{
  "type": "Domain",
  "indicator": "n.property",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/n.property",
    "alexa": "http://www.alexa.com/siteinfo/n.property",
    "indicator": "n.property",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3162389339,
      "indicator": "n.property",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "6426dda295502d82e6e6ef7f",
          "name": "v4 - Hybrid scan uploaded  + all suggested ioc's - vendor.3a0e728a.js another gem in edge on twitter.com/i/flow/login source code",
          "description": "WebpackChunk_Twitter-responsive_web is built on a single web address, which will allow users to upload images, tweets and videos to be stored in the same place as the hashtag.",
          "modified": "2023-03-31T13:18:26.733000",
          "created": "2023-03-31T13:18:26.733000",
          "tags": [
            "trojan",
            "apt",
            "ansi",
            "memoryfile scan",
            "error",
            "runtime data",
            "typeof e",
            "regexp",
            "array",
            "object",
            "typeof t",
            "void",
            "null",
            "unknown",
            "path",
            "facebook",
            "4096",
            "suspicious",
            "meta",
            "lazy",
            "entity",
            "union",
            "body",
            "idkey",
            "scroll",
            "backspace",
            "insert",
            "roboto",
            "target",
            "stack",
            "hybrid",
            "model",
            "click",
            "stream",
            "strings",
            "qakbot",
            "pattern match",
            "ud801",
            "ud804",
            "ud805",
            "ud806",
            "ud81a",
            "ud835",
            "ud800",
            "ud802",
            "sha1",
            "sha256",
            "vendor.3a0e728a.js"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/9bf30967dfbf84d91ff4a1ca66dcd6c3383e679917e8b7aa4f659ff9f4e848d7/6426cf48655f94b6b303704c"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1115",
              "name": "Clipboard Data",
              "display_name": "T1115 - Clipboard Data"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1353,
            "hostname": 222,
            "domain": 221,
            "FileHash-SHA256": 85,
            "FileHash-MD5": 3,
            "FileHash-SHA1": 1
          },
          "indicator_count": 1885,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 90,
          "modified_text": "1156 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6426dd17695f7673d2dcee65",
          "name": "v3 Hybrid scan uploaded  - vendor.3a0e728a.js another gem in edge on twitter.com/i/flow/login source code",
          "description": "WebpackChunk_Twitter-responsive_web is built on a single web address, which will allow users to upload images, tweets and videos to be stored in the same place as the hashtag.",
          "modified": "2023-03-31T13:16:07.144000",
          "created": "2023-03-31T13:16:07.144000",
          "tags": [
            "trojan",
            "apt",
            "ansi",
            "memoryfile scan",
            "error",
            "runtime data",
            "typeof e",
            "regexp",
            "array",
            "object",
            "typeof t",
            "void",
            "null",
            "unknown",
            "path",
            "facebook",
            "4096",
            "suspicious",
            "meta",
            "lazy",
            "entity",
            "union",
            "body",
            "idkey",
            "scroll",
            "backspace",
            "insert",
            "roboto",
            "target",
            "stack",
            "hybrid",
            "model",
            "click",
            "stream",
            "strings",
            "qakbot",
            "pattern match",
            "ud801",
            "ud804",
            "ud805",
            "ud806",
            "ud81a",
            "ud835",
            "ud800",
            "ud802",
            "sha1",
            "sha256",
            "vendor.3a0e728a.js"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/9bf30967dfbf84d91ff4a1ca66dcd6c3383e679917e8b7aa4f659ff9f4e848d7/6426cf48655f94b6b303704c"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1115",
              "name": "Clipboard Data",
              "display_name": "T1115 - Clipboard Data"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 43,
            "domain": 193,
            "URL": 64,
            "FileHash-SHA256": 85,
            "FileHash-MD5": 3,
            "FileHash-SHA1": 1
          },
          "indicator_count": 389,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 90,
          "modified_text": "1156 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62e1ca167a1591e7b4ca1129",
          "name": "VirusTotal view-source on https://www.virustotal.com/en/file/undefined/analysis/",
          "description": "someone really needs to figure out wtf this is all doing it has to be part of the net.sh",
          "modified": "2022-07-28T02:05:04.183000",
          "created": "2022-07-27T23:28:22.504000",
          "tags": [
            "array",
            "object",
            "typeof t",
            "layer1",
            "error",
            "path",
            "function",
            "typeerror",
            "date",
            "svg export",
            "span",
            "null",
            "unknown",
            "click",
            "february",
            "april",
            "june",
            "august",
            "this",
            "void",
            "bounce",
            "string",
            "regexp",
            "number",
            "sxa0",
            "amptoken",
            "optout",
            "notfound",
            "contenttype",
            "form",
            "copyright",
            "element",
            "polymer project",
            "authors",
            "bsd style",
            "code",
            "google",
            "software",
            "window",
            "generator",
            "comment",
            "trident",
            "typeof e",
            "typeof symbol",
            "typeof btoa",
            "btoa",
            "typeof reflect",
            "boolean",
            "customevent",
            "plugin",
            "build",
            "home",
            "intelligence",
            "graph",
            "report",
            "urls",
            "please",
            "javascript",
            "https://www.virustotal.com/en/file/undefined/analysis/",
            "net.sh"
          ],
          "references": [
            "entity%3Aip%20whois%3Ainfo%40anodicnetwork.com.html",
            "14.main.bundle.91f9f7ff635e0b797de3.js",
            "5.main.bundle.e92e5e24e074f9c2a52b.js",
            "0.main.bundle.a9d68f5204cd3ac257b6.js",
            "webcomponent-polyfill.js",
            "analytics.js",
            "12.main.bundle.50be73a11d1d3745a5ee.js",
            "\"<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"> <html xmlns=\"http://www.w3.org/1999/xhtml\">   <head>     <title>           Page not found       </title>       <meta http-equiv=\"Content-type\" content=\"text/html; charset=utf-8\">     <meta http-equiv=\"Pragma\" content=\"no-cache\">     <meta http-equiv=\"Pragma\" content=\"no-store\">     <meta http-equiv=\"Expires\" content=\"-1\">     <meta name=\"keywords\" content=\"virustotal, antivirus, infected, free, sca",
            "https://www.virustotal.com/en/file/undefined/analysis/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1538,
            "FileHash-SHA256": 138,
            "hostname": 363,
            "domain": 235
          },
          "indicator_count": 2274,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 392,
          "modified_text": "1403 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62e1ac770957f4b01c2b879b",
          "name": "ttps://www.virustotal.com/graph/assets/2.main.bundle.15d0dfb25d4e999fb483.js",
          "description": "Request Headers\nEmpty\nResponse Headers\ncache-control\tpublic, max-age=2592000\ncontent-encoding\tgzip\ncontent-type\tapplication/javascript\ndate\tWed, 27 Jul 2022 20:22:50 GMT\netag\t\"ltvPcw\"\nexpires\tFri, 26 Aug 2022 20:22:50 GMT\nserver\tGoogle Frontend\nx-cloud-trace-context\t4be97fb12578bcd711b3b2cec941f3b0",
          "modified": "2022-07-27T21:21:59.432000",
          "created": "2022-07-27T21:21:59.432000",
          "tags": [
            "empty response",
            "headers",
            "gmt etag",
            "gmt server",
            "google frontend",
            "object",
            "number",
            "customevent",
            "null",
            "reflect",
            "boolean",
            "vticon",
            "slot",
            "string",
            "image",
            "class",
            "roboto",
            "date"
          ],
          "references": [
            "ttps://www.virustotal.com/graph/assets/2.main.bundle.15d0dfb25d4e999fb483.js"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 20,
            "URL": 103,
            "hostname": 7,
            "domain": 14,
            "FileHash-MD5": 2
          },
          "indicator_count": 146,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 392,
          "modified_text": "1403 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "0.main.bundle.a9d68f5204cd3ac257b6.js",
        "https://hybrid-analysis.com/sample/9bf30967dfbf84d91ff4a1ca66dcd6c3383e679917e8b7aa4f659ff9f4e848d7/6426cf48655f94b6b303704c",
        "ttps://www.virustotal.com/graph/assets/2.main.bundle.15d0dfb25d4e999fb483.js",
        "5.main.bundle.e92e5e24e074f9c2a52b.js",
        "14.main.bundle.91f9f7ff635e0b797de3.js",
        "webcomponent-polyfill.js",
        "12.main.bundle.50be73a11d1d3745a5ee.js",
        "https://www.virustotal.com/en/file/undefined/analysis/",
        "\"<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"> <html xmlns=\"http://www.w3.org/1999/xhtml\">   <head>     <title>           Page not found       </title>       <meta http-equiv=\"Content-type\" content=\"text/html; charset=utf-8\">     <meta http-equiv=\"Pragma\" content=\"no-cache\">     <meta http-equiv=\"Pragma\" content=\"no-store\">     <meta http-equiv=\"Expires\" content=\"-1\">     <meta name=\"keywords\" content=\"virustotal, antivirus, infected, free, sca",
        "entity%3Aip%20whois%3Ainfo%40anodicnetwork.com.html",
        "analytics.js"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "6426dda295502d82e6e6ef7f",
      "name": "v4 - Hybrid scan uploaded  + all suggested ioc's - vendor.3a0e728a.js another gem in edge on twitter.com/i/flow/login source code",
      "description": "WebpackChunk_Twitter-responsive_web is built on a single web address, which will allow users to upload images, tweets and videos to be stored in the same place as the hashtag.",
      "modified": "2023-03-31T13:18:26.733000",
      "created": "2023-03-31T13:18:26.733000",
      "tags": [
        "trojan",
        "apt",
        "ansi",
        "memoryfile scan",
        "error",
        "runtime data",
        "typeof e",
        "regexp",
        "array",
        "object",
        "typeof t",
        "void",
        "null",
        "unknown",
        "path",
        "facebook",
        "4096",
        "suspicious",
        "meta",
        "lazy",
        "entity",
        "union",
        "body",
        "idkey",
        "scroll",
        "backspace",
        "insert",
        "roboto",
        "target",
        "stack",
        "hybrid",
        "model",
        "click",
        "stream",
        "strings",
        "qakbot",
        "pattern match",
        "ud801",
        "ud804",
        "ud805",
        "ud806",
        "ud81a",
        "ud835",
        "ud800",
        "ud802",
        "sha1",
        "sha256",
        "vendor.3a0e728a.js"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/9bf30967dfbf84d91ff4a1ca66dcd6c3383e679917e8b7aa4f659ff9f4e848d7/6426cf48655f94b6b303704c"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1115",
          "name": "Clipboard Data",
          "display_name": "T1115 - Clipboard Data"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1353,
        "hostname": 222,
        "domain": 221,
        "FileHash-SHA256": 85,
        "FileHash-MD5": 3,
        "FileHash-SHA1": 1
      },
      "indicator_count": 1885,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 90,
      "modified_text": "1156 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6426dd17695f7673d2dcee65",
      "name": "v3 Hybrid scan uploaded  - vendor.3a0e728a.js another gem in edge on twitter.com/i/flow/login source code",
      "description": "WebpackChunk_Twitter-responsive_web is built on a single web address, which will allow users to upload images, tweets and videos to be stored in the same place as the hashtag.",
      "modified": "2023-03-31T13:16:07.144000",
      "created": "2023-03-31T13:16:07.144000",
      "tags": [
        "trojan",
        "apt",
        "ansi",
        "memoryfile scan",
        "error",
        "runtime data",
        "typeof e",
        "regexp",
        "array",
        "object",
        "typeof t",
        "void",
        "null",
        "unknown",
        "path",
        "facebook",
        "4096",
        "suspicious",
        "meta",
        "lazy",
        "entity",
        "union",
        "body",
        "idkey",
        "scroll",
        "backspace",
        "insert",
        "roboto",
        "target",
        "stack",
        "hybrid",
        "model",
        "click",
        "stream",
        "strings",
        "qakbot",
        "pattern match",
        "ud801",
        "ud804",
        "ud805",
        "ud806",
        "ud81a",
        "ud835",
        "ud800",
        "ud802",
        "sha1",
        "sha256",
        "vendor.3a0e728a.js"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/9bf30967dfbf84d91ff4a1ca66dcd6c3383e679917e8b7aa4f659ff9f4e848d7/6426cf48655f94b6b303704c"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1115",
          "name": "Clipboard Data",
          "display_name": "T1115 - Clipboard Data"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 43,
        "domain": 193,
        "URL": 64,
        "FileHash-SHA256": 85,
        "FileHash-MD5": 3,
        "FileHash-SHA1": 1
      },
      "indicator_count": 389,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 90,
      "modified_text": "1156 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62e1ca167a1591e7b4ca1129",
      "name": "VirusTotal view-source on https://www.virustotal.com/en/file/undefined/analysis/",
      "description": "someone really needs to figure out wtf this is all doing it has to be part of the net.sh",
      "modified": "2022-07-28T02:05:04.183000",
      "created": "2022-07-27T23:28:22.504000",
      "tags": [
        "array",
        "object",
        "typeof t",
        "layer1",
        "error",
        "path",
        "function",
        "typeerror",
        "date",
        "svg export",
        "span",
        "null",
        "unknown",
        "click",
        "february",
        "april",
        "june",
        "august",
        "this",
        "void",
        "bounce",
        "string",
        "regexp",
        "number",
        "sxa0",
        "amptoken",
        "optout",
        "notfound",
        "contenttype",
        "form",
        "copyright",
        "element",
        "polymer project",
        "authors",
        "bsd style",
        "code",
        "google",
        "software",
        "window",
        "generator",
        "comment",
        "trident",
        "typeof e",
        "typeof symbol",
        "typeof btoa",
        "btoa",
        "typeof reflect",
        "boolean",
        "customevent",
        "plugin",
        "build",
        "home",
        "intelligence",
        "graph",
        "report",
        "urls",
        "please",
        "javascript",
        "https://www.virustotal.com/en/file/undefined/analysis/",
        "net.sh"
      ],
      "references": [
        "entity%3Aip%20whois%3Ainfo%40anodicnetwork.com.html",
        "14.main.bundle.91f9f7ff635e0b797de3.js",
        "5.main.bundle.e92e5e24e074f9c2a52b.js",
        "0.main.bundle.a9d68f5204cd3ac257b6.js",
        "webcomponent-polyfill.js",
        "analytics.js",
        "12.main.bundle.50be73a11d1d3745a5ee.js",
        "\"<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"> <html xmlns=\"http://www.w3.org/1999/xhtml\">   <head>     <title>           Page not found       </title>       <meta http-equiv=\"Content-type\" content=\"text/html; charset=utf-8\">     <meta http-equiv=\"Pragma\" content=\"no-cache\">     <meta http-equiv=\"Pragma\" content=\"no-store\">     <meta http-equiv=\"Expires\" content=\"-1\">     <meta name=\"keywords\" content=\"virustotal, antivirus, infected, free, sca",
        "https://www.virustotal.com/en/file/undefined/analysis/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1538,
        "FileHash-SHA256": 138,
        "hostname": 363,
        "domain": 235
      },
      "indicator_count": 2274,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 392,
      "modified_text": "1403 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62e1ac770957f4b01c2b879b",
      "name": "ttps://www.virustotal.com/graph/assets/2.main.bundle.15d0dfb25d4e999fb483.js",
      "description": "Request Headers\nEmpty\nResponse Headers\ncache-control\tpublic, max-age=2592000\ncontent-encoding\tgzip\ncontent-type\tapplication/javascript\ndate\tWed, 27 Jul 2022 20:22:50 GMT\netag\t\"ltvPcw\"\nexpires\tFri, 26 Aug 2022 20:22:50 GMT\nserver\tGoogle Frontend\nx-cloud-trace-context\t4be97fb12578bcd711b3b2cec941f3b0",
      "modified": "2022-07-27T21:21:59.432000",
      "created": "2022-07-27T21:21:59.432000",
      "tags": [
        "empty response",
        "headers",
        "gmt etag",
        "gmt server",
        "google frontend",
        "object",
        "number",
        "customevent",
        "null",
        "reflect",
        "boolean",
        "vticon",
        "slot",
        "string",
        "image",
        "class",
        "roboto",
        "date"
      ],
      "references": [
        "ttps://www.virustotal.com/graph/assets/2.main.bundle.15d0dfb25d4e999fb483.js"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 20,
        "URL": 103,
        "hostname": 7,
        "domain": 14,
        "FileHash-MD5": 2
      },
      "indicator_count": 146,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 392,
      "modified_text": "1403 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "n.property",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "n.property",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780216422.2162166
}