "binsh bintcsh", "jumpcloud ldap", "smb2", "security", "workgroup", "standalone", "samba server", "enforce", "smb3", "example share", "improper use", "ctrlc", "none", "fax reception", "hardwired", "0007", "must", "visudo", "blocksize", "charset lang", "language lcall", "lines columns", "lscolors", "sshauthsock", "orion", "setup user", "home", "zdotdir", "delete", "beep", "vendor", "kf10", "kf11", "kf12", "kf13", "backspace", "insert", "resume", "termsessionid", "savehist", "sharehistory", "h do", "volume", "de l", "l uuid", "m tra", "n est", "suuid", "prfen", "fusion", "syst", "look", "executant", "alla", "over", "test", "overie", "zapis", "rapid", "disco usa", "de macos", "nie s", "i denne", "adgjmpsvx", "diskgthis disk", "01k8x j", "34disk", "levy kytt", "dict", "array", "plist", "apple root", "code signing", "inode64r", "xofkoxzh", "integer", "doctype", "brain", "abcd", "ogwo", "boaw", "cobwa", "uhawavauatsh", "ip bitmap", "foewdc", "could", "ip block", "funcs", "cogwo", "trash", "double", "hunt", "affa", "carr", "crypto", "docwbac", "q1b0", "q1 0", "h h5", "docwbag", "slice", "format", "zero", "alfa", "hera", "lelei", "hehe", "hisp", "fail", "katy", "zakk", "eodwcbgao", "hhk8di", "alma", "topo", "open", "huhk", "piper", "hehx", "eh ui", "h20hph", "hif h", "hmhhihqhyla hq", "r11b0", "target", "uus10u", "hifh", "loghookfailed", "loghook", "hell", "q1b 0", "f duh", "aqw1", "1160" ], "references": [ "index.html.en", "bind.html", "caching.html", "BUILDING", "configuring.html", "content-negotiation.html", "custom-error.html", "convenience.map", "LDAP.tbd", "lber.h", "ldap.h", "LocalAuthentication.tbd", "arm64e-apple-macos.swiftinterface", "x86_64-apple-ios-macabi.swiftinterface", "arm64e-apple-ios-macabi.swiftinterface", "x86_64-apple-macos.swiftinterface", "MultipeerConnectivity.tbd", "module.modulemap", "MCNearbyServiceAdvertiser.h", "MCPeerID.h", "MCError.h", "MCNearbyServiceBrowser.h", "MCAdvertiserAssistant.h", "MultipeerConnectivity.apinotes", "MultipeerConnectivity.h", "MCSession.h", "MCBrowserViewController.h", "dbivport.h", "dbi_sql.h", "dbd_xsh.h", "dbixs_rev.h", "Driver_xst.h", "DBIXS.h", "hook_op_check.h", "Admin.tbd", "AirPlayReceiver.tbd", "apfs_boot_mount.tbd", "AOSKit.tbd", "APConfigurationSystem.tbd", "AppleFirmwareUpdate.tbd", "launchdaemons.txt", "preboot_archive_errors.log", "mounts.txt", "launchagents.txt", "disk_structure.txt", "user_launchagents.txt", "security_status.txt", "kexts.txt", "process_list.txt", "battery.csv", "diskEncryption.csv", "chromeExtensions.csv", "crashes.csv", "interfaceAddrs.csv", "kernel.csv", "interfaceDetails.csv", "etcHosts.csv", "applications.csv", "mounts.csv", "sharedFolders.csv", "certificates.csv", "sharingPreferences.csv", "launchD.csv", "usbDevices.csv", "managedPolicies.csv", "systemInfo.csv", "users.csv", "sipConfig.csv", "systemControls.csv", "canonical", "aliases", "custom_header_checks", "access", "bounce.cf.default", "generic", "header_checks", "main.cf.default", "LICENSE", "makedefs.out", "main.cf", "master.cf.default", "main.cf.proto", "master.cf.proto", "master.cf", "TLS_LICENSE", "postfix-files", "transport", "virtual", "relocated", "afpovertcp.cfg", "asl.conf", "auto_home", "auto_master", "autofs.conf", "bashrc_Apple_Terminal", "com.apple.screensharing.agent.launchd", "bashrc", "command_args.json", "csh.cshrc", "csh.login", "find.codes", "csh.logout", "ftpusers", "gettytab", "irbrc", "kern_loader.conf", "group", "locate.rc", "man.conf", "mail.rc", "manpaths", "networks", "nfs.conf", "newsyslog.conf", "ntp_opendirectory.conf", "ntp.conf", "notify.conf", "paths", "pf.conf", "passwd", "profile", "pf.os", "protocols", "rc.netboot", "rc.common", "rmtab", "resolv.conf", "rtadvd.conf", "rpc", "shells", "smb.conf", "sudo_lecture", "ttys", "syslog.conf", "xtab", "sudoers", "zprofile", "zshrc", "zshrc_Apple_Terminal", "CodeResources", "version.plist", "Info.plist" ], "public": 1, "adversary": "DragonForce Malaysia Hacker Group", "targeted_countries": [], "malware_families": [ { "id": "Lastname", "display_name": "Lastname", "target": null }, { "id": "Firstname", "display_name": "Firstname", "target": null } ], "attack_ids": [ { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 66, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ilyailya", "id": "298851", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 4449, "domain": 3847, "URL": 14263, "FileHash-SHA256": 2356, "FileHash-MD5": 223, "FileHash-SHA1": 523, "email": 223, "CVE": 40, "CIDR": 12, "SSLCertFingerprint": 302 }, "indicator_count": 26238, "is_author": false, "is_subscribing": null, "subscriber_count": 35, "modified_text": "343 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67a801c7a6074eb73a688c51", "name": "#OpsBedil Targeted Attack: Malicious Windows Spyware VIM on OS", "description": "The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines; including: \nT1027 - Obfuscated Files or Information\nT1030 - Data Transfer Size Limits\nT1036 - Masquerading\nT1056 - Input Capture\nT1059 - Command and Scripting Interpreter\nT1070 - Indicator Removal on Host\nT1105 - Ingress Tool Transfer\nT1106 - Native API\nT1119 - Automated Collection\nT1134 - Access Token Manipulation\nT1140 - Deobfuscate/Decode Files or Information\nT1176 - Browser Extensions\nT1547 - Boot or Logon Autostart Execution", "modified": "2025-03-11T00:00:59.533000", "created": "2025-02-09T01:15:51.632000", "tags": [ "code", "range", "file offset", "ecxedi20xa", "edi0x6d", "ebp20x20", "esi0x67", "edx0x6f", "esi0x61", "ebp20x62", "hopper", "cve20072438", "normally", "use vim", "checkfile", "vimruntime", "checkdir", "vim project", "https", "bram moolenaar", "bram", "files", "silent", "insert mode", "down", "pumvisible", "vim script", "evim", "maintainer", "spellpopupmenu", "aunmenu", "tlunmenu", "loadbuffermenu", "revert", "difforig", "show", "ctrlu", "diffthis", "bail", "win32", "vim support", "remove", "comment", "genericname", "name", "keywords", "gvim", "edit", "zhcn", "editor", "metin", "rediger", "loadftplugin", "filetype", "expand", "amatch", "make", "sinsert", "middlemouse", "unix", "amiga", "mswindows", "loadindent", "end def", "visual mode", "shiftdel", "copy", "vim default", "selectmode", "insert", "load", "detectfiletype", "addoption", "optiong", "binoptiong", "optionl", "binoptionl", "header", "space", "python", "find", "open", "mark", "shell", "ruby", "install", "vim desktop", "substitute", "vunmenu", "paste", "script", "selectall", "word", "popup", "menu", "line", "close", "window", "back", "toolbar", "compiler", "next", "hack", "vimvimrc", "haiku", "openvms", "setsyn", "lang", "syntax menu", "description", "define", "setsyn function", "assembly", "maya", "bufnewfile", "bufread", "starsetf", "setf", "language", "visual basic", "xml au", "latex", "setfiletypesh", "endif", "lilo", "apache", "postscript", "rexx", "atom", "meta", "clipper", "desktop", "gift", "hercules", "julia", "mercurial", "pacman", "trigger", "puppet", "path", "powershell", "info", "ziggy", "speedup", "systemd", "form", "format", "calendar", "dracula", "config", "sfile", "esc", "iconv", "psflags", "if defined", "newitem force", "itemtype file", "iso88591 t", "utf8", "utf8 t", "iconvpath", "t iso88591", "makefile", "converted", "bob ware", "colorado school", "mines", "vim editor", "on your", "original copy", "please", "golden", "translation", "lesson", "enter", "type", "filename", "press", "normal mode", "repeat", "summary", "notice", "ruler", "test", "letzn", "mrkl", "zeil", "strg", "bewg nn", "end von", "druck", "dautticht", "zipf", "zaichen", "netty", "moveu el", "entrar", "premeu", "fitxer", "normal", "prova", "repetiu", "sumari", "desprs", "ara premeu", "cont", "ctrl", "ctrld", "append", "ctrlr", "ctrli", "shift", "backspace", "lekce", "napi", "dek oznaen", "normlnm mdu", "pesu", "stla", "soubor", "pesu kurzor", "opakuj", "toto", "lektion", "flyt", "skriv", "tryk p", "gentag", "bemrk", "filnavn", "nr der", "tryk", "zeile", "bewege den", "tippe", "zeichen", "cursor zu", "cursor zum", "kommandos", "cursor", "null", "tutor", "ctrlg", "shiftg", "shiftn", "msdos", "vimtutor", "capslock", "michael", "movu la", "leciono", "enenklavo", "kursoron al", "tajpu", "kursoron e", "testo", "premu", "dosiernomo", "resumo", "nova", "anon", "leccin", "mueva el", "intro", "pulse", "escriba", "para", "ahora", "insertar", "esto", "repita", "antes", "tenga", "como", "este", "leon", "tapez", "dplacez", "entre", "chap", "insertion", "puis tapez", "rptez", "appuyez", "lekcija", "otipkajte", "pritisnite", "ponovite", "kako bi", "insert mod", "prijeite", "saetak", "imedatoteke", "note", "windows", "yank", "mozgassuk", "fjlnv", "parancs", "lecke", "teszt", "j sort", "nyomja meg", "norml mdban", "ismtelje", "muovi il", "batti", "lezione", "invio", "premi", "ripeti i", "nomefile", "modalit normale", "adesso batti", "nota", "alla", "stata", "replace", "change", "subtitute", "school", "emiau", "spustelkite", "testas", "pirmj", "failovardas", "fail", "normalij", "santrauka", "ymeklis", "raid", "ramen", "tagad", "ievadiet", "piemram", "apkopojums", "lai izdzstu", "lai ievietotu", "ievadot", "ievrojiet", "js varat", "macos", "leksjon", "flytt", "trykk", "slette", "repeter", "erstatte", "sette", "kommandoen", "sett", "tips", "vise", "druk", "het commando", "herhaal de", "als je", "deze", "de cursor", "gebruik", "voeg", "bestandsnaam", "zorg", "mova", "digite", "teste", "agora", "pressione", "insero", "mais", "lekcja", "przenie kursor", "wcinij", "vima", "wpisz", "teraz", "powtarzaj", "nazwapliku", "uwaga", "jest", "dmesine", "ders", "ilk satra", "bu satrda", "normal kipe", "normal kipte", "daha fazla", "pomerite kursor", "otkucajte", "preite", "imefajla", "rezime lekcije", "za zamenu", "flytta", "filnamn", "normallge", "tryck", "om du", "sammanfattning", "genom", "lekcia", "presu kurzor", "presu", "napsanie", "zopakuj", "poznmka", "lcmessages", "lcall", "slovak tutor", "vim tutor", "amatria", "thevimproject", "slovak", "czech", "number", "motion", "ignore", "hjkl", "by gi", "di chuyn", "cu lnh", "u tin", "thay", "tntptin", "nu bn", "tng kt", "vim c", "lodi", "caps", "lock", "abc de", "command", "krishna", "spellerrors", "display dpy", "none", "false", "xfree", "sendinit", "isserialname", "staticspace", "xsync", "sendtovim", "main", "k command", "shell script", "vt100", "term vt100w", "dec locator", "vsnet", "tools", "external tools", "title", "arguments", "curline", "itempath", "init dir", "empty", "fbshtagsfp", "create", "options", "tags", "bourne shell", "perl", "fbkshfp korn", "tcl shell", "tk windowing", "parse", "new buffer", "buildcasetable", "printf", "buildwidthtable", "keys", "parsefoldprops", "parsewidthprops", "variabletags", "argv", "stephen riehm", "david woodfall", "getopt", "v include", "print version", "suppress", "reason", "file", "severity", "o ccfilter", "following", "this first", "ccfilter", "quickfix format", "though", "start", "john lange", "primitivem", "errorformat", "perl script", "executecore", "aerts", "sw developer", "sony telecom", "europe", "b1130 brussels", "belgium", "port", "host", "server", "vim channel", "chopen", "localhost8765", "json message", "linelength", "compilernames", "irix", "solaris", "hpux", "pablo ariel", "c compiler", "compilerqty", "usage", "project", "collector", "written", "ives aerts", "notes", "r decrement", "v verbose", "outputs", "o treat", "program", "q errorfile", "stdout", "copyright", "joerg ziefle", "perl w", "first", "maketag", "version", "exuberant ctags", "statement", "loop", "michael schaap", "support", "packagename", "look", "february", "push", "sgi mipspro", "error int", "error", "doit", "vim9 function", "nr2char", "c program", "vim quickfix", "awk script", "dec terminal", "make vim", "errors", "begin", "kirchgatterer", "opcodes syn", "addresses", "numbers", "types syn", "blocks syn", "strings syn", "program counter", "hilo byte", "quit", "todo todo", "aappythonscript", "python line", "python block", "blockline", "abap", "statement hi", "string hi", "structure", "vim abap", "abapr4", "marius piedallu", "james allwright", "april", "klmpqwvw", "comment hi", "type hi", "identifier hi", "constant let", "abel", "john cook", "johncook3", "a bunch", "todo xxx", "fixme", "c style", "abaqus", "carl osterwisch", "costerwi", "remark", "abaqus comment", "abaqus keyword", "include hi", "todo hi", "acedb model", "stewart morris", "thu apr", "syntax file", "acedb software", "xref syn", "rest", "preproc hi", "delimiter hi", "nikolai weibull", "include", "useroption", "options medium", "defaultprinter", "outputfirstline", "filecommand", "todo fixme", "martin krischik", "kind", "keyword", "mk bram", "standard", "character", "stype", "date", "vim syn", "altera ahdl", "x syn", "todo", "xnor syn", "specialchar hi", "builtin", "define hi", "builtin rect", "operator hi", "special hi", "dbus", "g3drop", "builtin dump", "builtin number", "builtin call", "redir", "stream", "screen", "function hi", "aflex", "lex syntax", "mathieu clabaut", "lastchange", "ada syntax", "aflex stuff", "patterns", "dominique pelle", "storageclass hi", "keyword let", "endlet", "htmlformat", "htmlcolor", "span", "htmlformatn", "foldcolumnbuild", "css1", "foldedid", "html", "generator", "fixme todo", "xxx note", "spell", "amigados", "campbell", "former url", "syntaxamiga", "krief david", "display drop", "beta cauchy", "irand224 syn", "normal poisson", "antlr4", "another tool", "yinzuo jiang", "jiangyinzuo", "july", "option value", "ben rubson", "hammers", "changelog", "option value1", "option", "value1", "david necas", "yeti", "base", "xxx not", "core", "antlr", "javacc parser", "azaz09", "parserend", "parserbegin", "token skip", "antsyntaxscript", "doug kearns", "zellner", "xmlcdatastart", "xmlcdataend", "xmltag", "xmlendtag", "ayer", "atch", "orkspace", "ngle", "rity", "mbol", "ffset", "istory", "osition", "xport", "stack", "tack", "digi", "flip", "shade", "cluster", "keyb", "arch", "moran", "ecode", "gnu arch", "source", "keyword hi", "simulate", "aptitude", "state", "yann amar", "quidame", "aptconf", "incomplete", "ebug", "autodetect", "fast", "marker", "score", "arduino", "hoff", "october", "license", "vim license", "arduino ide", "erik nomitch", "adam obeng", "artenterprise", "dorai sitaram", "ds26", "thilo six", "number hi", "edfghprs", "gnu assembler", "erik wognsen", "kdahlhaus", "kevin", "label hi", "macro hi", "title hi", "deprecated", "skip", "none hi", "claudio fleiner", "claudio", "end imports", "exports from", "implicitstags", "explicitstags", "absent present", "size universal", "strings", "aspperlscript", "perlscript", "aaron hope", "constant hi", "bwlsdxp", "macro", "specialchar", "error hi", "aspvbserror", "aspvbsfunction", "aspvbsmethods", "aspvbsstatement", "aspvbsnumber", "aspvbscript", "aspvbscomment", "aspvbs", "exits", "floating point", "asterisk", "tilghman lesher", "corydon76", "zonemessages", "atlas", "inaki saez", "jisaez", "flags bef", "orange syn", "containsasytodo", "asymptote", "avid seeker", "c syntax", "autodoc", "berg", "xml dl", "display", "contains", "borz", "kdpds", "oneline", "hotstring", "comspec", "hotkey", "reload", "common", "autoit", "soundplay", "autoit v3", "jared breland", "ping", "shutdown", "vim maintainers", "john williams", "action", "makefile syntax", "avenue", "arcview", "wagner", "esri", "string", "integer number", "operator syn", "xor mod", "hitachi h8300h", "xorc syn", "identifier let", "avr assembler", "avra", "avra home", "avra version", "marius ghita", "mhitza", "gawk ref", "functions syn", "awk ref", "effective awk", "programming", "keeps", "astro", "style", "fold", "enable", "astrojavascript", "htmlpreproc", "wuelner martnez", "html tag", "azaz", "ayaccuniongroup", "ayacc", "clusters", "aunis", "bash", "a formal", "method", "contributor", "csaba hoch", "undef", "defaultchar", "startstartfont", "bdfboundingbox", "containsbdftodo", "bibtex", "bernd feige", "ignore case", "xdata customa", "xref", "ams mref", "data", "basic", "quickbasic", "trim", "metacommands", "kill", "zonenumber", "bind zone", "mehnle", "slava gorbanev", "generates syn", "bcall", "vlado", "keywords syn", "string syn", "comment syn", "parent", "sulejman", "blank", "xspo", "bitbake", "chris larson", "kergoth", "daniel kho", "bsdl", "vhdl syntax", "tim pope", "vimnospam", "highlight", "imperfect", "bstnumber", "entry function", "integers macro", "bazel", "david barnett", "label", "digit", "john leo", "spetz", "boolean", "statuses", "bazaar", "dmitry vasiliev", "dima", "diff", "nospell", "synchronization", "baanerror", "selecteos", "updateerror", "d rows", "default", "selectempty", "selecterror", "updateempty", "union", "hooks", "normal hi", "case", "haskell cabal", "build file", "profunctor", "benchmark", "import", "cabalconfigpath", "cabal config", "original author", "cabalconfigkey", "false ghc", "cabal project", "true false", "cabalprojectnat", "boolean hi", "cparengroup", "cstringgroup", "ccommentgroup", "clabelgroup", "iso c99", "elifs", "ifndef", "ccppoutingroup", "optional", "accept", "public dtddecl", "entity catalog", "errormsg hi", "cdlcommentgroup", "raul segura", "acevedo", "xcheck", "childsname", "parentsname", "grpsdescription", "fixme xxx", "fullburn", "readdriver", "writedevice", "readdevice", "cfgcomment", "uncpath", "cfgstring", "cfgsection", "prischepoff", "on off", "yes no", "dos drive", "zhenyu", "documentation", "and fold", "operator", "punctuation", "transparent", "region and", "cfmlcorekeyword", "linden", "coldfusion", "skipwhite", "nextgroup", "cdrtoctrack", "cdtext", "performer", "silence", "zero", "softintegration", "cc interpreter", "declspec", "exception hi", "structure let", "built", "chaiscript", "jason turner", "lefticus", "escape", "web changes", "andreas scherer", "details", "cweb", "knuth", "silvio levy", "webcweb", "november", "haskell", "armin sander", "changelog file", "menesis", "vinschen", "june", "chatito", "observeroftime", "import syn", "intent syn", "slot syn", "cheetah", "max ischenko", "matches", "precondit hi", "evan hanson", "scheme", "chicken", "repository", "scheme syntax", "lighten", "heredocs", "cc syntax", "hse1", "chorus", "startofverse", "startofbridge", "startoftab", "startofabc", "startofly", "chordfont", "chill", "repeat hi", "avoid", "youngsang yoon", "image", "ccitt high", "this", "ember", "sifs0", "sinclude", "calendarinclude", "andrea callea", "chuck", "object event", "ugen array", "pieter van", "engelen", "arthur van", "leeuwen", "start syn", "int real", "char bool", "zamana", "flagship", "mario eusebio", "accept append", "blank from", "highlight value", "cmake", "comments", "match key", "cmakecachekey", "advanced", "highlight str", "stringstr", "nickspoons", "internal", "clever language", "clever", "multibase", "philip uren", "philuspax", "cmod", "cmodautodoc", "supports", "init init", "exit gcrecurse", "browser", "cocor", "shukla", "any characters", "context end", "from if", "nested pragmas", "to tokens", "cword", "fnameescape", "supplement", "must", "dgacfbe", "clojuretop", "arraychunk", "vecnode", "vecseq", "x00x7f", "partstart", "gondi", "inst", "etcdisktab", "acmsg", "acmsgtype", "hammesr", "yngve inntjore", "levinsen", "khym chanur", "james mccoy", "well", "anything", "conary recipe", "addallflags syn", "run automake", "makeinstall syn", "install copy", "move symlink", "link remove", "doc syn", "crm114", "modemsg hi", "imported", "target", "true", "interface", "quiet", "private", "write", "multi", "never", "unknown", "fatalerror", "sensitive", "android", "download", "guard", "exact", "locale", "trace", "alphabet", "john hoelzel", "hours days", "commands", "llll", "hminsmsusnsi", "ffll", "ken shan", "ccshan", "context", "synname", "startstartz", "endstopz1", "mptop", "luatop", "csccommentgroup", "if else", "endif elseif", "lev sy", "iallancestors", "curgen sy", "warningmsg hi", "essbase", "prior", "descendants", "cshell", "syntaxcsh", "variables", "luul", "csall", "srecord", "az09", "processes", "amsettimer", "sdlmatch", "default hi", "fdr input", "maxim kim", "habamax", "functions", "predefined term", "end predefined", "term variables", "century term", "csdl", "jacek artymiak", "c22032019", "call", "replacing", "comp", "recognize", "ascii", "existing syntax", "ctrlhbold", "ctrlh", "module level", "prop", "media", "cuda", "nvidia compute", "unified device", "architecture", "terriberry", "device global", "host managed", "shared syn", "restrict", "cupl simulation", "cupl syntax", "matt dunford", "sat nov", "statement let", "tex syntax", "cweb source", "cc material", "webincludedc", "double", "rc file", "dada", "dadas", "etant", "scen", "regel", "pero", "esquema", "tapi", "kada", "dados", "maka", "fono", "cupl", "valid integer", "signal", "phil derrick", "phild", "cynpp", "cynlib", "cynlib syntax", "posedge negedge", "changed syn", "instantiate", "out inst", "url http", "default cynscon", "standard syntax", "include debian", "match uri", "addremove", "byhash", "christopher", "dcod trts", "tnxt crlf", "labl syn", "cequ cneq", "cgte clte", "cbit clse", "dcomment", "jason", "pragma", "4857", "digital command", "sword", "mine", "conditional hi", "dart", "eugene pr3d4t0r", "ciurana", "former", "gerfried fuchs", "alpha", "rust", "datascript", "dscommentgroup", "comment let", "debcopyright", "orig author", "rob brady", "robb", "wu yongwei", "library stub", "code windows", "dos syn", "exports imports", "dep3 patch", "gabriel filion", "gabster", "specification", "authorfrom", "adminemail", "lockfile", "matthijs", "match", "ttext", "ccategory", "fflag", "llicense", "rock linux", "ren rebe", "spell syn", "lastline syn", "filter", "disablestrat", "s un", "r en", "jakson alves", "ansi sgr", "ansi sgr8", "jan larres", "term left", "black", "green", "contact", "charityware", "uganda", "entry", "block", "parasitic", "parameter", "devicemos", "rules", "device", "diva", "toby schaffer", "categories", "exectryexec", "unmounticon", "at wp", "chat", "django", "django template", "dave hodder", "dnsbind zone", "docbook sgml", "cest let", "docbook xml", "docbook", "devin weaver", "shlomi fish", "auto detect", "syntax xml", "sgml", "syntax sgml", "rory hunter", "json", "dockerfiles", "honza pokorny", "onbuilds", "from", "add arg", "cmd copy", "mike williams", "mrmrdubya", "windows nt", "msdosms windows", "mckee", "nima talebi", "hong xu", "sept", "keyword hilink", "hilink", "error hilink", "nargs hilink", "markus mottl", "enclosing", "scott bordelon", "wed apr", "cadence", "automation", "design rule", "checking", "layout", "schematic", "dsssl", "cest", "example", "xmlregionhook", "dtml", "dtml syntax", "zope", "markup language", "jordaan", "doxygenhtmltop", "synlink", "link", "syncolor", "strong", "reflink", "cpreprocgroup", "actions", "dtrace d", "d script", "solaris dynamic", "tracing guide", "nicolas weber", "nicolasweber", "first line", "probe", "turn", "entity", "matchgroupnone", "document type", "definition", "brabandt", "dune", "anton kochkov", "samuel hym", "simon cruanes", "kawahara satoru", "urkedal", "etienne millon", "dylan", "justus", "fri sep", "include let", "dylan library", "interface files", "brent fulgham", "bfulgham", "string let", "fulgham", "dnsmasqkeyword", "dnsmasqrange", "editorconfig", "anders", "edif version", "edif", "artem zankovich", "zartem", "5481988", "john beppu", "beppu", "ecd file", "embedix linux", "elm filter", "syntaxelmfilt", "elmfiltnumber", "brssow", "environments", "wraparound", "elinksnumber", "elinkscolor", "savingstylew", "imagelinksuffix", "homepage", "current void", "selse", "sthen", "eiffel", "joseph hager", "ajhager", "typedef hi", "lambda", "xxxx", "kresimir marzic", "oscar hellstrm", "oscar", "kornel", "syntax", "label highlight", "type highlight", "identifier", "george", "exec sql", "preproc let", "esterel", "luca necchi", "nikos andrikos", "esterel regions", "esterel types", "esterel comment", "identifiers", "euphoria", "builtins", "function", "reset", "should suffice", "etermgeneral", "d0xx", "mod5", "rubytop", "eruby", "erubysubtypezsw", "conventional", "text", "generated file", "david nev", "setup", "expect", "normal expect", "ralph jennings", "knowbudy", "user", "sysv", "bsd isms", "syntaxexports", "optset", "eviews", "vaidotas zemlys", "zemlys", "az4857", "assembler", "fasm", "ron aaron", "vim url", "fasm home", "fasm version", "xmm0 xmm1", "xmm2 xmm3", "dwayne bailey", "dwayne", "fdcc", "definitions", "iso tr", "unicode", "shell command", "output", "array", "fantom", "service", "bridle", "informix", "update", "abort abs", "absolute accept", "access acos", "add after", "allocate alter", "drop", "fishnext", "fishstatement", "fishterminator", "fishargument", "nicholas boyle", "flexwiki", "reilly", "home", "fuse", "modify", "table", "pascal makefile", "sections", "comments syn", "forth79", "forth83", "char", "forth83 syn", "body", "noname", "class", "local", "tung", "thu oct", "thomas reiter", "manipulation", "book", "document", "textfile", "apply", "formats", "popu", "crea", "modi", "memo", "defi", "disp", "dele", "appe", "repl", "proj", "alia", "cmon", "nvert", "mwin", "uniq", "blin", "carr", "story", "mult", "rator", "fortran", "ends", "cray", "ulllull", "stop", "fvwmm4", "mainsyntax", "fvwm2m4", "include m4", "include fvwm2", "fvwm1", "hss1", "general syn", "szsw", "check", "journal", "hold", "fvwm", "cursormove", "edgeresistance", "modulepath", "noborder", "windowlistskip", "backcolor", "sticky", "refresh", "buttons", "exclam", "slash", "gdmo", "iso101654", "guidelines", "managed object", "gyuman", "chester", "godot resource", "section syn", "ssss", "gdb command", "simon sobisch", "isplay", "unset", "linkurl", "gemtext markup", "suneel freimuth", "heading", "list", "quote", "heading special", "list statement", "godot", "bug hack", "gitdiff", "dddd", "endt", "commit", "question hi", "giftcef", "linenr hi", "giftceffw", "giftce", "conceal hi", "gedcom", "paul johnson", "december", "abbr addr", "adop adr1", "adr2 afn", "godot gdscript", "website", "pattern", "attribute syn", "macro syn", "gitcommitdiff", "your", "todo let", "crrw", "creator", "xexec", "syn match", "az4857 syn", "adam monsen", "opengl shading", "modified", "godoc", "title let", "gocommentgroup", "chan", "foldenable", "packagecomment", "integer hi", "todo regexp", "todos", "josh wainwright", "dot ja", "at gmail", "dot com", "karim belabas", "texstyle syntax", "todo syntax", "todd zullinger", "daniel kahn", "gillmor", "containsgpgtodo", "gprof output", "flat profile", "gretl", "gretl genr", "variable", "grads", "fronzek", "grid analysis", "display system", "grads scripting", "variables syn", "gnashkeyword", "gnashcomment", "gnashtodo", "solreadonly", "solsafedir", "john marshall", "jmarshall", "pedro alejandro", "lpezvalencia", "ddd0xx", "pager", "terminal", "chainloader", "groovytop", "exception", "groovy", "debug hi", "gtk theme", "packer", "conceal", "json syntax", "single", "trailing commas", "fixme note", "gnu server", "pages", "source html", "include java", "redefine", "argc argv", "begin begg", "end endg", "graph", "vim source", "matchlist", "vimsrcdir", "both", "getqflist", "cent", "kword", "c function", "small", "light", "vimcontinue", "endstr", "gensynvim", "vim9 syn", "vimexprlist", "magic", "hamlrubytop", "hamlcomponent", "hamltop", "haml", "hamlhtmltop", "david fishburn", "sun oct", "hamster classic", "hamster", "harepostfix", "hare", "vim syntax", "amelia clarke", "selene", "haredoc", "miscellaneous", "haste", "vlsi ic", "c preprocessor", "09afaf", "treat", "varid", "error let", "hbfilename", "hbhtmlstring", "hbhtmltagn", "hbhtmltag", "hbdirectivelib", "hbdirectiveset", "hbdirectiveout", "kkmmgg", "upstream", "a block", "szskkzes", "vim program", "restorer", "defunct", "aprl", "helplang", "intel hex", "sams ricahrd", "data digit", "folding data", "records", "record syn", "ignore hi", "vim help", "ident", "dana edwards", "danaedwards", "ic design", "preprocessor", "spacings", "resolutions", "ranges", "slhg", "hgcommitdiff", "sapling", "ken takata", "kentkt", "max coplan", "float hi", "hls playlist", "benot ryder", "comment line", "hogvar", "hogopnot", "hognumber", "hogipaddr", "hogcomment", "hogport", "hogoprange", "hogcomment syn", "hogstring", "bind", "elseif", "html template", "dennis", "htmltop", "htmljavascript", "onas", "htmlxml", "idem", "aria", "m4top", "htmlm4", "htmlos", "repeat syn", "aestiva", "jason rust", "jrust", "django html", "scomment", "i3configident", "i3configstrin", "i3configvalue", "focus", "i3configsh", "i3configstrvar", "i3configcommand", "i3configcolvar", "moving", "itanium", "parth malwankar", "pmalwankar", "file version", "masm syntax", "mark manning", "markem", "allan kelly", "ibasic file", "icewm menu", "james mahler", "fri apr", "icewm", "ids menu", "icon special", "icemenu", "data language", "ajelenak", "paren hi", "paren", "billshannon", "nlps", "npro", "graphics", "iconpregroup", "icon", "wendell turner", "prelude", "inbpc", "ddspe", "leaderscopy", "fontname", "badness", "elan ruusame", "shtop", "value", "args", "substituted", "macros", "ipfspecial", "ipftodo todo", "hendrik scholz", "hendrik", "openbsd pf", "ipfcomment", "xxx fixme", "donovan keohane", "syndisplay", "global", "verbextend", "double2", "snote", "david brgin", "dbuergin", "continuedoelse", "argv binpath", "cr crlf", "del debug", "eav empty", "inno setup", "my innosetup", "jason mills", "enterdisk syn", "sdsetuptype syn", "ifdef", "elif", "else", "cortopassi", "istoutspec", "peter meszaros", "pmeszaros", "istinpspec", "istcharacter", "istnumber", "istcomment", "jamcommentgroup", "jamparengroup", "ralf lemke", "xxx syn", "jargon file", "dan church", "label let", "javascript", "jls17", "see https", "javatop", "javadoctags", "javahtml", "tx0cr", "javamarkdown", "markdowninline", "jinja", "jinja template", "names syn", "standard jess", "jess", "paul baleme", "pbaleme", "jonas munsin", "xaxis yaxis", "x cross", "number let", "javacc", "java compiler", "javasoft", "vim compiler", "vito", "doc comment", "note xxx", "jspjava", "java server", "rgarciasuarez", "darren greaves", "patch", "thomas kimpton", "software", "eli parra", "json keywords", "jsonc", "izhak jakov", "izhak724", "acknowledgement", "kevin locke", "remove syntax", "json5", "mazunki hoksaas", "guten ye", "ywzhaifei", "syntax setup", "endz1", "kconfigconfigif", "abstract", "juliaexprsnodot", "regex", "naninf", "kdlnumber", "kdlnumber d", "aram drevekenin", "kotlin", "generated", "annotation syn", "kix2001 syn", "kixtart", "handle", "trap", "michael piefel", "entwurf", "cpp mode", "preproc", "error highlight", "storageclass", "delimiter", "sysvars", "false true", "kivy", "corey prophitt", "corey", "load python", "kivy language", "define kivy", "lace", "jocelyn fiat", "constants syn", "latte", "nick moffitt", "pre tag", "elsa", "glapagrossklag", "riley bruins", "ribru17", "keywords syntax", "sections memory", "overlay phdrs", "version include", "absolute addr", "names", "ldapconfcomment", "iso dialect", "modula2 dialect", "modula2 input", "styles", "error endif", "august", "pim dialect", "modula2", "longbitset", "procedure", "r10 dialect", "sto dos", "ldap ldif", "zak johnson", "zakj", "less", "jenoma", "todo optimize", "orce", "arset", "prox", "cache", "agent", "haskelltop", "lhstexcontainer", "ian lynagh", "tex markup", "bird style", "markdown style", "tex style", "lexccode", "user code", "flex", "van engelen", "patrick texier", "lifelines", "xref tag", "liquid", "liquidstatement", "yaml front", "matter", "liquidyamltop", "acdfmnrstuklp", "lilonumber hi", "number list", "niels horn", "lite", "liteinside", "lutz eymers", "ixtab", "email", "sql syntax", "errmsg", "livebook syntax", "lisplistcluster", "clisp ffi", "standard lisp", "keyword lispkey", "litestepdir", "litestep rc", "nethood", "winnt", "lotos", "is8807 syn", "specifications", "is8807", "daniel amyot", "damyot", "wed aug", "except", "logtalk", "logtalk entity", "term", "logic", "chfnauth", "chshauth", "createhome", "defaulthome", "lout", "report", "lambdaprolog", "teyjus", "vim version", "general", "lpccommentgroup", "lpcefungroup", "nodule", "lpcparengroup", "lpcpreprocgroup", "echo", "poet", "timo frenay", "timo", "labels syn", "lotusscript", "taryn east", "ultraedit", "textpad", "activateapp as", "base beep", "call case", "scott bigham", "colorterm", "luau", "marcus aurelius", "farias", "carlos augusto", "collapsebrtags", "lynx web", "lynx", "todo note", "uploader", "lyrics", "lrcnumber", "quake", "operators", "hascbackend", "pkg syn", "definelib syn", "definepgm syn", "importm3lib syn", "fleiner", "mainsyntaxm4", "mailquoteexps", "mail", "felix von", "leitner", "am est", "ascii character", "froms", "mallard", "jhradilek", "mallard markup", "draft", "skipnl", "roland hieber", "overrule", "ostype", "manconfcomment", "build", "suffix", "mason", "perltop", "hinrik rn", "sigursson", "pentium", "abgl", "ceopsz", "offset", "align", "floatingpoint", "vpmaxsq syn", "integer", "maple", "release", "focus master", "define syntax", "filename suffix", "segname segtype", "mtaddon", "matlab", "alex burka", "bbddeess", "all functions", "except keywords", "maxima", "robert dodier", "mermaid", "craig maceahern", "4857192255", "self", "accdescr", "click", "meson", "liam beguin", "zpetkovic", "disabler", "wikitop", "containshtmltag", "wikitableformat", "mediawiki", "yakov lerner", "rfc3339", "james vega", "melgroup", "maya extension", "robert minsk", "jason franklin", "sunghyun nam", "goweol", "mudunuri", "version info", "ctrlh syntax", "markdown", "matchstr", "metafont", "page", "latest revision", "magic point", "spam", "xfont vfont", "gero kuhlmann", "gero", "snmpv1", "snmpv2 mib", "martin smat", "msmat", "david pascoe", "pascoedj", "ax16", "donald knuth", "taocp", "mmix", "dirk hsken", "knuthstyle", "precondit endif", "pcimapfile", "parportmapfile", "model", "nil nil", "true syn", "symbols", "mmatop", "stub", "peter funk", "getdialect", "timo pedersen", "dat97tpe", "whitespace", "any array", "mookeyword", "dilnt", "multiplication", "mojonumber", "mojo", "stuff", "monk", "seebeyond", "mike litherland", "dirk van", "deun", "metapost", "manual", "autosync", "dumpvideo", "loadidx", "rawvideo", "tsprog", "color", "tabtitle", "am cdt", "pm est", "dummy", "ms message", "kwl7", "common ms", "messages", "ms idl", "vadim zeitlin", "vadim", "msql", "env variables", "inlclude", "modsim iii", "philipp jocham", "march", "actid all", "and as", "murphi model", "diego ongaro", "integers", "nspemit", "switch", "mushcode syntax", "rick bird", "clock", "dbck", "dump", "hook", "motd", "notify", "nuke", "restart", "snoop", "stats", "teleport", "attributes", "prettyprint", "libpath", "promylibdir", "attributes syn", "mupad source", "dave silvia", "dsilvia", "ymwd", "cciskaf", "float", "mysql", "pronovici", "encrypt", "namednotnumber", "nick hibma", "location", "marcin", "chaos", "dmap", "modules", "control section", "nastran", "tom kowalski", "any integer", "n1ql", "eugene ciurana", "merge syn", "nest syn", "pr3d4t0r", "vim command", "natural", "nasm", "iend", "movs", "time", "interval", "size", "directory cache", "cache buffers", "minimum file", "count", "daylight", "miner", "keith smiley", "login", "netrwtreegroup", "diffchange hi", "netrw listing", "toplevel", "readtoken", "nixexpr", "daiderd jordan", "daiderd", "region match", "bufenter", "syntax event", "synset", "checked", "muttvars", "neomutt", "bounce", "nsisanyopt", "statements", "nsis", "music", "rcx2", "scout syn", "rcx2 syn", "nqcparengroup", "rcx syn", "nqccommentgroup", "modes", "scout", "stefan", "module", "nginx module", "nginx", "http", "gost", "comet", "speed", "sphinx", "curv", "mtllibs", "exmaintainer", "anthony hodsdon", "objc syntax", "odin", "ms44", "and or", "occamnumber", "group", "omnimark", "paul terray", "mailto", "activate again", "catch clear", "close copy", "ocamltypeexpr", "ocamlallerrs", "jon parise", "ondirshell", "operator let", "objc type", "smes12", "qualifiers", "smes7", "smes19", "preparation", "protected", "structure hi", "openscad", "niklas adam", "luis moreno", "abort all", "alter and", "any as", "asc at", "oplstatement", "oplnumber", "open psion", "epoc16epoc32", "af09", "openvpn", "openvpnnumber", "openvpnsignal", "hupinttermuser", "containstop", "keepend", "eval", "menumode", "endurance", "blade", "illusion", "sneak", "onload", "disablemouse", "getclass", "notes todo", "containsallbut", "spells", "ronan pigott", "ronan", "alpm", "tcpip", "gclckprocs syn", "oracle config", "sandor kopanyi", "oraall", "protocol syn", "bequeath syn", "latest change", "haochen tong", "withconceal", "inlinecode", "super", "pappperl", "papphtml", "cdata", "perlinterpdq", "marc lehmann", "perlexpr", "config file", "lennart schultz", "string keywords", "protobuf text", "lakshay garg", "crgut", "tim chase", "austin", "pcctsinrule", "cpptoplevel", "pccts", "nextstep syn", "openbsd packet", "lauri tirkkonen", "sloadsanchor", "phtml", "perlinterpsq", "perlinterpmatch", "perlinterpslash", "perldata", "portb syn", "intcon syn", "gie eeie", "t0ie inte", "rbie t0if", "intf rbif", "microchip", "pdfxml", "nrtbf", "font", "palm os", "schau", "font id", "beware", "data syn", "postfix", "kelemen peter", "peter", "kelemen", "anton shestakov", "pikestmt", "pikebadgroup", "pike", "pine", "thu feb", "macro let", "httpviewer", "infopath", "longmanuallinks", "filter0xb7", "plaintexmath", "glue", "acute", "cdhoopstuvijll", "rrowvert", "skewsqrt", "mega", "phpinnerhtmltop", "phpclfunction", "phpcltop", "refer", "cphil", "number support", "c language", "does", "address and", "dword", "juerd", "plpperl", "plpend syn", "counter syn", "pl1commentgroup", "pl1parengroup", "declare dcl", "procedure proc", "loops", "podformat", "ibsclfx", "perl pod", "poe item", "show hide", "minimal", "address", "obsolete", "openclose", "bjoern jacke", "bjacke", "povray", "syntax syn", "off true", "false yes", "ppwizard", "dennis bareis", "ppwizargval", "constants", "plsqlparengroup", "oracle", "plsql", "klaus muth", "klaus", "altf amcr", "arc asfn", "astk barc", "blk box", "call syn", "cass cir", "melchior franz", "mfranz", "sonia heimann", "todo tbd", "privoxy", "prolog", "promela", "mon oct", "thu aug", "promela types", "class linking", "ps ll3", "dsc comment", "device gstate", "ps level", "postscrstring", "escaped", "matrix", "courier", "buffers", "redistributions", "this software", "including", "but not", "limited to", "pbcommentgrp", "google", "az09az", "posix", "rex barzee", "rexbarzee", "aclqrv", "a af", "ag ax", "e ef", "eg ex", "certain", "ps1comment", "purify header", "informational", "warning", "corrupting", "fatal", "haakon riiser", "hakonrk", "c syn", "pypa", "commands syn", "globs", "line break", "pyrex", "marco barisione", "python syntax", "olor", "chars", "progress", "ation", "progressdebug", "progressnumber", "edure", "progresstodo", "eter", "daniel", "sage", "widget", "rage", "python library", "reference", "quarto", "aquino", "vim runtime", "quickfix", "directory hi", "hee1", "lookdown lookup", "quakeoctalerror", "quake12command", "noprefix", "console", "onoff", "qb64", "z2z1", "qmlexpr", "radiance scene", "georg mischler", "radiance", "greg ward", "surface", "raccruby", "rule", "racc input", "dobie", "xdobie", "handling", "vector", "types syntax", "raml", "restful api", "hopkins", "rofi advanced", "pierguill", "common rc", "resource", "heiko erhardt", "language syn", "bitmap icon", "cursor cursor", "cmash", "ratpoison", "magnus woldrich", "djkea2", "bulls eye", "force control", "number syn", "rapid", "azazxc0xff", "azazxc0xff09", "rakuinterpqq", "rakuregexen", "rakuregexp5", "rcs log", "joe karthauser", "rcs file", "revision", "yyyy", "rebol", "yer todo", "words syn", "view", "view tabs", "spaces", "vicharsearch", "viprevword", "viendword", "visearchagain", "vinextword", "registry key", "registry export", "ulitin", "head", "regedit4", "win9", "bytes", "paths", "xxx bug", "davide alberani", "remind", "ben orchard", "rem omit", "mit license", "raimon49", "permission", "software is", "resolvipcluster", "ipv6 support", "09azaz", "radu dineiu", "hidesymbol", "r help", "r code", "epsilon", "kappa", "slabelsk", "over", "relax ng", "containsrnctodo", "rnoweb", "highlighting", "rnowebr", "ranke", "ferraz pereira", "rosa", "extension", "bytestream", "andrew bromage", "frameend", "worldbegin", "worldend", "attributebegin", "attributeend", "todo improve", "handles", "todo are", "redif", "axel castellane", "templatetype", "and add", "alex zvoleff", "configuration", "r syntax", "syntaxrpcgen", "mikrotik", "cidr notation", "cycle", "exit", "catch", "rpl2", "rmdlatex", "yaml header", "highlight code", "rmdr", "text format", "rich text", "control words", "new control", "rstcruft", "salt state", "jinja runtime", "star", "disallow syn", "disallow", "samba", "new maintainer", "ntlmv2 syn", "synfold", "rubymodifier", "sasbasicsyntax", "add syntax", "sasgraph", "yrdif yyq", "template", "mixin", "extend", "return", "steven dobay", "stevendobay", "sather", "science", "institute", "dede", "scilab", "benoit hamelin", "containedgroup", "preproc syn", "aclchg", "acldel", "aclgrp", "aclumask", "lockscreen", "zombie", "scss", "puria nafisi", "azizi", "always", "ip adresses", "verify", "synopsys design", "constraints", "tcl vim", "thu mar", "tcl syntax", "tcl extension", "xor syn", "task else", "nextstate syn", "in out", "with from", "ebcdic", "closedelay", "txtrigger", "spdnormal", "portd", "comment hilink", "sexplib", "atoms syn", "lists", "clst", "sgml charset", "capacity scope", "features", "baseset descset", "simple", "shfoldheredoc", "shfoldifdofor", "shlooplist", "shfunctionlist", "shidlist", "shecholist", "shcaselist", "shdblquotelist", "provides", "sgml specific", "space crlf", "dquote syn", "percent", "mp luacall", "alephversion", "uchar", "udelimiterunder", "umathchardef", "umathruleheight", "umathstackvgap", "umathxscale", "uoverwithdelims", "hai tp", "bestanden", "hanya dalam", "fiierele", "tp tin", "aemacron amstex", "aacute", "abrevehook", "afterpar", "agrave ahook", "amstex amacron", "atilde", "beforepar beta", "bigm", "delta", "oldstable", "experimental", "bullseye", "trixie", "forky", "focal", "jammy", "devel", "buzz", "maverick", "keyword syntax", "typescriptvalue", "title syntax", "typescripttype", "blabla", "sicad", "zbranyiczky", "irpt", "irptl", "mes1", "swift project", "simula", "simula syn", "keyword end", "when", "nagle", "main url", "comparison", "load sinda", "on si", "off eng", "sieve", "skill", "nsqn", "dirfile", "pnamestring", "pathversion", "schemeskill", "afterbefore", "tolist", "renderman", "dan piponi", "specialkey hi", "headers", "nontext hi", "jan hlavacek", "xuserblock", "for loop", "userblock", "null syn", "tracedrop", "daheartbeat", "slpregcomment", "spi file", "private public", "slrn score", "preben peppe", "guldberg", "age bytes", "syntaxsm", "smarty", "mon nov", "constant", "slice", "zeroc", "morel bodin", "smcl", "stata markup", "jeff pitblado", "jpitblado", "statasmcl", "directive", "smith", "smil", "herve foucher", "smil boston", "animation syn", "smlallerrs", "smlaenoparen", "fabrizio zeno", "cornelli", "zeno", "snns network", "snns http", "lln lun", "toff soff", "ctype syn", "snns", "maximum", "maximum output", "stringcomment", "initvalvalstr", "mono", "snobol4", "rafal sulejman", "site", "csnobol", "parens", "cothi", "afpnumkg", "spice circuit", "noam halevy", "insensitive syn", "spice", "splintallstuff", "splintannotelem", "ralf wildenhues", "splint home", "c code", "purpose", "buildinstall", "linux rpm", "freund", "ormeir", "wed oct", "spyce", "rimon barr", "rimon", "spupordinary", "input output", "spuptextproc", "type stream", "bugs", "execution", "snns result", "fishburn", "thu sep", "sqloracle", "buffer", "sqlforms", "austin ziegler", "prev change", "todo find", "xpos", "java syntax", "sqlj", "sap hana", "upper case", "upper", "schema syn", "user syn", "memory database", "sql syn", "spl syn", "comment syntax", "query language", "adaptive server", "anywhere", "xpscanf syn", "methods syn", "starea syn", "stcentroid syn", "stperimeter syn", "paul moore", "oracle nquote", "diffadd hi", "diffchange let", "section", "query report", "writer", "nathan stratton", "treadway", "jeff lanzarotta", "squid", "thanksto", "ilya sher", "iso8601", "subrip", "range syn", "ddd skipwhite", "bold", "sections syn", "override", "smalltalk", "arndt hesse", "hesse", "openssh client", "jakub jelen", "jakuje", "dominik fischer", "openssh server", "conditional", "repeats", "types", "globals", "statafuncgroup", "statamacrogroup", "stataparengroup", "rmcoll syn", "invftail", "invibeta", "haseprop", "mata", "structurizr dsl", "venthur", "hsiaoming yang", "lepture", "marc harter", "sudoersuser", "lazy", "generic", "swig", "julien marrec", "apache license", "runtime library", "vim maintainer", "emir sari", "nowarn", "i3confignumvar", "endze", "josef litos", "james eapen", "nargs syncolor", "nargs synlink", "syncolor type", "syncolor ignore", "syncolor added", "preproc synlink", "type synlink", "special synlink", "budden", "ingo karkat", "myk taylor", "install syntax", "syntax au", "systemverilog", "verilog syntax", "tads", "amir karger", "karger", "history info", "syntaxtags", "tak2", "tak3", "tak2000", "tak compare", "tak output", "load tak", "tar listing", "type let", "john florian", "wed jul", "key names", "values", "characters", "uuids syn", "rufus cable", "verbose tap", "rufus", "tap output", "pass", "foolman", "cmovsetj", "borland", "united force", "vector graphics", "verbose", "known template", "xfire user", "tcshvarlist", "tcsh", "gautam iyer", "ttlconstant", "term language", "tera term", "kcpy kcrt", "eenlrtbfs", "xhp xhpa", "xt xenl", "msgr", "tclspecialc", "tcltk", "taylor venable", "taylor", "system", "geometry", "tss syn", "typescript", "kao weiko", "jose elera", "campana", "zhao yi", "scott shattuck", "irc channel", "freenode", "vim filetype", "andy lester", "tt2topcluster", "typescriptreact", "react", "strpart", "include perl", "rawperl", "moriki", "atsushi", "ucnumber", "unrealscript", "openwrt unified", "colin caine", "fancy", "normal let", "typstcode", "matchgroupnoise", "noise highlight", "hashtag", "typstmarkup", "noise", "motif uil", "user interface", "thomas koehler", "september", "import hi", "anton", "prunefs", "prunenames", "prunepaths", "prunebindmounts", "upstart", "upstart job", "michael biebl", "biebl", "james hunt", "archivebit syn", "datelimit syn", "daysold syn", "deleted syn", "destination syn", "dirsonly syn", "drivealias syn", "filedate syn", "filedelete syn", "files syn", "msid", "innovation data", "rob owens", "ull ulls", "msg types", "ip address", "agtpcsrv", "profile", "version date", "ms windows", "action devpath", "valgrind memory", "debugger output", "roger luethi", "program url", "christoph gysin", "valve data", "tag syn", "wend", "prather", "pratam", "minor", "iskeyword", "xnor xor", "veraparengroup", "veralabelgroup", "vhdl", "linting", "vhsic", "high speed", "new style", "verilog", "mun johl", "485763", "vos cm", "andrew mcgill", "az syn", "bwlfdgh", "fdgh", "bwlqofdgh", "psect", "virata aconfig", "virata", "viratahexnumber", "execoptions", "ewind", "uffer", "malt", "wind", "vrmlevents", "vrmlfields", "vrmlcomment", "vrmlprotos", "vrmlnodes start", "externproto", "proto", "vgrindefs", "vgrindefs file", "profilesetzss", "java source", "parmp", "novimmain", "extern", "mswin", "featguimswin", "vimdll", "editnone", "level", "heading level", "vimtestsetup", "noop", "java language", "nontext", "returns", "chapter", "annotations", "labels", "text text", "tag head", "void", "htmlsnippets", "object", "object apply", "object bb", "no operation", "u003b", "n value", "pair", "long", "generics", "predicate", "vimtestsetup hi", "error import", "nontext class", "see jls", "declaration", "taggable", "binaryoperator", "i1 x", "i1 y", "string str", "taggable i1", "letters", "letters alpha", "letters beta", "tag tail", "use identity", "supplier", "tests", "identity", "comparable", "intfunction", "a dummy", "tggabl", "string s", "string tostring", "do not", "this file", "indent4", "indent2", "indent8", "tggabls", "fields", "classlock", "defines demo", "testable", "serviceloader", "malformed", "woof", "string s1", "string s2", "browns", "jumpss", "string s4", "string s6", "string apply", "string bay", "as quick", "woofs", "beta", "yieldable", "t yield", "other", "colon", "arrow", "unfoldenable", "italic", "strikethrough", "bold italic", "foobar", "modula2 pim", "test file", "colouring", "is licensed", "under the", "from system", "modula2 iso", "retain", "to do", "modula2 r10", "unsafe", "cardinal", "var abc", "variableb", "variablec", "var3", "var4", "var5", "var6", "variablea", "variabled", "variablee", "variable3", "varb", "variable1", "variable2", "varc", "vard", "variable4", "function1", "function4", "function2", "function3", "eq ne", "gt ge", "le lt", "ne gt", "ge le", "variableathis", "valsubfunc", "below", "reply", "issue", "cfoo", "ifoo", "interrupt", "ctrlc", "e123 catch", "varvalue", "cdpath", "backuptype", "defaultdevice", "executefbackup", "shall", "please wait", "buffer foo", "nargs range", "completer1 foo", "completer2 foo", "foo2", "bang", "nargs foo", "foo delcommand", "multiline", "commenttitle", "end augroup", "autocmd", "fixme call", "matched", "start not", "end not", "end call", "xterm call", "givename", "vim9", "test const", "foo def", "ex command", "dict", "end endfunction", "end enddef", "answer", "warningmsg", "endwhile", "dotest3", "dotest4", "dotest5", "dotest6", "test1", "test2", "test3", "test4", "test5", "funa", "dofuna", "funb", "dofunb", "func", "dofunc", "fund", "dofund", "foo delfunction", "foo function", "foo comment", "foo none", "guifg", "comment none", "ctermfgcyan", "end end", "end let", "end line", "end line1", "a basic", "rhs map", "foo bar", "fubar", "needle", "foogroup foo", "foogroup", "homeinclude", "defabc", "snomagicfoobar", "smagicfoobar", "special", "line comment", "b special", "char0x0044", "testcluster", "cchar", "keywords list", "vim line", "element", "x1f xf", "31 3", "u02a4 u000002a4", "string escape", "hexadecimal", "0xff echo", "decimal", "octal echo", "0377 echo", "vim shebang", "instance", "pairclasstest", "vim keymap", "end const", "expr", "foo unlet", "vim comment", "vim9 ex", "end foo", "xterm foo", "eof foo", "vim9script", "s vim9script", "12345", "0b10101010", "192939", "0777", "0o777", "0xabcdef00", "0x12345678", "runtest", "rticle", "syntax test", "file 0", "dougkearns", "2024 jun", "13 0", "test failures", "when comparing", "italicized text", "eading level", "igure", "eader", "frame", "diomatic text", "nput", "utput", "icture", "rogres", "cript", "earch", "ection", "elect", "reformat", "failure 0", "egend", "oscript", "bject", "ptgroup", "ption", "trong", "tyle", "able", "emplate", "extarea", "itle", "ource", "olgroup", "atalist", "etails", "ialog", "ieldset", "igcaption", "eleted text", "mphasis", "mbed", "side", "udio", "lockquote", "anvas", "aption", "ring at", "ideo", "cronym", "rame", "rameset", "arque", "enuitem", "rack", "narticulated an", "oframes", "trike", "ortal", "aram", "trikethrough", "highlighted", "elements have", "never be", "mage", "interface 0", "efault 0", "mport 0", "redundant", "tail", "alue", "nterface 0", "primer", "label 0", "tatic 0", "oid 0", "edundant", "identity cast", "expres", "to nest", "typeuse an", "htmlcom", "here is", "snip", "tmlsnip", "egion 0", "literal", "html com", "no entry", "point method", "code main", "return 0", "code nul", "eturn 0", "noop1", "may be", "used after", "noop2", "literalu0", "is proces", "return 8", "noop5", "nbsp", "noop6", "noop7", "link j0", "javaignorej0", "vimtestsetup s0", "fen 0", "nt 0", "majorversion", "empty string", "rotected 0", "compares this", "instance with", "the pas", "code that", "no period", "for the", "above sum", "rivate 0", "htmlsnip", "return an", "link m0", "execute", "match visual", "fen c0", "ref0", "literals", "clas", "tostring", "start 0", "ostring 0", "replace 0", "ubstring 0", "noop8", "noop9", "markdowncom", "arkdownsnip", "markdown com", "code public", "the method", "must be", "declared", "code 0", "the major", "java version", "used with", "inal 0", "markdownsnip", "blanks and", "re 0", "static void", "param a0", "rgs 0", "optional c0", "arguments 0", "invoke", "nontext 0", "hrow 0", "ew 0", "object module", "object open", "exports opens", "requires", "bject 0", "eplacement 0", "ar 0", "opens", "object opens", "object provides", "object requires", "object to", "uses", "xtends 0", "mplements 0", "ealed 0", "ermits 0", "bstract 0", "c1 i0", "noop3", "noop4", "a sum", "foldingtests", "static", "object b", "escapestests", "static final", "string hel", "har 0", "0ffffff0", "1200", "1210", "1230", "1240", "1250", "1260", "1270", "1300", "1310", "2040", "3240", "0100", "0120", "0130", "0140", "0150", "0160", "0170", "0200", "0210", "0230", "biginteger", "t1 x", "uper 0", "e element", "radix", "ecord 0", "tatic", "t dum", "isempty", "ublic 0", "ase 0", "ong 0", "witch 0", "genericstests", "todo 0", "3400", "3410", "3420", "3430", "3450", "3460", "3470", "3500", "3510", "3520", "sempty", "opal", "opsome", "ushal", "ushsome", "adix", "romdecimal", "lambdaexpres", "leftconst07", "leftconst08", "leftconst09", "i1 0", "leftconst10", "leftconst1", "leftconst01", "leftconst02", "leftconst03", "leftconst04", "leftconst05", "leftconst06", "leftconst", "const1", "const2", "witch", "hen 0", "alpha w0", "beta w0", "equals", "leftconst12", "typearguments", "identifier 0", "nteger", "ashcode", "omparable", "ry 0", "atch 0", "unction", "tring", "length", "ntfunction", "intsup", "clone", "naryoperator", "alueof", "quals", "redicate", "equalist", "gymnastics for", "ipredicate", "superequalist", "ethodhandle", "invokepredicate", "methodhandle mh", "throwable th", "a dum", "b dum", "t extends", "stringer", "ostring", "ntvalue", "onsumer", "println", "uperequalist", "nvokepredicate", "ethodhandle mh", "remember", "num 0", "asci", "stylable", "t e0", "tringer", "ative 0", "ynchronized 0", "trictfp 0", "thread", "qualist", "ransient 0", "methodstests", "string t0", "la s", "string name", "equires 0", "odule 0", "this module", "to the", "sample project", "published at", "mport m0", "related sup", "ransitive 0", "xports 0", "pens 0", "jdk 23", "ses 0", "rovides 0", "ith 0", "doautocmd", "syntax 0", "0xp0", "ouble 0", "minusoned", "xap1", "doto", "numberstests", "ouble", "loat 0", "maxdecf", "maxhexf", "mindecf", "minhexfa", "minhexfb", "maxdecd", "maxhexd", "minhex", "minoct", "minbin", "minusonehex", "minusoneoct", "minusonebin", "maxhexl", "maxoctl", "minusonehexl", "minusoneoctl", "minusonebinl", "jdk 21", "object o", "rue 0", "alse 0", "stringtests", "a quick", "brown fox", "jumps over", "the lazy", "there are", "lf after", "jumps0", "ver the0", "a nested", "string ap", "brown", "jumps", "over the", "nested com", "switchtests", "ield", "a or", "ield 0", "yte 0", "1let", "hort", "hort 0", "nofoldenable 0", "0000 0", "unfoldingtests", "reak 0", "old italic", "s1024", "talic", "inheritdoc", "object ap", "hile 0", "for vim", "file is", "licensed under", "the vim", "license 0", "efinition 0", "rom 0", "predefined", "ype 0", "ointer 0", "il 0", "nter", "ninter", "octal", "pragmas", "with emphasis", "opyright 0", "uthor 0", "fred flintstone", "icense 0", "baz bam", "ispose 0", "oc 0", "ord 0", "dr 0", "ast 0", "size 0", "rocedure 0", "egin 0", "nd 0", "ixme 0", "eprecated 0", "procedures", "ewfo", "nteger 0", "disabled", "hile fo", "do 0", "while", "synonyms", "itset 0", "roc 0", "roces", "ewproces", "ransfer 0", "ystem 0", "ongcard 0", "bozo bim", "dada jingle", "etbar", "lias 0", "defined pragmas", "numeric", "xcafed0", "inline", "noinline", "implementation", "cho 0", "this for", "done", "is a", "very handy", "solution and", "no real", "replacement", "available", "unction1", "a text", "shel", "his is", "home 0", "ariable10", "this is", "with a", "nset 0", "962 0", "f true", "unab", "abclear 0", "bclear 0", "java module", "changefilename", "restorefilename", "todo highlight", "author", "antonio colombo", "delete", "processing", "hebrew", "complete", "separate", "usercomplete", "matchitem", "cargo", "utility call", "trim trailing", "nvim", "linenr", "newcolumn", "columnnr", "wordregex", "gnat", "atomic", "timeslice", "structmembers", "nextitem", "col2", "typename", "typeref", "mpkeywords", "ctxkeywords", "binarysearch", "contextcmd", "omnisyntaxlist", "vim completion", "alex vear", "sung pae", "clojure version", "emptynode", "unitname", "setsession", "dec ada", "switchsession", "zat line", "vim adadec", "synidattr", "strridx", "auto", "nfz62010", "mdn css", "mask", "mnem", "setprojectfile", "pretty", "project file", "bufreadpost", "vim autoload", "decho", "dret", "getonescript", "e486", "dredir", "buffer test", "beginning", "prevnonblank", "getline", "xhtml", "dot pl", "doctype", "completetags", "harepath", "finddir", "attempt", "hare module", "java", "strive to", "for at", "least vim", "e121", "dialect", "setdialect", "hide", "bruno sutic", "blur", "accesskey", "onblur", "onfocus", "select", "tosource", "anchor", "cookie", "iframe", "checkbox", "codebase", "infinity", "foreign", "dorec", "lexer", "panic", "netrw", "charles e", "win9x", "dfunc", "systemroot", "nfhhtml", "nfhhtm", "nfhjpg", "toolbar menu", "synstack", "indent", "quote handling", "extraoemake", "hostcc", "buildcc", "buildcflags", "buildldflags", "freebasic", "precedence", "searchbracket", "plnum", "shiftwidth", "extrafunc", "python task", "parlnum", "commenttodo", "omni completion", "xml directory", "scope", "abbr", "fixed", "findmatch", "matchmax", "findbracket", "lispword", "isforfold", "inherestring", "nulldict", "column", "rstfoldcache", "cacherstfold", "rstfold", "antony lee", "helper", "getcurpos", "endfunction", "getpos", "shelltokenize", "withpath", "fnamemodify", "jump", "warningmsg echo", "emit", "play", "defpython", "rustfmtcommand", "runrustfmt", "detectversion", "split", "getconfigvar", "stephen sugden", "stephen", "save rustfmt", "vrustfmt", "nread", "loadfile", "getdirchoices", "yesn", "winbufnr", "vimspell", "bufwinnr", "index", "sqlcwarningmsg", "sqlcgetcolumns", "sqlcerrormsg", "compltype", "omni", "allow user", "synlist", "problem", "snum", "lnum", "isinclassdef", "isposinclassdef", "getrubyvartype", "getoption", "tohtml", "diff2html", "jumptoline", "mime charset", "latin1", "typst", "echoerr", "echomsg", "typeset", "echowarn", "getrunningjobs", "tex root", "addjob", "removejob", "showmesg", "chgdir", "vimball", "decompress", "vimballhome", "mkvimball", "restoresettings", "mkdir", "item", "emptystackp", "getlastopentag", "vimxmlattrinfo", "vimxmltaginfo", "tagstack", "istag", "endtag", "decreaseindent", "textwidth", "emptytag", "starttag", "browse", "setsaneopts", "restoreopts", "extract", "adacore", "cmdpre", "makeprg", "cargo file", "cmdpost", "basefont", "samp", "cite", "applet", "input", "middle", "acronym", "button", "gamma", "theta", "omega", "apos", "cong", "legend", "annotation", "attributegroup", "choice", "selector", "field", "choose", "foreach", "sort", "param", "stripspace", "all rights", "apple system", "tmpdir", "containerdir", "supportawdd", "supportbtserver", "apple", "rights", "file system", "fontd", "bookmark", "securityscope", "directory", "utility", "regularfile", "packagekit", "darwincachedir", "store database", "allow", "security", "reboot", "os x", "homedir", "realhomedir", "usersbasedir", "usercachedir", "audio", "callkit", "datacloudkit", "workaround", "rdar", "ckassets", "mmcs", "anyuuid", "caches", "allow fsctl", "fontvalidator", "frameworks", "coreservices", "carbon", "lsarpc", "dssetup sandbox", "squash", "readonly", "deny write", "issue sandbox", "network stack", "services lookup", "readwrite file", "system keychain", "wkssvc sandbox", "brlm", "byte range", "lock manager", "allow smbd", "allow wsp", "allow launchd", "netfsserver", "allow file", "sandbox profile", "ipv4", "ipv6", "netcore", "afsystem", "sysprotocontrol", "edge cache", "video", "allow access", "sandbox", "pkrecipt", "cachedir", "cmds", "applesmcclient", "smt isolation", "verw", "tempdir", "byhost", "sigkill", "sysmacsyscall", "sysaccess", "sysclose", "syscsrctl", "sysfchmod", "sysfsetxattr", "sysfsgetpath", "sysfstat64", "sysfstatat64", "darwintempdir", "reserve", "parampath", "mailv2", "mail importer", "allow mail", "library", "appcontainer", "document being", "quick look", "manage", "carbon noise", "make sure", "opengl", "plugin", "movie", "safari", "unix domain", "uuid cache", "redistribution", "is provided", "direct", "cfnetwork", "satellite", "files access", "daemon", "webdav file", "sharing", "sysgethostuuid", "gr ucs", "freebsd", "netbsd", "ucs gb2312", "cp932vdc", "ucs cp932vdc", "gb2312", "gbk ucs", "gb18030 ucs", "gb18030", "cpucs", "grucs", "appleucs", "gr mapperzone", "iso8859ucs", "big5ucs", "jisucs", "cnsucs", "appleinternal", "applications", "volumes", "gregory mcgarry", "coff dsp21k", "risc os", "programmer", "appendix e", "packdir", "git pack", "acorn", "chunk file", "from risc", "os programmer", "corrupted", "infocom", "david griffith", "glulx", "text adventure", "game", "adventure game", "allen garvin", "dave chapeskie", "aes crypt", "encrypted data", "joerg jenderek", "createdby", "createdby b", "windows gui", "alliant", "alliant fx", "fx series", "allegro", "toby deshane", "algol", "4 string", "bmode", "proc", "defmens vendors", "procedure b", "bref", "bflex", "bsdos", "bsdi", "unix32v", "sunos", "again", "hive rc", "sequence", "avro", "parquet", "apache hadoop", "apache big", "obj apache", "orc apache", "par1 apache", "pitentry", "android vdex", "android backup", "0 dalvik", "android bootimg", "password salt", "hidden", "loki", "apl workspace", "module sound", "density", "amigaos", "postma", "soundmon module", "trid", "amiga disk", "dos disk", "application", "mpeg v4", "dmb maf", "ycbcr", "cmaf media", "monaural", "heif image", "apple quicktime", "mike", "codec", "live", "applixware", "peter soos", "words words", "raster bitmap", "macro macro", "builder builder", "mac os", "ii image", "disk image", "blocks", "apple dos", "appleworks word", "spreadsheet", "sweet", "bernie", "rescue", "corrupt", "bobo", "amanda", "tapestart date", "file dump", "arm coff", "aarch64", "arm thumb", "armv7 thumb", "apt cache", "second", "bits per", "image width", "per meter", "asfdataobject", "time offset", "data length", "colors", "040t", "asterx", "guy harris", "word words", "grap graphic", "macr macro", "asterx version", "words document", "graphic", "coff", "we32000 coff", "mau hardware", "sccs", "we32k", "bbxpro5files", "oliver dammer", "dammer", "beetle vm", "beetle", "cable", "box router", "fritz", "box fritz", "password b", "oem b", "language b", "thu jun", "x tap", "sender", "x5fx81x44", "batch", "notification", "georg sauthoff", "gsma", "gsm association", "cdrs", "bflt", "philippe de", "muyter", "blockhashloc", "marco pontello", "sam alignment", "bgzf", "samtools", "binary call", "binary sequence", "fasta", "iupac", "blocked gnu", "patchmaster", "binary format", "alois schloegl", "medica soft", "axgr biosigaxg", "biosigaxg", "ircam file", "adpcm", "david korth", "song", "atari st", "ache", "david", "bonk", "insane", "pokey", "otto", "zbot", "blcr", "uncomment", "vma06", "kernel", "berkeley lab", "c000r000 blcr", "sparc", "armeb", "sparc64", "blender", "native format", "glob chunk", "blender3d", "scripts", "bpy blender3d", "bpython script", "blackberry file", "blackberry rim", "etp file", "0x10", "greg roelofs", "gnu tar", "ascii null", "compress", "0x04", "openoffice", "freeze", "archiver", "designer", "spark", "hpack", "oblivion", "zpack", "blink", "npack", "xpack", "blit mpxmux", "blit", "vaxorder", "blit stuff", "ttcomp", "ttcomp archive", "need", "we32 dmd", "birtual machine", "oses", "sparc demand", "4096", "sparc pure", "chiasmus", "federal", "office", "bundesamt", "sicherheit", "xia1r chiasmus", "xis chiasmus", "btsnoop", "hci uart", "hci bcsp", "hci serial", "mikhail gusarov", "dottedmag", "nekovm", "neko nekovm", "resilient logic", "guile file", "goof", "le b", "be b", "cbor", "concise binary", "raw tape", "cbm basic", "dirk jagdmann", "d64 image", "d71 image", "d81 image", "c64 emultar", "cartridge image", "c source", "bcpl source", "bcpl", "libhdr", "java se", "java bytecode", "macho", "java class", "cpu type", "cafe babes", "java start", "x version", "tablature file", "chord music", "file format", "chord text", "powertab", "jelmer vernooij", "jelmer", "powertab v3", "runect citrus", "lcctype", "ctrsme citrus", "ctrsmo citrus", "lcmonetary", "ctrsnu citrus", "lcnumeric", "ctrsti citrus", "lctime", "cddb", "cd player", "developer", "julien blache", "database", "keyindex", "help", "systems", "microcode", "netbsdalpha", "ios microcode", "kompas", "vrml", "xml document", "reserved", "applicationtype", "autocad dwg", "schema", "scanline", "alliance", "claris", "claris clip", "377377377377001", "claris works", "c1 r1", "c2 r1", "c3 r1", "intergraph", "clipper coff", "fairchild", "clipper use", "hitachi sh", "common object", "coff intel", "intel", "files format", "djgpp", "clojure script", "clojure", "jason felice", "clojure module", "convex", "convex soff", "convex storage", "convexes", "added", "core file", "third", "idc file", "suiteid", "chart", "debacle", "ttcn", "tree", "notation", "suite ttcn", "abstract test", "suite", "boseos", "snmperrnoerror", "commitrow", "readcreate", "retlen", "writecreate", "mydata", "putindexdata", "snmpsetvarvalue", "checkfnslocal", "not be", "note note", "decides", "snmp error", "requestvb", "asnoctetstr", "asnobjectid", "logerr", "undoinfo", "rcsfile", "end code", "debugmsgtl", "initialize", "allowcreation", "adding", "oidlength", "handler", "snmperrgenerr", "colnum", "break", "current", "snmp", "dodescr", "nodeinfo", "calldefine", "doformatedtext", "startperl", "perleval", "mib type", "oids", "const", "register", "asn type", "rorw status", "generating code", "mib tree", "netsnmp style", "getnext", "mib table", "tabledata", "container", "mibs", "print", "please specify", "send", "memcpy", "rscreateandgo", "writemethod", "findvarmethod", "variablesoid", "substr", "varlen", "sprintmaxlen", "datacontext", "mode", "freeundoinfo", "reallyreally", "initializingn", "handlercanronly", "netsnmp", "emitindexvars", "enddefine", "emitgetargs", "emitloaddata", "emitindexinfo", "output skeleton", "loader", "Aishah Siti Lazim", "194 Green Street" ], "references": [ "vimrc", "bugreport.vim", "evim.vim", "delmenu.vim", "defaults.vim", "ftplugof.vim", "ftoff.vim", "gvim.desktop", "ftplugin.vim", "gvimrc_example.vim", "indent.vim", "indoff.vim", "mswin.vim", "scripts.vim", "optwin.vim", "vim.desktop", "menu.vim", "vimrc_example.vim", "synmenu.vim", "filetype.vim", "Make_mvc.mak", "Make_all.mak", "README.ru.utf-8.txt", "README.txt", "tutor", "tutor.bar.utf-8", "tutor.ca.utf-8", "tutor.bg.utf-8", "tutor.cs.utf-8", "tutor.da.utf-8", "tutor.de.utf-8", "tutor.el.utf-8", "tutor.eo.utf-8", "tutor.es.utf-8", "tutor.fr.utf-8", "tutor.hr.utf-8", "tutor.ja.utf-8", "tutor.hu.utf-8", "tutor.it.utf-8", "tutor.ko", "tutor.ko.utf-8", "tutor.lt.utf-8", "tutor.lv.utf-8", "tutor.nb.utf-8", "tutor.nl.utf-8", "tutor.no.utf-8", "tutor.pt.utf-8", "tutor.pl.utf-8", "tutor.ru.utf-8", "tutor.tr.utf-8", "tutor.sr.utf-8", "tutor.sv.utf-8", "tutor.sk.utf-8", "tutor.vim", "tutor.zh_cn.utf-8", "tutor.utf-8", "tutor.vi.utf-8", "tutor.uk.utf-8", "tutor.zh_tw.utf-8", "tutor.zh.utf-8", "vimspell.txt", "xcmdsrv_client.c", "ref", "vim132", "vimm", "vim_vs_net.cmd", "shtags.1", "unicode.vim", "shtags.pl", "ccfilter_README.txt", "blink.c", "efm_filter.txt", "demoserver.py", "ccfilter.c", "efm_filter.pl", "ccfilter.1", "efm_perl.pl", "pltags.pl", "mve.txt", "emoji_list.vim", "mve.awk", "a65.vim", "aap.vim", "abap.vim", "abc.vim", "abel.vim", "abaqus.vim", "acedb.vim", "a2ps.vim", "ada.vim", "ahdl.vim", "8th.vim", "aflex.vim", "aidl.vim", "2html.vim", "alsaconf.vim", "amiga.vim", "ampl.vim", "antlr4.vim", "apachestyle.vim", "apache.vim", "antlr.vim", "ant.vim", "aml.vim", "arch.vim", "aptconf.vim", "arduino.vim", "art.vim", "asm.vim", "asciidoc.vim", "asn.vim", "aspperl.vim", "asm68k.vim", "aspvbs.vim", "asteriskvm.vim", "atlas.vim", "asy.vim", "autodoc.vim", "autohotkey.vim", "autoit.vim", "automake.vim", "ave.vim", "asmh8300.vim", "avra.vim", "awk.vim", "astro.vim", "ayacc.vim", "asterisk.vim", "bash.vim", "b.vim", "bdf.vim", "bib.vim", "basic.vim", "bindzone.vim", "bc.vim", "blank.vim", "bitbake.vim", "bsdl.vim", "bst.vim", "bzl.vim", "btm.vim", "bzr.vim", "baan.vim", "cabal.vim", "cabalconfig.vim", "cabalproject.vim", "c.vim", "catalog.vim", "cdl.vim", "cdrdaoconf.vim", "cfg.vim", "cgdbrc.vim", "cf.vim", "cdrtoc.vim", "ch.vim", "chaiscript.vim", "change.vim", "chaskell.vim", "changelog.vim", "chatito.vim", "cheetah.vim", "chicken.vim", "chordpro.vim", "chill.vim", "calendar.vim", "chuck.vim", "clean.vim", "clipper.vim", "cmakecache.vim", "cl.vim", "cmod.vim", "cmusrc.vim", "coco.vim", "colortest.vim", "clojure.vim", "conf.vim", "config.vim", "confini.vim", "conaryrecipe.vim", "crm.vim", "cmake.vim", "crontab.vim", "cpp.vim", "context.vim", "csc.vim", "csh.vim", "cs.vim", "csp.vim", "csv.vim", "cterm.vim", "csdl.vim", "cobol.vim", "ctrlh.vim", "css.vim", "cuda.vim", "cuplsim.vim", "cvs.vim", "cweb.vim", "cvsrc.vim", "cucumber.vim", "cupl.vim", "cynpp.vim", "cynlib.vim", "deb822sources.vim", "dcd.vim", "d.vim", "dcl.vim", "dart.vim", "debchangelog.vim", "debcontrol.vim", "datascript.vim", "debcopyright.vim", "def.vim", "dep3patch.vim", "denyhosts.vim", "debsources.vim", "desc.vim", "dictconf.vim", "dictdconf.vim", "diff.vim", "dircolors.vim", "dirpager.vim", "diva.vim", "desktop.vim", "django.vim", "dns.vim", "docbksgml.vim", "docbkxml.vim", "docbk.vim", "dockerfile.vim", "dosbatch.vim", "dosini.vim", "dot.vim", "dracula.vim", "dsl.vim", "dtml.vim", "doxygen.vim", "dts.vim", "dtrace.vim", "dtd.vim", "dune.vim", "dylanintr.vim", "dylanlid.vim", "dylan.vim", "dnsmasq.vim", "editorconfig.vim", "edif.vim", "ecd.vim", "elmfilt.vim", "elf.vim", "elinks.vim", "eiffel.vim", "elm.vim", "erlang.vim", "esmtprc.vim", "esqlc.vim", "esterel.vim", "euphoria3.vim", "eterm.vim", "eruby.vim", "euphoria4.vim", "exim.vim", "expect.vim", "exports.vim", "eviews.vim", "fasm.vim", "fdcc.vim", "falcon.vim", "fan.vim", "fetchmail.vim", "fgl.vim", "fish.vim", "flexwiki.vim", "focexec.vim", "fpcmake.vim", "forth.vim", "form.vim", "framescript.vim", "foxpro.vim", "fortran.vim", "freebasic.vim", "fvwm2m4.vim", "fstab.vim", "fvwm.vim", "gdmo.vim", "gdresource.vim", "gdb.vim", "gemtext.vim", "gdshader.vim", "git.vim", "gift.vim", "gedcom.vim", "gdscript.vim", "gitattributes.vim", "gitcommit.vim", "gitconfig.vim", "gitignore.vim", "gitolite.vim", "gitrebase.vim", "gitsendemail.vim", "gkrellmrc.vim", "goaccess.vim", "glsl.vim", "godoc.vim", "go.vim", "gnuplot.vim", "gp.vim", "gpg.vim", "gprof.vim", "gretl.vim", "grads.vim", "gnash.vim", "groff.vim", "grub.vim", "groovy.vim", "gtkrc.vim", "group.vim", "gyp.vim", "gsp.vim", "gvpr.vim", "update_date.vim", "README.md", "gen_syntax_vim.vim", "vim.vim.base", "haml.vim", "hamster.vim", "hare.vim", "haredoc.vim", "haste.vim", "haskell.vim", "hastepreproc.vim", "hb.vim", "hcl.vim", "help_ru.vim", "hex.vim", "help.vim", "hercules.vim", "hgcommit.vim", "hitest.vim", "hlsplaylist.vim", "hog.vim", "hostsaccess.vim", "hostconf.vim", "htmlcheetah.vim", "htmlangular.vim", "html.vim", "htmlm4.vim", "htmlos.vim", "htmldjango.vim", "i3config.vim", "ia64.vim", "ibasic.vim", "icemenu.vim", "idlang.vim", "idl.vim", "icon.vim", "initex.vim", "initng.vim", "ipfilter.vim", "inittab.vim", "inform.vim", "j.vim", "iss.vim", "ishd.vim", "jal.vim", "ist.vim", "jam.vim", "jargon.vim", "javascript.vim", "javascriptreact.vim", "java.vim", "jinja.vim", "jess.vim", "jgraph.vim", "javacc.vim", "jq.vim", "jsp.vim", "json.vim", "jsonc.vim", "json5.vim", "kconfig.vim", "julia.vim", "kdl.vim", "kotlin.vim", "kix.vim", "kwt.vim", "krl.vim", "kscript.vim", "kivy.vim", "lace.vim", "latte.vim", "lc.vim", "ld.vim", "ldapconf.vim", "iso.vim", "pim.vim", "r10.vim", "ldif.vim", "less.vim", "lftp.vim", "lhaskell.vim", "libao.vim", "lex.vim", "lifelines.vim", "liquid.vim", "limits.vim", "lilo.vim", "lite.vim", "livebook.vim", "lisp.vim", "litestep.vim", "lotos.vim", "loginaccess.vim", "logtalk.vim", "logindefs.vim", "lout.vim", "lprolog.vim", "lpc.vim", "lsl.vim", "lscript.vim", "lss.vim", "luau.vim", "lua.vim", "lynx.vim", "lyrics.vim", "m3quake.vim", "m3build.vim", "m4.vim", "mailaliases.vim", "mail.vim", "mailcap.vim", "mallard.vim", "make.vim", "manual.vim", "manconf.vim", "mason.vim", "masm.vim", "maple.vim", "master.vim", "matlab.vim", "maxima.vim", "mermaid.vim", "meson.vim", "mediawiki.vim", "messages.vim", "mel.vim", "man.vim", "markdown.vim", "mf.vim", "mgp.vim", "mgl.vim", "mib.vim", "mix.vim", "mmix.vim", "mmp.vim", "modconf.vim", "model.vim", "mma.vim", "modula2.vim", "modula3.vim", "moo.vim", "mojo.vim", "monk.vim", "mp.vim", "mplayerconf.vim", "mrxvtrc.vim", "msmessages.vim", "msidl.vim", "msql.vim", "modsim3.vim", "murphi.vim", "mush.vim", "mupad.vim", "muttrc.vim", "mysql.vim", "named.vim", "nanorc.vim", "nastran.vim", "n1ql.vim", "natural.vim", "nasm.vim", "ncf.vim", "netrc.vim", "netrw.vim", "ninja.vim", "nix.vim", "nosyntax.vim", "nroff.vim", "neomuttrc.vim", "nsis.vim", "nqc.vim", "nginx.vim", "obj.vim", "objcpp.vim", "odin.vim", "occam.vim", "omnimark.vim", "ocaml.vim", "ondir.vim", "objc.vim", "openscad.vim", "openroad.vim", "opl.vim", "openvpn.vim", "obse.vim", "opam.vim", "pamenv.vim", "pacmanlog.vim", "ora.vim", "pamconf.vim", "pandoc.vim", "papp.vim", "pcap.vim", "pbtxt.vim", "pascal.vim", "passwd.vim", "pccts.vim", "pf.vim", "phtml.vim", "perl.vim", "pic.vim", "pdf.vim", "pilrc.vim", "pfmain.vim", "pike.vim", "pine.vim", "pinfo.vim", "plaintex.vim", "php.vim", "plm.vim", "plp.vim", "pli.vim", "pod.vim", "poefilter.vim", "po.vim", "ppd.vim", "pov.vim", "povini.vim", "ppwiz.vim", "plsql.vim", "prescribe.vim", "procmail.vim", "privoxy.vim", "prolog.vim", "promela.vim", "postscr.vim", "protocols.vim", "proto.vim", "psf.vim", "psl.vim", "ps1.vim", "purifylog.vim", "ptcap.vim", "pymanifest.vim", "pyrex.vim", "progress.vim", "python.vim", "python2.vim", "quarto.vim", "qf.vim", "quake.vim", "qb64.vim", "r.vim", "qml.vim", "radiance.vim", "racc.vim", "racket.vim", "raml.vim", "rasi.vim", "rc.vim", "ratpoison.vim", "rapid.vim", "raku.vim", "rcslog.vim", "rcs.vim", "rebol.vim", "readline.vim", "registry.vim", "rego.vim", "remind.vim", "requirements.vim", "reva.vim", "resolv.vim", "rhelp.vim", "rexx.vim", "rnc.vim", "rng.vim", "rnoweb.vim", "rib.vim", "redif.vim", "rrst.vim", "rpcgen.vim", "routeros.vim", "rpl.vim", "rmd.vim", "rtf.vim", "rst.vim", "salt.vim", "robots.vim", "samba.vim", "ruby.vim", "sas.vim", "sass.vim", "rust.vim", "sbt.vim", "scdoc.vim", "sather.vim", "scilab.vim", "scala.vim", "scheme.vim", "screen.vim", "scss.vim", "sd.vim", "sdc.vim", "sdl.vim", "sensors.vim", "sed.vim", "services.vim", "sendpr.vim", "setserial.vim", "sexplib.vim", "sgmldecl.vim", "sgmllnx.vim", "sh.vim", "sgml.vim", "context-data-metafun.vim", "context-data-tex.vim", "hgcommitDiff.vim", "context-data-context.vim", "context-data-interfaces.vim", "debversions.vim", "typescriptcommon.vim", "sicad.vim", "sil.vim", "simula.vim", "sinda.vim", "sindacmp.vim", "sindaout.vim", "sieve.vim", "skill.vim", "sl.vim", "sisu.vim", "slang.vim", "slpconf.vim", "slpreg.vim", "slpspi.vim", "slrnsc.vim", "sm.vim", "smarty.vim", "slice.vim", "smcl.vim", "smith.vim", "smil.vim", "sml.vim", "snnsnet.vim", "snnspat.vim", "slrnrc.vim", "snobol4.vim", "solidity.vim", "spice.vim", "splint.vim", "spec.vim", "specman.vim", "spyce.vim", "spup.vim", "snnsres.vim", "sql.vim", "sqlforms.vim", "sqlj.vim", "sqlhana.vim", "sqlinformix.vim", "sqlanywhere.vim", "sqloracle.vim", "srec.vim", "sqr.vim", "squirrel.vim", "squid.vim", "srt.vim", "ssa.vim", "st.vim", "sshconfig.vim", "sshdconfig.vim", "stp.vim", "stata.vim", "strace.vim", "structurizr.vim", "stylus.vim", "sudoers.vim", "swift.vim", "swig.vim", "swiftgyb.vim", "swayconfig.vim", "syncolor.vim", "svn.vim", "synload.vim", "sysctl.vim", "systemverilog.vim", "tads.vim", "tags.vim", "tak.vim", "takcmp.vim", "takout.vim", "tar.vim", "taskdata.vim", "taskedit.vim", "tap.vim", "tasm.vim", "svg.vim", "syntax.vim", "template.vim", "tcsh.vim", "teraterm.vim", "terminfo.vim", "terraform.vim", "systemd.vim", "tcl.vim", "tssgm.vim", "typescript.vim", "tsv.vim", "tt2js.vim", "tssop.vim", "typescriptreact.vim", "tt2.vim", "tt2html.vim", "uc.vim", "uci.vim", "typst.vim", "udevconf.vim", "udevperm.vim", "uil.vim", "unison.vim", "updatedb.vim", "upstart.vim", "upstreamdat.vim", "upstreaminstalllog.vim", "upstreamlog.vim", "upstreamrpt.vim", "usw2kagtlog.vim", "urlshortcut.vim", "udevrules.vim", "valgrind.vim", "vdf.vim", "vb.vim", "verilogams.vim", "vera.vim", "vhdl.vim", "viminfo.vim", "verilog.vim", "voscm.vim", "vmasm.vim", "virata.vim", "vim.vim", "vrml.vim", "vgrindefs.vim", "usserverlog.vim", "c.c", "html.html", "java_comments_markdown.java", "java_annotations_signature.java", "java_comments.java", "java_enfoldment.java", "java_escapes.java", "java_generics_signature.java", "java_generics.java", "java_contextual_keywords.java", "java_lambda_expressions_signature.java", "java_annotations.java", "java_lambda_expressions.java", "java_method_references_signature.java", "java_methods_indent4.java", "java_methods_indent2.java", "java_methods_indent4_signature.java", "java_methods_indent2_signature.java", "java_methods_indent8_signature.java", "java_methods_style.java", "java_module_info.java", "java_methods_style_signature.java", "java_numbers.java", "java_previews_430.java", "java_string.java", "java_previews_455.java", "java_switch.java", "java_methods_indent8.java", "java_unfoldment.java", "markdown_conceal.markdown", "modula2_pim.def", "modula2_iso.def", "modula2_r10.def", "progress_comments.p", "sh_02.sh", "sh_01.sh", "sh_04.sh", "sh_03.sh", "sh_05.sh", "sh_07.sh", "sh_09.sh", "sh_08.sh", "sh_10.sh", "sh_11.sh", "vim_ex_abbreviate.vim", "vim_ex_behave.vim", "vim_ex_call.vim", "vim_ex_catch.vim", "sh_06.sh", "vim_ex_command.vim", "vim_ex_comment_strings.vim", "vim_ex_comment-vim9.vim", "vim_ex_comment.vim", "vim_ex_augroup.vim", "vim_ex_commands.vim", "vim_ex_def_nested.vim", "vim_ex_def_nested_fold.vim", "vim_ex_def_fold.vim", "vim_ex_def.vim", "vim_ex_echo.vim", "vim_ex_execute.vim", "vim_ex_function_def_tail_comment_errors.vim", "vim_ex_function_def_tail_comments.vim", "vim_ex_function_nested_fold.vim", "vim_ex_function_nested.vim", "vim_ex_function_fold.vim", "vim_ex_highlight.vim", "vim_ex_let_heredoc.vim", "vim_ex_loadkeymap_after_bar.vim", "vim_ex_loadkeymap_after_colon.vim", "vim_ex_map.vim", "vim_ex_function.vim", "vim_ex_menu.vim", "vim_ex_menutranslate.vim", "vim_ex_no_comment_strings.vim", "vim_ex_match.vim", "vim_ex_range.vim", "vim_ex_set.vim", "vim_ex_sleep.vim", "vim_ex_substitute.vim", "vim_ex_throw.vim", "vim_keymap.vim", "vim_ex_syntax.vim", "vim_key_notation.vim", "vim_line_continuation.vim", "vim_expr.vim", "vim_new.vim", "vim_shebang.vim", "vim_object_methods.vim", "vim_variables.vim", "vim9_ex_comment_strings.vim", "vim9_ex_commands.vim", "vim9_ex_no_comment_strings.vim", "vim9_ex_function_def_tail_comments.vim", "vim9_expr.vim", "vim9_keymap.vim", "vim9_ex_function_def_tail_comment_errors.vim", "vim9_legacy_header_fold.vim", "vim9_legacy_header.vim", "vim9_shebang.vim", "yaml.yaml", "dots_03", "dots_05", "dots_02", "dots_04", "dots_01", "dots_06", "dots_08", "dots_09", "dots_10", "dots_07", "dots_11", "dots_12", "dots_14", "dots_13", "dots_15", "dots_16", "dots_17", "dots_18", "dots_19", "dots_20", "html_00.dump", "html_03.dump", "html_05.dump", "html_04.dump", "html_06.dump", "html_02.dump", "html_01.dump", "html_07.dump", "html_08.dump", "java_annotations_01.dump", "java_annotations_00.dump", "java_annotations_02.dump", "java_annotations_03.dump", "java_annotations_04.dump", "java_annotations_signature_00.dump", "java_annotations_signature_02.dump", "java_annotations_signature_01.dump", "java_annotations_signature_03.dump", "java_annotations_signature_04.dump", "java_comments_html_01.dump", "java_comments_html_02.dump", "java_comments_html_03.dump", "java_comments_html_00.dump", "java_comments_html_04.dump", "java_comments_html_05.dump", "java_comments_markdown_00.dump", "java_comments_html_07.dump", "java_comments_markdown_03.dump", "java_comments_markdown_01.dump", "java_comments_html_06.dump", "java_comments_markdown_04.dump", "java_comments_markdown_02.dump", "java_comments_markdown_05.dump", "java_comments_markdown_06.dump", "java_comments_markdown_07.dump", "java_contextual_keywords_00.dump", "java_comments_markdown_08.dump", "java_contextual_keywords_01.dump", "java_contextual_keywords_02.dump", "java_enfoldment_01.dump", "java_contextual_keywords_03.dump", "java_enfoldment_00.dump", "java_enfoldment_02.dump", "java_escapes_00.dump", "java_escapes_01.dump", "java_escapes_03.dump", "java_escapes_05.dump", "java_escapes_07.dump", "java_escapes_02.dump", "java_escapes_06.dump", "java_generics_01.dump", "java_generics_03.dump", "java_generics_02.dump", "java_generics_04.dump", "java_generics_05.dump", "java_generics_07.dump", "java_generics_00.dump", "java_generics_06.dump", "java_escapes_04.dump", "java_generics_signature_00.dump", "java_generics_signature_01.dump", "java_generics_signature_02.dump", "java_generics_signature_03.dump", "java_generics_signature_04.dump", "java_generics_signature_05.dump", "java_generics_signature_07.dump", "java_generics_signature_06.dump", "java_lambda_expressions_00.dump", "java_lambda_expressions_01.dump", "java_lambda_expressions_03.dump", "java_lambda_expressions_02.dump", "java_lambda_expressions_04.dump", "java_lambda_expressions_05.dump", "java_lambda_expressions_06.dump", "java_lambda_expressions_07.dump", "java_lambda_expressions_08.dump", "java_lambda_expressions_signature_00.dump", "java_lambda_expressions_signature_01.dump", "java_lambda_expressions_signature_02.dump", "java_lambda_expressions_signature_03.dump", "java_lambda_expressions_signature_04.dump", "java_lambda_expressions_signature_05.dump", "java_lambda_expressions_signature_06.dump", "java_lambda_expressions_signature_07.dump", "java_lambda_expressions_signature_08.dump", "java_method_references_00.dump", "java_method_references_01.dump", "java_method_references_03.dump", "java_method_references_04.dump", "java_method_references_06.dump", "java_method_references_05.dump", "java_method_references_07.dump", "java_method_references_08.dump", "java_method_references_09.dump", "java_method_references_10.dump", "java_method_references_signature_00.dump", "java_method_references_signature_01.dump", "java_method_references_02.dump", "java_method_references_signature_02.dump", "java_method_references_signature_03.dump", "java_method_references_signature_04.dump", "java_method_references_signature_05.dump", "java_method_references_signature_07.dump", "java_method_references_signature_08.dump", "java_method_references_signature_09.dump", "java_methods_indent2_00.dump", "java_methods_indent2_00.vim", "java_methods_indent2_01.dump", "java_methods_indent2_01.vim", "java_methods_indent2_02.dump", "java_methods_indent2_02.vim", "java_method_references_signature_10.dump", "java_methods_indent2_03.vim", "java_methods_indent2_03.dump", "java_methods_indent2_04.dump", "java_methods_indent2_04.vim", "java_methods_indent2_05.dump", "java_methods_indent2_05.vim", "java_method_references_signature_06.dump", "java_methods_indent2_signature_00.vim", "java_methods_indent2_signature_01.dump", "java_methods_indent2_signature_01.vim", "java_methods_indent2_signature_02.dump", "java_methods_indent2_signature_02.vim", "java_methods_indent2_signature_03.dump", "java_methods_indent2_signature_03.vim", "java_methods_indent2_signature_04.dump", "java_methods_indent2_signature_04.vim", "java_methods_indent2_signature_05.dump", "java_methods_indent2_signature_05.vim", "java_methods_indent4_00.vim", "java_methods_indent4_01.vim", "java_methods_indent4_01.dump", "java_methods_indent4_02.dump", "java_methods_indent2_signature_00.dump", "java_methods_indent4_02.vim", "java_methods_indent4_03.vim", "java_methods_indent4_03.dump", "java_methods_indent4_04.dump", "java_methods_indent4_04.vim", "java_methods_indent4_05.dump", "java_methods_indent4_06.dump", "java_methods_indent4_05.vim", "java_methods_indent4_signature_00.dump", "java_methods_indent4_signature_01.dump", "java_methods_indent4_signature_01.vim", "java_methods_indent4_signature_02.dump", "java_methods_indent4_signature_02.vim", "java_methods_indent4_signature_03.dump", "java_methods_indent4_signature_03.vim", "java_methods_indent4_signature_04.dump", "java_methods_indent4_signature_04.vim", "java_methods_indent4_signature_05.dump", "java_methods_indent4_signature_05.vim", "java_methods_indent8_00.dump", "java_methods_indent4_signature_06.dump", "java_methods_indent8_00.vim", "java_methods_indent8_01.dump", "java_methods_indent8_01.vim", "java_methods_indent4_signature_00.vim", "java_methods_indent8_02.dump", "java_methods_indent8_02.vim", "java_methods_indent8_03.dump", "java_methods_indent8_03.vim", "java_methods_indent8_04.dump", "java_methods_indent8_05.dump", "java_methods_indent8_06.dump", "java_methods_indent8_05.vim", "java_methods_indent8_signature_00.dump", "java_methods_indent8_signature_01.dump", "java_methods_indent8_signature_01.vim", "java_methods_indent8_signature_02.dump", "java_methods_indent8_signature_02.vim", "java_methods_indent8_signature_00.vim", "java_methods_indent8_signature_03.dump", "java_methods_indent8_signature_03.vim", "java_methods_indent8_signature_04.dump", "java_methods_indent8_signature_04.vim", "java_methods_indent8_signature_05.vim", "java_methods_indent8_signature_05.dump", "java_methods_indent8_signature_06.dump", "java_methods_indent8_signature_06.vim", "java_methods_style_00.dump", "java_methods_style_00.vim", "java_methods_style_01.vim", "java_methods_style_02.vim", "java_methods_indent8_04.vim", "java_methods_style_03.dump", "java_methods_style_04.dump", "java_methods_style_02.dump", "java_methods_style_signature_00.dump", "java_methods_style_signature_00.vim", "java_methods_style_signature_01.vim", "java_methods_style_03.vim", "java_methods_style_signature_02.vim", "java_methods_style_01.dump", "java_methods_style_signature_03.dump", "java_methods_style_signature_03.vim", "java_methods_style_signature_04.dump", "java_methods_style_signature_01.dump", "java_module_info_00.dump", "java_methods_style_04.vim", "java_module_info_01.dump", "java_module_info_02.dump", "java_numbers_01.dump", "java_numbers_02.dump", "java_methods_style_signature_04.vim", "java_numbers_00.dump", "java_numbers_03.dump", "java_numbers_04.dump", "java_numbers_05.dump", "java_previews_430_00.dump", "java_previews_455_00.dump", "java_previews_455_01.dump", "java_previews_455_02.dump", "java_previews_455_03.dump", "java_methods_style_signature_02.dump", "java_methods_indent4_00.dump", "java_string_00.dump", "java_string_01.dump", "java_string_02.dump", "java_string_04.dump", "java_string_03.dump", "java_string_05.dump", "java_switch_00.dump", "java_switch_02.dump", "java_switch_01.dump", "java_switch_04.dump", "java_switch_03.dump", "java_switch_05.dump", "java_switch_07.dump", "java_unfoldment_00.dump", "java_switch_06.dump", "java_unfoldment_01.dump", "java_unfoldment_05.dump", "java_unfoldment_02.dump", "markdown_conceal_00.dump", "java_unfoldment_03.dump", "modula2_iso_00.dump", "modula2_iso_01.dump", "modula2_iso_03.dump", "modula2_iso_02.dump", "modula2_iso_04.dump", "modula2_iso_05.dump", "modula2_pim_00.dump", "modula2_iso_06.dump", "modula2_pim_01.dump", "modula2_pim_02.dump", "modula2_pim_03.dump", "modula2_pim_04.dump", "modula2_pim_06.dump", "modula2_pim_05.dump", "modula2_r10_00.dump", "modula2_r10_03.dump", "sh_07_01.dump", "sh_08_02.dump", "sh_11_00.dump", "vim_ex_abbreviate_01.dump", "vim_ex_command_00.dump", "java_module_info.vim", "markdown_conceal.vim", "cleanadd.vim", "yi.vim", "he.vim", "adacomplete.vim", "cargo.vim", "ccomplete.vim", "clojurecomplete.vim", "decada.vim", "contextcomplete.vim", "csscomplete.vim", "gnat.vim", "gzip.vim", "getscript.vim", "htmlcomplete.vim", "javaformat.vim", "netrw_gitignore.vim", "javascriptcomplete.vim", "haskellcomplete.vim", "netrwSettings.vim", "netrwFileHandlers.vim", "paste.vim", "pythoncomplete.vim", "RstFold.vim", "python3complete.vim", "rustfmt.vim", "spellfile.vim", "sqlcomplete.vim", "syntaxcomplete.vim", "rubycomplete.vim", "tohtml.vim", "typeset.vim", "vimball.vim", "xmlcomplete.vim", "xmlformat.vim", "zip.vim", "quickfix.vim", "html32.vim", "html40f.vim", "html40s.vim", "html40t.vim", "html401f.vim", "html401t.vim", "xhtml10f.vim", "xhtml10s.vim", "xsd.vim", "xhtml10t.vim", "html401s.vim", "xhtml11.vim", "xsl.vim", "airportd.sb", "awdd.sb", "bluetoothd.sb", "com.apple.atsd.internal.sb", "BTLEServer.sb", "com.apple.atsd.support.sb", "com.apple.bootinstalld.sb", "com.apple.ckdiscretionaryd.sb", "com.apple.CommCenter.sb", "com.apple.cloudd.sb", "com.apple.fontd.internal.sb", "com.apple.corespotlightservice.sb", "com.apple.FontValidator.sb", "com.apple.fontd.support.sb", "com.apple.genatsdb.internal.sb", "com.apple.managedcorespotlightd.sb", "com.apple.msrpc.lsarpc.sb", "com.apple.msrpc.mdssvc.sb", "com.apple.mobileassetd.sb", "com.apple.msrpc.netlogon.sb", "com.apple.msrpc.srvsvc.sb", "com.apple.msrpc.wkssvc.sb", "com.apple.smbd.sb", "com.apple.netbiosd.sb", "com.apple.softwareupdate_firstrun_tasks.sb", "com.apple.taskgated-helper.sb", "com.apple.spotlightknowledged.importer.sb", "com.apple.USBAgent.sb", "com.apple.softwareupdated.sb", "com.apple.xscertd-helper.sb", "com.apple.usbd.sb", "com.apple.xscertd.sb", "cvmsCompAgent.sb", "cvmsServer.sb", "fontmover.sb", "fontmoverinternal.sb", "fontworkerinternal.sb", "gss-acceptor.sb", "gss-initiator.sb", "kadmind.sb", "kcm.sb", "mdflagwriter.sb", "kdc.sb", "ftp-proxy.sb", "mds.sb", "mdworker-bundle.sb", "mds_stores.sb", "mdworker-mail.sb", "mdworker-sizing.sb", "mdworker-scan.sb", "mdworker.sb", "natpmpd.sb", "qlmanage.sb", "pfd.sb", "quicklook-satellite-general.sb", "mDNSResponder.sb", "quicklook-satellite.sb", "quicklook-satellite-personal.sb", "quicklookd-job-creation.sb", "webdav_agent.sb", "quicklookd.sb", "watool.sb", "wfs.sb", "wifivelocityd.sb", "Mac-CAD6701F7CEA0921.plist", "Mac-FFE5EF870D7BA81A.plist", "Mac-7DF21CB3ED6977E5.plist", "Mac-35C5E08120C7EEAF.plist", "Mac-2BD1B31983FE1663.plist", "Mac-42FD25EABCABB274.plist", "Mac-35C1E88140C3E6CF.plist", "Mac-27ADBB7B4CEE8E61.plist", "Mac-66E35819EE2D0D05.plist", "Mac-473D31EABEB93F9B.plist", "Mac-06F11FD93F0323C5.plist", "Mac-4B682C642B45593E.plist", "Mac-031B6874CF7F642A.plist", "Mac-551B86E5744E2388.plist", "Mac-A369DDC4E67F1C45.plist", "Mac-BE0E8AC46FE800CC.plist", "Mac-E43C1C25D4880AD6.plist", "default.plist", "Mac-BE088AF8C5EB4FA2.plist", "Mac-EE2EBD4B90B839A8.plist", "Mac-3CBD00234E554E41.plist", "Mac-77EB7D7DAF985301.plist", "Mac-189A3D4F975D5FFC.plist", "Mac-B809C3757DA9BB8D.plist", "Mac-DB15BD556843C820.plist", "Mac-06F11F11946D27C5.plist", "Mac-9F18E312C5C2BF0B.plist", "Mac-9AE82516C7C6B903.plist", "Mac-B4831CEBD52A0C4C.plist", "Mac-FA842E06C61E91C5.plist", "charset.pivot", "mapper.dir", "firmlinks", "Stopwords.plist", "adi", "acorn", "adventure", "aes", "alliant", "allegro", "algol68", "aout", "apache", "android", "apl", "amigaos", "application", "animation", "applix", "apple", "amanda", "arm", "apt", "asf", "assembler", "asterix", "att3b", "basis", "beetle", "avm", "ber", "bflt", "bhl", "bioinformatics", "biosig", "audio", "blcr", "blender", "blackberry", "archive", "blit", "bm", "bout", "bsdi", "bsi", "btsnoop", "bytecode", "cbor", "c64", "c-lang", "cafebabe", "chord", "citrus", "cddb", "clarion", "cisco", "cad", "claris", "clipper", "coff", "clojure", "convex", "communications", "dicrc", "mib2c.access_functions.conf", "mib2c.check_values.conf", "mib2c.check_values_local.conf", "mib2c.column_defines.conf", "mib2c.array-user.conf", "mib2c.column_enums.conf", "mib2c.column_storage.conf", "mib2c.create-dataset.conf", "mib2c.container.conf", "mib2c.genhtml.conf", "mib2c.int_watch.conf", "mib2c.conf", "mib2c.mfd.conf", "mib2c.notify.conf", "mib2c.iterate.conf", "mib2c.old-api.conf", "mib2c.iterate_access.conf", "mib2c.scalar.conf", "mib2c.perl.conf" ], "public": 1, "adversary": "DragonForce Malaysia", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Esc", "display_name": "Esc", "target": null }, { "id": "SelectAll", "display_name": "SelectAll", "target": null }, { "id": "Vim Tutor", "display_name": "Vim Tutor", "target": null }, { "id": "Todo", "display_name": "Todo", "target": null }, { "id": "AdaCore", "display_name": "AdaCore", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1030", "name": "Data Transfer Size Limits", "display_name": "T1030 - Data Transfer Size Limits" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 109, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ilyailya", "id": "298851", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "email": 635, "hostname": 840, "URL": 2021, "FileHash-SHA1": 6, "domain": 378, "FileHash-SHA256": 548 }, "indicator_count": 4430, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "405 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "678d3ad53ba37ac1825e3d2c", "name": "Aishah Lazim", "description": "Domestic cyberterrorism", "modified": "2025-02-21T00:57:53.601000", "created": "2025-01-19T17:48:05.477000", "tags": [ "filesystem", "timestamp", "plugin", "event", "mcdp29xxisp", "mcdp29xxapp", "mcdp29xx", "slam", "debug", "info", "stix2", "wisemo", "findmykids", "shutdownlog", "chromefavicon", "firefoxfavicon", "interactionc", "whatsapp", "predator", "flexispy", "cerberus", "metasploit", "theonespy", "netspy", "mobilespy", "webwatcher", "observer", "phonespy", "spynote", "ahmyth", "droidwatcher", "lovespy", "onespy", "safenet", "calendar", "f2c43", "timezonedb", "runningboard", "aspsnapshots", "wifi", "safari", "GUANGZHOU FIVE SIX TECHNOLOGY CO L", "194 Green Street", "Brooklyn" ], "references": [ "info.json", "timeline.csv", "filesystem.json", "command.log", "DiskMountConditioner.json" ], "public": 1, "adversary": "Dragonforce Malaysia Hacker Group", "targeted_countries": [ "United States of America", "Bahrain", "France" ], "malware_families": [ { "id": "", "display_name": "", "target": null } ], "attack_ids": [ { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" } ], "industries": [ "Media" ], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ilyailya", "id": "298851", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 923, "FileHash-MD5": 12, "FileHash-SHA1": 39, "domain": 817, "FileHash-SHA256": 422, "URL": 1543, "CIDR": 4, "email": 68, "SSLCertFingerprint": 387, "CVE": 5 }, "indicator_count": 4220, "is_author": false, "is_subscribing": null, "subscriber_count": 32, "modified_text": "423 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "671fd3b07ffb71116f2db7fa", "name": "dragonforce.io", "description": "Throw your MacBook in the trash, where the hackers belong.", "modified": "2024-11-27T17:01:13.516000", "created": "2024-10-28T18:10:56.355000", "tags": [ "copyright", "apple computer", "tcpip", "supported", "quantum", "postfix", "mail", "aliases", "postfix version", "restrict", "wietse venema", "sample", "note", "person", "basic system", "general", "column", "tiff", "linus walleij", "triad", "greg roelofs", "html", "daniel quinlan", "aiff", "music", "wave", "formats", "magic", "form", "crunch", "freeze", "maker", "format", "postscript", "this", "ifmodule", "include", "virtualhost", "directory", "require", "serverroot", "listen", "ifdefine", "loadmodule", "errordocument", "apache", "win32", "example", "main", "webdav", "internet", "mime type", "xlm xla", "xlc xlt", "xlam", "xlsb", "xlsm", "xltm", "z7 z8", "xhtml xht", "addiconbytype", "adddescription", "fancyindexed", "gzip", "indexignore", "indexes", "versionsort", "fancyindexing", "alias icons", "full", "minrate500", "keepalive", "prod", "email", "apache http", "server", "timeout", "number", "minimal", "major", "addlanguage", "addcharset", "defaultlanguage", "fallback", "polish", "addlanguage pl", "catalan", "english", "greekmodern", "korean", "turkish", "browsermatch", "davlockdb", "requireany", "usergroup", "alias", "authtype digest", "davupload admin", "authuserfile", "errorhttp", "http", "yourincludepath", "apache version", "serversignature", "alias error", "addhandler", "threadsperchild", "startservers", "minsparethreads", "maxsparethreads", "maximum number", "pidfile", "mpms", "threadstacksize", "extendedstatus", "change", "sethandler", "require host", "get information", "allow server", "allow", "userdir sites", "control access", "userdir", "sslsessioncache", "configure", "ocsp stapling", "ssl engine", "sslrequire", "ssltls standard", "prng", "sslrandomseed", "openssl", "high", "first", "refer", "servername", "virtualhost 80", "serveradmin", "documentroot", "errorlog", "customlog", "hosts", "please", "almost", "loadfile c", "proxyhtmllinks", "ascii", "unicode", "windows", "must", "location", "w3c html", "directoryindex", "allowoverride", "manual", "provide access", "options indexes", "files", "removetype tr", "traditionally", "addlanguage da", "addtype", "a facility", "claim", "file", "level error", "sender", "store", "level", "facility", "category", "time", "host", "threadid", "function", "line", "message", "guest", "access", "kernel", "usereventagent", "springboard", "message sep", "message mc", "message secure", "ca message", "multitouchhid", "use directory", "home autohome", "automounter map", "get home", "ps1h", "make bash", "s checkwinsize", "etcbashrc", "termprogram", "level info", "broadcast", "ignore", "rules", "true", "t option", "mount", "force", "environment", "automountdenv", "promptcommand", "shellsessiondir", "histfile", "histfilesize", "terminal", "myvar", "histtimeformat", "arrange", "bashrematch", "tell", "limit", "order deny", "authtype", "default require", "require user", "owner", "authkey", "lpadmin", "order", "system", "local", "cups scheduler", "list", "synconclose no", "default user", "user lp", "group lp", "group value", "restrict access", "cups", "inpck", "nnnbaud", "berkeley", "parity", "pc entry", "pass8", "parenb istrip", "fixed speed", "entry", "clocal mode", "host database", "maxhistsize", "promptmode", "verbose end", "etcirbrcloaded", "default", "setup", "history file", "readline", "error", "searchpaths", "freebsd", "tmpdir", "fcodes", "prunepaths", "vartmp", "prunedirs", "filesystems", "status mailfrom", "returnpath via", "open directory", "jabber", "group database", "cyrus", "calendar", "dovecot", "postfix scsd", "networkd", "nroff", "manpath", "uncomment", "manpager", "whatispager", "manlocale", "every", "manpath optman", "maybe", "troff", "flags", "bcgjnuwz", "d0 j", "ldap defaults", "base dcexample", "uri ldap", "sizelimit", "timelimit", "deref", "syntax", "kerberos", "name", "corba object", "desc", "schema", "openldap", "redistribution", "public license", "license", "collective", "shall not", "ldap", "co llective", "equality", "sup name", "structural must", "singlevalue", "auxiliary must", "auxiliary may", "guid", "desc account", "desc mount", "desc password", "service", "info", "tiger", "multi", "d esc", "rfc1274", "structural may", "quality", "substr caseigno", "corba", "ldap directory", "reserved", "ldap server", "dynamic group", "netscape", "not recommended", "for production", "attribute", "name managedby", "name leaf", "duas", "internetdrafts", "coast", "project", "java object", "java class", "de sc", "pkcs", "inetorgperson", "rfc2798", "signeddata", "smime", "openldap note", "hold", "code", "java", "jndi reference", "jndi", "with syntax", "definitions", "kerberos v", "kdc schema", "oid base", "size", "subclass of", "may contain", "objectclass", "must contain", "matches for", "obsolete", "des c", "abstract must", "sup person", "microsoft", "advanced server", "schema mapping", "netinfo", "config", "groups", "netinfo preset", "crypt", "netinfo rpcs", "rpcs number", "oncrpcnumber", "ipnetmasknumber", "assistant", "may description", "rfc2307", "rfc2252", "match syntax", "openldaproot", "openldaporg", "openldapou", "equal ity", "kind", "rule", "attcertpath", "rolesyntax", "ldif", "blank", "ldap entry", "spaces", "cosine pilot", "directory forum", "password policy", "false", "april", "auxiliary", "passwd", "account", "desc pool", "unix", "structural", "sup rpcentry", "sup container", "abstract may", "sup ipsecbase", "Chelsea Manning Help Me", "Aishah Siti Lazim", "Aishah Lazim", "194 Green Street", "Human Subjects", "cybernetic", "RNA molecule", "matches", "postfix smtp", "domain", "ipv6 host", "reject", "reply", "prior", "bugs", "reject empty", "canonical", "tables", "post", "replace user", "address", "generic", "smtp", "isp mail", "mail delivery", "charset", "report", "postfix dsn", "mail returned", "only", "mime", "headerchecks", "readme files", "filters while", "posix", "empty", "body", "pass", "write", "date", "program", "agreement", "contributor", "recipient", "contribution", "the program", "corporation", "contributors", "product x", "as expressly", "arch", "arch x8664", "pipe wall", "wimplicit", "ranlib", "warn", "switch", "start", "systype", "smtp server", "specify", "mx host", "unix password", "user unknown", "pathbin", "postfix queue", "path", "beware", "class", "uucp", "shell", "outlook", "postfix master", "begin", "server admin", "mail backend", "modern smtp", "iana", "many", "postfix pipe", "recent cyrus", "amos gouaux", "old example", "update", "usrsbin", "file format", "no group", "daemondirectory", "relocated", "matches user", "synopsis", "or even", "lutz jaenicke", "technology", "cottbus", "germany", "openssl package", "openssl project", "europe", "remember that", "use of", "virtual", "virtual alias", "redirect mail", "deliver mail", "transport", "description", "result format", "bashno", "r etcbashrc", "protocol", "ipv6", "icmp", "cisco", "monitoring", "argus", "chaos", "rsvp", "encapsulation", "aris", "isis", "kame", "id key", "specification", "auto exit", "vpn socket", "networkup", "term", "devnull", "common setup", "set command", "sunnet manager", "rpcsrc", "netlicense", "apple", "netbootmount", "netbootshadow", "computername", "localonly", "localnetbootdir", "netboot", "define", "purpose", "networkonly", "waiting", "auditing", "solaris", "openbsm", "secsrvr", "allocation", "bsm event", "solaris kernel", "openbsm kernel", "solaris auemac", "solaris umount", "integer", "array", "data", "state", "opendirectoryd", "ipv4", "plist", "dict", "session", "commcenter", "airport", "cfbasichash", "thread", "cfrunloop", "cfrunloopmode", "usrbinsudo", "usrsbinnetbiosd", "removed" ], "references": [ "afpovertcp.cfg", "aliases", "magic", "httpd.conf", "mime.types", "httpd-autoindex.conf", "httpd-default.conf", "httpd-languages.conf", "httpd-dav.conf", "httpd-multilang-errordoc.conf", "httpd-mpm.conf", "httpd-info.conf", "httpd-userdir.conf", "httpd-ssl.conf", "httpd-vhosts.conf", "proxy-html.conf", "httpd-manual.conf", "php7.conf", "mpm.conf", "com.apple.eventmonitor", "com.apple.authd", "com.apple.cdscheduler", "com.apple.contacts.ContactsAutocomplete", "com.apple.install", "com.apple.coreduetd", "com.apple.login.guest", "com.apple.mkb", "com.apple.mail", "com.apple.MessageTracer", "com.apple.mkb.internal", "com.apple.iokit.power", "com.apple.performance", "com.apple.networking.boringssl", "auto_master", "auto_home", "bashrc", "asl.conf", "autofs.conf", "bashrc_Apple_Terminal", "csh.cshrc", "csh.logout", "com.apple.screensharing.agent.launchd", "csh.login", "cupsd.conf", "cups-files.conf.default", "cupsd.conf.O", "cupsd.conf.default", "cups-files.conf", "snmp.conf", "snmp.conf.default", "dragonforce.io", "find.codes", "ftpusers", "hosts.equiv", "gettytab", "hosts", "kern_loader.conf", "irbrc", "locate.rc", "mail.rc", "group", "man.conf", "networks", "manpaths", "newsyslog.conf", "com.apple.slapconfig.conf", "files.conf", "com.apple.xscertd.conf", "wifi.conf", "com.apple.slapd.conf", "nfs.conf", "ntp.conf", "notify.conf", "ntp_opendirectory.conf", "AppleOpenLDAP.plist", "ldap.conf", "ldap.conf.default", "apple_auxillary.schema", "corba.ldif", "collective.schema", "collective.ldif", "core.ldif", "apple.schema", "cosine.ldif", "core.schema", "corba.schema", "duaconf.ldif", "dyngroup.ldif", "fmserver.schema", "duaconf.schema", "java.ldif", "inetorgperson.schema", "inetorgperson.ldif", "java.schema", "krb5-kdc.schema", "cosine.schema", "misc.ldif", "microsoft.std.schema", "misc.schema", "netinfo.schema", "nis.schema", "nis.ldif", "openldap.schema", "dyngroup.schema", "pmi.ldif", "ppolicy.ldif", "pmi.schema", "openldap.ldif", "README", "ppolicy.schema", "samba.schema", "microsoft.schema", "access", "custom_header_checks", "canonical", "generic", "bounce.cf.default", "header_checks", "LICENSE", "makedefs.out", "main.cf", "master.cf.default", "master.cf", "main.cf.proto", "master.cf.proto", "postfix-files", "relocated", "TLS_LICENSE", "virtual", "main.cf.default", "transport", "profile", "protocols", "racoon.conf", "rmtab", "rc.common", "rpc", "rtadvd.conf", "rc.netboot", "audit_class", "audit_warn", "audit_event", "audit_control" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Bahrain", "Israel", "India" ], "malware_families": [ { "id": "DirectoryIndex", "display_name": "DirectoryIndex", "target": null }, { "id": "AllowOverride", "display_name": "AllowOverride", "target": null }, { "id": "Malaysia, Truly Asia", "display_name": "Malaysia, Truly Asia", "target": null }, { "id": "9002 RAT", "display_name": "9002 RAT", "target": null }, { "id": "Virus:DOS/PSMPC_386", "display_name": "Virus:DOS/PSMPC_386", "target": "/malware/Virus:DOS/PSMPC_386" }, { "id": "TEL:TrojanSpy:Win32/KediRat", "display_name": "TEL:TrojanSpy:Win32/KediRat", "target": null }, { "id": "TrojanSpy:iOS/XcodeGhost", "display_name": "TrojanSpy:iOS/XcodeGhost", "target": "/malware/TrojanSpy:iOS/XcodeGhost" }, { "id": "ALF:HSTR:TrojanSpy:MSIL/KeyLogger", "display_name": "ALF:HSTR:TrojanSpy:MSIL/KeyLogger", "target": null }, { "id": "Ultra VNC", "display_name": "Ultra VNC", "target": null }, { "id": "TrojanDownloader:Win32/Bridge", "display_name": "TrojanDownloader:Win32/Bridge", "target": "/malware/TrojanDownloader:Win32/Bridge" }, { "id": "Virus:DOS/Cyberwar_5300", "display_name": "Virus:DOS/Cyberwar_5300", "target": "/malware/Virus:DOS/Cyberwar_5300" }, { "id": "Backdoor:Win32/Espion", "display_name": "Backdoor:Win32/Espion", "target": "/malware/Backdoor:Win32/Espion" }, { "id": "Pegasus for iOS - S0289", "display_name": "Pegasus for iOS - S0289", "target": null }, { "id": "Pegasus - MOB-S0005", "display_name": "Pegasus - MOB-S0005", "target": null }, { "id": "Pegasus for Android - S0316", "display_name": "Pegasus for Android - S0316", "target": null }, { "id": "ALF:HeraklezEval:Backdoor:Linux/Mirai", "display_name": "ALF:HeraklezEval:Backdoor:Linux/Mirai", "target": null }, { "id": "ALF:HeraklezEval:BackdoorLinux/Mirai", "display_name": "ALF:HeraklezEval:BackdoorLinux/Mirai", "target": null }, { "id": "ALF:HeraklezEval:Backdoor:Linux/Tsunami", "display_name": "ALF:HeraklezEval:Backdoor:Linux/Tsunami", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1404", "name": "Exploit OS Vulnerability", "display_name": "T1404 - Exploit OS Vulnerability" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1001.002", "name": "Steganography", "display_name": "T1001.002 - Steganography" }, { "id": "T1003.004", "name": "LSA Secrets", "display_name": "T1003.004 - LSA Secrets" }, { "id": "T1001.001", "name": "Junk Data", "display_name": "T1001.001 - Junk Data" }, { "id": "T1003.001", "name": "LSASS Memory", "display_name": "T1003.001 - LSASS Memory" }, { "id": "T1003.005", "name": "Cached Domain Credentials", "display_name": "T1003.005 - Cached Domain Credentials" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1026", "name": "Multiband Communication", "display_name": "T1026 - Multiband Communication" }, { "id": "T1562.004", "name": "Disable or Modify System Firewall", "display_name": "T1562.004 - Disable or Modify System Firewall" }, { "id": "T1025", "name": "Data from Removable Media", "display_name": "T1025 - Data from Removable Media" }, { "id": "T1055.002", "name": "Portable Executable Injection", "display_name": "T1055.002 - Portable Executable Injection" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1021.006", "name": "Windows Remote Management", "display_name": "T1021.006 - Windows Remote Management" }, { "id": "T1021", "name": "Remote Services", "display_name": "T1021 - Remote Services" } ], "industries": [ "Media", "LGBTQ+ Activists", "Technology", "Telecommunications", "Hospitality", "Energy", "NGO", "Semiconductor", "Human Subjects" ], "TLP": "white", "cloned_from": null, "export_count": 35, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 669, "URL": 1976, "email": 21, "hostname": 1198, "FileHash-SHA256": 277, "CVE": 2, "CIDR": 3 }, "indicator_count": 4146, "is_author": false, "is_subscribing": null, "subscriber_count": 35, "modified_text": "508 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "671fd3afa974b93284d6bac1", "name": "dragonforce.io", "description": "Throw your MacBook in the trash, where the hackers belong.", "modified": "2024-11-27T17:01:13.516000", "created": "2024-10-28T18:10:55.712000", "tags": [ "copyright", "apple computer", "tcpip", "supported", "quantum", "postfix", "mail", "aliases", "postfix version", "restrict", "wietse venema", "sample", "note", "person", "basic system", "general", "column", "tiff", "linus walleij", "triad", "greg roelofs", "html", "daniel quinlan", "aiff", "music", "wave", "formats", "magic", "form", "crunch", "freeze", "maker", "format", "postscript", "this", "ifmodule", "include", "virtualhost", "directory", "require", "serverroot", "listen", "ifdefine", "loadmodule", "errordocument", "apache", "win32", "example", "main", "webdav", "internet", "mime type", "xlm xla", "xlc xlt", "xlam", "xlsb", "xlsm", "xltm", "z7 z8", "xhtml xht", "addiconbytype", "adddescription", "fancyindexed", "gzip", "indexignore", "indexes", "versionsort", "fancyindexing", "alias icons", "full", "minrate500", "keepalive", "prod", "email", "apache http", "server", "timeout", "number", "minimal", "major", "addlanguage", "addcharset", "defaultlanguage", "fallback", "polish", "addlanguage pl", "catalan", "english", "greekmodern", "korean", "turkish", "browsermatch", "davlockdb", "requireany", "usergroup", "alias", "authtype digest", "davupload admin", "authuserfile", "errorhttp", "http", "yourincludepath", "apache version", "serversignature", "alias error", "addhandler", "threadsperchild", "startservers", "minsparethreads", "maxsparethreads", "maximum number", "pidfile", "mpms", "threadstacksize", "extendedstatus", "change", "sethandler", "require host", "get information", "allow server", "allow", "userdir sites", "control access", "userdir", "sslsessioncache", "configure", "ocsp stapling", "ssl engine", "sslrequire", "ssltls standard", "prng", "sslrandomseed", "openssl", "high", "first", "refer", "servername", "virtualhost 80", "serveradmin", "documentroot", "errorlog", "customlog", "hosts", "please", "almost", "loadfile c", "proxyhtmllinks", "ascii", "unicode", "windows", "must", "location", "w3c html", "directoryindex", "allowoverride", "manual", "provide access", "options indexes", "files", "removetype tr", "traditionally", "addlanguage da", "addtype", "a facility", "claim", "file", "level error", "sender", "store", "level", "facility", "category", "time", "host", "threadid", "function", "line", "message", "guest", "access", "kernel", "usereventagent", "springboard", "message sep", "message mc", "message secure", "ca message", "multitouchhid", "use directory", "home autohome", "automounter map", "get home", "ps1h", "make bash", "s checkwinsize", "etcbashrc", "termprogram", "level info", "broadcast", "ignore", "rules", "true", "t option", "mount", "force", "environment", "automountdenv", "promptcommand", "shellsessiondir", "histfile", "histfilesize", "terminal", "myvar", "histtimeformat", "arrange", "bashrematch", "tell", "limit", "order deny", "authtype", "default require", "require user", "owner", "authkey", "lpadmin", "order", "system", "local", "cups scheduler", "list", "synconclose no", "default user", "user lp", "group lp", "group value", "restrict access", "cups", "inpck", "nnnbaud", "berkeley", "parity", "pc entry", "pass8", "parenb istrip", "fixed speed", "entry", "clocal mode", "host database", "maxhistsize", "promptmode", "verbose end", "etcirbrcloaded", "default", "setup", "history file", "readline", "error", "searchpaths", "freebsd", "tmpdir", "fcodes", "prunepaths", "vartmp", "prunedirs", "filesystems", "status mailfrom", "returnpath via", "open directory", "jabber", "group database", "cyrus", "calendar", "dovecot", "postfix scsd", "networkd", "nroff", "manpath", "uncomment", "manpager", "whatispager", "manlocale", "every", "manpath optman", "maybe", "troff", "flags", "bcgjnuwz", "d0 j", "ldap defaults", "base dcexample", "uri ldap", "sizelimit", "timelimit", "deref", "syntax", "kerberos", "name", "corba object", "desc", "schema", "openldap", "redistribution", "public license", "license", "collective", "shall not", "ldap", "co llective", "equality", "sup name", "structural must", "singlevalue", "auxiliary must", "auxiliary may", "guid", "desc account", "desc mount", "desc password", "service", "info", "tiger", "multi", "d esc", "rfc1274", "structural may", "quality", "substr caseigno", "corba", "ldap directory", "reserved", "ldap server", "dynamic group", "netscape", "not recommended", "for production", "attribute", "name managedby", "name leaf", "duas", "internetdrafts", "coast", "project", "java object", "java class", "de sc", "pkcs", "inetorgperson", "rfc2798", "signeddata", "smime", "openldap note", "hold", "code", "java", "jndi reference", "jndi", "with syntax", "definitions", "kerberos v", "kdc schema", "oid base", "size", "subclass of", "may contain", "objectclass", "must contain", "matches for", "obsolete", "des c", "abstract must", "sup person", "microsoft", "advanced server", "schema mapping", "netinfo", "config", "groups", "netinfo preset", "crypt", "netinfo rpcs", "rpcs number", "oncrpcnumber", "ipnetmasknumber", "assistant", "may description", "rfc2307", "rfc2252", "match syntax", "openldaproot", "openldaporg", "openldapou", "equal ity", "kind", "rule", "attcertpath", "rolesyntax", "ldif", "blank", "ldap entry", "spaces", "cosine pilot", "directory forum", "password policy", "false", "april", "auxiliary", "passwd", "account", "desc pool", "unix", "structural", "sup rpcentry", "sup container", "abstract may", "sup ipsecbase", "Chelsea Manning Help Me", "Aishah Siti Lazim", "Aishah Lazim", "194 Green Street", "Human Subjects", "cybernetic", "RNA molecule", "matches", "postfix smtp", "domain", "ipv6 host", "reject", "reply", "prior", "bugs", "reject empty", "canonical", "tables", "post", "replace user", "address", "generic", "smtp", "isp mail", "mail delivery", "charset", "report", "postfix dsn", "mail returned", "only", "mime", "headerchecks", "readme files", "filters while", "posix", "empty", "body", "pass", "write", "date", "program", "agreement", "contributor", "recipient", "contribution", "the program", "corporation", "contributors", "product x", "as expressly", "arch", "arch x8664", "pipe wall", "wimplicit", "ranlib", "warn", "switch", "start", "systype", "smtp server", "specify", "mx host", "unix password", "user unknown", "pathbin", "postfix queue", "path", "beware", "class", "uucp", "shell", "outlook", "postfix master", "begin", "server admin", "mail backend", "modern smtp", "iana", "many", "postfix pipe", "recent cyrus", "amos gouaux", "old example", "update", "usrsbin", "file format", "no group", "daemondirectory", "relocated", "matches user", "synopsis", "or even", "lutz jaenicke", "technology", "cottbus", "germany", "openssl package", "openssl project", "europe", "remember that", "use of", "virtual", "virtual alias", "redirect mail", "deliver mail", "transport", "description", "result format", "bashno", "r etcbashrc", "protocol", "ipv6", "icmp", "cisco", "monitoring", "argus", "chaos", "rsvp", "encapsulation", "aris", "isis", "kame", "id key", "specification", "auto exit", "vpn socket", "networkup", "term", "devnull", "common setup", "set command", "sunnet manager", "rpcsrc", "netlicense", "apple", "netbootmount", "netbootshadow", "computername", "localonly", "localnetbootdir", "netboot", "define", "purpose", "networkonly", "waiting", "auditing", "solaris", "openbsm", "secsrvr", "allocation", "bsm event", "solaris kernel", "openbsm kernel", "solaris auemac", "solaris umount", "integer", "array", "data", "state", "opendirectoryd", "ipv4", "plist", "dict", "session", "commcenter", "airport", "cfbasichash", "thread", "cfrunloop", "cfrunloopmode", "usrbinsudo", "usrsbinnetbiosd", "removed" ], "references": [ "afpovertcp.cfg", "aliases", "magic", "httpd.conf", "mime.types", "httpd-autoindex.conf", "httpd-default.conf", "httpd-languages.conf", "httpd-dav.conf", "httpd-multilang-errordoc.conf", "httpd-mpm.conf", "httpd-info.conf", "httpd-userdir.conf", "httpd-ssl.conf", "httpd-vhosts.conf", "proxy-html.conf", "httpd-manual.conf", "php7.conf", "mpm.conf", "com.apple.eventmonitor", "com.apple.authd", "com.apple.cdscheduler", "com.apple.contacts.ContactsAutocomplete", "com.apple.install", "com.apple.coreduetd", "com.apple.login.guest", "com.apple.mkb", "com.apple.mail", "com.apple.MessageTracer", "com.apple.mkb.internal", "com.apple.iokit.power", "com.apple.performance", "com.apple.networking.boringssl", "auto_master", "auto_home", "bashrc", "asl.conf", "autofs.conf", "bashrc_Apple_Terminal", "csh.cshrc", "csh.logout", "com.apple.screensharing.agent.launchd", "csh.login", "cupsd.conf", "cups-files.conf.default", "cupsd.conf.O", "cupsd.conf.default", "cups-files.conf", "snmp.conf", "snmp.conf.default", "dragonforce.io", "find.codes", "ftpusers", "hosts.equiv", "gettytab", "hosts", "kern_loader.conf", "irbrc", "locate.rc", "mail.rc", "group", "man.conf", "networks", "manpaths", "newsyslog.conf", "com.apple.slapconfig.conf", "files.conf", "com.apple.xscertd.conf", "wifi.conf", "com.apple.slapd.conf", "nfs.conf", "ntp.conf", "notify.conf", "ntp_opendirectory.conf", "AppleOpenLDAP.plist", "ldap.conf", "ldap.conf.default", "apple_auxillary.schema", "corba.ldif", "collective.schema", "collective.ldif", "core.ldif", "apple.schema", "cosine.ldif", "core.schema", "corba.schema", "duaconf.ldif", "dyngroup.ldif", "fmserver.schema", "duaconf.schema", "java.ldif", "inetorgperson.schema", "inetorgperson.ldif", "java.schema", "krb5-kdc.schema", "cosine.schema", "misc.ldif", "microsoft.std.schema", "misc.schema", "netinfo.schema", "nis.schema", "nis.ldif", "openldap.schema", "dyngroup.schema", "pmi.ldif", "ppolicy.ldif", "pmi.schema", "openldap.ldif", "README", "ppolicy.schema", "samba.schema", "microsoft.schema", "access", "custom_header_checks", "canonical", "generic", "bounce.cf.default", "header_checks", "LICENSE", "makedefs.out", "main.cf", "master.cf.default", "master.cf", "main.cf.proto", "master.cf.proto", "postfix-files", "relocated", "TLS_LICENSE", "virtual", "main.cf.default", "transport", "profile", "protocols", "racoon.conf", "rmtab", "rc.common", "rpc", "rtadvd.conf", "rc.netboot", "audit_class", "audit_warn", "audit_event", "audit_control" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Bahrain", "Israel", "India" ], "malware_families": [ { "id": "DirectoryIndex", "display_name": "DirectoryIndex", "target": null }, { "id": "AllowOverride", "display_name": "AllowOverride", "target": null }, { "id": "Malaysia, Truly Asia", "display_name": "Malaysia, Truly Asia", "target": null }, { "id": "9002 RAT", "display_name": "9002 RAT", "target": null }, { "id": "Virus:DOS/PSMPC_386", "display_name": "Virus:DOS/PSMPC_386", "target": "/malware/Virus:DOS/PSMPC_386" }, { "id": "TEL:TrojanSpy:Win32/KediRat", "display_name": "TEL:TrojanSpy:Win32/KediRat", "target": null }, { "id": "TrojanSpy:iOS/XcodeGhost", "display_name": "TrojanSpy:iOS/XcodeGhost", "target": "/malware/TrojanSpy:iOS/XcodeGhost" }, { "id": "ALF:HSTR:TrojanSpy:MSIL/KeyLogger", "display_name": "ALF:HSTR:TrojanSpy:MSIL/KeyLogger", "target": null }, { "id": "Ultra VNC", "display_name": "Ultra VNC", "target": null }, { "id": "TrojanDownloader:Win32/Bridge", "display_name": "TrojanDownloader:Win32/Bridge", "target": "/malware/TrojanDownloader:Win32/Bridge" }, { "id": "Virus:DOS/Cyberwar_5300", "display_name": "Virus:DOS/Cyberwar_5300", "target": "/malware/Virus:DOS/Cyberwar_5300" }, { "id": "Backdoor:Win32/Espion", "display_name": "Backdoor:Win32/Espion", "target": "/malware/Backdoor:Win32/Espion" }, { "id": "Pegasus for iOS - S0289", "display_name": "Pegasus for iOS - S0289", "target": null }, { "id": "Pegasus - MOB-S0005", "display_name": "Pegasus - MOB-S0005", "target": null }, { "id": "Pegasus for Android - S0316", "display_name": "Pegasus for Android - S0316", "target": null }, { "id": "ALF:HeraklezEval:Backdoor:Linux/Mirai", "display_name": "ALF:HeraklezEval:Backdoor:Linux/Mirai", "target": null }, { "id": "ALF:HeraklezEval:BackdoorLinux/Mirai", "display_name": "ALF:HeraklezEval:BackdoorLinux/Mirai", "target": null }, { "id": "ALF:HeraklezEval:Backdoor:Linux/Tsunami", "display_name": "ALF:HeraklezEval:Backdoor:Linux/Tsunami", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1404", "name": "Exploit OS Vulnerability", "display_name": "T1404 - Exploit OS Vulnerability" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1001.002", "name": "Steganography", "display_name": "T1001.002 - Steganography" }, { "id": "T1003.004", "name": "LSA Secrets", "display_name": "T1003.004 - LSA Secrets" }, { "id": "T1001.001", "name": "Junk Data", "display_name": "T1001.001 - Junk Data" }, { "id": "T1003.001", "name": "LSASS Memory", "display_name": "T1003.001 - LSASS Memory" }, { "id": "T1003.005", "name": "Cached Domain Credentials", "display_name": "T1003.005 - Cached Domain Credentials" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1026", "name": "Multiband Communication", "display_name": "T1026 - Multiband Communication" }, { "id": "T1562.004", "name": "Disable or Modify System Firewall", "display_name": "T1562.004 - Disable or Modify System Firewall" }, { "id": "T1025", "name": "Data from Removable Media", "display_name": "T1025 - Data from Removable Media" }, { "id": "T1055.002", "name": "Portable Executable Injection", "display_name": "T1055.002 - Portable Executable Injection" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1021.006", "name": "Windows Remote Management", "display_name": "T1021.006 - Windows Remote Management" }, { "id": "T1021", "name": "Remote Services", "display_name": "T1021 - Remote Services" } ], "industries": [ "Media", "LGBTQ+ Activists", "Technology", "Telecommunications", "Hospitality", "Energy", "NGO", "Semiconductor", "Human Subjects" ], "TLP": "white", "cloned_from": null, "export_count": 34, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 669, "URL": 1976, "email": 21, "hostname": 1198, "FileHash-SHA256": 277, "CVE": 2, "CIDR": 3 }, "indicator_count": 4146, "is_author": false, "is_subscribing": null, "subscriber_count": 33, "modified_text": "508 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66f837de06233b5ccdd84a81", "name": "The Real Jane Doe Syndrome Files", "description": "An array of scripts and files designed to completely compromise your MacBook and effectively erase your digital identity from the internet exists. This type of targeted attack is perpetrated by various groups for political or monetary agendas. It gradually takes over your devices and consumes your energy, time, career, and overall quality of life. In my case, the adversary involved is the DragonForce Malaysia Hacker Group.", "modified": "2024-10-28T16:02:26.345000", "created": "2024-09-28T17:07:42.479000", "tags": [ "copyright", "apple computer", "tcpip", "supported", "quantum", "automounter map", "use directory", "get home", "home autohome", "facility", "file", "level", "access", "level info", "broadcast", "store", "ignore", "rules", "sender", "true", "t option", "mount", "force", "environment", "automountdenv", "promptcommand", "shellsessiondir", "histfile", "histfilesize", "terminal", "myvar", "histtimeformat", "arrange", "bashrematch", "tell", "postfix", "mail", "aliases", "postfix version", "restrict", "wietse venema", "sample", "note", "person", "basic system", "general", "host database", "inpck", "nnnbaud", "berkeley", "parity", "pc entry", "pass8", "parenb istrip", "fixed speed", "entry", "clocal mode", "open directory", "jabber", "group database", "cyrus", "calendar", "dovecot", "postfix scsd", "networkd", "searchpaths", "freebsd", "tmpdir", "fcodes", "prunepaths", "vartmp", "prunedirs", "filesystems", "status mailfrom", "returnpath via", "maxhistsize", "promptmode", "verbose end", "etcirbrcloaded", "default", "setup", "history file", "kernel", "readline", "error", "nroff", "manpath", "uncomment", "manpager", "whatispager", "manlocale", "every", "manpath optman", "maybe", "troff", "refer", "pidfile", "flags", "bcgjnuwz", "ps1h", "make bash", "s checkwinsize", "etcbashrc", "termprogram", "daemon", "service", "server", "user", "audio", "user database", "unix copy", "protocol", "gate daemon", "desktop", "agent", "bridge", "bin usrsbin", "sbin", "default pf", "care", "bashno", "r etcbashrc", "ipv6", "internet", "icmp", "cisco", "monitoring", "argus", "chaos", "rsvp", "encapsulation", "aris", "isis", "rfc1323", "m1460", "macos x", "signature", "linux", "opera", "xp sp1", "windows sp1", "nmap syn", "m265", "direct", "unknown", "synack", "mind", "macos", "warp", "generic", "networkup", "term", "devnull", "common setup", "configure", "set command", "pathbin", "path", "netbootmount", "netbootshadow", "computername", "localonly", "localnetbootdir", "netboot", "define", "purpose", "networkonly", "waiting", "sunnet manager", "rpcsrc", "netlicense", "apple", "notice", "dns hostname", "dns query", "see also", "kame", "ftpd", "bindash binksh", "binsh bintcsh", "none", "fax reception", "hardwired", "0007", "setup user", "home", "zdotdir", "delete", "beep", "vendor", "kf10", "kf11", "kf12", "kf13", "backspace", "insert", "resume", "termsessionid", "savehist", "sharehistory", "addiconbytype", "adddescription", "directory", "fancyindexed", "gzip", "indexignore", "indexes", "versionsort", "fancyindexing", "alias icons", "format", "browsermatch", "davlockdb", "requireany", "webdav", "usergroup", "alias", "authtype digest", "davupload admin", "authuserfile", "apache", "full", "minrate500", "keepalive", "prod", "email", "apache http", "timeout", "number", "minimal", "major", "manual", "provide access", "options indexes", "require", "sethandler", "files", "removetype tr", "traditionally", "addlanguage da", "extendedstatus", "change", "require host", "get information", "allow server", "allow", "addlanguage", "addcharset", "defaultlanguage", "fallback", "polish", "addlanguage pl", "catalan", "english", "greekmodern", "korean", "turkish", "ifmodule", "threadsperchild", "startservers", "minsparethreads", "maxsparethreads", "maximum number", "mpms", "threadstacksize", "loadfile c", "html", "proxyhtmllinks", "first", "ascii", "unicode", "windows", "must", "location", "w3c html", "example", "sslsessioncache", "ocsp stapling", "ssl engine", "sslrequire", "ssltls standard", "prng", "sslrandomseed", "openssl", "high", "userdir sites", "control access", "userdir", "virtualhost", "servername", "virtualhost 80", "serveradmin", "documentroot", "errorlog", "customlog", "hosts", "please", "almost", "errorhttp", "http", "yourincludepath", "apache version", "serversignature", "alias error", "addhandler", "include", "serverroot", "listen", "ifdefine", "loadmodule", "errordocument", "win32", "main", "addtype", "directoryindex", "claim", "category", "time", "host", "threadid", "function", "line", "message", "level error", "a facility", "guest", "springboard", "message sep", "message mc", "message secure", "ca message", "multitouchhid", "usereventagent", "cups", "hp envy", "high duplex", "none colormodel", "gray gamma", "env10", "envc6", "envchou3", "envchou4", "envdl", "isob5", "false", "cups scheduler", "list", "synconclose no", "default user", "user lp", "group lp", "system", "group value", "limit", "order deny", "require user", "owner", "authtype", "default require", "authkey", "lpadmin", "restrict access", "d0 j", "acl account", "touch id", "airdrop anchor", "reject empty", "domain", "canonical", "tables", "ldap", "post", "replace user", "address", "bugs", "matches", "postfix smtp", "ipv6 host", "reject", "reply", "prior", "hold", "info", "smtp", "isp mail", "name", "mail delivery", "charset", "report", "postfix dsn", "mail returned", "this", "only", "program", "agreement", "contributor", "recipient", "contribution", "the program", "corporation", "contributors", "product x", "as expressly", "arch", "arch x8664", "pipe wall", "wimplicit", "ranlib", "warn", "switch", "start", "systype", "mime", "headerchecks", "readme files", "filters while", "posix", "empty", "body", "pass", "write", "date", "smtp server", "specify", "mx host", "unix password", "user unknown", "postfix queue", "unix", "beware", "class", "uucp", "shell", "local", "outlook", "postfix master", "begin", "server admin", "mail backend", "modern smtp", "iana", "many", "postfix pipe", "recent cyrus", "amos gouaux", "old example", "relocated", "matches user", "synopsis", "or even", "lutz jaenicke", "technology", "cottbus", "germany", "openssl package", "openssl project", "europe", "remember that", "use of", "virtual", "virtual alias", "redirect mail", "deliver mail", "transport", "description", "result format", "update", "usrsbin", "file format", "no group", "daemondirectory", "id key", "specification", "auto exit", "vpn socket", "ipv4v6", "userfqdn", "fqdn", "auditing", "solaris", "reserved", "openbsm", "secsrvr", "allocation", "bsm event", "solaris kernel", "openbsm kernel", "solaris auemac", "solaris umount", "removed", "Aishah Siti Lazim" ], "references": [ "afpovertcp.cfg", "auto_home", "auto_master", "asl.conf", "autofs.conf", "com.apple.screensharing.agent.launchd", "bashrc_Apple_Terminal", "csh.cshrc", "csh.login", "aliases", "csh.logout", "find.codes", "ftpusers", "hosts", "gettytab", "hosts.equiv", "kern_loader.conf", "group", "locate.rc", "mail.rc", "irbrc", "manpaths", "man.conf", "networks", "newsyslog.conf", "nfs.conf", "bashrc", "ntp_opendirectory.conf", "nsmb.conf", "ntp.conf", "passwd", "paths", "pf.conf", "profile", "notify.conf", "protocols", "pf.os", "rc.common", "rc.netboot", "rpc", "rmtab", "resolv.conf", "rtadvd.conf", "shells", "syslog.conf", "ttys", "xtab", "zprofile", "zshrc", "zshrc_Apple_Terminal", "httpd-autoindex.conf", "httpd-dav.conf", "httpd-default.conf", "httpd-manual.conf", "httpd-info.conf", "httpd-languages.conf", "httpd-mpm.conf", "proxy-html.conf", "httpd-ssl.conf", "httpd-userdir.conf", "httpd-vhosts.conf", "httpd-multilang-errordoc.conf", "httpd.conf", "mpm.conf", "php7.conf", "johndoe.conf", "com.apple.cdscheduler", "com.apple.contacts.ContactsAutocomplete", "com.apple.authd", "com.apple.eventmonitor", "com.apple.mail", "com.apple.iokit.power", "com.apple.MessageTracer", "com.apple.login.guest", "com.apple.install", "com.apple.networking.boringssl", "com.apple.performance", "com.apple.mkb.internal", "com.apple.coreduetd", "com.apple.mkb", "snmp.conf", "snmp.conf.default", "HP_ENVY_6000_series__3D66E1_.ppd", "cups-files.conf", "cups-files.conf.default", "cupsd.conf.default", "cupsd.conf", "com.apple.slapd.conf", "com.apple.xscertd.conf", "files.conf", "com.apple.slapconfig.conf", "authorization", "authorization_la", "authorization_ctk", "authorization_aks", "checkpw", "authorization_lacont", "chkpasswd", "cups", "login.term", "login", "other", "screensaver", "screensaver_new", "screensaver_aks", "screensaver_la", "screensaver_new_ctk", "screensaver_new_la", "screensaver_new_aks", "smbd", "sshd", "screensaver_ctk", "su", "sudo", "sudo_local.template", "10-cryptex", "com.apple", "custom_header_checks", "canonical", "access", "generic", "bounce.cf.default", "LICENSE", "makedefs.out", "header_checks", "main.cf", "main.cf.proto", "master.cf.default", "master.cf.proto", "main.cf.default", "master.cf", "relocated", "TLS_LICENSE", "virtual", "transport", "postfix-files", "racoon.conf", "psk.txt", "audit_warn", "audit_class", "audit_event", "audit_user", "audit_control.example" ], "public": 1, "adversary": "DragonForce Hacker Group Malaysia, Al-Arqam", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 36, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 285, "URL": 618, "hostname": 306, "email": 21, "FileHash-SHA256": 219, "CIDR": 3 }, "indicator_count": 1452, "is_author": false, "is_subscribing": null, "subscriber_count": 32, "modified_text": "538 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://www.iana.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://www.iana.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776684305.7001994 }