{ "type": "Domain", "indicator": "stackoverflow.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/stackoverflow.com", "alexa": "http://www.alexa.com/siteinfo/stackoverflow.com", "indicator": "stackoverflow.com", "type": "domain", "type_title": "Domain", "validation": [ { "source": "ad_network", "message": "Whitelisted ad network domain ads.stackoverflow.com", "name": "Whitelisted ad network domain" }, { "source": "akamai", "message": "Akamai rank: #8920", "name": "Akamai Popular Domain" }, { "source": "alexa", "message": "Alexa rank: #34", "name": "Listed on Alexa" }, { "source": "majestic", "message": "Whitelisted domain stackoverflow.com", "name": "Whitelisted domain" }, { "source": "whitelist", "message": "Whitelisted domain stackoverflow.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 2651289957, "indicator": "stackoverflow.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 50, "pulses": [ { "id": "69eb254f17eb4a2a990f07e5", "name": "LevelBlue - Open Threat Exchange", "description": "[ As part of security research, we look at some of the most well-known vulnerabilities in the PDF ecosystem, and how they can be identified and mitigated, with the help of a simple hash.] [64xxxx]", "modified": "2026-05-28T07:10:11.800000", "created": "2026-04-24T08:09:51.488000", "tags": [ "pdfkit", "cve202225765", "exploit script", "github", "unicordev", "cves", "xml external", "entity", "pdfs", "knowledge base", "python", "mozilla", "virustotal", "cisa", "apple", "microsoft", "pdfkit ruby", "remote code", "execution", "urls", "malware", "raid", "caddywiper", "wipes", "cve202543529", "webkit", "february", "cve202620643", "bypass", "march", "webkit bug", "command", "control", "levelblue", "open threat" ], "references": [ "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Wipes", "display_name": "Wipes", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1084, "FileHash-SHA1": 874, "FileHash-SHA256": 3052, "CVE": 36, "domain": 437, "hostname": 1086, "URL": 1411, "CIDR": 15, "email": 13 }, "indicator_count": 8008, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "2 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a135614ee83fa05ff58af66", "name": "Validated: Cybercrime - #Alberta Compromise", "description": "Validated: Cybercrime - UofA BEC/ATO -> UAlberta Alfresco & Edmonton Police Compromise (HR Files) & TX - 05.24.26 - edit", "modified": "2026-05-24T19:48:36.416000", "created": "2026-05-24T19:48:36.416000", "tags": [], "references": [ "https://www.virustotal.com/graph/embed/g3238715200b747f1a237e03037a4d5ff15d85564ee0740439750d8ff75347031?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology", "Healthcare", "Government", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "UCP_GoA23", "id": "382539", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 200, "FileHash-MD5": 60, "FileHash-SHA1": 59, "FileHash-SHA256": 1097, "IPv4": 397, "domain": 341, "hostname": 407 }, "indicator_count": 2561, "is_author": false, "is_subscribing": null, "subscriber_count": 18, "modified_text": "6 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a10a079d3a0831710f3a0ab", "name": "Catastrophic DataBreach confirmed - UAlberta & Edmonton Police Services - 05.22.26", "description": "BEC/ATO (reported) and unauthorized use & abuse of Stolen Identity/Access/Credentials from the University of Alberta has been demonstrated as the cause of catastrophic Data-Breaches across the ualberta[.]ca domain and Edmonton Police Services (EPS).\nData is comprehensive, includes HR Records, PII/PHI, employment data, addresses, contact information.", "modified": "2026-05-22T18:29:13.092000", "created": "2026-05-22T18:29:13.092000", "tags": [], "references": [ "https://www.virustotal.com/graph/embed/g3238715200b747f1a237e03037a4d5ff15d85564ee0740439750d8ff75347031?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Government", "Healthcare", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "UCP_GoA23", "id": "382539", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 200, "FileHash-MD5": 61, "FileHash-SHA1": 60, "FileHash-SHA256": 1032, "IPv4": 393, "domain": 340, "hostname": 387 }, "indicator_count": 2473, "is_author": false, "is_subscribing": null, "subscriber_count": 19, "modified_text": "8 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0e936ce3f3ebd4b76fee29", "name": "MAV-en * VirusTotal report for setup-maven-master.zip", "description": "[The full text of the statement on the subject of human rights, as compiled by BBC Radio 4's Panorama, will be published on Wednesday, 27 March.. and will appear on BBC iPlayer]usernotificationsd, \"freeze_skip_reason:\" : \"none\",\n \"pid\" : 851,\n \"cpuTime\" : 0.52999799999999997,\n \"name\" : \"HeuristicInterpreter\",\n country_code\":\"US\",\"agent\":\"parsecd\\/1 (iPhone17,4; iPhone OS 26.3.1 23D8133) parsecd\\/", "modified": "2026-05-21T23:45:08.365000", "created": "2026-05-21T05:09:00.942000", "tags": [ "file type", "ascii", "ascii text", "java source", "json", "unicode text", "utf8 text", "c source", "sgml document", "creates", "persistence", "malicious", "next", "windows sandbox", "calls clear", "png image", "svg scalable", "vector graphics", "rgba", "crlf line", "ms windows", "title", "installer", "template", "pcx ver", "code helper", "helper", "plugin", "renderer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "mitre attack", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339747&Signature=R%2FOTx2wxfF3MkMsUAEbX76dOSFXtiY%2BBtXR6Kl7PxVGTXaylNjmhXaxofJAQ0RP2z7ICeXit4nmXky1HIQZnPX74ZyD16ICTt3%2BAXA6yZSU%2Fw%2Fks9M2Ju1xi3m8IMloiUH7Z9Le5L5Mlfrw5QO4ZO%2FgDHG3ATHUk0qk%2BFUT2gsjT8jS6aztZHjZo4xVQLlmmwWY2%2F8%2FKZejJlFptwLfMZEA%2BDW1ZbssKpkNsXZGu69SkdNPO9c", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339770&Signature=tPgwja3MWoODqbVlxhsock2mBa1WfALhB00A%2FSu4klEizmiV6VxM5y6vH%2FGm%2FFf67mLtz5mR6Mt17RKGQUPK11iYmQax86WhcCuxTpR0mDpo12tG4HAI5ht8qM4xgOQcjspEhBgsXPDvw2Np7e9trD0l8MytxvCqOuA7DVNdiUL2xvLNXAG1yCptFpvqyZo7kokLxp4RwsvDJuOrH8%2FGrNAOjdaHFQ8FWGhgkhyO6Q767Szi", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339792&Signature=O6r4LzVdjNFj7wZVT%2B0a4%2BGemB4yEqip9waMS7NlonESXy80tfqV33UBqEEp8i%2B2qOg6S%2Ba4cSwzi3nXOtjSaUaFAI43DmvSsxq5Y5WsA8cMb4Ul6FhGON6Cr0JT1xoEMtACmSdxG8Vo%2Be4PVcu93v6CBeWMZnFb8exU8ku4GUDY8ZEFW%2FJqeu266wn59KD9gFKRwlqx3NuRzMLdwqMA7f9o6QLPcM8WWnB%2BkvJVFk3BnxJAfBn7T2JO", "https://vtbehaviour.commondatastorage.googleapis.com/f839e941d0d2b6d9c5d6fd9b8b9ea9d34629182973bb9cc8af28e1e3ccdbbdd4_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339838&Signature=GgSFM3a3czj9g63hY67%2B%2FAyC%2FcGgMmTIqhErAonJ7vV9C8snHKwK0GtHZ6drm%2Fd%2BKaMonYJwSmh1LrRzYF9toBJc5rBwpR%2BPlsrS9EArViMI%2Bd%2Fb8ZZBHgqFsmCiiSWfzz4kIQRPM0RB4osCHqQxKmGW2i1uyWrytYjA4V%2FZREm1%2Bm2EEWx38PebvBFrM9pMznjF6rghFHp8ls6tzuolbXD4WUfR0OSoXjcAaAgihobJ%2FmOd", "https://vtbehaviour.commondatastorage.googleapis.com/e2f820daf9f578d5f3219ae8b3c6391017badf913a68c4aaac4e52c5155c566f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339867&Signature=l%2F%2BDGW7ZLqIfVvi1NOyg4%2FCgXPJBdSweWglJKW7iMb5GfnK0pX4yYYVL3OKkqrzAbMUcR2fqLUXHJfnMwSKBhQxjGR8LGF1nh7TeXxVGIQVh8kAyEZBCuXNHsZfzxR0zVbZfKAIEvC9D8S2%2FwBmpI6xztHiC7vmaJ5OhJD%2BoPDojRqXH2bmBpCz1XTZd7JphPNXRIbefZL4mR%2FrRe7o8WO2JHylOy9rIodNKKPEv5W9Q54%2BaA%2FG926", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339948&Signature=JA8BamPMfn7P8xM9CTv8ndNuaNtng0n%2Btofwj05768pJwsCB6Mgd6GU18%2BpNjCvwwZg%2F%2Bw0a2xOYIsvuqdDQAFzoO3jl3EUYKu7dPoOelD2NPrIcyCAHc8qKhqpPdjZKpo%2B8AJCxvO13OXHoSh94%2B%2Bht9h6mIJs8y7YO2CUo%2FqlV8M0fa5Px90aErgl%2BarD7%2ByQWlt0QD2caFKl%2BHViTViTx", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779340034&Signature=tbq82yoC%2BAKXaH%2F2XjmRWiAbt911K91ltP8zHTYrstzi0i1UKrzJxM48ky9ypV%2B%2FvrYdgBnaOfI9MzgZH0C%2FOFJUaVJ3WB87ULkjglD%2F6GeEDDcPtDX%2BY6aw2%2Bb8WaJU2xLc%2F9JbwoTbPP0n83pJv1qe0KLqckLIjEN4iREH1zU%2FldO5TBRicvB%2BxjeAxpPFZnjNZmyFl%2FNHbavuuvRc%2FMNR0DbjnriB2Mub" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 204, "FileHash-SHA1": 90, "FileHash-SHA256": 1997, "IPv4": 49, "domain": 34, "hostname": 124, "URL": 429, "URI": 1, "CIDR": 16 }, "indicator_count": 2944, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "9 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0e935a4a7df45548fe942d", "name": "MAV-en * VirusTotal report for setup-maven-master.zip", "description": "[The full text of the statement on the subject of human rights, as compiled by BBC Radio 4's Panorama, will be published on Wednesday, 27 March.. and will appear on BBC iPlayer]usernotificationsd, \"freeze_skip_reason:\" : \"none\",\n \"pid\" : 851,\n \"cpuTime\" : 0.52999799999999997,\n \"name\" : \"HeuristicInterpreter\",\n country_code\":\"US\",\"agent\":\"parsecd\\/1 (iPhone17,4; iPhone OS 26.3.1 23D8133) parsecd\\/", "modified": "2026-05-21T05:21:46.242000", "created": "2026-05-21T05:08:42.394000", "tags": [ "file type", "ascii", "ascii text", "java source", "json", "unicode text", "utf8 text", "c source", "sgml document", "creates", "persistence", "malicious", "next", "windows sandbox", "calls clear", "png image", "svg scalable", "vector graphics", "rgba", "crlf line", "ms windows", "title", "installer", "template", "pcx ver", "code helper", "helper", "plugin", "renderer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "mitre attack", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339747&Signature=R%2FOTx2wxfF3MkMsUAEbX76dOSFXtiY%2BBtXR6Kl7PxVGTXaylNjmhXaxofJAQ0RP2z7ICeXit4nmXky1HIQZnPX74ZyD16ICTt3%2BAXA6yZSU%2Fw%2Fks9M2Ju1xi3m8IMloiUH7Z9Le5L5Mlfrw5QO4ZO%2FgDHG3ATHUk0qk%2BFUT2gsjT8jS6aztZHjZo4xVQLlmmwWY2%2F8%2FKZejJlFptwLfMZEA%2BDW1ZbssKpkNsXZGu69SkdNPO9c", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339770&Signature=tPgwja3MWoODqbVlxhsock2mBa1WfALhB00A%2FSu4klEizmiV6VxM5y6vH%2FGm%2FFf67mLtz5mR6Mt17RKGQUPK11iYmQax86WhcCuxTpR0mDpo12tG4HAI5ht8qM4xgOQcjspEhBgsXPDvw2Np7e9trD0l8MytxvCqOuA7DVNdiUL2xvLNXAG1yCptFpvqyZo7kokLxp4RwsvDJuOrH8%2FGrNAOjdaHFQ8FWGhgkhyO6Q767Szi", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339792&Signature=O6r4LzVdjNFj7wZVT%2B0a4%2BGemB4yEqip9waMS7NlonESXy80tfqV33UBqEEp8i%2B2qOg6S%2Ba4cSwzi3nXOtjSaUaFAI43DmvSsxq5Y5WsA8cMb4Ul6FhGON6Cr0JT1xoEMtACmSdxG8Vo%2Be4PVcu93v6CBeWMZnFb8exU8ku4GUDY8ZEFW%2FJqeu266wn59KD9gFKRwlqx3NuRzMLdwqMA7f9o6QLPcM8WWnB%2BkvJVFk3BnxJAfBn7T2JO", "https://vtbehaviour.commondatastorage.googleapis.com/f839e941d0d2b6d9c5d6fd9b8b9ea9d34629182973bb9cc8af28e1e3ccdbbdd4_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339838&Signature=GgSFM3a3czj9g63hY67%2B%2FAyC%2FcGgMmTIqhErAonJ7vV9C8snHKwK0GtHZ6drm%2Fd%2BKaMonYJwSmh1LrRzYF9toBJc5rBwpR%2BPlsrS9EArViMI%2Bd%2Fb8ZZBHgqFsmCiiSWfzz4kIQRPM0RB4osCHqQxKmGW2i1uyWrytYjA4V%2FZREm1%2Bm2EEWx38PebvBFrM9pMznjF6rghFHp8ls6tzuolbXD4WUfR0OSoXjcAaAgihobJ%2FmOd", "https://vtbehaviour.commondatastorage.googleapis.com/e2f820daf9f578d5f3219ae8b3c6391017badf913a68c4aaac4e52c5155c566f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339867&Signature=l%2F%2BDGW7ZLqIfVvi1NOyg4%2FCgXPJBdSweWglJKW7iMb5GfnK0pX4yYYVL3OKkqrzAbMUcR2fqLUXHJfnMwSKBhQxjGR8LGF1nh7TeXxVGIQVh8kAyEZBCuXNHsZfzxR0zVbZfKAIEvC9D8S2%2FwBmpI6xztHiC7vmaJ5OhJD%2BoPDojRqXH2bmBpCz1XTZd7JphPNXRIbefZL4mR%2FrRe7o8WO2JHylOy9rIodNKKPEv5W9Q54%2BaA%2FG926", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339948&Signature=JA8BamPMfn7P8xM9CTv8ndNuaNtng0n%2Btofwj05768pJwsCB6Mgd6GU18%2BpNjCvwwZg%2F%2Bw0a2xOYIsvuqdDQAFzoO3jl3EUYKu7dPoOelD2NPrIcyCAHc8qKhqpPdjZKpo%2B8AJCxvO13OXHoSh94%2B%2Bht9h6mIJs8y7YO2CUo%2FqlV8M0fa5Px90aErgl%2BarD7%2ByQWlt0QD2caFKl%2BHViTViTx", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779340034&Signature=tbq82yoC%2BAKXaH%2F2XjmRWiAbt911K91ltP8zHTYrstzi0i1UKrzJxM48ky9ypV%2B%2FvrYdgBnaOfI9MzgZH0C%2FOFJUaVJ3WB87ULkjglD%2F6GeEDDcPtDX%2BY6aw2%2Bb8WaJU2xLc%2F9JbwoTbPP0n83pJv1qe0KLqckLIjEN4iREH1zU%2FldO5TBRicvB%2BxjeAxpPFZnjNZmyFl%2FNHbavuuvRc%2FMNR0DbjnriB2Mub" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 216, "FileHash-SHA1": 122, "FileHash-SHA256": 2487, "IPv4": 19, "domain": 47, "hostname": 73, "URL": 205, "URI": 1, "email": 1 }, "indicator_count": 3171, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "10 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0e936aec67867b0f6d29f3", "name": "MAV-en * VirusTotal report for setup-maven-master.zip", "description": "[The full text of the statement on the subject of human rights, as compiled by BBC Radio 4's Panorama, will be published on Wednesday, 27 March.. and will appear on BBC iPlayer]usernotificationsd, \"freeze_skip_reason:\" : \"none\",\n \"pid\" : 851,\n \"cpuTime\" : 0.52999799999999997,\n \"name\" : \"HeuristicInterpreter\",\n country_code\":\"US\",\"agent\":\"parsecd\\/1 (iPhone17,4; iPhone OS 26.3.1 23D8133) parsecd\\/", "modified": "2026-05-21T05:13:23.417000", "created": "2026-05-21T05:08:58.537000", "tags": [ "file type", "ascii", "ascii text", "java source", "json", "unicode text", "utf8 text", "c source", "sgml document", "creates", "persistence", "malicious", "next", "windows sandbox", "calls clear", "png image", "svg scalable", "vector graphics", "rgba", "crlf line", "ms windows", "title", "installer", "template", "pcx ver", "code helper", "helper", "plugin", "renderer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "mitre attack", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339747&Signature=R%2FOTx2wxfF3MkMsUAEbX76dOSFXtiY%2BBtXR6Kl7PxVGTXaylNjmhXaxofJAQ0RP2z7ICeXit4nmXky1HIQZnPX74ZyD16ICTt3%2BAXA6yZSU%2Fw%2Fks9M2Ju1xi3m8IMloiUH7Z9Le5L5Mlfrw5QO4ZO%2FgDHG3ATHUk0qk%2BFUT2gsjT8jS6aztZHjZo4xVQLlmmwWY2%2F8%2FKZejJlFptwLfMZEA%2BDW1ZbssKpkNsXZGu69SkdNPO9c", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339770&Signature=tPgwja3MWoODqbVlxhsock2mBa1WfALhB00A%2FSu4klEizmiV6VxM5y6vH%2FGm%2FFf67mLtz5mR6Mt17RKGQUPK11iYmQax86WhcCuxTpR0mDpo12tG4HAI5ht8qM4xgOQcjspEhBgsXPDvw2Np7e9trD0l8MytxvCqOuA7DVNdiUL2xvLNXAG1yCptFpvqyZo7kokLxp4RwsvDJuOrH8%2FGrNAOjdaHFQ8FWGhgkhyO6Q767Szi", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339792&Signature=O6r4LzVdjNFj7wZVT%2B0a4%2BGemB4yEqip9waMS7NlonESXy80tfqV33UBqEEp8i%2B2qOg6S%2Ba4cSwzi3nXOtjSaUaFAI43DmvSsxq5Y5WsA8cMb4Ul6FhGON6Cr0JT1xoEMtACmSdxG8Vo%2Be4PVcu93v6CBeWMZnFb8exU8ku4GUDY8ZEFW%2FJqeu266wn59KD9gFKRwlqx3NuRzMLdwqMA7f9o6QLPcM8WWnB%2BkvJVFk3BnxJAfBn7T2JO", "https://vtbehaviour.commondatastorage.googleapis.com/f839e941d0d2b6d9c5d6fd9b8b9ea9d34629182973bb9cc8af28e1e3ccdbbdd4_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339838&Signature=GgSFM3a3czj9g63hY67%2B%2FAyC%2FcGgMmTIqhErAonJ7vV9C8snHKwK0GtHZ6drm%2Fd%2BKaMonYJwSmh1LrRzYF9toBJc5rBwpR%2BPlsrS9EArViMI%2Bd%2Fb8ZZBHgqFsmCiiSWfzz4kIQRPM0RB4osCHqQxKmGW2i1uyWrytYjA4V%2FZREm1%2Bm2EEWx38PebvBFrM9pMznjF6rghFHp8ls6tzuolbXD4WUfR0OSoXjcAaAgihobJ%2FmOd", "https://vtbehaviour.commondatastorage.googleapis.com/e2f820daf9f578d5f3219ae8b3c6391017badf913a68c4aaac4e52c5155c566f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339867&Signature=l%2F%2BDGW7ZLqIfVvi1NOyg4%2FCgXPJBdSweWglJKW7iMb5GfnK0pX4yYYVL3OKkqrzAbMUcR2fqLUXHJfnMwSKBhQxjGR8LGF1nh7TeXxVGIQVh8kAyEZBCuXNHsZfzxR0zVbZfKAIEvC9D8S2%2FwBmpI6xztHiC7vmaJ5OhJD%2BoPDojRqXH2bmBpCz1XTZd7JphPNXRIbefZL4mR%2FrRe7o8WO2JHylOy9rIodNKKPEv5W9Q54%2BaA%2FG926", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339948&Signature=JA8BamPMfn7P8xM9CTv8ndNuaNtng0n%2Btofwj05768pJwsCB6Mgd6GU18%2BpNjCvwwZg%2F%2Bw0a2xOYIsvuqdDQAFzoO3jl3EUYKu7dPoOelD2NPrIcyCAHc8qKhqpPdjZKpo%2B8AJCxvO13OXHoSh94%2B%2Bht9h6mIJs8y7YO2CUo%2FqlV8M0fa5Px90aErgl%2BarD7%2ByQWlt0QD2caFKl%2BHViTViTx", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779340034&Signature=tbq82yoC%2BAKXaH%2F2XjmRWiAbt911K91ltP8zHTYrstzi0i1UKrzJxM48ky9ypV%2B%2FvrYdgBnaOfI9MzgZH0C%2FOFJUaVJ3WB87ULkjglD%2F6GeEDDcPtDX%2BY6aw2%2Bb8WaJU2xLc%2F9JbwoTbPP0n83pJv1qe0KLqckLIjEN4iREH1zU%2FldO5TBRicvB%2BxjeAxpPFZnjNZmyFl%2FNHbavuuvRc%2FMNR0DbjnriB2Mub" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 204, "FileHash-SHA1": 88, "FileHash-SHA256": 1993, "IPv4": 19, "domain": 34, "hostname": 60, "URL": 203, "URI": 1 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "10 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0e9368acb77419bf65660d", "name": "MAV-en * VirusTotal report for setup-maven-master.zip", "description": "[The full text of the statement on the subject of human rights, as compiled by BBC Radio 4's Panorama, will be published on Wednesday, 27 March.. and will appear on BBC iPlayer]usernotificationsd, \"freeze_skip_reason:\" : \"none\",\n \"pid\" : 851,\n \"cpuTime\" : 0.52999799999999997,\n \"name\" : \"HeuristicInterpreter\",\n country_code\":\"US\",\"agent\":\"parsecd\\/1 (iPhone17,4; iPhone OS 26.3.1 23D8133) parsecd\\/", "modified": "2026-05-21T05:13:16.005000", "created": "2026-05-21T05:08:56.934000", "tags": [ "file type", "ascii", "ascii text", "java source", "json", "unicode text", "utf8 text", "c source", "sgml document", "creates", "persistence", "malicious", "next", "windows sandbox", "calls clear", "png image", "svg scalable", "vector graphics", "rgba", "crlf line", "ms windows", "title", "installer", "template", "pcx ver", "code helper", "helper", "plugin", "renderer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "mitre attack", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339747&Signature=R%2FOTx2wxfF3MkMsUAEbX76dOSFXtiY%2BBtXR6Kl7PxVGTXaylNjmhXaxofJAQ0RP2z7ICeXit4nmXky1HIQZnPX74ZyD16ICTt3%2BAXA6yZSU%2Fw%2Fks9M2Ju1xi3m8IMloiUH7Z9Le5L5Mlfrw5QO4ZO%2FgDHG3ATHUk0qk%2BFUT2gsjT8jS6aztZHjZo4xVQLlmmwWY2%2F8%2FKZejJlFptwLfMZEA%2BDW1ZbssKpkNsXZGu69SkdNPO9c", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339770&Signature=tPgwja3MWoODqbVlxhsock2mBa1WfALhB00A%2FSu4klEizmiV6VxM5y6vH%2FGm%2FFf67mLtz5mR6Mt17RKGQUPK11iYmQax86WhcCuxTpR0mDpo12tG4HAI5ht8qM4xgOQcjspEhBgsXPDvw2Np7e9trD0l8MytxvCqOuA7DVNdiUL2xvLNXAG1yCptFpvqyZo7kokLxp4RwsvDJuOrH8%2FGrNAOjdaHFQ8FWGhgkhyO6Q767Szi", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339792&Signature=O6r4LzVdjNFj7wZVT%2B0a4%2BGemB4yEqip9waMS7NlonESXy80tfqV33UBqEEp8i%2B2qOg6S%2Ba4cSwzi3nXOtjSaUaFAI43DmvSsxq5Y5WsA8cMb4Ul6FhGON6Cr0JT1xoEMtACmSdxG8Vo%2Be4PVcu93v6CBeWMZnFb8exU8ku4GUDY8ZEFW%2FJqeu266wn59KD9gFKRwlqx3NuRzMLdwqMA7f9o6QLPcM8WWnB%2BkvJVFk3BnxJAfBn7T2JO", "https://vtbehaviour.commondatastorage.googleapis.com/f839e941d0d2b6d9c5d6fd9b8b9ea9d34629182973bb9cc8af28e1e3ccdbbdd4_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339838&Signature=GgSFM3a3czj9g63hY67%2B%2FAyC%2FcGgMmTIqhErAonJ7vV9C8snHKwK0GtHZ6drm%2Fd%2BKaMonYJwSmh1LrRzYF9toBJc5rBwpR%2BPlsrS9EArViMI%2Bd%2Fb8ZZBHgqFsmCiiSWfzz4kIQRPM0RB4osCHqQxKmGW2i1uyWrytYjA4V%2FZREm1%2Bm2EEWx38PebvBFrM9pMznjF6rghFHp8ls6tzuolbXD4WUfR0OSoXjcAaAgihobJ%2FmOd", "https://vtbehaviour.commondatastorage.googleapis.com/e2f820daf9f578d5f3219ae8b3c6391017badf913a68c4aaac4e52c5155c566f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339867&Signature=l%2F%2BDGW7ZLqIfVvi1NOyg4%2FCgXPJBdSweWglJKW7iMb5GfnK0pX4yYYVL3OKkqrzAbMUcR2fqLUXHJfnMwSKBhQxjGR8LGF1nh7TeXxVGIQVh8kAyEZBCuXNHsZfzxR0zVbZfKAIEvC9D8S2%2FwBmpI6xztHiC7vmaJ5OhJD%2BoPDojRqXH2bmBpCz1XTZd7JphPNXRIbefZL4mR%2FrRe7o8WO2JHylOy9rIodNKKPEv5W9Q54%2BaA%2FG926", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339948&Signature=JA8BamPMfn7P8xM9CTv8ndNuaNtng0n%2Btofwj05768pJwsCB6Mgd6GU18%2BpNjCvwwZg%2F%2Bw0a2xOYIsvuqdDQAFzoO3jl3EUYKu7dPoOelD2NPrIcyCAHc8qKhqpPdjZKpo%2B8AJCxvO13OXHoSh94%2B%2Bht9h6mIJs8y7YO2CUo%2FqlV8M0fa5Px90aErgl%2BarD7%2ByQWlt0QD2caFKl%2BHViTViTx", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779340034&Signature=tbq82yoC%2BAKXaH%2F2XjmRWiAbt911K91ltP8zHTYrstzi0i1UKrzJxM48ky9ypV%2B%2FvrYdgBnaOfI9MzgZH0C%2FOFJUaVJ3WB87ULkjglD%2F6GeEDDcPtDX%2BY6aw2%2Bb8WaJU2xLc%2F9JbwoTbPP0n83pJv1qe0KLqckLIjEN4iREH1zU%2FldO5TBRicvB%2BxjeAxpPFZnjNZmyFl%2FNHbavuuvRc%2FMNR0DbjnriB2Mub" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 204, "FileHash-SHA1": 88, "FileHash-SHA256": 1993, "IPv4": 19, "domain": 34, "hostname": 60, "URL": 203, "URI": 1 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "10 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0e936b647274be6ed25227", "name": "MAV-en * VirusTotal report for setup-maven-master.zip", "description": "[The full text of the statement on the subject of human rights, as compiled by BBC Radio 4's Panorama, will be published on Wednesday, 27 March.. and will appear on BBC iPlayer]usernotificationsd, \"freeze_skip_reason:\" : \"none\",\n \"pid\" : 851,\n \"cpuTime\" : 0.52999799999999997,\n \"name\" : \"HeuristicInterpreter\",\n country_code\":\"US\",\"agent\":\"parsecd\\/1 (iPhone17,4; iPhone OS 26.3.1 23D8133) parsecd\\/", "modified": "2026-05-21T05:13:13.100000", "created": "2026-05-21T05:08:59.081000", "tags": [ "file type", "ascii", "ascii text", "java source", "json", "unicode text", "utf8 text", "c source", "sgml document", "creates", "persistence", "malicious", "next", "windows sandbox", "calls clear", "png image", "svg scalable", "vector graphics", "rgba", "crlf line", "ms windows", "title", "installer", "template", "pcx ver", "code helper", "helper", "plugin", "renderer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "mitre attack", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339747&Signature=R%2FOTx2wxfF3MkMsUAEbX76dOSFXtiY%2BBtXR6Kl7PxVGTXaylNjmhXaxofJAQ0RP2z7ICeXit4nmXky1HIQZnPX74ZyD16ICTt3%2BAXA6yZSU%2Fw%2Fks9M2Ju1xi3m8IMloiUH7Z9Le5L5Mlfrw5QO4ZO%2FgDHG3ATHUk0qk%2BFUT2gsjT8jS6aztZHjZo4xVQLlmmwWY2%2F8%2FKZejJlFptwLfMZEA%2BDW1ZbssKpkNsXZGu69SkdNPO9c", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339770&Signature=tPgwja3MWoODqbVlxhsock2mBa1WfALhB00A%2FSu4klEizmiV6VxM5y6vH%2FGm%2FFf67mLtz5mR6Mt17RKGQUPK11iYmQax86WhcCuxTpR0mDpo12tG4HAI5ht8qM4xgOQcjspEhBgsXPDvw2Np7e9trD0l8MytxvCqOuA7DVNdiUL2xvLNXAG1yCptFpvqyZo7kokLxp4RwsvDJuOrH8%2FGrNAOjdaHFQ8FWGhgkhyO6Q767Szi", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339792&Signature=O6r4LzVdjNFj7wZVT%2B0a4%2BGemB4yEqip9waMS7NlonESXy80tfqV33UBqEEp8i%2B2qOg6S%2Ba4cSwzi3nXOtjSaUaFAI43DmvSsxq5Y5WsA8cMb4Ul6FhGON6Cr0JT1xoEMtACmSdxG8Vo%2Be4PVcu93v6CBeWMZnFb8exU8ku4GUDY8ZEFW%2FJqeu266wn59KD9gFKRwlqx3NuRzMLdwqMA7f9o6QLPcM8WWnB%2BkvJVFk3BnxJAfBn7T2JO", "https://vtbehaviour.commondatastorage.googleapis.com/f839e941d0d2b6d9c5d6fd9b8b9ea9d34629182973bb9cc8af28e1e3ccdbbdd4_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339838&Signature=GgSFM3a3czj9g63hY67%2B%2FAyC%2FcGgMmTIqhErAonJ7vV9C8snHKwK0GtHZ6drm%2Fd%2BKaMonYJwSmh1LrRzYF9toBJc5rBwpR%2BPlsrS9EArViMI%2Bd%2Fb8ZZBHgqFsmCiiSWfzz4kIQRPM0RB4osCHqQxKmGW2i1uyWrytYjA4V%2FZREm1%2Bm2EEWx38PebvBFrM9pMznjF6rghFHp8ls6tzuolbXD4WUfR0OSoXjcAaAgihobJ%2FmOd", "https://vtbehaviour.commondatastorage.googleapis.com/e2f820daf9f578d5f3219ae8b3c6391017badf913a68c4aaac4e52c5155c566f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339867&Signature=l%2F%2BDGW7ZLqIfVvi1NOyg4%2FCgXPJBdSweWglJKW7iMb5GfnK0pX4yYYVL3OKkqrzAbMUcR2fqLUXHJfnMwSKBhQxjGR8LGF1nh7TeXxVGIQVh8kAyEZBCuXNHsZfzxR0zVbZfKAIEvC9D8S2%2FwBmpI6xztHiC7vmaJ5OhJD%2BoPDojRqXH2bmBpCz1XTZd7JphPNXRIbefZL4mR%2FrRe7o8WO2JHylOy9rIodNKKPEv5W9Q54%2BaA%2FG926", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339948&Signature=JA8BamPMfn7P8xM9CTv8ndNuaNtng0n%2Btofwj05768pJwsCB6Mgd6GU18%2BpNjCvwwZg%2F%2Bw0a2xOYIsvuqdDQAFzoO3jl3EUYKu7dPoOelD2NPrIcyCAHc8qKhqpPdjZKpo%2B8AJCxvO13OXHoSh94%2B%2Bht9h6mIJs8y7YO2CUo%2FqlV8M0fa5Px90aErgl%2BarD7%2ByQWlt0QD2caFKl%2BHViTViTx", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779340034&Signature=tbq82yoC%2BAKXaH%2F2XjmRWiAbt911K91ltP8zHTYrstzi0i1UKrzJxM48ky9ypV%2B%2FvrYdgBnaOfI9MzgZH0C%2FOFJUaVJ3WB87ULkjglD%2F6GeEDDcPtDX%2BY6aw2%2Bb8WaJU2xLc%2F9JbwoTbPP0n83pJv1qe0KLqckLIjEN4iREH1zU%2FldO5TBRicvB%2BxjeAxpPFZnjNZmyFl%2FNHbavuuvRc%2FMNR0DbjnriB2Mub" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 204, "FileHash-SHA1": 88, "FileHash-SHA256": 1993, "IPv4": 19, "domain": 34, "hostname": 60, "URL": 203, "URI": 1 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "10 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0e936cb4a9e6db51876ae2", "name": "MAV-en * VirusTotal report for setup-maven-master.zip", "description": "[The full text of the statement on the subject of human rights, as compiled by BBC Radio 4's Panorama, will be published on Wednesday, 27 March.. and will appear on BBC iPlayer]usernotificationsd, \"freeze_skip_reason:\" : \"none\",\n \"pid\" : 851,\n \"cpuTime\" : 0.52999799999999997,\n \"name\" : \"HeuristicInterpreter\",\n country_code\":\"US\",\"agent\":\"parsecd\\/1 (iPhone17,4; iPhone OS 26.3.1 23D8133) parsecd\\/", "modified": "2026-05-21T05:13:12.402000", "created": "2026-05-21T05:09:00.401000", "tags": [ "file type", "ascii", "ascii text", "java source", "json", "unicode text", "utf8 text", "c source", "sgml document", "creates", "persistence", "malicious", "next", "windows sandbox", "calls clear", "png image", "svg scalable", "vector graphics", "rgba", "crlf line", "ms windows", "title", "installer", "template", "pcx ver", "code helper", "helper", "plugin", "renderer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "mitre attack", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339747&Signature=R%2FOTx2wxfF3MkMsUAEbX76dOSFXtiY%2BBtXR6Kl7PxVGTXaylNjmhXaxofJAQ0RP2z7ICeXit4nmXky1HIQZnPX74ZyD16ICTt3%2BAXA6yZSU%2Fw%2Fks9M2Ju1xi3m8IMloiUH7Z9Le5L5Mlfrw5QO4ZO%2FgDHG3ATHUk0qk%2BFUT2gsjT8jS6aztZHjZo4xVQLlmmwWY2%2F8%2FKZejJlFptwLfMZEA%2BDW1ZbssKpkNsXZGu69SkdNPO9c", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339770&Signature=tPgwja3MWoODqbVlxhsock2mBa1WfALhB00A%2FSu4klEizmiV6VxM5y6vH%2FGm%2FFf67mLtz5mR6Mt17RKGQUPK11iYmQax86WhcCuxTpR0mDpo12tG4HAI5ht8qM4xgOQcjspEhBgsXPDvw2Np7e9trD0l8MytxvCqOuA7DVNdiUL2xvLNXAG1yCptFpvqyZo7kokLxp4RwsvDJuOrH8%2FGrNAOjdaHFQ8FWGhgkhyO6Q767Szi", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339792&Signature=O6r4LzVdjNFj7wZVT%2B0a4%2BGemB4yEqip9waMS7NlonESXy80tfqV33UBqEEp8i%2B2qOg6S%2Ba4cSwzi3nXOtjSaUaFAI43DmvSsxq5Y5WsA8cMb4Ul6FhGON6Cr0JT1xoEMtACmSdxG8Vo%2Be4PVcu93v6CBeWMZnFb8exU8ku4GUDY8ZEFW%2FJqeu266wn59KD9gFKRwlqx3NuRzMLdwqMA7f9o6QLPcM8WWnB%2BkvJVFk3BnxJAfBn7T2JO", "https://vtbehaviour.commondatastorage.googleapis.com/f839e941d0d2b6d9c5d6fd9b8b9ea9d34629182973bb9cc8af28e1e3ccdbbdd4_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339838&Signature=GgSFM3a3czj9g63hY67%2B%2FAyC%2FcGgMmTIqhErAonJ7vV9C8snHKwK0GtHZ6drm%2Fd%2BKaMonYJwSmh1LrRzYF9toBJc5rBwpR%2BPlsrS9EArViMI%2Bd%2Fb8ZZBHgqFsmCiiSWfzz4kIQRPM0RB4osCHqQxKmGW2i1uyWrytYjA4V%2FZREm1%2Bm2EEWx38PebvBFrM9pMznjF6rghFHp8ls6tzuolbXD4WUfR0OSoXjcAaAgihobJ%2FmOd", "https://vtbehaviour.commondatastorage.googleapis.com/e2f820daf9f578d5f3219ae8b3c6391017badf913a68c4aaac4e52c5155c566f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339867&Signature=l%2F%2BDGW7ZLqIfVvi1NOyg4%2FCgXPJBdSweWglJKW7iMb5GfnK0pX4yYYVL3OKkqrzAbMUcR2fqLUXHJfnMwSKBhQxjGR8LGF1nh7TeXxVGIQVh8kAyEZBCuXNHsZfzxR0zVbZfKAIEvC9D8S2%2FwBmpI6xztHiC7vmaJ5OhJD%2BoPDojRqXH2bmBpCz1XTZd7JphPNXRIbefZL4mR%2FrRe7o8WO2JHylOy9rIodNKKPEv5W9Q54%2BaA%2FG926", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339948&Signature=JA8BamPMfn7P8xM9CTv8ndNuaNtng0n%2Btofwj05768pJwsCB6Mgd6GU18%2BpNjCvwwZg%2F%2Bw0a2xOYIsvuqdDQAFzoO3jl3EUYKu7dPoOelD2NPrIcyCAHc8qKhqpPdjZKpo%2B8AJCxvO13OXHoSh94%2B%2Bht9h6mIJs8y7YO2CUo%2FqlV8M0fa5Px90aErgl%2BarD7%2ByQWlt0QD2caFKl%2BHViTViTx", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779340034&Signature=tbq82yoC%2BAKXaH%2F2XjmRWiAbt911K91ltP8zHTYrstzi0i1UKrzJxM48ky9ypV%2B%2FvrYdgBnaOfI9MzgZH0C%2FOFJUaVJ3WB87ULkjglD%2F6GeEDDcPtDX%2BY6aw2%2Bb8WaJU2xLc%2F9JbwoTbPP0n83pJv1qe0KLqckLIjEN4iREH1zU%2FldO5TBRicvB%2BxjeAxpPFZnjNZmyFl%2FNHbavuuvRc%2FMNR0DbjnriB2Mub" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 204, "FileHash-SHA1": 88, "FileHash-SHA256": 1993, "IPv4": 19, "domain": 34, "hostname": 60, "URL": 203, "URI": 1 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "10 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0bff94564a0098e02ab37d", "name": "Alfresco Archive // b257cc536324cd2566432555666307b43d27ee9cbda5e45707e3e97b61b3dff6 - 05.19.26", "description": "The full list of Edmonton police officers, officers and staff, as part of the city's Police Complaints Commission (PCC), has been released.", "modified": "2026-05-19T06:16:59.932000", "created": "2026-05-19T06:13:40.134000", "tags": [ "UAlberta", "Edmonton", "Edmontonpolice", "EPS", "YEG" ], "references": [ "https://www.virustotal.com/gui/collection/3f5e2fc684dd1957828c6f9c0d1b7d13524218c8402a4a0a91e9135fb662f127", "https://www.virustotal.com/gui/collection/3f5e2fc684dd1957828c6f9c0d1b7d13524218c8402a4a0a91e9135fb662f127/iocs", "https://www.virustotal.com/graph/embed/g3238715200b747f1a237e03037a4d5ff15d85564ee0740439750d8ff75347031?theme=dark", "b257cc536324cd2566432555666307b43d27ee9cbda5e45707e3e97b61b3dff6" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Government", "Education", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "UCP_GoA23", "id": "382539", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 58, "FileHash-SHA1": 57, "FileHash-SHA256": 952, "IPv4": 393, "URL": 200, "domain": 340, "hostname": 367 }, "indicator_count": 2367, "is_author": false, "is_subscribing": null, "subscriber_count": 19, "modified_text": "12 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a09b3b462c09a8bf0daa85b", "name": "Credit: Disable_Duck [\"UAlberta alfresco management\"]", "description": "", "modified": "2026-05-17T12:25:24.282000", "created": "2026-05-17T12:25:24.282000", "tags": [ "note", "home", "lucene paths", "json descriptor", "lucene path", "company home", "actividades", "pageuser", "sie knnen", "sie auf", "link klicken", "recente", "u kunt", "attivit", "possibile", "activits", "vous", "report", "web link", "cvs report", "link", "chs placement", "chs student", "placement", "team", "google form", "university", "alberta", "automation", "please", "following", "followers", "ihnen", "mitarbeitern", "mitarbeiter", "hello", "foreign visitor", "fvca", "human resource", "fvca assessment", "incomplete", "regards", "klik", "wachtwoord", "mijn profiel", "klik op", "hoogachtend", "alfresco", "bonjour", "cliquez sur", "nous", "pour ce", "mon profil", "changer", "invito", "caro", "fare", "password", "il mio", "cambia password", "per rifiutare", "cordiali saluti", "my profile", "change password", "konto", "sie erstellt", "passwort", "wir legen", "ihnen nahe", "passwort bei", "anmeldung zu", "ndern", "gehen sie", "mmm yyyy", "nome utente", "nombre", "contrasea", "para hacerlo", "mi perfil", "atentamente", "account", "alfresco share", "hola", "haga", "los datos", "y seleccione", "si desea", "click", "einladung von", "hallo", "sie eingeladen", "site", "klicken sie", "konto fr", "alfresco client", "kofax index", "inhaltselement", "zur site", "gren alfresco", "pledged gift", "office", "advancement", "datetime", "university vpn", "date", "shared", "support", "auxiliary", "process", "priority", "medium high", "pay action", "sincerely", "uofa ecm", "link um", "aufgaben stehen", "verfgung", "prioritt", "niedrig mittel", "hoch", "klicken", "aufgabe zu", "il seguente", "disponibile", "priorit", "bassa media", "alta", "clicca", "clicca su", "la tche", "tre rcupre", "basse moyenne", "leve", "cliquez", "cordialement", "prioriteit", "laag gemiddeld", "hoog", "la siguiente", "prioridad", "media alta", "saludos", "kb content", "links content", "content url", "download url", "webdav url", "ttulo", "descripcin", "ninguno", "ninguna", "creador", "creado", "modificador", "modificado", "tamao", "webdav", "titre", "aucun", "aucune", "modificateur", "modifi", "taille", "ko liens", "du contenu", "dossier du", "url webdav", "titolo", "nessuno", "nessuna", "creato", "modificato", "dimensioni", "kb link", "al contenuto", "cartella", "ingen", "beskrivelse", "tittel", "opprettet", "modifikator", "modifisert", "strrelse", "lenker for", "innhold mappe", "descrio", "nome", "nenhum", "nenhuma", "criador", "criado", "tamanho", "geen", "beschrijving", "titel", "maker", "gemaakt", "gewijzigd", "grootte", "contenturl", "downloadurl", "beschreibung", "url zum", "keiner", "keine", "ersteller", "erstellt", "bearbeiter", "gendert", "kb links", "download", "navigatebrowse", "pagesite", "readme file", "yesno", "user name", "main", "function", "log debug", "record", "sample rm", "import", "njson", "forms", "sites", "documenttype", "commonfolder", "error", "value", "jsonfile", "service", "false", "moving", "prop", "null", "bearer", "uappol", "uappol function", "contentid", "param", "id var", "call", "post request", "json", "config", "coveo", "uappol metadata", "content id", "and not", "loads", "update", "uploader", "inbox", "rnrn", "create", "contenteml", "inbox folder", "number", "normal", "textpart", "backup", "createchildren", "backupname", "childlist", "name", "content", "array", "write", "childname2", "childname3", "childname4", "reviewgroup", "groupsite", "starting", "started", "delete email", "command", "found", "create content", "resources", "unknown command", "globals", "var title", "rnrncopyright", "copyright", "csvtoarray", "regexp", "jsonstr", "daily", "review", "az09", "format", "hrsfilescanner", "hrs document", "fromscanner", "not type", "matches1", "employee id", "third", "tempfilename", "ldap", "version", "this", "file share", "folder", "trimlr", "namearr", "personid", "document name", "ales file", "scanned", "shared drive", "last", "document type", "document", "advising notes", "debug", "debugstr", "schedule", "descriptorpath", "web service", "inbound rule", "web services", "collaborator", "groupeveryone", "check", "index", "taskassignee", "taskenddate", "filename", "localisotime", "startdatetime", "timeperiod", "uofa edrms", "author", "descommonnode", "nomatch", "iddocumenttype", "siteid", "span", "path", "term", "core", "cap report", "template", "object", "cap mail", "dev testing", "application", "aps status", "cap generate", "monthly report", "extension", "alfresco locale", "september", "pm mdt", "school", "didx", "json response", "cap final", "rebcapiddict", "finalcapiddict", "aps process", "trigger", "chsdocument", "message", "func", "msgstr", "emailobj", "emailtemplate", "emailsubject", "sitepath", "chs docs", "studentfiles", "faculty", "true", "chssiteid", "type", "aspect", "chsdocs", "nodeidx", "find", "expired", "chs school", "defunc", "facultykey", "program", "spasite", "ldapperson", "parent name", "securitytype", "formsengg", "limit", "enggfilescanner", "stuccid", "csv file", "studdept", "supccid", "supdept", "cosupccid", "relocation", "fgsr", "records site", "fgsr doc", "department", "start fgsr", "department doc", "completion of", "oral hlth", "form", "application for", "report of", "admission", "master", "music", "unknown", "comp", "class", "leave", "supervisor", "currentline", "return", "studentid", "superccid", "revdate", "code", "apstaskproperty", "converttocsv", "aps guideline", "aps task", "newdata", "hyperlink", "certificate", "first", "info", "procid", "filecontentstr", "query sort", "create header", "person id", "subject title", "node", "studentccid", "yyyymmdd", "lookupjson", "propidx", "input date", "iso format", "folder level", "query", "duedate", "test java", "dailyschedule", "upload", "ro adm", "workflow", "offset", "adm workflow", "data length", "startindex", "json object", "aps group", "acs site", "user", "getgroupid", "am mst", "acsaps group", "user sync", "january", "start january", "february", "start february", "december", "start december", "march", "start march", "am mdt", "consumer march", "aps student", "april", "start april", "june", "start june", "pm mst", "ro backscan", "edrmsteam", "group", "group december", "aps ro", "copy file", "aps api", "maxfile", "creator", "rand", "hrsbs", "july", "august", "hrsbssyncccids", "zhrroleuserresp", "edrms", "ccids", "prefix", "createdirectory", "directory", "actionreason", "safefilename", "employeeclass", "carry", "csv data", "host", "bachelor", "college level", "mike", "propname", "maxitems", "currjson", "fvca status", "important", "prod", "manual data", "doctoratephd", "medicine", "nodename", "employeeccid", "managerccid", "employeeid", "workingtitle", "regtempdescr", "findkey", "email", "new document", "doctypelabel", "competitive bid", "bid exception", "pcm competitive", "and aspect", "competitive", "nodes", "bid update", "acommonfolder", "formspcm", "peoplesoft", "no data", "qaselectednode", "qaselected", "qanotselected", "qa folder", "preqa", "qa var", "documentcount", "passcount", "qadocument", "qa selected", "moved", "attempts", "accepted", "rm file", "plan", "rm filing", "min to", "rm system", "batch", "time limit", "rmcfg", "string", "already", "load", "valid", "graddate", "uathdep", "ccid", "title", "abstract", "embargo", "datestr", "searchresult", "alfresco afa", "admissions", "student case", "files", "and type", "institution", "inst", "json config", "institution not", "if file", "logger", "needle", "xmlstr", "staus", "document linkn", "getlogfile", "documentlist", "xml field", "not found", "addaspect", "move aspect", "duplicate file", "makes", "to max", "checks", "workflow name", "workflow link", "emplid", "due daten", "total afa", "not path", "afabundling", "change", "not aspect", "logs", "ephesoft", "document moved", "epehsoft", "xmlsourcenode", "batchsize", "filemappingpdf", "entry", "move file", "getcsvfile", "batchprocess", "logging", "completed", "document link", "groupn", "created date", "stdapl", "person", "workflow desc", "json file", "list", "lastmonth", "daily qa", "default", "qastartdate", "query language", "finished", "afa bundle", "transcriptarr", "lucene query", "qacounter", "rrfgroupname", "uaroemplid", "uaropriority", "uaroduedate", "documentlistarr", "uarmm", "profile", "courseauditform", "status", "jile", "searchmatchmove", "logfoldername", "backscanreview", "smfstr", "rosm", "converter", "shortxml", "failedcsvfolder", "xml file", "qaoperatorindex", "qaoperatorlabel", "script", "suresh", "aws promotion", "file", "tasks", "bundlingprop", "tasktype", "grps2", "uarotasktype", "comments", "test", "ro scripts", "xmlnode", "shortdescr", "xmlcont", "firstname", "orgid", "middlename", "lastname", "middle", "final", "script started", "to now", "received date", "first name", "receiveddatestr", "dateofbirthstr", "getdefination", "2005 aug", "dropbox", "foldercreate", "scan doc", "officiality", "search match", "running script", "materialextid", "studentref", "ceeb", "materialcode", "memo", "jsoncontent", "ro document", "paperfileutils", "afaconfig", "ro workflow", "paperfileconfig", "applicationjson", "formsrso", "targetfile", "property name", "pinames today", "addp", "science addp", "addp move", "ro code", "scifilescanner", "desconfnode", "grabnodeprop", "copy", "consumer", "initiators", "hiring", "consigno", "offer letter", "match", "apsmaster", "match2", "reappointment", "expiry date", "today", "finaldate", "task info", "psperson", "complete basic", "hiring info", "employee", "resultdata", "delegategroup", "delegate group", "verify", "bind", "aps appointment", "trevor report", "sfsussl", "drawdown", "refund", "reporttype", "var document", "shareurl", "newgroup", "parentgrp", "group created", "var logfile", "rule folder", "site running", "report on", "get site", "foldername", "create file", "reportlogslogs", "reportlogs", "ist site", "running report", "count", "tran", "var csvfile", "result length", "processid", "process id", "delimiters", "quoted", "standard", "starting name", "morechildren", "pdf var", "length", "newname", "fiscal", "docnamearr", "filenode", "calendar year", "versionhistory", "new doc", "web deployed", "var startdate", "startdate", "maxcount", "prevmonth", "monthcount", "application id", "delete", "get path", "if node", "search length", "arra y", "if csv", "version history", "graduate", "graduate folder", "children", "graduate file", "searchmatchdob", "career", "appl nbr", "jan04 now", "counter", "thesis", "runyear", "spring", "service log", "everything", "this determine", "thesis deposit", "archival", "problem", "filepath", "md import", "arraytocsv", "found document", "start", "food", "yumna", "start kofax", "kofax", "admin", "subject", "sample email", "execute", "koafx", "apasresponseid", "merge", "recruitment", "transcripts", "review request", "admindate", "requesteddate", "approveddate", "approvereject", "getemailbody", "taskid", "sendemail", "request status", "siteconsumer", "sitemanager", "eval", "acshost", "global env", "config file", "apsprod", "params", "alloc", "checkpath", "newpath", "adding entity", "surnamechar", "adding person", "jsonfunction", "text", "syntaxerror", "arraytoxml", "xml related", "change xml", "xmltoarray", "xmlutil", "common folder", "random2digit", "maxlimit", "jsonarchive", "very", "returns", "sitecontext", "arrcounter", "node id", "items", "array length", "therecord", "award sponsor", "rso project", "res0012345", "iso88591", "util function", "project id", "proposal id", "doc name", "newdocname", "prod url", "199899", "property", "typeprop", "barcode", "accepts", "parent", "xmlfilename", "siteconfigjson", "qabatchgrp", "signeddate", "ephdocumenttype", "json document", "qapercentage", "entity", "broker", "add error", "getexecutetime", "qaoperator", "retain title", "idnumber", "assocname", "metaarr", "fund report", "csvcontent", "input folder", "doc00c200004txg", "xmlfile", "node1", "node2", "540am", "240pm", "metadata", "var folder", "filter", "mappedobj", "09azaz", "conditionval", "foldercondition", "file name", "xmlfileobj", "alfresco prop", "setup error", "formatjson", "id property", "move", "getrandomnumber", "result", "newdoctype", "no title", "clioacs update", "clio", "patch", "system overview", "system", "overview", "purpose", "aims", "objectives", "prerequisites", "total", "expected effort", "domain", "urls", "dept param", "department name", "done", "submit form", "saving", "label", "input", "approvers", "information", "user group", "request", "group request", "users", "single family", "edmonton ab", "coverage", "common law", "step workflow", "care", "dental benefits", "direct", "web scripts", "get http", "documentation", "web script", "http method", "http", "apis", "development", "knowledge", "java", "empty argument", "e1234", "im system", "lookupentity", "configfilename", "namespace", "searchterm", "access", "jsonuser", "alfresco search", "page search", "expires", "signer", "reason", "utf8", "stripcharacter", "pull hiring", "getapsdbid", "save", "processsetidset", "saved", "returndata", "boolean", "start building", "varname", "fill", "time click", "initiated all", "submissions", "all submissions", "process landing", "page", "initiators all", "maps initiated", "post doc", "student term", "start form", "middle name", "email address", "retype", "cell", "phone no", "fellow", "secureorigin", "expand", "thank", "here", "please check", "aps list", "pang", "subset", "display", "args", "task", "username", "save form", "data need", "cdkey", "checkdict", "item", "column", "anchor", "multi", "tasks filter", "search", "trigger aps", "process api", "apsprocess", "authentication", "webscript", "getapsperson", "process info", "initsavestatus", "step0statusfail", "signer1", "signer2", "appointment", "taskjson", "groupapiaccess", "checkapiuser", "fgsrpr", "psaudit", "statusname", "unsuccessful1", "apptreappt", "emplobject", "caps aps", "cap epsb", "applicant", "form submitted", "board review", "form applicant", "school district", "start date", "cap application", "home help", "pdfa format", "larger", "upload file", "please click", "uofacap", "applications", "jstr", "processjson", "invalid url", "associate dean", "edmonton public", "october", "elk island", "reutrn false", "mapdoctypeurl", "doctype", "cap document", "doctypes", "doctypemap", "schools", "public schools", "foip", "edmonton area", "epsb", "capid", "server", "aps user", "groupcapadmin", "assignuser", "cap ea", "successfully", "please wait", "successfully ea", "apsservice", "apsserviceprod", "requireddate", "bibliography", "reb approval", "letter", "cprbls", "ahsrespect", "ahscon", "immformdocs", "picvsc", "whmis", "condissi", "hspnet", "conphoto", "conclin", "college", "health", "submission date", "effective date", "expiration date", "chs admin", "student view", "typekey", "placementdocs", "warning", "jobj", "abraniuk", "wendy", "terry harris", "directorhrsbs", "level", "holiday pay", "part time", "payroll", "salariedreg aux", "cheat", "paramname", "getallurlparams", "hrsbs config", "data dictionary", "field", "responsejson", "workflowid", "workflow id", "context", "event", "statusevent", "uaesign", "success", "permission", "progress report", "postdoctoral", "sorry", "deptjson", "fgsr student", "process status", "select", "currentuser", "reports", "student ccid", "populated", "invalid student", "supervisor ccid", "co supervisor", "due date", "freedom", "report process", "fgsr forms", "list fgsr", "report fgsr", "report sorry", "review process", "fgsr supervisor", "thesis programs", "programs", "please enter", "student id", "submit button", "var taskid", "var currentuser", "review sorry", "raheel", "added", "urlorigin", "need", "raheel var", "elmid", "commentkeyarr", "override", "menu", "colour bar", "mdphd", "absence", "completion", "mbameng", "mbamsc", "meng", "jason", "acs property", "available", "subdoctype", "test person", "test effective", "modelnodepath", "sitename", "metadatamap", "sitefile", "google addon", "gtagra", "gta gra", "zhreformengresp", "id otherwise", "university home", "indicate", "monday", "tuesday", "wednesday", "thursday", "friday", "na note", "services", "please contact", "documentname", "time", "docs", "documentlink", "employee ccid", "conflict", "task assigned", "ist coi", "declaration", "jsonobj3", "parse", "stringify", "grouplist", "json post", "taskfilter", "applies", "assigntogroup", "retrieves", "assignee", "queries", "expects", "uri args", "json containing", "applyfilter", "assignment", "avm folder", "avm store", "store id", "fullpath", "store", "storeid", "avm stores", "search term", "blog query", "category", "api call", "returns json", "cached data", "keylabel", "rest", "ldap query", "resultstr", "jsonoutput", "campusid", "jsonobj", "suresh joshee", "raheel bhojani", "desrochers", "first check", "set message", "materialkey", "acommonfolderid", "hasaccess", "siteconfig", "unprocesseddata", "savemetadata", "getcustomscript", "sitetitle", "error occured", "afa admission", "afas", "change log", "date name", "description", "ebeaton script", "tfrith", "afa main", "runasuser", "afas name", "afa paper", "file test", "utility enter", "does", "student", "bad query", "parameters", "add all", "or condition", "batch ids", "case files", "batchid", "afns", "agricultural", "anaesthes", "life", "environmental", "anaesthesiology", "uappol content", "deanaheed", "programyear", "province", "agreementtype", "safety manual", "mtis", "cree", "blackfoot", "nakota sioux", "iroquois", "dene", "treaties", "first nations", "next", "refresh", "site viewer", "facetkey", "sortparameter", "textjavascript", "public site", "viewer access", "acs cron", "job error", "alfrescos", "unauthorized", "enter", "bear tracks", "main department", "choose", "library", "john", "reviewer", "embargodate", "actiondate", "convocation", "graduation", "nodeid", "thesis status", "match result", "match list", "name dob", "view", "searchcriteria", "main function", "method", "chs upload", "stuln", "filetype", "stuid", "chs agreement", "health sciences", "recreation fomd", "dentistry fomd", "fomd", "therapy fomd", "consent for", "disclosure of", "alberta freedom", "protection", "privacy act", "alberta health", "chs form", "intake", "tasks dashlet", "doccd", "val2", "a my", "view error", "view warning", "keyword search", "refresh list" ], "references": [ "old-AlfrescoToolkit.conf", "AlfrescoToolkit.info", "AlfrescoToolkit.conf", "activities-email_es.ftl", "activities-email_ja.ftl", "activities-email_de.ftl", "activities-email_nl.ftl", "activities-email.ftl", "activities-email_it.ftl", "activities-email_fr.ftl", "CAP-notify-monthly-report.ftl", "chs-commentUpdate.ftl", "chs-studentUploadNotification.ftl", "chs-Invalid.ftl", "chs-studentExpireSoon.ftl", "chs-studentExpired.ftl", "following-email.html_it.ftl", "following-email.html_fr.ftl", "following-email.html_ja.ftl", "following-email.html_nl.ftl", "following-email_de.html.ftl", "following-email_fr.html.ftl", "following-email_ja.html.ftl", "following-email_it.html.ftl", "following-email_nl.html.ftl", "following-email.html.ftl", "following-email.html_de.ftl", "fvca-reminder-email.ftl", "fvca-corrections-email.ftl", "invite-email_nl.html.ftl", "invite-email-add-direct.html.ftl", "invite-email-add-direct.html_fr.ftl", "invite-email_fr.html.ftl", "invite-email_it.html.ftl", "invite-email-add-direct.html_es.ftl", "invite-email-add-direct.html_de.ftl", "invite-email_ja.html.ftl", "invite-email-add-direct.html_nl.ftl", "new-user-email.html.ftl", "new-user-email_de.html.ftl", "invite-email-add-direct.html_ja.ftl", "invite-email-moderated.html.ftl", "new-user-email_fr.html.ftl", "new-user-email_it.html.ftl", "new-user-email_ja.html.ftl", "new-user-email_es.html.ftl", "new-user-email_nl.html.ftl", "invite-email-add-direct.html_it.ftl", "new-user-email_nl.html", "invite-email.html_nl.ftl", "invite-email.ftl", "invite-email_es.html.ftl", "invite-email.html.ftl", "invite-email_de.html.ftl", "invite_user_email.ftl", "kofaxFailedEmailTemplate.ftl", "notify_user_email.ftl", "notify_nl.htm", "notify_user_email_es.html.ftl", "notify_user_email_de.html.ftl", "notify_user_email_ooa_failed.ftl", "notify_user_email.html.ftl", "notify_user_email_it.html.ftl", "notify_user_email_e-transcript_failed.ftl", "notify_user_email_ja.html.ftl", "notify_user_email_fr.html.ftl", "notify_user_email_nl.html.ftl", "OOA-notify-email-template.ftl", "ADV-notify-terms-types.ftl", "appt-final-reminder.ftl", "appt-halfway-reminder.ftl", "sfs-wf-email.html.ftl", "sfs-wf-completed-email.html.ftl", "payActionDecision.html.ftl", "departmentAdhocTask.html.ftl", "wf-email.html_de.ftl", "wf-email.html.ftl", "wf-email_it.html.ftl", "wf-email_fr.html.ftl", "wf-email_nl.html.ftl", "wf-email_ja.html.ftl", "wf-email.html_fr.ftl", "wf-email.html_nl.ftl", "wf-email_es.html.ftl", "wf-email.html_ja.ftl", "wf-email.html_it.ftl", "wf-email_de.html.ftl", "wf-email.html_es.ftl", "emailbody_textplain_alfresco.ftl", "emailbody_textplain_alfresco_es.ftl", "emailbody_textplain_alfresco_fr.ftl", "emailbody_textplain_alfresco_it.ftl", "emailbody_textplain_alfresco_ja.ftl", "emailbody_textplain_alfresco_nb.ftl", "emailbody_textplain_alfresco_pt_BR.ftl", "emailbody_textplain_alfresco_nl.ftl", "emailbody_textplain_alfresco_ru.ftl", "emailbody_textplain_alfresco_zh_CN.ftl", "emailbody_textplain_share.ftl", "emailbody_textplain_share_de.ftl", "emailbody_textplain_share_es.ftl", "emailbody_textplain_share_it.ftl", "emailbody_textplain_share_ja.ftl", "emailbody_textplain_share_nb.ftl", "emailbody_textplain_share_nl.ftl", "emailbody_textplain_share_ru.ftl", "emailbody-alfresco-textplain.ftl", "emailbody-share-textplain.ftl", "emailbody_textplain_alfresco_de.ftl", "emailbody_textplain_share_zh_CN.ftl", "emailbody_textplain_share_fr.ftl", "emailbody_textplain_share_pt_BR.ftl", "uofa-pc-model.xml", "uofa-pllc-model.xml", "uofa-science-model.xml", "uofa-rso-model.xml", "uofa-set-model.xml", "uofa-sfs-model.xml", "uofa-slate-model.xml", "uofa-uappol-model.xml", "advext-model.xml", "assocModel.xml", "adv-model.xml", "cbsr-model.xml", "dynamicSecurityMarksModel", "ephesoft-educational.xml", "facopr-model.xml", "fgsr-model.xml", "faculty-model.xml", "psAudit-model.xml", "FVCA.xml", "roDocProcessing-model.xml", "ro-model.xml", "fgsr-thesis-deposit.xml", "security-group-model.xml", "ua-audit-generic-model.xml", "ua-dummy.xml", "calendar-year-model.xml", "ua-error-model.xml", "uafgsrsup-model.xml", "uaqa-model.xml", "transcript-model.xml", "uAlbertaWorkflowGeneral.xml", "uarmm-supplement-scanning.xml", "uarm-rma-filing-model.xml", "ua-search-model.xml", "ro-search-match.xml", "uatraining.xml", "uofa-ales-model.xml", "uofa-arts-model.xml", "uofa-aps-model.xml", "uofa-base-model.xml", "uawfh-model.xml", "uofa-augustana-model.xml", "uofa-business-model.xml", "uarmTempModel.xml", "uofa-cap-model.xml", "uofa-chs-model.xml", "uofa-chs-agreements-model.xml", "uofa-common-model.xml", "uofa-education-model.xml", "tamis-model.xml", "uofa-engg-coop-model.xml", "uofa-engg-model.xml", "uofa-fo-model.xml", "uofa-extension-model.xml", "uofa-esign-model.xml", "uofa-hrsbs-model.xml", "uofa-law-model.xml", "uofa-caps-model.xml", "uofa-hrs-model.xml", "uofa-native-studies-model.xml", "uofa-pllc-model.json", "uofa-rso-model.json", "uofa-pc-model.json", "uofa-native-studies-model.json", "uofa-slate-model.json", "uofa-uappol-model.json", "uofa-science-model.json", "uofa-workflowGeneral.json", "uofa-sfs-model.json", "adv-model.json", "advext-model.json", "assocModel.json", "calendar-year-model.json", "facopr-model.json", "cbsr-model.json", "ephesoft-educational.json", "faculty-model.json", "faculty-model.xml.json", "rma-model.json", "fgsr-model.json", "FVCA.json", "psAudit-model.json", "ro-aug-model.json", "ro-search-match.json", "tamis-model.json", "security-group-model.json", "fgsr-thesis-deposit.json", "transcript-model.json", "ro-model.json", "ua-audit-generic-model.json", "uafgsrsup-model.json", "uaqa-model.json", "uarmm-supplement-scanning.json", "uAlbertaWorkflowGeneral.json", "ua-error-model.json", "uofa-ales-model.json", "ua-search-model.json", "uarmTempModel.json", "uofa-aps-model.json", "uawfh-model.json", "uofa-arts-model.json", "uofa-cap-model.json", "uofa-chs-agreements-model.json", "uofa-augustana-model.json", "uofa-base-model.json", "uofa-chs-model.json", "uofa-engg-coop-model.json", "uofa-common-model.json", "uofa-engg-model.json", "uofa-extension-model.json", "uofa-hrsbs-model.json", "uofa-fo-model.json", "uofa-education-model.json", "uofa-law-model.json", "uofa-hrs-model.json", "uofa-esign-model.json", "uofa-business-model.json", "faculty-of-science-site.json", "FandO-Organizations.json", "FandO-Programs.json", "fgsr-awards.json", "fgsr-category-list.json", "fgsr-exam-list.json", "fgsr-official-list.json", "fgsr-programOfStudy.json", "fgsr-site.json", "fo-emergency-response-manual.json", "graduate-student-records-site.json", "fo-site.json", "fo-utilities.json", "hrs-benefits.json", "hrsbs-action-reasons.json", "graduate-student-records-v2-site.json", "hrsbs-doc-list.json", "hrsbs-file-structure.json", "hrsbs-owner-details.json", "hrsbs-functionalroles.json", "hrsbs-function-module.json", "hrsbs-review-month.json", "hrsbs-security-class.json", "hrsbs-site.json", "hrs-employeeApprovedDeductions.json", "hrs-bulkId.json", "hrsbs-review-cycle.json", "hrs-employmentFinancial.json", "hrs-personalInformation.json", "hrs-pension.json", "hrs-security-list.json", "hrs-leaves.json", "Institutions.json", "ist-site.json", "hrs-site.json", "my-site-site.json", "law-security-list.json", "native-studies-doc-list.json", "fgsr-credential-list.json", "law-doc-list.json", "native-studies-security-list.json", "office-of-advancement-record-types.json", "office-of-advancement-site.json", "pcm-category.json", "pllc-doc-list.json", "ro-academic-pre-pro-programs.json", "pllc-security-list.json", "ro-acad-group.json", "ro-admitType.json", "ro-applicant-type.json", "ro-campusSolutionsTerm.json", "hrsbs-employee-class.json", "pllc-site.json", "ro-indigenous-type.json", "ro-doctypes.json", "pcm-site.json", "ro-official.json", "ro-org-desc.json", "ro-related-record-types.json", "ro-relationship-to-institution.json", "ro-search-match-status.json", "ro-authenticity.json", "ro-slate-folio-material-non-school-scope.json", "ro-slate-institution-material.json", "ro-slate-folio-material-school-scope.json", "ro-method-receipt.json", "ro-slate-institutions.json", "ro-test-id.json", "rso-accounts-receivable-accounts-payable-doc-type.json", "rso-agreements-doc-category.json", "rso-bulk-scan-doc-type.json", "rso-cfi-purchasing-doc-type.json", "rso-cfi-financials-doc-type.json", "rso-financial-reconciliation-doc-type.json", "rso-financial-reporting-doc-type.json", "rso-financials-doc-type.json", "rso-mask.json", "rso-site.json", "rso-sponsor-names.json", "science-doc-list.json", "science-security-list.json", "school-of-business-site.json", "sfs-ussl-report-status.json", "staff-training-site.json", "student-financial-services-doc-list.json", "student-financial-services-site.json", "student-records-bulk-load-testing-site.json", "student-records-training-site.json", "student-records-site.json", "student-transcripts-site.json", "rso-forms-form-type.json", "support-documentation-site.json", "test-site-site.json", "uappol-category-heirarchy.json", "uappol-type.json", "uappol-site.json", "uoda-faculties.json", "academic-department.json", "adv-correspondence-type.json", "uoda-departments.json", "advsearch.json", "ales-security-list.json", "ales-doc-list.json", "arts-doc-list.json", "arts-security-list.json", "augustana-security-list.json", "augustana-site.json", "augustana-legacy-transcript-doc-list.json", "rso-activation-report-doc-type.json", "business-doc-list.json", "business-security-list.json", "bulkload-testing-site.json", "cap-site.json", "caps-school-board-list.json", "cbsrsite-site.json", "cbsrsite-sopTypes.json", "cbsr-study.json", "cbsr-worksheetType.json", "augustana-doc-list.json", "chs-ag-type.json", "chs-agreements-site.json", "chs-campus-list.json", "chs-degProgram-list.json", "chs-emailNotification.json", "chs-document-status.json", "chs-faculty-list.json", "chs-programYear-list.json", "chs-program-list.json", "canada-provinces-list.json", "demo-site-site.json", "education-doc-list.json", "department.json", "education-security-list.json", "chs-stuEmailNotification.json", "college-of-health-sciences-site.json", "chs-provinces-list.json", "engineering-coop-doc-list.json", "engineering-coop-security-list.json", "engineering-co-op-site.json", "engineering-doc-list.json", "extension-doc-list.json", "extension-security-list.json", "facopr-planTypes.json", "facopr-supportinDocField.json", "faculty-of-ales-site.json", "engineering-security-list.json", "faculty-of-education-site.json", "faculty-of-extension-site.json", "faculty-of-native-studies-site.json", "faculty-of-law-site.json", "faculty-of-arts-site.json", "faculty-of-engineering-site.json", "my_docs_inline.ftl", "my_docs.ftl", "my_spaces.ftl", "recent_docs.ftl", "translatable.ftl", "readme.ftl", "show_audit.ftl", "general_example.ftl", "my_summary.ftl", "doc_info.ftl", "localizable.ftl", "recordsCustomModel.xml", "imapConfig.json", "rm_event_config.json", "rmScriptThrowError.js", "report_rmr_transferReport.html.ftl", "report_rmr_destructionReport.html.ftl", "report_rmr_holdReport.html.ftl", "notify-records-due-for-review-email.ftl", "record-rejected-email.ftl", "record-superseded-email.ftl", "onCreate_supersedes.js", "rma_isClosed.js", "PaperFileconfig.json", "MyTasks-config.json", "AFAconfig.json", "roDocumentTypes.json", "uappol-upload-rule.js", "uappolCreateFolderRule.js", "uappolCreateFolder.js", "uappol-api.js", "uappol-functions.js", "command-utils.js", "backup and log.js", "backup.js", "example test script.js", "test return value.js", "start-pooled-review-workflow.js", "command-processor.js", "command-search.js", "alfresco docs.js", "append copyright.js", "createDepartmentJSON.js", "hrsDaily.js", "hrsFolderCreateSchedule.js", "hrsScanned.js", "hrsCreateFolder.js", "hrsFolderCreateRule.js", "hrsFileShareFolder.js", "alesCreateFolderRestricted.js", "alesCreateFolderSchedule.js", "alesBulkShareFolder.js", "alesFileScanned.js", "alesCreateFolder.js", "alesDaily.js", "alesFileShareFolder.js", "alesCreateFolderConfidential.js", "alesCreateAdvisingNotes.js", "alesFolderCreateSchedule.js", "deployWebServiceDescriptor.js", "taskReportCSV-Appointment-prod.js", "artsFileScanned.js", "artsCreateFolderRule.js", "artsCreateFolder.js", "artsCreateFolderRestricted.js", "augCreateFolderRestricted.js", "augCreateFolder.js", "businessCreateFolderRule.js", "businessCreateFolder.js", "businessCreateFolderSchedule.js", "businessBulkShareFolder.js", "businessFileShareFolder.js", "businessCreateFolderRestricted.js", "businessDaily.js", "businessCreateAdvisingNotes.js", "businessFileScanned.js", "CAPSendMonthlyReportEmail.js", "CAPGenerateMonthlyReport.js", "CapFinalReportSubmit.js", "chsCreateFolderRule.js", "chsEmailOnUpdateComment.js", "chsReport.js", "EmailNotifCHSStudent.js", "SetExpiryDate.js", "chsCreateFolder.js", "chsFacultyReport.js", "chsAgreementCreateFolderRule.js", "chsAgreementCreateFolder.js", "scheduleJobTest.js", "every52MinPastHour.js", "every46MinPastHourBetween4PM12PM.js", "every57MinPastHour.js", "every47MinPastHourBetween4PM12PM.js", "everyDay4H30MinAM.js", "everyDay7H45MinAM.js", "every10MinStartingAt5MinPastHour.js", "every38MinPastHourBetween4PM12PM.js", "every20MinStartingAt15MinPastHour.js", "everyDay2H05MinAM.js", "every2MinStartingAt1MinPastHour.js", "everyDay1H05MinAM.js", "everyDay12H30MinAM.js", "everyDay7H30MinPM.js", "every30MinStartingAt19MinPastHour.js", "every30MinStartingAt11MinPastHour.js", "everyDay2H35MinAM.js", "every30MinStartingAt26MinPastHour.js", "every16MinPastHour.js", "everyDay1H45MinAM.js", "everyDay2H45MinAM.js", "every29MinPastHour.js", "every22MinPastHour.js", "everyDay11H30MinPM.js", "educationCreateFolderRule.js", "educationCreateFolder.js", "educationCreateAdvisingNotes.js", "enggCoopCreateFolderRestricted.js", "enggCoopCreateFolderRule.js", "enggCoopBulkUpload.js", "enggCreateFolderRule.js", "enggCreateFolderRestricted.js", "enggCreateFolder.js", "engineeringCreateAdvisingNotes.js", "enggCoopCreateFolder.js", "enggFileScanned.js", "enggCoopFileScanned.js", "extensionFileScanned.js", "extensionCreateFolder.js", "extensionCreateFolderRule.js", "fgsrCreateGuidelineAPSProcessFromCSV.js", "fgsrDocRestructure.js", "fgsrMigrationScript.js", "fgsrDocRelocation.js", "fgsrCreateFolderFromCSV.js", "guideline-reports.js", "fgsrMigrationScript-withTerminationLogic.js", "modfiyOrUpdatePropertyfromCSV.js", "fgsr-case-file-report.js", "fgsrCreateAPSProcessFromFolder.js", "fgsrCreateFolder.js", "fgsrCopyMetadataToFolderLevel.js", "fgsrCreateAPSProcessFromCSV.js", "foCreateFolder.js", "foCreateFolderRule.js", "Script1.js", "Script2.js", "scheduleRunEvery2-10PM.js", "scheduleRunEvery5PMTo10PM.js", "scheduleRunEvery30Minutes.js", "scheduleRunEvery60Minutes.js", "scheduleRunEveryday3PMto11PM.js", "scheduleRunEveryday12AMto6AM.js", "scheduleRunEvery20Minutes.js", "scheduleRunEvery2AM.js", "acsToApsUserUpdate.js", "2024-01-13-log.txt", "2024-01-15-log.txt", "2024-01-20-log.txt", "2024-01-21-log.txt", "2024-01-22-log.txt", "2024-01-23-log.txt", "2024-02-04-log.txt", "2024-02-05-log.txt", "2024-02-06-log.txt", "2024-02-07-log.txt", "2024-02-08-log.txt", "2024-01-14-log.txt", "2024-01-18-log.txt", "2024-01-11-log.txt", "2024-01-16-log.txt", "2024-01-19-log.txt", "2024-01-26-log.txt", "2024-01-28-log.txt", "2024-01-30-log.txt", "2024-01-12-log.txt", "2024-01-29-log.txt", "2024-01-27-log.txt", "2024-01-31-log.txt", "2024-01-24-log.txt", "2024-02-09-log.txt", "2024-02-02-log.txt", "2024-01-09-log.txt", "2024-02-03-log.txt", "2024-01-05-log.txt", "2024-01-06-log.txt", "2024-01-04-log.txt", "2024-02-01-log.txt", "2024-01-07-log.txt", "2024-01-08-log.txt", "2024-02-10-log.txt", "2024-02-11-log.txt", "2024-02-12-log.txt", "2024-02-13-log.txt", "2023-12-31-log.txt", "2024-02-15-log.txt", "2024-02-16-log.txt", "2024-02-14-log.txt", "2024-02-18-log.txt", "2024-02-20-log.txt", "2024-01-17-log.txt", "2024-02-19-log.txt", "2024-01-10-log.txt", "2024-02-23-log.txt", "2024-02-25-log.txt", "2024-02-21-log.txt", "2024-01-25-log.txt", "2024-02-28-log.txt", "2024-02-22-log.txt", "2024-02-29-log.txt", "2024-03-02-log.txt", "2024-03-03-log.txt", "2024-02-26-log.txt", "2024-03-04-log.txt", "2024-03-06-log.txt", "2024-03-07-log.txt", "2024-03-05-log.txt", "2024-03-08-log.txt", "2024-03-09-log.txt", "2024-03-11-log.txt", "2024-03-10-log.txt", "2024-03-12-log.txt", "2024-03-13-log.txt", "2024-03-14-log.txt", "2024-03-15-log.txt", "2024-03-16-log.txt", "2024-03-17-log.txt", "2024-03-18-log.txt", "2024-03-20-log.txt", "2024-03-21-log.txt", "2024-03-22-log.txt", "2024-03-19-log.txt", "2024-03-23-log.txt", "2024-03-01-log.txt", "2024-03-26-log.txt", "2024-03-25-log.txt", "2024-03-28-log.txt", "2024-03-29-log.txt", "2024-03-27-log.txt", "2024-03-24-log.txt", "2024-03-30-log.txt", "2024-04-02-log.txt", "2024-04-03-log.txt", "2024-03-31-log.txt", "2024-04-05-log.txt", "2024-04-06-log.txt", "2024-04-07-log.txt", "2024-04-08-log.txt", "2024-04-09-log.txt", "2024-04-04-log.txt", "2024-04-11-log.txt", "2024-04-12-log.txt", "2024-04-13-log.txt", "2024-02-17-log.txt", "2024-04-01-log.txt", "2024-04-16-log.txt", "2024-04-15-log.txt", "2024-04-10-log.txt", "2024-04-17-log.txt", "2024-02-24-log.txt", "2024-04-14-log.txt", "2024-04-19-log.txt", "2024-04-21-log.txt", "2024-04-22-log.txt", "2024-04-23-log.txt", "2024-04-24-log.txt", "2024-04-26-log.txt", "2024-04-25-log.txt", "2024-04-29-log.txt", "2024-04-30-log.txt", "2024-05-01-log.txt", "2024-05-02-log.txt", "2024-05-03-log.txt", "2024-05-04-log.txt", "2024-05-05-log.txt", "2024-05-06-log.txt", "2024-04-28-log.txt", "2024-05-07-log.txt", "2024-04-18-log.txt", "2024-05-08-log.txt", "2024-05-09-log.txt", "2024-05-10-log.txt", "2024-05-12-log.txt", "2024-05-14-log.txt", "2024-05-11-log.txt", "2024-05-16-log.txt", "2024-04-27-log.txt", "2024-05-17-log.txt", "2024-05-15-log.txt", "2024-05-18-log.txt", "2024-05-20-log.txt", "2024-05-21-log.txt", "2024-05-19-log.txt", "2024-05-22-log.txt", "2024-05-23-log.txt", "2024-05-25-log.txt", "2024-05-24-log.txt", "2024-05-26-log.txt", "2024-05-27-log.txt", "2024-05-28-log.txt", "2024-05-29-log.txt", "2024-05-30-log.txt", "2024-06-02-log.txt", "2024-05-13-log.txt", "2024-06-01-log.txt", "2024-05-31-log.txt", "2024-04-20-log.txt", "2024-06-03-log.txt", "2024-06-04-log.txt", "2024-06-05-log.txt", "2023-12-30-log.txt", "2023-12-01-log.txt", "2024-02-27-log.txt", "2023-12-29-log.txt", "gtaGraProcessToCSV.js", "gtaGraProcessToCSV-2AM.js", "hrs-benefit-report.js", "westCanDocumentMove.js", "hrsbsReviewCycleReport.js", "hrsbsCreateFolderRule.js", "HRSBS-SyncCCIDs.js", "hrsbsCreateFolder.js", "FVCA-data-import.js", "FVCA-manual-property-update.js", "istPerformanceReviewCreateFolder.js", "lawCreateFolderRestricted.js", "lawFileScanned.js", "lawCreateFolder.js", "lawCreateFolderRule.js", "nativeStudiesCreateFolderRestricted.js", "nsFolderCreateSchedule.js", "nativeStudiesCreateFolder.js", "nativeStudiesCreateFolderRule.js", "ADV-notify-type-mapping.json", "OOA-notify-email.js", "ADV-notify-terms-types.js", "pcm-grab-competitive-noderefs.js", "pcm-update-competitive-noderefs.js", "pcmCreateFolder.js", "psUpdateAlfrescoDepartment.js", "pllcCreateFolder.js", "qaProcess.js", "qaRelease.js", "rmOOABackgroundInformationFiling.js", "rmFilingDoc.js", "rmSearchmatchNomatchFiling.js", "rmFilingConfig.json", "thesisDestructionReport.js", "rmThesis.js", "add_document_type_ro.js", "updateSearchMatchStatus.js", "searchmatchFullDob.js", "createROReconciliationReports.js", "eTranscriptInstList.js", "folder-create-ro.js", "augTranscript.js", "addTimeStamp.js", "missingDocumentList-csv.js", "roAddAspectAndMoveAFA.js", "myTaskDownload.js", "roAddAspectAndMoveTranscript.js", "roAddBundlingAspect.js", "roAddSearchMatchAspect.js", "roCopyEphesoftMetadataXML.js", "roBatchScript.js", "addSearchMatchDocumentType.js", "roCreateEducationalCSV.js", "roCopyOlderScannedDocument.js", "roDocumentListAPLSTD.js", "roCopyOlderScannedDocumentAdHoc.js", "roEtranscriptReport.js", "roDailyQA.js", "roEtranscriptsBundleTest.js", "roFolderCreateLDAPLookup_no_notificatiion.js", "roFolderCreateLDAPLookup.js", "roEtranscriptsBundle.js", "roAddComment.js", "roCopyEphesoftMetadataScanned.js", "roMoveCompleted.js", "roMoveCompletedBackScan.js", "roMoveCompletedSearchMatch.js", "roEtranscriptPDFConverter.js", "roScanningMetadata.js", "roScript1.js", "RORoutingWorkflowUtil.js", "roScript3.js", "roScript2.js", "roScanningMetadataBackScan.js", "roScript7.js", "roScript6.js", "roScript9.js", "roScript1BackScan.js", "roSearchMatchNoMatchReport.js", "roSearchMatchQuery.js", "RONotification.js", "roSlateDocumentExport.js", "roTagAndFileRenderedPDFs.js", "roScript4.js", "roScript5.js", "roScript8.js", "createSlateFolioMaterialDropdown.js", "createSlateApplicationsCSV.js", "LaunchWorkflowUtils.js", "PaperFileUtils.js", "GenerateSponsornamesAndPinames.js", "rsoCreateFolder.js", "sciCreateFolderConfidential.js", "sciCreateFolderPublic.js", "sciCreateFolder.js", "sciCreateFolderRestricted.js", "scienceASDocumentImport.js", "sciFileADDPFileTypes.js", "sciFileShareFolder.js", "sciFileScanned.js", "sciBulkShareFolder.js", "copy-signed-offer-letter.js", "dept-config.js", "reappointment-generate-schedule.js", "reappointment-reminder-schedule.js", "reappointment-generate-process.js", "manual-generate-script.js", "reappointment-reminder-process.js", "reminder-email-util.js", "reappointment-tracking-schedule.js", "reappointment-tracking-process.js", "appointment-report.js", "appointment-report-schedule.js", "manual-tracking-script.js", "sfsCreateFolder.js", "sfsWorkflowStatus.js", "security-group-user.js", "createReportPermissionsFoldersInASite.js", "siteMembersReport.js", "createReportRecursiveGroupsAndUsersInASite.js", "search-responses.js", "advChangeDocumentType.js", "addFolderMetadata.js", "advChangeDocumentType_confidential.js", "consignOInitiatorOfferLetterChange.js", "advChangeDocumentType_background.js", "transcriptResponse.js", "change-fgsr-pdf-file-name-with-date.js", "copy-fgsr-to-graduate-students-records.js", "ADVDonationCalendarToFiscal.js", "document-query.js", "deletingCompletingWorkflow.js", "eTranscriptTemp.js", "eTranscript-bundled-02-jan.js", "eTranscriptVersionModifierFix.js", "fixCheckout.js", "removeDonationGrp.js", "eTranscriptVersioningFix.js", "move-fgsr-folder.js", "search-match-dob-add.js", "thesisDepositArchival.js", "moveThesesForTransfer.js", "eraReportGeneration.js", "kofaxMetadataMerge.js", "kofaxMetadataMergeMissing.js", "generic2min.js", "kofaxSendEmail.js", "PeopleSoft-eTranscript-XML-PDF.js", "startBenefitWorkflow.js", "peoplesoftMetadataMergeMissing.js", "securityWorkflowUtil.js", "startPayActionWorkflow.js", "startDepartmentAdhocApprovalWorkflow.js", "convertTranscript.js", "CreateTranscriptUserMemberships.js", "startTwoStepWorkflow.js", "fix_employee_names.js", "env.js", "folderCreateUtil.js", "folderCreateUtilAA.js", "generalSchedule.js", "JSON.js", "xmlUtil.js", "addPersonAspect.js", "addTimeStampRandomFileName.js", "archiveDocument.js", "luceneUtil.js", "util.js", "archivedItems.js", "getProjectDetails.js", "ADVChangeAuthor.js", "ADVcalendarToFiscal.js", "symplexUtils.js", "advBatchProcessing.js", "advChangeDocumentName.js", "ADVEphesoftMove.js", "advCreateFolderScheduled.js", "advErrorMessageReset.js", "advMetadataUpdate.js", "advMoveToFoldersScheduled.js", "ADVendFundReportFiling.js", "advReconcilliation.js", "ADVmoveRecordsToPreQA.js", "advScanningMetadata.js", "advScript2.js", "advScript3.js", "advScript4.js", "advScript1.js", "advScript5.js", "advScriptDaily.js", "advScriptMonthly.js", "advScriptKofax.js", "ADVSiteContext.js", "advMoveToFolder.js", "deleteEphesoftDoc.js", "advUtils.js", "folderCreateADV.js", "advScriptDaily30minFreq.js", "jsonUtils.js", "advScanning.js", "folderCreateDocumentADV.js", "moveToFolders.js", "symplexMetadataUpdate.js", "OOA_SOT_Name_change.js", "moveToFoldersRetainTitle.js", "advScriptWeekly.js", "symplexMoveToFolder.js", "clioToAcsDocUpdate.js", "ClioUpdateScheduledJob.js", "smartFoldersExample.json", "system-overview.html", "businessDocSetup.json", "uappolDocSetup.json", "businessConfig.json", "augConfig.json", "augDocSetup.json", "lawConfig.json", "uappolConfig.json", "UAlbertaSettings.json", "hrsbsDocSetup.json", "advConfig.json", "hrsbsConfig.json", "hrsConfig.json", "hrsDocSetup.json", "advSimplexMapping.json", "advDocSetup.json", "artsDocSetup.json", "alesConfig.json", "alesDocSetup.json", "archiveFolder.json", "artsConfig.json", "advScanningMapping.json", "collegeOfHealthSciencesConfig.json", "chsAgreementsConfig.json", "dropboxCommonAspects.json", "collegeOfHealthSciencesDocSetup.json", "chsAgreementsDocSetup.json", "educationConfig.json", "extensionConfig.json", "fgsrv2DocSetup.json", "foConfig.json", "foDocSetup.json", "educationDocSetup.json", "lawDocSetup.json", "nativeStudiesDocSetup.json", "pllcConfig.json", "pllcDocSetup.json", "roConfig.json", "fgsrv2Config.json", "rsoConfig.json", "rsoDocSetup.json", "sciConfig.json", "eTranscriptConfig.json", "sciDocSetup.json", "roDocSetup.json", "sfsDocSetup.json", "UAlbertaSettings.conf", "student-recordsConfig.json", "securityWorkflowSetting.json", "thesisDepositConfig.json", "globalHeader.html.ftl", "webFormDialog.html.ftl", "alfrescoUserGroupRequest.ftl", "pensionBenefit.html.ftl", "pinames.json", "sponsornames.json", "searchPageConfig.json", "pcmDocSetup.json", "pcmConfig.json", "qaConfig.json", "apsAppConfig.json", "fgsrCreateApsFromCSV.json", "fgsrCopyMetadata.json", "enggCoopDocSetup.json", "enggDocSetup.json", "enggConfig.json", "enggCoopConfig.json", "CapApsConfig.json", "extensionDocSetup.json", "readme.html", "readme_de.html", "readme_ja.html", "readme_fr.html", "advEndowmentName.get.desc.xml", "advEndowmentName.get.json.ftl", "advEndowmentName.get.js", "advEntityName.get.desc.xml", "advEntityName.get.js", "advEntityName.get.html.ftl", "search.get.desc.xml", "search.get.js", "search.get.html.ftl", "changeInitiatorAppt.put.desc.xml", "eSignatureStatusHistory.get.html.ftl", "changeInitiatorAppt.put.json.ftl", "eSignatureStatusHistory.get.desc.xml", "appointmentSubmit.get.js", "processIdProps.get.desc.xml", "changeInitiatorAppt.put.js", "processIdProps.get.json.ftl", "processIdProps.get.js", "appointmentLandingPage.get.desc.xml", "appointmentLandingPage.get.js", "appointmentLandingPage.get.html.ftl", "appointmentStart.get.desc.xml", "appointmentStart.get.html.ftl", "appointmentStart.get.js", "appointmentStartTest.get.desc.xml", "appointmentStartTest.get.js", "appointmentStartTest.get.html.ftl", "appointmentSubmit.get.desc.xml", "appointmentSubmit.get.html.ftl", "eSignatureStatusHistory.get.js", "apsApplicationList.get.desc.xml", "apsApplicationList.get.html.ftl", "assignuser.put.js", "assignuser.put.json.ftl", "claimtask.put.desc.xml", "claimtask.put.js", "claimtask.put.json.ftl", "completetask.post.desc.xml", "completetask.post.json.ftl", "completetask.post.js", "getapsdbid.get.desc.xml", "getapsdbid.get.json.ftl", "gettasks.get.desc.xml", "gettasks.get.json.ftl", "assignuser.put.desc.xml", "gettasks.get.js", "savetask.post.desc.xml", "savetask.post.js", "savetask.post.json.ftl", "taskForm.get.js", "taskForm.get.desc.xml", "tasklist.get.desc.xml", "apsApplicationList.get.js", "taskForm.get.json.ftl", "tasklist.get.html.ftl.jquery", "tasklist.get.html.ftl", "tasklist.get.js", "triggerapsprocess.post.desc.xml", "triggerapsprocess.post.js", "updatevariables.post.desc.xml.notused", "triggerapsprocess.post.json.ftl", "updatevariables.post.json.ftl.notused", "getapsdbid.get.js", "updatevariables.post.js.notused", "taskUtils.js", "apsGroupsConfig.json", "apsSitesConfig.json", "apptStepZeroStarter.post.desc.xml", "apptStepZeroStarter.post.json.ftl", "apptStepZeroStarter.post.js", "apptStepOneStarter.post.desc.xml", "apptStepOneStarter.post.js", "apptStepOneStarter.post.json.ftl", "apptStepOneSave.post.json.ftl", "apptStepOneSave.post.desc.xml", "apptStepOneSave.post.js", "apptStatusDocUpdate.post.desc.xml", "apptStatusDocUpdate.post.json.ftl", "apptStatusDocUpdate.post.js", "APSWorkflowStatus.get.desc.xml", "APSWorkflowStatus.put.html.ftl", "APSWorkflowStatus.get.html.ftl", "APSWorkflowInfo.put.html.ftl", "APSWorkflowStatus.put.desc.xml", "APSWorkflowInfo.put.desc.xml", "APSWorkflowStatus.get.js", "APSWorkflowStatus.put.js", "APSWorkflowInfo.put.js", "NodeInfo.get.desc.xml", "NodeInfo.get.html.ftl", "capinfo.get.js", "capstart.get.js", "epsb.get.js", "epsb.get.html.ftl", "capstart.get.html.ftl", "epsb.get.desc.xml", "schoolboard.get.html.ftl", "NodeInfo.get.js", "NodeInfoByCapId.get.desc.xml", "updateVariable.post.json.ftl", "updateVariable.post.js", "schoolboard.get.desc.xml", "updateVariable.post.desc.xml", "schoolboard.get.js", "capinfo.get.html.ftl.backup", "cap-file-load.post.json.ftl", "NodeInfoByCapId.get.js", "capinfo.get.html.ftl", "capstart.get.desc.xml", "cap-file-load.post.desc.xml", "capinfo.get.desc.xml", "cap-file-load.post.js", "capeamergedoc.get.js", "capeamergedoc.get.desc.xml", "capeamergedoc.get.html.ftl", "capConfig.js", "chsEnv.js", "chsConfig.js", "chsAdminStuView.get.desc.xml", "chsAdminStuView.get.html.ftl", "chsAdminStuView.get.js", "coupa.get.html.ftl", "coupa.get.desc.xml", "coupa.get.js", "coveoGetDocList.get.desc.xml", "coveoGetDocList.get.json.ftl", "coveoGetDocList.get.js", "getJson.get.desc.xml", "getJson.get.js", "getJson.get.json.ftl", "simpleupload.post.desc.xml", "simpleupload.post.json.ftl", "simpleupload.post.js", "consignoMessage.get.js", "consignoWebhook.post.js", "consignoWebhook.post.json.ftl", "consignoMessage.get.desc.xml", "consignoWebhook.post.desc.xml", "consignoMessage.get.json.ftl", "eSignDownload.get.js", "eSignDownload.get.html.ftl", "eSignDownload.get.desc.xml", "review-supervisorv2.get.desc.xml", "review-supervisorv2.get.js", "review-supervisorv2.get.html.ftl", "fgsrssgLanding.get.js", "review-comm01v2.get.desc.xml", "fgsrssgLanding.get.html.ftl", "review-comm01v2.get.html.ftl", "review-comm02v2.get.desc.xml", "review-comm02v2.get.html.ftl", "fgsrssgLanding.get.desc.xml", "review-studentv2.get.html.ftl", "review-comm03v2.get.html.ftl", "review-comm03v2.get.desc.xml", "review-studentv2.get.desc.xml", "review-cosupervisorv2.get.html.ftl", "review-comm02v2.get.js", "review-startv2.get.desc.xml", "review-studentv2.get.js", "review-cosupervisorv2.get.js", "review-startv2.get.js", "review-student-revisionv2.get.html.ftl", "review-student-revisionv2.get.desc.xml", "review-startv2.get.html.ftl", "review-comm03v2.get.js", "review-cosupervisorv2.get.desc.xml", "review-student-revisionv2.get.js", "review-comm01v2.get.js", "review-comm02.get.desc.xml", "review-comm02.get.html.ftl", "review-comm03.get.desc.xml", "review-comm02.get.js", "review-comm03.get.html.ftl", "review-cosupervisor.get.desc.xml", "review-cosupervisor.get.html.ftl", "review-cosupervisor.get.js", "review-nextdate.get.desc.xml", "review-comm03.get.js", "review-nextdate.get.js", "review-student.get.html.ftl", "review-student.get.js", "review-student-revision.get.desc.xml", "review-student.get.desc.xml", "review-student-revision.get.js", "review-studentTest.get.desc.xml", "review-supervisor.get.desc.xml", "review-studentTest.get.js", "review-supervisor.get.html.ftl", "review-supervisor.get.js", "review-comm01.get.desc.xml", "review-comm01.get.html.ftl", "review-comm01.get.js", "review-student-revision.get.html.ftl", "review-nextdate.get.html.ftl", "review-studentTest.get.html.ftl", "guidelines-supervisor.get.desc.xml", "guidelines-supervisor-revision.get.html.ftl", "guidelines-start.get.desc.xml", "guidelines-start.get.html.ftl", "guidelines-start.get.js", "guidelines-student.get.desc.xml", "guidelines-student.get.html.ftl", "guidelines-student-revision.get.js", "guidelines-student-revision.get.desc.xml", "guidelines-supervisor.get.html.ftl", "guidelines-supervisor-revision.get.desc.xml", "guidelines-student-revision.get.html.ftl", "guidelines-student.get.js", "guidelines-supervisor.get.js", "guidelines-supervisor-revision.get.js", "programExtensionScript.js", "customScript.js", "customCSS_FGSR2.css", "customCSS_FGSR.css", "fgsrEnv.js", "FGSR-Forms-Config.js", "config.js", "googleAddon.get.json.ftl", "googleAddon.get.desc.xml", "googleAddon.get.js", "gtaGraStatus.post.json.ftl", "gtaGraStatus.post.js", "gtaGraStatus.post.desc.xml", "wfh-manager.get.desc.xml", "wfh-form.get.js", "wfh-manager.get.html.ftl", "wfh-form.get.desc.xml", "wfh-revise.get.desc.xml", "wfh-revise.get.html.ftl", "wfh-revise.get.js", "wfh-seniormanager.get.desc.xml", "wfh-manager.get.js", "wfh-seniormanager.get.js", "wfh-seniormanager.get.html.ftl", "wfh-form.get.html.ftl", "hrsbsDocumentLinking.get.desc.xml", "hrsbsDocumentLinking.get.html.ftl", "hrsbsDocumentLinking.get.js", "coi-start.get.desc.xml", "coi-start.get.html.ftl", "coi-revise.get.html.ftl", "coi-employee.get.html.ftl", "coi-employee.get.desc.xml", "coi-revise.get.desc.xml", "coi-start.get.js", "coi-revise.get.js", "coi-supervisor.get.js", "coi-supervisor.get.desc.xml", "coi-employee.get.js", "coi-supervisor.get.html.ftl", "getTaskFilter.get.json.ftl", "queryTasks.get.json.ftl", "routableGroups.get.desc.xml", "routableGroups.get.js", "routableGroups.get.json.ftl", "queryTasks.get.desc.xml", "setTaskFilter.post.js", "setTaskFilter.post.json.ftl", "setTaskFilter.post.desc.xml", "applyTaskAction.post.js", "applyTaskAction.post.json.ftl", "applyTaskAction.post.desc.xml", "getTaskFilter.get.desc.xml", "getTaskFilter.get.js", "queryTasks.get.js", "avmbrowse.get.desc.xml", "avmbrowse.get.html.ftl", "avmbrowse.get.js", "avmstores.get.desc.xml", "avmstores.get.html.ftl", "blogsearch.get.atom.400.ftl", "blogsearch.get.html.400.ftl", "blogsearch.get.desc.xml", "blogsearch.get.js", "categorysearch.get.atom.404.ftl", "blogsearch.get.html.ftl", "categorysearch.get.html.404.ftl", "categorysearch.get.js", "categorysearch.get.html.ftl", "categorysearch.get.desc.xml", "folder.get.desc.xml", "folder.get.html.ftl", "folder.get.js", "psDeptAll.get.js", "psDeptSingle.get.json.ftl", "psDeptSingle.get.js", "psPerson.get.json.ftl", "psUtil.js", "psPerson.get.js", "psAcademicDeptAll.get.desc.xml", "psAcademicDeptAll.get.json.ftl", "psAuthorizedApprover.get.desc.xml", "psDeptAll.get.json.ftl", "psAuthorizedApprover.get.js", "psAuthorizedApprover.get.json.ftl", "psDeptAll.get.desc.xml", "psDeptSingle.get.desc.xml", "psPerson.get.desc.xml", "ceeb.get.desc.xml", "ceeb.get.json.ftl", "getSlateId.get.desc.xml", "getSlateId.get.js", "materials.get.json.ftl", "materials.get.desc.xml", "getSlateId.get.json.ftl", "ceeb.get.js", "materials.get.js", "edit.get.html.ftl", "edit.get.js", "save.post.js", "save.post.json.ftl", "scans.get.desc.xml", "scans.get.js", "uploadfile.post.desc.xml", "uploadfile.post.json.ftl", "edit.get.desc.xml", "uploadfile.post.js", "scans.get.html.ftl", "save.post.desc.xml", "AFA_Main.post.desc.xml", "AFA_MainFileOnly.post.desc.xml", "AFA_MainFileOnly.post.js", "AFA_Main.post.js", "AFA_MainFileOnly.post.json.ftl", "AFA_Main.post.json.ftl", "paperFileUtil.get.desc.xml", "paperFileUtil.get.js", "paperFileUtil.get.html.ftl", "rsoprojectdetails.get.html.ftl", "rsoprojectdetails.get.js", "rsoprojectdetails.get.desc.xml", "roslateapplist.get.html.ftl", "roslateapplist.get.desc.xml", "roslateapplist.get.json.ftl", "roslateexists.get.html.ftl", "roslateexists.get.desc.xml", "roslateapplist.get.js", "roslateexists.get.js", "uofaDepartmentList.get.desc.xml", "uofaDepartmentList.get.js", "uofaDepartmentList.get.html.ftl", "uofaDepartmentName.get.desc.xml", "uofaDepartmentName.get.html.ftl", "uofaFacultyList.get.html.ftl", "uofaFacultyList.get.desc.xml", "uofaDepartmentName.get.js", "uofapersonid.get.desc.xml", "uofapersonidrest.get.html.ftl", "uofapersonidrest.get.desc.xml", "uofapersonid.get.html.ftl", "uofapersonid.get.js", "uofapersonidrest.get.js", "uappolCategoryHeirarchy.get.desc.xml", "uappolCategoryHeirarchy.get.json.ftl", "uappol-metadata-query.get.desc.xml", "uappol-metadata-query.get.js", "uappol-metadata-query.get.json.ftl", "uappolCategoryHeirarchy.get.js", "siteFileViewer.get.desc.xml", "siteFileViewerConfig.js", "siteFileViewer.get.html.ftl", "siteFileViewer.get.js", "publicSiteFileViewer.get.html.ftl", "publicSiteFileViewer.get.desc.xml", "publicSiteFileViewer.get.js", "cronJob.post.desc.xml", "cronJob.post.js", "cronJob.post.json.ftl", "studentupload.get.html.ftl", "generatereport.get.json.ftl", "generatereport.get.desc.xml", "approvethesis.post.js", "generatereport.get.js", "search-match-attach.get.js", "search-match-list.get.html.ftl", "search-match-result.get.html.ftl", "search-match-result.get.js", "search-match-list.get.js.old", "chs-agreements.get.js", "chs-agreements.get.html.ftl", "chs-upload.get.html.ftl", "chs-upload.get.js", "uamytasks.config.get.js", "chsStudentView.get.js", "chsStudentView.get.html.ftl", "foModel.xml", "uofaDocTypes.xml", "uofaDocTypes.json", "foModel.json", "tim-sops", "FandO", "cbsr", "nanofab", "support-documentation", "Alfresco.zip - 1bf054bded99e2ae414154593d0892066b2e0c7add603f9321e157c77ae52075", "https://www.virustotal.com/graph/embed/g05f1796a358b458d95751d31d1d529aa378f8ffadf0b4305b7fa0bd1c64fe228?theme=dark", "https://www.virustotal.com/gui/collection/63819e07111e9665ba8602777d782527c54f3fad71ef36f977405a004484787c/iocs", "https://viz.greynoise.io/analysis/0cd9177e-8328-4355-a2c0-d05704a64c72", "components.zip - 2b91fcf852a5f1f57be71a269d82497b37c9f544ebd8f32aaa240e4cde0ffeea", "https://www.virustotal.com/graph/embed/g2948a5c332eb4614973872a8243215f6aa1fba79749a48ea92806e9b934db91f?theme=dark", "https://viz.greynoise.io/ip/analysis/2610b635-c05a-4f28-a112-7278de8fdf9b" ], "public": 1, "adversary": "TA413 proposed (06.08.24), Callisto, APT38, APT 28/29 - too much time too many problems", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Government", "Healthcare", "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": "6665315e25f9dd42a99e4f2f", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 7132, "hostname": 3118, "URL": 4909, "email": 20, "FileHash-SHA256": 2144, "FileHash-MD5": 29, "FileHash-SHA1": 29 }, "indicator_count": 17381, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "13 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d5f37d3917861c6b99884b", "name": "CAPE Sandbox RIP.exe BLOODBANK.exe", "description": "A Cuckoo executable, for MS Windows, runs at 12:12:57 on the morning of 11 November, 2024, and ends in an unauthorised binary that ends up in a box full of data.- rip.exe tied to a gov domain is a treat.", "modified": "2026-05-16T07:01:32.826000", "created": "2026-04-08T06:19:41.886000", "tags": [ "shell folders", "cname", "ip address", "nothing", "registry keys", "cape sandbox", "file type", "file size", "sha256", "mwdb", "accept", "shutdown", "windows sandbox", "calls process", "nethandle", "net1510000", "fastly", "skyca3", "po box", "city", "san francisco", "stateprov", "postalcode", "orgtechhandle", "orgnochandle", "orgid", "orgabuseref", "orgname", "cidr", "text process", "user", "default", "xport", "use my", "gmt ifnonematch", "microsoft excel", "pe file", "https", "contains", "spawns", "reads", "aslr", "seterrormode", "window", "malicious", "next", "csv text", "ascii text", "process", "queries memory", "network info", "dropped info", "persistence", "javascript", "please", "strong", "toggle", "mitre att", "advapi32", "windows", "dynamicloader", "sspicli", "name", "pid parent", "first", "threads", "path", "pegasus", "crypt32", "virustotal", "enterprise", "service", "close", "performs dns", "urls", "found", "united", "jpeg image", "jfif", "json", "tls version", "mitre attack", "creates", "phishing", "clear filters", "thumbprint", "temp", "full path", "windir", "behavior", "selfdeleting", "bat file", "address", "port", "report", "system process", "downloads", "binary", "hxojc8o", "signatures", "success", "regopenkeyexw", "regopenkeyexa", "hkeycurrentuser", "hkeyclassesroot", "createfilew", "regcreatekeyexw", "regsetvalueexw", "genericread", "readfile", "desktop", "webview", "fail" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/6c375dc240faf5cde2a8eafd44351309edfa18c7e11ea52c2437701584ec2579_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775626394&Signature=mjMxHo8L7UrEZ%2B0mpGMaevi%2Fnyxg566NrZjoVPOa6T3Cbyv9SjUxWf%2BLTZqUG6wgBgPDMrC9WYvpluFNlA3a8CmS9FgO5Wk4ihVivuBtOPhisX8aQoky6AhLHqi%2FTU6pVryey1kfBt6MlRl0gEZ6OJtKADUb2hPUfxXN0b6zIDrBlBpDlzmi73JWdo%2BTl7HWhJzFk%2FDQy3DniCvgLRSPVSK0WPg%2BpvgzruUYB%2F5pkH20cP", "https://vtbehaviour.commondatastorage.googleapis.com/1d5f970b7378625145832550f06d4eb5543258aee214e4d72172e4018c2d88a3_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775626418&Signature=TwvqChaO8lqc0vzwz%2BZ7W7IIwZZZt6%2FhJ4DzgyGjlwl%2Bev3Aj3iyAMtUxNhwGhTz10UGTbYuZcmLUPKLpQ81mgT%2B8axs57DfzVt1BoJTH5lWYK%2BOI8LDJGXD8tZ8DGKuNa6dHqqdQ9gDvuEpnhGfMmpJovXa%2B0drHScs%2BE%2FQKF%2BRTqOXjfSVxMdoqYnlB3zMc6AU2CYPv%2FE1mP06q5yCaRjgA0aIcnf7ADr9", "https://vtbehaviour.commondatastorage.googleapis.com/6c375dc240faf5cde2a8eafd44351309edfa18c7e11ea52c2437701584ec2579_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775626474&Signature=kfjlpWuwZbaZbbP6fMcuay73HaFSKrqF520LJELy0GSL34yjKdsQSvLU8g4sBtj69rWQb6rJwENSsxoLQizFVcBSn04iqFQqS6VlgbQsMMJd57JpVb9gcQPuRc5iP37IN5crnnQjwWgIDQAxcMFVgX8L2SW2Eji5xGKVeIoJ6MJFYKxoyfiZD3779nqt8YvoaK1E4DWe5%2F9TzZWks0%2BaP5dwYHpoPnvYsj4k0X61JFQChNE5cZcNNbUH8i", "https://vtbehaviour.commondatastorage.googleapis.com/1d5f970b7378625145832550f06d4eb5543258aee214e4d72172e4018c2d88a3_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775626915&Signature=A8EIjrcllVER4J%2FPzV2FRPV1NC%2FPha6J1APjMga6WlTRSe%2By092MDDTg4tF9ILYLxQtuQgmgwx93nasQfll6ffrd12FvlAsin2zj4vtdTT4AcIXmxJcKO0d%2FoLnozrBzi1R36TlEknCbXkqQPX%2BdvF%2BwroU1F61f6IOtIfgIK2uxK0KIG5I41N7fQcNOUNIwHoCvfAlSb2OqY1V4ESvWxMJ4MjdBn%2F%2B%2FUAOfpOh%2B7c", "https://vtbehaviour.commondatastorage.googleapis.com/1d4dd113c9924d71398d9db20e2fcf347cad29c3d3bdc9612a44dfd47c1971aa_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775627160&Signature=K5%2FGwGNRKy0XCvva8zcyKHnsarNPNRQXXQI%2FV%2B1Susn9nmU9j%2Fm1SKT0f3LpBrVV5dyaLLy%2FYMPBmGKun3XY4WEmEl0KQkg17reIGCcLSeFbgDwpUm2DyN3ENt5d%2BkePCG6FvM5jUx7Cpf1ZTyw0PYePphEx1shaRArarvvSWz1kosuQhe%2BZ8tBYqt1c35e7%2BjQrwmLeZ489ungWsKJvhuXHetKJVJVEhY%2FLb3%2FBgTDodLwx3l", "https://vtbehaviour.commondatastorage.googleapis.com/0526bc88565de11e5c67b8e01590ba1184e3c6130fc1ced3d1ecacb00c51a7fa_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775627259&Signature=LB8UpSFAWpkptxq2TpSlVUjgaYsD8ZVxTie7HZDfh0FJ9h5o0dlAfn3fQ2KoL66TnUg2S0MIsEXMxl5O%2BL%2FFPweNRNyFyFK8M4aHPEHTZZlcAopz6ofdP7b0rYACYLl%2BH51rdDSCCDGVFB2AxZXaz54b748ZJBd0lCSxvueW2MVVLJcFl5w4hcNIIwnXuHCQD02rsYzffmjBIO6CC1hPulQwohf%2FTZKDK5iuOAhPoVWWswdroV2A7M6M6PUg9g", "https://vtbehaviour.commondatastorage.googleapis.com/1d5f970b7378625145832550f06d4eb5543258aee214e4d72172e4018c2d88a3_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775627300&Signature=ZqM8a%2BUX0F1D8t51nlp1%2BcYFN0ozRLI92p85KFn1f3Aey19YDGw%2BAAEbxD1JMvi%2BsMRGGfYTPACg4h9DM0VFKT8yq4FOOqED%2FO17EAyZrz6YSyQcMMnozviy%2B%2FdpS0Sqd8sas9FdpgcUAS%2FzEEcqa%2FsQVtkpv2rp9BZLKqvbpquNXBlA9rnKzvbtNwEP7meNDc%2FXDspVqf%2Frb9bWY8uHq7hJl6pMWknVtV", "https://vtbehaviour.commondatastorage.googleapis.com/faa6f8935bf337bb6f98bfe73e3b74f6e785da6929775e6bacbbd20d90ecf2c3_SNDBOX.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775627494&Signature=lBb52t94Lck4SSu4FORagQFNGojj5%2Bi7JRPlb68HqacyPusyn33LTlV%2F72P5M52r2EZ8ylUROPiRnCRBg0ry%2B2D1ctl1uWtP%2F1HDdBpnbxxUtkcM97MGzmUbIfTSOAsXsbB3f4Y6ZOIM%2BLYzCo%2BxwRmun4K%2Bo8K3mYHMatcF3mBtKcBPnP7WM5%2FHTz3XqJGMH9TCDIfe7j%2F3SAnx7X0tt0BgUcwPe4OkmHkUutihMBfek2MBp%2B", "https://vtbehaviour.commondatastorage.googleapis.com/0526bc88565de11e5c67b8e01590ba1184e3c6130fc1ced3d1ecacb00c51a7fa_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775627608&Signature=nc6gUdC0NeDtHUOIT6P0pC0i9EKDBHTO%2BMbcwHvgjPzFPqDFGMq%2Fei9aUhg8ub9H4poa985bQO4xz1xEEOmGhEihgwKvDZ5u0QETkzbQJLxzzm5g9t%2Fx4iBeBHToQjDXdMrSu0ML%2FYBep0l%2F%2BkYortodmtnjHYhAEYOOLSZn4gSAWaPoq5vxXF9gtsRojKf9RIk5VuzDXFGY6BGsDKn2tch7nTJ3SmYKodEv4iWyVn4jp5g%2B4", "https://vtbehaviour.commondatastorage.googleapis.com/0c5a10f10eb29b8251a5dfe15fa74f7e25c281b4f9be7c87839a9ae3d34dfe6d_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775627783&Signature=FHIZFXnHZsAaWvZbG2O1vXTFfRz6BqTP8ikzyyXMpZ4VG6WEVnK3yHhhrnLfoLQqUCUgXvWOb1ThHRM6WXJGEx4jLnKM%2Fp6YkHmVEj1nFXBd%2BQ0IPGVwZRJfZcttoBFwmLwJ%2BTXEzUvqX%2FTXDGgeIKFac4IFl%2FGXPEmxi43CSXwZsWuD5CLfaHxEu65DvnuniHqPovnhBOp%2B2rEM2jSLgHuouV%2B9LiZwjgsSXeUVh1BFN5XrPPojB0Lk", "https://vtbehaviour.commondatastorage.googleapis.com/644031a68bde879af85bcc9cb3e6fa1e9a6b0f61d49307581974b5dbc09d3de8_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775628069&Signature=Tqx0WDIqoieH9yCo18tkPUdcYvTU0l0vEGnEzncxScNgePm2%2Bm5dMzcVkPb2dN4j43pL0c6xFpyqUmgcAaV4yJd1bWnukU%2FSoTPxrfzwEEPlXeMoapx9eeELYqF6WZWyor0m%2F4qv%2FuaYFkLWO2D8iOkqIiaNQBvu6nVuNBM3I%2FkrnXhWRxt3C8KQlAF%2Fo3ft05L0QBoJH6mQquOx2C777xrO6tjr31CGKjIMIAih66ud8Oskb57I%2B6zt", "https://vtbehaviour.commondatastorage.googleapis.com/aa2691bc8ec9abf5359396a356551d1e2de12c9c5035c259650650ced6607c6f_VirusTotal%20R2DBox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775628175&Signature=C%2Bm0zPP%2FHfqcIuof%2F2O%2F0UbWPaY37tDrVB%2FZMr2M9H%2BjPTiynLMHNyn5vNT97ndboi7U21mT93t30I4UMIqdICdXtc%2BlGG7rYgE2ruFbI6U%2BBxHCmlKEUYh1FZY%2BPsskjCqojS2K4I1w%2BfsLyUwkpsGHzh92WF%2B5h5FbNY5PySi2Fd3B4ns1okQyrU6i%2F0PdPGs%2BjnHvLfdB%2Bx%2FOjTJPOcKqkwk", "https://vtbehaviour.commondatastorage.googleapis.com/6c375dc240faf5cde2a8eafd44351309edfa18c7e11ea52c2437701584ec2579_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775628363&Signature=dlMT8ox9JTkziQZLJ6FL%2BRBc%2Fz%2BeAIvgi4qr%2FO3pMT9vAKLgbGFgQum2bJ74s07XpftMHPBj1fCgNY5xK7EIouHXhmpyiD%2B5zsfcKaNckOkNoIo6A9%2FfM6g42hN5djOg3pDclOqwj0ECuBWrtZXqZcrc5nv%2BU51qwqs6AAkIaiZWOX341r7RHPc49dpGRK0DG1XQDRGxacXm5erHEQmAAO8I8yR%2FzKT%2BZ6EJK6xC99uC", "https://vtbehaviour.commondatastorage.googleapis.com/000001ea2ae617d6de171f648d2683ff43b52cc01bc077f131cfd1be7549704a_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775628967&Signature=cw9IN04sKdFEDdQTLeqNWDt35Spbg0yI2vZFSrsk%2FJ6%2BD%2BRC5pt7QZKTQlutBh8zpYG9b4%2F7TjCFxf5jo1s6uYpiVA8s%2F5c5ZVy2Ia387UGrip6kYJ9s2cfp%2BgQ1o2RHEQRhukeRqR6uQpb87IVhWb1VjeABoOqT%2Buy%2BeXUckwOcInk8tcs9wCI1xhRe3raMJ1EC1gIdXCGzMqLU%2F874cclP6LWAUiQ08FPQe8VZtob", "https://vtbehaviour.commondatastorage.googleapis.com/012f268838dbc4f0877ea47f272bcd5acdc15ac4584c3d3cddeae2f5107d09de_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775629156&Signature=qIGYvmHwkDg5a1aWpPn%2FCFierOaHWS9Gyvi4Owjd4sJ7YytEl%2F5qxIIpo84v%2F7J%2BvxGYG9PrPDBHbH5jiJc2VOMkKroiRdzapAh%2FFwXVnVhn%2FCJ1eu6xMH2KJ6bs578zBbSbt6QJ2KPBU2E7RJQ5o%2FxLV93YjttPgspSTvjqiC1vCSwx78AdV7nt4xmxTCpqZB3OJuH%2ByROH7tWED9Qzq%2BVgwf7AmK9UrFuIKnmo07prAMKfo1k1", "https://vtcuckoo.commondatastorage.googleapis.com/000001ea2ae617d6de171f648d2683ff43b52cc01bc077f131cfd1be7549704a?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775629192&Signature=gnfHVeS3e3cryOoChL6czgBUI9mEJwFk8OZ22bAN4U7V1r1yCjBq7i3y7Sarv1O34zp2Yabguk5BQI4cgnZ64Dj1uLdrx9dUaYo%2FzBoITjzCiJ7djJCvB0alIiIw%2Bok%2BqRGGtIFbrfS61QNeDiXmFpeD1d%2F1lGe8ZoBd0nLLqtP5xdbRALcJbrvbCeln9nFuu199svtMraGxafiWFWiEC4GRx1BmdMZYVqC%2B%2FukhirOXs7MyPd6i1%2FsSjSWfGa8ss4pgIMD" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 94, "FileHash-SHA1": 70, "FileHash-SHA256": 294, "domain": 50, "hostname": 410, "URL": 281, "CIDR": 1, "email": 3, "IPv4": 2 }, "indicator_count": 1205, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "15 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d79c38e0a059039b475ebe", "name": "CAPE Sandbox", "description": "Email today from them on my line. Very wild things happening here. trying to close my line", "modified": "2026-05-09T12:10:59.635000", "created": "2026-04-09T12:31:52.495000", "tags": [ "html document", "unicode text", "utf8 text", "crlf", "lf line", "site", "meta", "verizon", "wireless", "internet", "phone services", "official", "shop verizon", "lte network", "get fios", "title", "code", "error", "utc na", "utc google", "tag manager", "gtmw2vn2cq", "utc dc9849921", "utc dc685973", "utc g12r1dx1lx7", "utc aw647962234", "utc aw2761768", "utc aw685973", "verizon business", "verizon for business", "verizon business account", "verizon business phone", "verizon wireless for business", "verizon business service", "verizon business plan", "business internet services", "learn", "gartner", "contact", "find", "discover", "support", "close log", "shop", "upgrade", "small", "voice", "chat", "mitre attack", "network info", "program", "html page", "t1055 process", "overview", "processes extra", "overview zenbox", "verdict", "guest system", "phishing", "next", "ver2", "msclkidn", "utc amazon", "analytics na", "utc bing", "vids1", "vids0", "gdlname" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/edb4c21d60daa44b3429e7ba9bfa342759ebef23c136c934f74aef145453ce19_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775737365&Signature=S%2B7RcHYjab1hbKlKwFfvUbDirFPJS1A2TJQ3bVIObMcON4PD9pRDvhMtYMCnEBrYsICi0UJCFW5eUDolL5Jlbngsc587kF36vvuhlkPprbkSOY1jOyDTpe3Qsb6jRFz3xwOfZc9S5QervoLnRKb%2FyGSyZE6ZK6TxzBrOPczPtZ7sLf9NfD6E%2B2gMRXaRjEqVwVITLG7YqCiiNuohFOuNlK3uNHFpIk53viKvBSAIqLtSklH9bHW4q1DX", "https://www.verizon.com/business/", "https://vtbehaviour.commondatastorage.googleapis.com/edb4c21d60daa44b3429e7ba9bfa342759ebef23c136c934f74aef145453ce19_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775737710&Signature=fbsokraSd7lsYmUfaTEl8Phs2K3hp7AtVmQU9axeEBcYmYbrrYrrfpP5lPEQaE%2Fh3%2BEP9Rn8mD8D1haqQVXCN0VVlxJ4sddjWmyC5USsgBsvUb0%2F72h1WHDS2KXHlteZWE%2Bauckabain9D5kX501AnqFY38s77OIqO6SMOkQ%2BvXiDSSRK%2FZhbfradBnei3ZLHsXGxkoshTyvB0%2BC%2F8SiUzdVsqSjik0Bn2r%2BIlLpDQK90GlZTD0N" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 772, "hostname": 706, "domain": 875, "FileHash-SHA256": 2348, "FileHash-MD5": 2237, "FileHash-SHA1": 2260, "CVE": 1, "email": 9 }, "indicator_count": 9208, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "21 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d7a3f4d72c30f9586634b9", "name": "VirusTotal report\n for flow-browser-main.zip", "description": "A sample of flow-browser-main, an unauthorised version of the web browser, has been detected by researchers at the University of California, Los Angeles, and the National Security Agency (NSA). myvzw.com after an email on ending a #", "modified": "2026-05-09T12:10:59.635000", "created": "2026-04-09T13:04:52.444000", "tags": [ "file type", "png image", "ascii", "ascii text", "java source", "json", "rgba", "creates", "crlf line", "mac os", "date", "malicious", "next", "button", "span", "edit3icon", "rotateccwicon", "xicon", "htmldivelement", "react", "saveicon", "null", "shortcutitem", "click", "zip archive", "png multimedia", "graphics" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/087797e64cf016f13eac46473b4150d49c7eba564c894300f69bc643b059c980_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775739500&Signature=r1pLCgJf%2FQK8TvenCwXy9bnghFzjJ5QssdQSLP37SLv6EkA3WXuFUIvKrsXKokco7bMfQUy%2FArk8F6aP%2Bhaj16Jv7P%2FGB%2Blf7mPvs47VjwfBJRCP8AZLlWvO45%2BjC68v798csdJFPTP31O4yDOE3pXZ3EThm4nSrIwLPhTSPfi3cPlEh2wLSzcySW7BYLw%2BqCoawFCxeLUz7hIV0vC89Mlwi3DeS%2BEnWFF%2FsvT9lVJjdbLoJLEeO", "https://vtbehaviour.commondatastorage.googleapis.com/087797e64cf016f13eac46473b4150d49c7eba564c894300f69bc643b059c980_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775739700&Signature=bOTo%2FxCpGDGOsIKJDZjBBhLZRg8UiOGi%2FvVr47Xpmh7tOh9dez7911bi%2F9SUdu4ATLhzRVog%2BdVP%2BUPwTuEfIdEcPuGRGVc1KOSP3fTQrKhRjF3x2dqykxVCH%2B1iqBmCgod%2B1uAdlraxqSOeOgst1l%2Bk250uXff4axktE%2BfGjeNDeGJao%2FfOMktqIL7zU8%2BIQYTObwelnnYx45FBSiXI1bWM4vhdgIX4cs2cT%2F" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 220, "FileHash-MD5": 562, "FileHash-SHA1": 566, "FileHash-SHA256": 1011, "URL": 125, "hostname": 139, "email": 4 }, "indicator_count": 2627, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "21 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d7a3f511d0121d253b753d", "name": "VirusTotal report\n for flow-browser-main.zip", "description": "A sample of flow-browser-main, an unauthorised version of the web browser, has been detected by researchers at the University of California, Los Angeles, and the National Security Agency (NSA). myvzw.com after an email on ending a #", "modified": "2026-05-09T12:10:59.635000", "created": "2026-04-09T13:04:53.436000", "tags": [ "file type", "png image", "ascii", "ascii text", "java source", "json", "rgba", "creates", "crlf line", "mac os", "date", "malicious", "next", "button", "span", "edit3icon", "rotateccwicon", "xicon", "htmldivelement", "react", "saveicon", "null", "shortcutitem", "click", "zip archive", "png multimedia", "graphics" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/087797e64cf016f13eac46473b4150d49c7eba564c894300f69bc643b059c980_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775739500&Signature=r1pLCgJf%2FQK8TvenCwXy9bnghFzjJ5QssdQSLP37SLv6EkA3WXuFUIvKrsXKokco7bMfQUy%2FArk8F6aP%2Bhaj16Jv7P%2FGB%2Blf7mPvs47VjwfBJRCP8AZLlWvO45%2BjC68v798csdJFPTP31O4yDOE3pXZ3EThm4nSrIwLPhTSPfi3cPlEh2wLSzcySW7BYLw%2BqCoawFCxeLUz7hIV0vC89Mlwi3DeS%2BEnWFF%2FsvT9lVJjdbLoJLEeO", "https://vtbehaviour.commondatastorage.googleapis.com/087797e64cf016f13eac46473b4150d49c7eba564c894300f69bc643b059c980_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775739700&Signature=bOTo%2FxCpGDGOsIKJDZjBBhLZRg8UiOGi%2FvVr47Xpmh7tOh9dez7911bi%2F9SUdu4ATLhzRVog%2BdVP%2BUPwTuEfIdEcPuGRGVc1KOSP3fTQrKhRjF3x2dqykxVCH%2B1iqBmCgod%2B1uAdlraxqSOeOgst1l%2Bk250uXff4axktE%2BfGjeNDeGJao%2FfOMktqIL7zU8%2BIQYTObwelnnYx45FBSiXI1bWM4vhdgIX4cs2cT%2F" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 224, "FileHash-MD5": 558, "FileHash-SHA1": 564, "FileHash-SHA256": 558, "URL": 140, "hostname": 166, "email": 2, "CVE": 8 }, "indicator_count": 2220, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "21 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d7a3f6657dd0c212d8344a", "name": "VirusTotal report\n for flow-browser-main.zip", "description": "A sample of flow-browser-main, an unauthorised version of the web browser, has been detected by researchers at the University of California, Los Angeles, and the National Security Agency (NSA). myvzw.com after an email on ending a #", "modified": "2026-05-09T12:10:59.635000", "created": "2026-04-09T13:04:54.060000", "tags": [ "file type", "png image", "ascii", "ascii text", "java source", "json", "rgba", "creates", "crlf line", "mac os", "date", "malicious", "next", "button", "span", "edit3icon", "rotateccwicon", "xicon", "htmldivelement", "react", "saveicon", "null", "shortcutitem", "click", "zip archive", "png multimedia", "graphics" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/087797e64cf016f13eac46473b4150d49c7eba564c894300f69bc643b059c980_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775739500&Signature=r1pLCgJf%2FQK8TvenCwXy9bnghFzjJ5QssdQSLP37SLv6EkA3WXuFUIvKrsXKokco7bMfQUy%2FArk8F6aP%2Bhaj16Jv7P%2FGB%2Blf7mPvs47VjwfBJRCP8AZLlWvO45%2BjC68v798csdJFPTP31O4yDOE3pXZ3EThm4nSrIwLPhTSPfi3cPlEh2wLSzcySW7BYLw%2BqCoawFCxeLUz7hIV0vC89Mlwi3DeS%2BEnWFF%2FsvT9lVJjdbLoJLEeO", "https://vtbehaviour.commondatastorage.googleapis.com/087797e64cf016f13eac46473b4150d49c7eba564c894300f69bc643b059c980_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775739700&Signature=bOTo%2FxCpGDGOsIKJDZjBBhLZRg8UiOGi%2FvVr47Xpmh7tOh9dez7911bi%2F9SUdu4ATLhzRVog%2BdVP%2BUPwTuEfIdEcPuGRGVc1KOSP3fTQrKhRjF3x2dqykxVCH%2B1iqBmCgod%2B1uAdlraxqSOeOgst1l%2Bk250uXff4axktE%2BfGjeNDeGJao%2FfOMktqIL7zU8%2BIQYTObwelnnYx45FBSiXI1bWM4vhdgIX4cs2cT%2F" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 217, "FileHash-MD5": 558, "FileHash-SHA1": 564, "FileHash-SHA256": 558, "URL": 118, "hostname": 133, "email": 2 }, "indicator_count": 2150, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "21 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d7a3f683111bbbe1c9ae35", "name": "VirusTotal report\n for flow-browser-main.zip", "description": "A sample of flow-browser-main, an unauthorised version of the web browser, has been detected by researchers at the University of California, Los Angeles, and the National Security Agency (NSA). myvzw.com after an email on ending a #", "modified": "2026-05-09T12:10:59.635000", "created": "2026-04-09T13:04:54.775000", "tags": [ "file type", "png image", "ascii", "ascii text", "java source", "json", "rgba", "creates", "crlf line", "mac os", "date", "malicious", "next", "button", "span", "edit3icon", "rotateccwicon", "xicon", "htmldivelement", "react", "saveicon", "null", "shortcutitem", "click", "zip archive", "png multimedia", "graphics" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/087797e64cf016f13eac46473b4150d49c7eba564c894300f69bc643b059c980_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775739500&Signature=r1pLCgJf%2FQK8TvenCwXy9bnghFzjJ5QssdQSLP37SLv6EkA3WXuFUIvKrsXKokco7bMfQUy%2FArk8F6aP%2Bhaj16Jv7P%2FGB%2Blf7mPvs47VjwfBJRCP8AZLlWvO45%2BjC68v798csdJFPTP31O4yDOE3pXZ3EThm4nSrIwLPhTSPfi3cPlEh2wLSzcySW7BYLw%2BqCoawFCxeLUz7hIV0vC89Mlwi3DeS%2BEnWFF%2FsvT9lVJjdbLoJLEeO", "https://vtbehaviour.commondatastorage.googleapis.com/087797e64cf016f13eac46473b4150d49c7eba564c894300f69bc643b059c980_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775739700&Signature=bOTo%2FxCpGDGOsIKJDZjBBhLZRg8UiOGi%2FvVr47Xpmh7tOh9dez7911bi%2F9SUdu4ATLhzRVog%2BdVP%2BUPwTuEfIdEcPuGRGVc1KOSP3fTQrKhRjF3x2dqykxVCH%2B1iqBmCgod%2B1uAdlraxqSOeOgst1l%2Bk250uXff4axktE%2BfGjeNDeGJao%2FfOMktqIL7zU8%2BIQYTObwelnnYx45FBSiXI1bWM4vhdgIX4cs2cT%2F" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 218, "FileHash-MD5": 558, "FileHash-SHA1": 564, "FileHash-SHA256": 558, "URL": 119, "hostname": 133, "email": 4 }, "indicator_count": 2154, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "21 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d7a3f6f81dc2388c0fa027", "name": "VirusTotal report\n for flow-browser-main.zip", "description": "A sample of flow-browser-main, an unauthorised version of the web browser, has been detected by researchers at the University of California, Los Angeles, and the National Security Agency (NSA). myvzw.com after an email on ending a #", "modified": "2026-05-09T12:10:59.635000", "created": "2026-04-09T13:04:54.563000", "tags": [ "file type", "png image", "ascii", "ascii text", "java source", "json", "rgba", "creates", "crlf line", "mac os", "date", "malicious", "next", "button", "span", "edit3icon", "rotateccwicon", "xicon", "htmldivelement", "react", "saveicon", "null", "shortcutitem", "click", "zip archive", "png multimedia", "graphics" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/087797e64cf016f13eac46473b4150d49c7eba564c894300f69bc643b059c980_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775739500&Signature=r1pLCgJf%2FQK8TvenCwXy9bnghFzjJ5QssdQSLP37SLv6EkA3WXuFUIvKrsXKokco7bMfQUy%2FArk8F6aP%2Bhaj16Jv7P%2FGB%2Blf7mPvs47VjwfBJRCP8AZLlWvO45%2BjC68v798csdJFPTP31O4yDOE3pXZ3EThm4nSrIwLPhTSPfi3cPlEh2wLSzcySW7BYLw%2BqCoawFCxeLUz7hIV0vC89Mlwi3DeS%2BEnWFF%2FsvT9lVJjdbLoJLEeO", "https://vtbehaviour.commondatastorage.googleapis.com/087797e64cf016f13eac46473b4150d49c7eba564c894300f69bc643b059c980_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775739700&Signature=bOTo%2FxCpGDGOsIKJDZjBBhLZRg8UiOGi%2FvVr47Xpmh7tOh9dez7911bi%2F9SUdu4ATLhzRVog%2BdVP%2BUPwTuEfIdEcPuGRGVc1KOSP3fTQrKhRjF3x2dqykxVCH%2B1iqBmCgod%2B1uAdlraxqSOeOgst1l%2Bk250uXff4axktE%2BfGjeNDeGJao%2FfOMktqIL7zU8%2BIQYTObwelnnYx45FBSiXI1bWM4vhdgIX4cs2cT%2F" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 218, "FileHash-MD5": 558, "FileHash-SHA1": 564, "FileHash-SHA256": 558, "URL": 119, "hostname": 133, "email": 4 }, "indicator_count": 2154, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "21 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69fda935d86fd4e7e3fb7893", "name": "[Targeted Attack: Windows Virtual Interface Machine] {credit ilyailya} - usernote: falseflagdragon", "description": "", "modified": "2026-05-08T12:22:01.570000", "created": "2026-05-08T09:13:25.760000", "tags": [ "code", "range", "file offset", "ecxedi20xa", "edi0x6d", "ebp20x20", "esi0x67", "edx0x6f", "esi0x61", "ebp20x62", "hopper", "cve20072438", "normally", "use vim", "checkfile", "vimruntime", "checkdir", "vim project", "https", "bram moolenaar", "bram", "files", "silent", "insert mode", "down", "pumvisible", "vim script", "evim", "maintainer", "spellpopupmenu", "aunmenu", "tlunmenu", "loadbuffermenu", "revert", "difforig", "show", "ctrlu", "diffthis", "bail", "win32", "vim support", "remove", "comment", "genericname", "name", "keywords", "gvim", "edit", "zhcn", "editor", "metin", "rediger", "loadftplugin", "filetype", "expand", "amatch", "make", "sinsert", "middlemouse", "unix", "amiga", "mswindows", "loadindent", "end def", "visual mode", "shiftdel", "copy", "vim default", "selectmode", "insert", "load", "detectfiletype", "addoption", "optiong", "binoptiong", "optionl", "binoptionl", "header", "space", "python", "find", "open", "mark", "shell", "ruby", "install", "vim desktop", "substitute", "vunmenu", "paste", "script", "selectall", "word", "popup", "menu", "line", "close", "window", "back", "toolbar", "compiler", "next", "hack", "vimvimrc", "haiku", "openvms", "setsyn", "lang", "syntax menu", "description", "define", "setsyn function", "assembly", "maya", "bufnewfile", "bufread", "starsetf", "setf", "language", "visual basic", "xml au", "latex", "setfiletypesh", "endif", "lilo", "apache", "postscript", "rexx", "atom", "meta", "clipper", "desktop", "gift", "hercules", "julia", "mercurial", "pacman", "trigger", "puppet", "path", "powershell", "info", "ziggy", "speedup", "systemd", "form", "format", "calendar", "dracula", "config", "sfile", "esc", "iconv", "psflags", "if defined", "newitem force", "itemtype file", "iso88591 t", "utf8", "utf8 t", "iconvpath", "t iso88591", "makefile", "converted", "bob ware", "colorado school", "mines", "vim editor", "on your", "original copy", "please", "golden", "translation", "lesson", "enter", "type", "filename", "press", "normal mode", "repeat", "summary", "notice", "ruler", "test", "letzn", "mrkl", "zeil", "strg", "bewg nn", "end von", "druck", "dautticht", "zipf", "zaichen", "netty", "moveu el", "entrar", "premeu", "fitxer", "normal", "prova", "repetiu", "sumari", "desprs", "ara premeu", "cont", "ctrl", "ctrld", "append", "ctrlr", "ctrli", "shift", "backspace", "lekce", "napi", "dek oznaen", "normlnm mdu", "pesu", "stla", "soubor", "pesu kurzor", "opakuj", "toto", "lektion", "flyt", "skriv", "tryk p", "gentag", "bemrk", "filnavn", "nr der", "tryk", "zeile", "bewege den", "tippe", "zeichen", "cursor zu", "cursor zum", "kommandos", "cursor", "null", "tutor", "ctrlg", "shiftg", "shiftn", "msdos", "vimtutor", "capslock", "michael", "movu la", "leciono", "enenklavo", "kursoron al", "tajpu", "kursoron e", "testo", "premu", "dosiernomo", "resumo", "nova", "anon", "leccin", "mueva el", "intro", "pulse", "escriba", "para", "ahora", "insertar", "esto", "repita", "antes", "tenga", "como", "este", "leon", "tapez", "dplacez", "entre", "chap", "insertion", "puis tapez", "rptez", "appuyez", "lekcija", "otipkajte", "pritisnite", "ponovite", "kako bi", "insert mod", "prijeite", "saetak", "imedatoteke", "note", "windows", "yank", "mozgassuk", "fjlnv", "parancs", "lecke", "teszt", "j sort", "nyomja meg", "norml mdban", "ismtelje", "muovi il", "batti", "lezione", "invio", "premi", "ripeti i", "nomefile", "modalit normale", "adesso batti", "nota", "alla", "stata", "replace", "change", "subtitute", "school", "emiau", "spustelkite", "testas", "pirmj", "failovardas", "fail", "normalij", "santrauka", "ymeklis", "raid", "ramen", "tagad", "ievadiet", "piemram", "apkopojums", "lai izdzstu", "lai ievietotu", "ievadot", "ievrojiet", "js varat", "macos", "leksjon", "flytt", "trykk", "slette", "repeter", "erstatte", "sette", "kommandoen", "sett", "tips", "vise", "druk", "het commando", "herhaal de", "als je", "deze", "de cursor", "gebruik", "voeg", "bestandsnaam", "zorg", "mova", "digite", "teste", "agora", "pressione", "insero", "mais", "lekcja", "przenie kursor", "wcinij", "vima", "wpisz", "teraz", "powtarzaj", "nazwapliku", "uwaga", "jest", "dmesine", "ders", "ilk satra", "bu satrda", "normal kipe", "normal kipte", "daha fazla", "pomerite kursor", "otkucajte", "preite", "imefajla", "rezime lekcije", "za zamenu", "flytta", "filnamn", "normallge", "tryck", "om du", "sammanfattning", "genom", "lekcia", "presu kurzor", "presu", "napsanie", "zopakuj", "poznmka", "lcmessages", "lcall", "slovak tutor", "vim tutor", "amatria", "thevimproject", "slovak", "czech", "number", "motion", "ignore", "hjkl", "by gi", "di chuyn", "cu lnh", "u tin", "thay", "tntptin", "nu bn", "tng kt", "vim c", "lodi", "caps", "lock", "abc de", "command", "krishna", "spellerrors", "display dpy", "none", "false", "xfree", "sendinit", "isserialname", "staticspace", "xsync", "sendtovim", "main", "k command", "shell script", "vt100", "term vt100w", "dec locator", "vsnet", "tools", "external tools", "title", "arguments", "curline", "itempath", "init dir", "empty", "fbshtagsfp", "create", "options", "tags", "bourne shell", "perl", "fbkshfp korn", "tcl shell", "tk windowing", "parse", "new buffer", "buildcasetable", "printf", "buildwidthtable", "keys", "parsefoldprops", "parsewidthprops", "variabletags", "argv", "stephen riehm", "david woodfall", "getopt", "v include", "print version", "suppress", "reason", "file", "severity", "o ccfilter", "following", "this first", "ccfilter", "quickfix format", "though", "start", "john lange", "primitivem", "errorformat", "perl script", "executecore", "aerts", "sw developer", "sony telecom", "europe", "b1130 brussels", "belgium", "port", "host", "server", "vim channel", "chopen", "localhost8765", "json message", "linelength", "compilernames", "irix", "solaris", "hpux", "pablo ariel", "c compiler", "compilerqty", "usage", "project", "collector", "written", "ives aerts", "notes", "r decrement", "v verbose", "outputs", "o treat", "program", "q errorfile", "stdout", "copyright", "joerg ziefle", "perl w", "first", "maketag", "version", "exuberant ctags", "statement", "loop", "michael schaap", "support", "packagename", "look", "february", "push", "sgi mipspro", "error int", "error", "doit", "vim9 function", "nr2char", "c program", "vim quickfix", "awk script", "dec terminal", "make vim", "errors", "begin", "kirchgatterer", "opcodes syn", "addresses", "numbers", "types syn", "blocks syn", "strings syn", "program counter", "hilo byte", "quit", "todo todo", "aappythonscript", "python line", "python block", "blockline", "abap", "statement hi", "string hi", "structure", "vim abap", "abapr4", "marius piedallu", "james allwright", "april", "klmpqwvw", "comment hi", "type hi", "identifier hi", "constant let", "abel", "john cook", "johncook3", "a bunch", "todo xxx", "fixme", "c style", "abaqus", "carl osterwisch", "costerwi", "remark", "abaqus comment", "abaqus keyword", "include hi", "todo hi", "acedb model", "stewart morris", "thu apr", "syntax file", "acedb software", "xref syn", "rest", "preproc hi", "delimiter hi", "nikolai weibull", "include", "useroption", "options medium", "defaultprinter", "outputfirstline", "filecommand", "todo fixme", "martin krischik", "kind", "keyword", "mk bram", "standard", "character", "stype", "date", "vim syn", "altera ahdl", "x syn", "todo", "xnor syn", "specialchar hi", "builtin", "define hi", "builtin rect", "operator hi", "special hi", "dbus", "g3drop", "builtin dump", "builtin number", "builtin call", "redir", "stream", "screen", "function hi", "aflex", "lex syntax", "mathieu clabaut", "lastchange", "ada syntax", "aflex stuff", "patterns", "dominique pelle", "storageclass hi", "keyword let", "endlet", "htmlformat", "htmlcolor", "span", "htmlformatn", "foldcolumnbuild", "css1", "foldedid", "html", "generator", "fixme todo", "xxx note", "spell", "amigados", "campbell", "former url", "syntaxamiga", "krief david", "display drop", "beta cauchy", "irand224 syn", "normal poisson", "antlr4", "another tool", "yinzuo jiang", "jiangyinzuo", "july", "option value", "ben rubson", "hammers", "changelog", "option value1", "option", "value1", "david necas", "yeti", "base", "xxx not", "core", "antlr", "javacc parser", "azaz09", "parserend", "parserbegin", "token skip", "antsyntaxscript", "doug kearns", "zellner", "xmlcdatastart", "xmlcdataend", "xmltag", "xmlendtag", "ayer", "atch", "orkspace", "ngle", "rity", "mbol", "ffset", "istory", "osition", "xport", "stack", "tack", "digi", "flip", "shade", "cluster", "keyb", "arch", "moran", "ecode", "gnu arch", "source", "keyword hi", "simulate", "aptitude", "state", "yann amar", "quidame", "aptconf", "incomplete", "ebug", "autodetect", "fast", "marker", "score", "arduino", "hoff", "october", "license", "vim license", "arduino ide", "erik nomitch", "adam obeng", "artenterprise", "dorai sitaram", "ds26", "thilo six", "number hi", "edfghprs", "gnu assembler", "erik wognsen", "kdahlhaus", "kevin", "label hi", "macro hi", "title hi", "deprecated", "skip", "none hi", "claudio fleiner", "claudio", "end imports", "exports from", "implicitstags", "explicitstags", "absent present", "size universal", "strings", "aspperlscript", "perlscript", "aaron hope", "constant hi", "bwlsdxp", "macro", "specialchar", "error hi", "aspvbserror", "aspvbsfunction", "aspvbsmethods", "aspvbsstatement", "aspvbsnumber", "aspvbscript", "aspvbscomment", "aspvbs", "exits", "floating point", "asterisk", "tilghman lesher", "corydon76", "zonemessages", "atlas", "inaki saez", "jisaez", "flags bef", "orange syn", "containsasytodo", "asymptote", "avid seeker", "c syntax", "autodoc", "berg", "xml dl", "display", "contains", "borz", "kdpds", "oneline", "hotstring", "comspec", "hotkey", "reload", "common", "autoit", "soundplay", "autoit v3", "jared breland", "ping", "shutdown", "vim maintainers", "john williams", "action", "makefile syntax", "avenue", "arcview", "wagner", "esri", "string", "integer number", "operator syn", "xor mod", "hitachi h8300h", "xorc syn", "identifier let", "avr assembler", "avra", "avra home", "avra version", "marius ghita", "mhitza", "gawk ref", "functions syn", "awk ref", "effective awk", "programming", "keeps", "astro", "style", "fold", "enable", "astrojavascript", "htmlpreproc", "wuelner martnez", "html tag", "azaz", "ayaccuniongroup", "ayacc", "clusters", "aunis", "bash", "a formal", "method", "contributor", "csaba hoch", "undef", "defaultchar", "startstartfont", "bdfboundingbox", "containsbdftodo", "bibtex", "bernd feige", "ignore case", "xdata customa", "xref", "ams mref", "data", "basic", "quickbasic", "trim", "metacommands", "kill", "zonenumber", "bind zone", "mehnle", "slava gorbanev", "generates syn", "bcall", "vlado", "keywords syn", "string syn", "comment syn", "parent", "sulejman", "blank", "xspo", "bitbake", "chris larson", "kergoth", "daniel kho", "bsdl", "vhdl syntax", "tim pope", "vimnospam", "highlight", "imperfect", "bstnumber", "entry function", "integers macro", "bazel", "david barnett", "label", "digit", "john leo", "spetz", "boolean", "statuses", "bazaar", "dmitry vasiliev", "dima", "diff", "nospell", "synchronization", "baanerror", "selecteos", "updateerror", "d rows", "default", "selectempty", "selecterror", "updateempty", "union", "hooks", "normal hi", "case", "haskell cabal", "build file", "profunctor", "benchmark", "import", "cabalconfigpath", "cabal config", "original author", "cabalconfigkey", "false ghc", "cabal project", "true false", "cabalprojectnat", "boolean hi", "cparengroup", "cstringgroup", "ccommentgroup", "clabelgroup", "iso c99", "elifs", "ifndef", "ccppoutingroup", "optional", "accept", "public dtddecl", "entity catalog", "errormsg hi", "cdlcommentgroup", "raul segura", "acevedo", "xcheck", "childsname", "parentsname", "grpsdescription", "fixme xxx", "fullburn", "readdriver", "writedevice", "readdevice", "cfgcomment", "uncpath", "cfgstring", "cfgsection", "prischepoff", "on off", "yes no", "dos drive", "zhenyu", "documentation", "and fold", "operator", "punctuation", "transparent", "region and", "cfmlcorekeyword", "linden", "coldfusion", "skipwhite", "nextgroup", "cdrtoctrack", "cdtext", "performer", "silence", "zero", "softintegration", "cc interpreter", "declspec", "exception hi", "structure let", "built", "chaiscript", "jason turner", "lefticus", "escape", "web changes", "andreas scherer", "details", "cweb", "knuth", "silvio levy", "webcweb", "november", "haskell", "armin sander", "changelog file", "menesis", "vinschen", "june", "chatito", "observeroftime", "import syn", "intent syn", "slot syn", "cheetah", "max ischenko", "matches", "precondit hi", "evan hanson", "scheme", "chicken", "repository", "scheme syntax", "lighten", "heredocs", "cc syntax", "hse1", "chorus", "startofverse", "startofbridge", "startoftab", "startofabc", "startofly", "chordfont", "chill", "repeat hi", "avoid", "youngsang yoon", "image", "ccitt high", "this", "ember", "sifs0", "sinclude", "calendarinclude", "andrea callea", "chuck", "object event", "ugen array", "pieter van", "engelen", "arthur van", "leeuwen", "start syn", "int real", "char bool", "zamana", "flagship", "mario eusebio", "accept append", "blank from", "highlight value", "cmake", "comments", "match key", "cmakecachekey", "advanced", "highlight str", "stringstr", "nickspoons", "internal", "clever language", "clever", "multibase", "philip uren", "philuspax", "cmod", "cmodautodoc", "supports", "init init", "exit gcrecurse", "browser", "cocor", "shukla", "any characters", "context end", "from if", "nested pragmas", "to tokens", "cword", "fnameescape", "supplement", "must", "dgacfbe", "clojuretop", "arraychunk", "vecnode", "vecseq", "x00x7f", "partstart", "gondi", "inst", "etcdisktab", "acmsg", "acmsgtype", "hammesr", "yngve inntjore", "levinsen", "khym chanur", "james mccoy", "well", "anything", "conary recipe", "addallflags syn", "run automake", "makeinstall syn", "install copy", "move symlink", "link remove", "doc syn", "crm114", "modemsg hi", "imported", "target", "true", "interface", "quiet", "private", "write", "multi", "never", "unknown", "fatalerror", "sensitive", "android", "download", "guard", "exact", "locale", "trace", "alphabet", "john hoelzel", "hours days", "commands", "llll", "hminsmsusnsi", "ffll", "ken shan", "ccshan", "context", "synname", "startstartz", "endstopz1", "mptop", "luatop", "csccommentgroup", "if else", "endif elseif", "lev sy", "iallancestors", "curgen sy", "warningmsg hi", "essbase", "prior", "descendants", "cshell", "syntaxcsh", "variables", "luul", "csall", "srecord", "az09", "processes", "amsettimer", "sdlmatch", "default hi", "fdr input", "maxim kim", "habamax", "functions", "predefined term", "end predefined", "term variables", "century term", "csdl", "jacek artymiak", "c22032019", "call", "replacing", "comp", "recognize", "ascii", "existing syntax", "ctrlhbold", "ctrlh", "module level", "prop", "media", "cuda", "nvidia compute", "unified device", "architecture", "terriberry", "device global", "host managed", "shared syn", "restrict", "cupl simulation", "cupl syntax", "matt dunford", "sat nov", "statement let", "tex syntax", "cweb source", "cc material", "webincludedc", "double", "rc file", "dada", "dadas", "etant", "scen", "regel", "pero", "esquema", "tapi", "kada", "dados", "maka", "fono", "cupl", "valid integer", "signal", "phil derrick", "phild", "cynpp", "cynlib", "cynlib syntax", "posedge negedge", "changed syn", "instantiate", "out inst", "url http", "default cynscon", "standard syntax", "include debian", "match uri", "addremove", "byhash", "christopher", "dcod trts", "tnxt crlf", "labl syn", "cequ cneq", "cgte clte", "cbit clse", "dcomment", "jason", "pragma", "4857", "digital command", "sword", "mine", "conditional hi", "dart", "eugene pr3d4t0r", "ciurana", "former", "gerfried fuchs", "alpha", "rust", "datascript", "dscommentgroup", "comment let", "debcopyright", "orig author", "rob brady", "robb", "wu yongwei", "library stub", "code windows", "dos syn", "exports imports", "dep3 patch", "gabriel filion", "gabster", "specification", "authorfrom", "adminemail", "lockfile", "matthijs", "match", "ttext", "ccategory", "fflag", "llicense", "rock linux", "ren rebe", "spell syn", "lastline syn", "filter", "disablestrat", "s un", "r en", "jakson alves", "ansi sgr", "ansi sgr8", "jan larres", "term left", "black", "green", "contact", "charityware", "uganda", "entry", "block", "parasitic", "parameter", "devicemos", "rules", "device", "diva", "toby schaffer", "categories", "exectryexec", "unmounticon", "at wp", "chat", "django", "django template", "dave hodder", "dnsbind zone", "docbook sgml", "cest let", "docbook xml", "docbook", "devin weaver", "shlomi fish", "auto detect", "syntax xml", "sgml", "syntax sgml", "rory hunter", "json", "dockerfiles", "honza pokorny", "onbuilds", "from", "add arg", "cmd copy", "mike williams", "mrmrdubya", "windows nt", "msdosms windows", "mckee", "nima talebi", "hong xu", "sept", "keyword hilink", "hilink", "error hilink", "nargs hilink", "markus mottl", "enclosing", "scott bordelon", "wed apr", "cadence", "automation", "design rule", "checking", "layout", "schematic", "dsssl", "cest", "example", "xmlregionhook", "dtml", "dtml syntax", "zope", "markup language", "jordaan", "doxygenhtmltop", "synlink", "link", "syncolor", "strong", "reflink", "cpreprocgroup", "actions", "dtrace d", "d script", "solaris dynamic", "tracing guide", "nicolas weber", "nicolasweber", "first line", "probe", "turn", "entity", "matchgroupnone", "document type", "definition", "brabandt", "dune", "anton kochkov", "samuel hym", "simon cruanes", "kawahara satoru", "urkedal", "etienne millon", "dylan", "justus", "fri sep", "include let", "dylan library", "interface files", "brent fulgham", "bfulgham", "string let", "fulgham", "dnsmasqkeyword", "dnsmasqrange", "editorconfig", "anders", "edif version", "edif", "artem zankovich", "zartem", "5481988", "john beppu", "beppu", "ecd file", "embedix linux", "elm filter", "syntaxelmfilt", "elmfiltnumber", "brssow", "environments", "wraparound", "elinksnumber", "elinkscolor", "savingstylew", "imagelinksuffix", "homepage", "current void", "selse", "sthen", "eiffel", "joseph hager", "ajhager", "typedef hi", "lambda", "xxxx", "kresimir marzic", "oscar hellstrm", "oscar", "kornel", "syntax", "label highlight", "type highlight", "identifier", "george", "exec sql", "preproc let", "esterel", "luca necchi", "nikos andrikos", "esterel regions", "esterel types", "esterel comment", "identifiers", "euphoria", "builtins", "function", "reset", "should suffice", "etermgeneral", "d0xx", "mod5", "rubytop", "eruby", "erubysubtypezsw", "conventional", "text", "generated file", "david nev", "setup", "expect", "normal expect", "ralph jennings", "knowbudy", "user", "sysv", "bsd isms", "syntaxexports", "optset", "eviews", "vaidotas zemlys", "zemlys", "az4857", "assembler", "fasm", "ron aaron", "vim url", "fasm home", "fasm version", "xmm0 xmm1", "xmm2 xmm3", "dwayne bailey", "dwayne", "fdcc", "definitions", "iso tr", "unicode", "shell command", "output", "array", "fantom", "service", "bridle", "informix", "update", "abort abs", "absolute accept", "access acos", "add after", "allocate alter", "drop", "fishnext", "fishstatement", "fishterminator", "fishargument", "nicholas boyle", "flexwiki", "reilly", "home", "fuse", "modify", "table", "pascal makefile", "sections", "comments syn", "forth79", "forth83", "char", "forth83 syn", "body", "noname", "class", "local", "tung", "thu oct", "thomas reiter", "manipulation", "book", "document", "textfile", "apply", "formats", "popu", "crea", "modi", "memo", "defi", "disp", "dele", "appe", "repl", "proj", "alia", "cmon", "nvert", "mwin", "uniq", "blin", "carr", "story", "mult", "rator", "fortran", "ends", "cray", "ulllull", "stop", "fvwmm4", "mainsyntax", "fvwm2m4", "include m4", "include fvwm2", "fvwm1", "hss1", "general syn", "szsw", "check", "journal", "hold", "fvwm", "cursormove", "edgeresistance", "modulepath", "noborder", "windowlistskip", "backcolor", "sticky", "refresh", "buttons", "exclam", "slash", "gdmo", "iso101654", "guidelines", "managed object", "gyuman", "chester", "godot resource", "section syn", "ssss", "gdb command", "simon sobisch", "isplay", "unset", "linkurl", "gemtext markup", "suneel freimuth", "heading", "list", "quote", "heading special", "list statement", "godot", "bug hack", "gitdiff", "dddd", "endt", "commit", "question hi", "giftcef", "linenr hi", "giftceffw", "giftce", "conceal hi", "gedcom", "paul johnson", "december", "abbr addr", "adop adr1", "adr2 afn", "godot gdscript", "website", "pattern", "attribute syn", "macro syn", "gitcommitdiff", "your", "todo let", "crrw", "creator", "xexec", "syn match", "az4857 syn", "adam monsen", "opengl shading", "modified", "godoc", "title let", "gocommentgroup", "chan", "foldenable", "packagecomment", "integer hi", "todo regexp", "todos", "josh wainwright", "dot ja", "at gmail", "dot com", "karim belabas", "texstyle syntax", "todo syntax", "todd zullinger", "daniel kahn", "gillmor", "containsgpgtodo", "gprof output", "flat profile", "gretl", "gretl genr", "variable", "grads", "fronzek", "grid analysis", "display system", "grads scripting", "variables syn", "gnashkeyword", "gnashcomment", "gnashtodo", "solreadonly", "solsafedir", "john marshall", "jmarshall", "pedro alejandro", "lpezvalencia", "ddd0xx", "pager", "terminal", "chainloader", "groovytop", "exception", "groovy", "debug hi", "gtk theme", "packer", "conceal", "json syntax", "single", "trailing commas", "fixme note", "gnu server", "pages", "source html", "include java", "redefine", "argc argv", "begin begg", "end endg", "graph", "vim source", "matchlist", "vimsrcdir", "both", "getqflist", "cent", "kword", "c function", "small", "light", "vimcontinue", "endstr", "gensynvim", "vim9 syn", "vimexprlist", "magic", "hamlrubytop", "hamlcomponent", "hamltop", "haml", "hamlhtmltop", "david fishburn", "sun oct", "hamster classic", "hamster", "harepostfix", "hare", "vim syntax", "amelia clarke", "selene", "haredoc", "miscellaneous", "haste", "vlsi ic", "c preprocessor", "09afaf", "treat", "varid", "error let", "hbfilename", "hbhtmlstring", "hbhtmltagn", "hbhtmltag", "hbdirectivelib", "hbdirectiveset", "hbdirectiveout", "kkmmgg", "upstream", "a block", "szskkzes", "vim program", "restorer", "defunct", "aprl", "helplang", "intel hex", "sams ricahrd", "data digit", "folding data", "records", "record syn", "ignore hi", "vim help", "ident", "dana edwards", "danaedwards", "ic design", "preprocessor", "spacings", "resolutions", "ranges", "slhg", "hgcommitdiff", "sapling", "ken takata", "kentkt", "max coplan", "float hi", "hls playlist", "benot ryder", "comment line", "hogvar", "hogopnot", "hognumber", "hogipaddr", "hogcomment", "hogport", "hogoprange", "hogcomment syn", "hogstring", "bind", "elseif", "html template", "dennis", "htmltop", "htmljavascript", "onas", "htmlxml", "idem", "aria", "m4top", "htmlm4", "htmlos", "repeat syn", "aestiva", "jason rust", "jrust", "django html", "scomment", "i3configident", "i3configstrin", "i3configvalue", "focus", "i3configsh", "i3configstrvar", "i3configcommand", "i3configcolvar", "moving", "itanium", "parth malwankar", "pmalwankar", "file version", "masm syntax", "mark manning", "markem", "allan kelly", "ibasic file", "icewm menu", "james mahler", "fri apr", "icewm", "ids menu", "icon special", "icemenu", "data language", "ajelenak", "paren hi", "paren", "billshannon", "nlps", "npro", "graphics", "iconpregroup", "icon", "wendell turner", "prelude", "inbpc", "ddspe", "leaderscopy", "fontname", "badness", "elan ruusame", "shtop", "value", "args", "substituted", "macros", "ipfspecial", "ipftodo todo", "hendrik scholz", "hendrik", "openbsd pf", "ipfcomment", "xxx fixme", "donovan keohane", "syndisplay", "global", "verbextend", "double2", "snote", "david brgin", "dbuergin", "continuedoelse", "argv binpath", "cr crlf", "del debug", "eav empty", "inno setup", "my innosetup", "jason mills", "enterdisk syn", "sdsetuptype syn", "ifdef", "elif", "else", "cortopassi", "istoutspec", "peter meszaros", "pmeszaros", "istinpspec", "istcharacter", "istnumber", "istcomment", "jamcommentgroup", "jamparengroup", "ralf lemke", "xxx syn", "jargon file", "dan church", "label let", "javascript", "jls17", "see https", "javatop", "javadoctags", "javahtml", "tx0cr", "javamarkdown", "markdowninline", "jinja", "jinja template", "names syn", "standard jess", "jess", "paul baleme", "pbaleme", "jonas munsin", "xaxis yaxis", "x cross", "number let", "javacc", "java compiler", "javasoft", "vim compiler", "vito", "doc comment", "note xxx", "jspjava", "java server", "rgarciasuarez", "darren greaves", "patch", "thomas kimpton", "software", "eli parra", "json keywords", "jsonc", "izhak jakov", "izhak724", "acknowledgement", "kevin locke", "remove syntax", "json5", "mazunki hoksaas", "guten ye", "ywzhaifei", "syntax setup", "endz1", "kconfigconfigif", "abstract", "juliaexprsnodot", "regex", "naninf", "kdlnumber", "kdlnumber d", "aram drevekenin", "kotlin", "generated", "annotation syn", "kix2001 syn", "kixtart", "handle", "trap", "michael piefel", "entwurf", "cpp mode", "preproc", "error highlight", "storageclass", "delimiter", "sysvars", "false true", "kivy", "corey prophitt", "corey", "load python", "kivy language", "define kivy", "lace", "jocelyn fiat", "constants syn", "latte", "nick moffitt", "pre tag", "elsa", "glapagrossklag", "riley bruins", "ribru17", "keywords syntax", "sections memory", "overlay phdrs", "version include", "absolute addr", "names", "ldapconfcomment", "iso dialect", "modula2 dialect", "modula2 input", "styles", "error endif", "august", "pim dialect", "modula2", "longbitset", "procedure", "r10 dialect", "sto dos", "ldap ldif", "zak johnson", "zakj", "less", "jenoma", "todo optimize", "orce", "arset", "prox", "cache", "agent", "haskelltop", "lhstexcontainer", "ian lynagh", "tex markup", "bird style", "markdown style", "tex style", "lexccode", "user code", "flex", "van engelen", "patrick texier", "lifelines", "xref tag", "liquid", "liquidstatement", "yaml front", "matter", "liquidyamltop", "acdfmnrstuklp", "lilonumber hi", "number list", "niels horn", "lite", "liteinside", "lutz eymers", "ixtab", "email", "sql syntax", "errmsg", "livebook syntax", "lisplistcluster", "clisp ffi", "standard lisp", "keyword lispkey", "litestepdir", "litestep rc", "nethood", "winnt", "lotos", "is8807 syn", "specifications", "is8807", "daniel amyot", "damyot", "wed aug", "except", "logtalk", "logtalk entity", "term", "logic", "chfnauth", "chshauth", "createhome", "defaulthome", "lout", "report", "lambdaprolog", "teyjus", "vim version", "general", "lpccommentgroup", "lpcefungroup", "nodule", "lpcparengroup", "lpcpreprocgroup", "echo", "poet", "timo frenay", "timo", "labels syn", "lotusscript", "taryn east", "ultraedit", "textpad", "activateapp as", "base beep", "call case", "scott bigham", "colorterm", "luau", "marcus aurelius", "farias", "carlos augusto", "collapsebrtags", "lynx web", "lynx", "todo note", "uploader", "lyrics", "lrcnumber", "quake", "operators", "hascbackend", "pkg syn", "definelib syn", "definepgm syn", "importm3lib syn", "fleiner", "mainsyntaxm4", "mailquoteexps", "mail", "felix von", "leitner", "am est", "ascii character", "froms", "mallard", "jhradilek", "mallard markup", "draft", "skipnl", "roland hieber", "overrule", "ostype", "manconfcomment", "build", "suffix", "mason", "perltop", "hinrik rn", "sigursson", "pentium", "abgl", "ceopsz", "offset", "align", "floatingpoint", "vpmaxsq syn", "integer", "maple", "release", "focus master", "define syntax", "filename suffix", "segname segtype", "mtaddon", "matlab", "alex burka", "bbddeess", "all functions", "except keywords", "maxima", "robert dodier", "mermaid", "craig maceahern", "4857192255", "self", "accdescr", "click", "meson", "liam beguin", "zpetkovic", "disabler", "wikitop", "containshtmltag", "wikitableformat", "mediawiki", "yakov lerner", "rfc3339", "james vega", "zsdze", "melgroup", "maya extension", "robert minsk", "jason franklin", "sunghyun nam", "goweol", "mudunuri", "version info", "ctrlh syntax", "markdown", "matchstr", "metafont", "page", "latest revision", "magic point", "spam", "xfont vfont", "gero kuhlmann", "gero", "snmpv1", "snmpv2 mib", "martin smat", "msmat", "david pascoe", "pascoedj", "ax16", "donald knuth", "taocp", "mmix", "dirk hsken", "knuthstyle", "precondit endif", "pcimapfile", "parportmapfile", "model", "nil nil", "true syn", "symbols", "mmatop", "stub", "peter funk", "getdialect", "timo pedersen", "dat97tpe", "whitespace", "any array", "mookeyword", "dilnt", "multiplication", "mojonumber", "mojo", "stuff", "monk", "seebeyond", "mike litherland", "dirk van", "deun", "metapost", "manual", "autosync", "dumpvideo", "loadidx", "rawvideo", "tsprog", "color", "tabtitle", "am cdt", "pm est", "dummy", "ms message", "kwl7", "common ms", "messages", "ms idl", "vadim zeitlin", "vadim", "msql", "env variables", "inlclude", "modsim iii", "philipp jocham", "march", "actid all", "and as", "murphi model", "diego ongaro", "integers", "nspemit", "switch", "mushcode syntax", "rick bird", "clock", "dbck", "dump", "hook", "motd", "notify", "nuke", "restart", "snoop", "stats", "teleport", "attributes", "prettyprint", "libpath", "promylibdir", "attributes syn", "mupad source", "dave silvia", "dsilvia", "ymwd", "cciskaf", "float", "mysql", "pronovici", "encrypt", "namednotnumber", "nick hibma", "location", "marcin", "chaos", "dmap", "modules", "control section", "nastran", "tom kowalski", "any integer", "n1ql", "eugene ciurana", "merge syn", "nest syn", "pr3d4t0r", "vim command", "natural", "nasm", "iend", "movs", "time", "interval", "size", "directory cache", "cache buffers", "minimum file", "count", "daylight", "miner", "keith smiley", "login", "netrwtreegroup", "diffchange hi", "netrw listing", "toplevel", "readtoken", "nixexpr", "daiderd jordan", "daiderd", "region match", "bufenter", "syntax event", "synset", "checked", "muttvars", "neomutt", "bounce", "nsisanyopt", "statements", "nsis", "music", "rcx2", "scout syn", "rcx2 syn", "nqcparengroup", "rcx syn", "nqccommentgroup", "modes", "scout", "stefan", "module", "nginx module", "nginx", "http", "gost", "comet", "speed", "sphinx", "curv", "mtllibs", "exmaintainer", "anthony hodsdon", "objc syntax", "odin", "ms44", "and or", "occamnumber", "group", "omnimark", "paul terray", "mailto", "activate again", "catch clear", "close copy", "ocamltypeexpr", "ocamlallerrs", "jon parise", "ondirshell", "operator let", "objc type", "smes12", "qualifiers", "smes7", "smes19", "preparation", "protected", "structure hi", "openscad", "niklas adam", "luis moreno", "abort all", "alter and", "any as", "asc at", "oplstatement", "oplnumber", "open psion", "epoc16epoc32", "af09", "openvpn", "openvpnnumber", "openvpnsignal", "hupinttermuser", "containstop", "keepend", "eval", "menumode", "endurance", "blade", "illusion", "sneak", "onload", "disablemouse", "getclass", "notes todo", "containsallbut", "spells", "ronan pigott", "ronan", "alpm", "tcpip", "gclckprocs syn", "oracle config", "sandor kopanyi", "oraall", "protocol syn", "bequeath syn", "latest change", "haochen tong", "withconceal", "inlinecode", "super", "pappperl", "papphtml", "cdata", "perlinterpdq", "marc lehmann", "perlexpr", "config file", "lennart schultz", "string keywords", "protobuf text", "lakshay garg", "crgut", "tim chase", "austin", "pcctsinrule", "cpptoplevel", "pccts", "nextstep syn", "openbsd packet", "lauri tirkkonen", "sloadsanchor", "phtml", "perlinterpsq", "perlinterpmatch", "perlinterpslash", "perldata", "portb syn", "intcon syn", "gie eeie", "t0ie inte", "rbie t0if", "intf rbif", "microchip", "pdfxml", "nrtbf", "font", "palm os", "schau", "font id", "beware", "data syn", "postfix", "kelemen peter", "peter", "kelemen", "anton shestakov", "pikestmt", "pikebadgroup", "pike", "pine", "thu feb", "macro let", "httpviewer", "infopath", "longmanuallinks", "filter0xb7", "plaintexmath", "glue", "acute", "cdhoopstuvijll", "rrowvert", "skewsqrt", "mega", "phpinnerhtmltop", "phpclfunction", "phpcltop", "refer", "cphil", "number support", "c language", "does", "address and", "dword", "juerd", "plpperl", "plpend syn", "counter syn", "pl1commentgroup", "pl1parengroup", "declare dcl", "procedure proc", "loops", "podformat", "ibsclfx", "perl pod", "poe item", "show hide", "minimal", "address", "obsolete", "openclose", "bjoern jacke", "bjacke", "povray", "syntax syn", "off true", "false yes", "ppwizard", "dennis bareis", "ppwizargval", "constants", "plsqlparengroup", "oracle", "plsql", "klaus muth", "klaus", "altf amcr", "arc asfn", "astk barc", "blk box", "call syn", "cass cir", "melchior franz", "mfranz", "sonia heimann", "todo tbd", "privoxy", "prolog", "promela", "mon oct", "thu aug", "promela types", "class linking", "ps ll3", "dsc comment", "device gstate", "ps level", "postscrstring", "escaped", "matrix", "courier", "buffers", "redistributions", "this software", "including", "but not", "limited to", "pbcommentgrp", "google", "az09az", "posix", "rex barzee", "rexbarzee", "aclqrv", "a af", "ag ax", "e ef", "eg ex", "certain", "ps1comment", "purify header", "informational", "warning", "corrupting", "fatal", "haakon riiser", "hakonrk", "c syn", "pypa", "commands syn", "globs", "line break", "pyrex", "marco barisione", "python syntax", "olor", "chars", "progress", "ation", "progressdebug", "progressnumber", "edure", "progresstodo", "eter", "daniel", "sage", "widget", "rage", "python library", "reference", "quarto", "aquino", "vim runtime", "quickfix", "directory hi", "hee1", "lookdown lookup", "quakeoctalerror", "quake12command", "noprefix", "console", "onoff", "qb64", "z2z1", "qmlexpr", "radiance scene", "georg mischler", "radiance", "greg ward", "surface", "raccruby", "rule", "racc input", "dobie", "xdobie", "handling", "vector", "types syntax", "raml", "restful api", "hopkins", "rofi advanced", "pierguill", "common rc", "resource", "heiko erhardt", "language syn", "bitmap icon", "cursor cursor", "cmash", "ratpoison", "magnus woldrich", "djkea2", "bulls eye", "force control", "number syn", "rapid", "azazxc0xff", "azazxc0xff09", "rakuinterpqq", "rakuregexen", "rakuregexp5", "rcs log", "joe karthauser", "rcs file", "revision", "yyyy", "rebol", "yer todo", "words syn", "view", "view tabs", "spaces", "vicharsearch", "viprevword", "viendword", "visearchagain", "vinextword", "registry key", "registry export", "ulitin", "head", "regedit4", "win9", "bytes", "paths", "xxx bug", "davide alberani", "remind", "ben orchard", "rem omit", "mit license", "raimon49", "permission", "software is", "resolvipcluster", "ipv6 support", "09azaz", "radu dineiu", "hidesymbol", "r help", "r code", "epsilon", "kappa", "slabelsk", "over", "relax ng", "containsrnctodo", "rnoweb", "highlighting", "rnowebr", "ranke", "ferraz pereira", "rosa", "extension", "bytestream", "andrew bromage", "frameend", "worldbegin", "worldend", "attributebegin", "attributeend", "todo improve", "handles", "todo are", "redif", "axel castellane", "templatetype", "and add", "alex zvoleff", "configuration", "r syntax", "syntaxrpcgen", "mikrotik", "cidr notation", "cycle", "exit", "catch", "rpl2", "rmdlatex", "yaml header", "highlight code", "rmdr", "text format", "rich text", "control words", "new control", "rstcruft", "salt state", "jinja runtime", "star", "disallow syn", "disallow", "samba", "new maintainer", "ntlmv2 syn", "synfold", "rubymodifier", "sasbasicsyntax", "add syntax", "sasgraph", "yrdif yyq", "template", "mixin", "extend", "return", "steven dobay", "stevendobay", "sather", "science", "institute", "dede", "scilab", "benoit hamelin", "containedgroup", "preproc syn", "aclchg", "acldel", "aclgrp", "aclumask", "lockscreen", "zombie", "scss", "puria nafisi", "azizi", "always", "ip adresses", "verify", "synopsys design", "constraints", "tcl vim", "thu mar", "tcl syntax", "tcl extension", "xor syn", "task else", "nextstate syn", "in out", "with from", "ebcdic", "closedelay", "txtrigger", "spdnormal", "portd", "comment hilink", "sexplib", "atoms syn", "lists", "clst", "sgml charset", "capacity scope", "features", "baseset descset", "simple", "shfoldheredoc", "shfoldifdofor", "shlooplist", "shfunctionlist", "shidlist", "shecholist", "shcaselist", "shdblquotelist", "provides", "sgml specific", "space crlf", "dquote syn", "percent", "mp luacall", "alephversion", "uchar", "udelimiterunder", "umathchardef", "umathruleheight", "umathstackvgap", "umathxscale", "uoverwithdelims", "hai tp", "bestanden", "hanya dalam", "fiierele", "tp tin", "aemacron amstex", "aacute", "abrevehook", "afterpar", "agrave ahook", "amstex amacron", "atilde", "beforepar beta", "bigm", "delta", "oldstable", "experimental", "bullseye", "trixie", "forky", "focal", "jammy", "devel", "buzz", "maverick", "keyword syntax", "typescriptvalue", "title syntax", "typescripttype", "blabla", "sicad", "zbranyiczky", "irpt", "irptl", "mes1", "swift project", "simula", "simula syn", "keyword end", "when", "nagle", "main url", "comparison", "load sinda", "on si", "off eng", "sieve", "skill", "nsqn", "dirfile", "pnamestring", "pathversion", "schemeskill", "afterbefore", "tolist", "renderman", "dan piponi", "specialkey hi", "headers", "nontext hi", "jan hlavacek", "xuserblock", "for loop", "userblock", "null syn", "tracedrop", "daheartbeat", "slpregcomment", "spi file", "private public", "slrn score", "preben peppe", "guldberg", "age bytes", "syntaxsm", "smarty", "mon nov", "constant", "slice", "zeroc", "morel bodin", "smcl", "stata markup", "jeff pitblado", "jpitblado", "statasmcl", "directive", "smith", "smil", "herve foucher", "smil boston", "animation syn", "smlallerrs", "smlaenoparen", "fabrizio zeno", "cornelli", "zeno", "snns network", "snns http", "lln lun", "toff soff", "ctype syn", "snns", "maximum", "maximum output", "stringcomment", "initvalvalstr", "mono", "snobol4", "rafal sulejman", "site", "csnobol", "parens", "cothi", "afpnumkg", "spice circuit", "noam halevy", "insensitive syn", "spice", "splintallstuff", "splintannotelem", "ralf wildenhues", "splint home", "c code", "purpose", "buildinstall", "linux rpm", "freund", "ormeir", "wed oct", "spyce", "rimon barr", "rimon", "spupordinary", "input output", "spuptextproc", "type stream", "bugs", "execution", "snns result", "fishburn", "thu sep", "sqloracle", "buffer", "sqlforms", "austin ziegler", "prev change", "todo find", "xpos", "java syntax", "sqlj", "sap hana", "upper case", "upper", "schema syn", "user syn", "memory database", "sql syn", "spl syn", "comment syntax", "query language", "adaptive server", "anywhere", "xpscanf syn", "methods syn", "starea syn", "stcentroid syn", "stperimeter syn", "paul moore", "oracle nquote", "diffadd hi", "diffchange let", "section", "query report", "writer", "nathan stratton", "treadway", "jeff lanzarotta", "squid", "thanksto", "ilya sher", "iso8601", "subrip", "range syn", "ddd skipwhite", "bold", "sections syn", "override", "smalltalk", "arndt hesse", "hesse", "openssh client", "jakub jelen", "jakuje", "dominik fischer", "openssh server", "conditional", "repeats", "types", "globals", "statafuncgroup", "statamacrogroup", "stataparengroup", "rmcoll syn", "invftail", "invibeta", "haseprop", "mata", "structurizr dsl", "venthur", "hsiaoming yang", "lepture", "marc harter", "sudoersuser", "lazy", "generic", "swig", "julien marrec", "apache license", "runtime library", "vim maintainer", "emir sari", "nowarn", "i3confignumvar", "endze", "josef litos", "james eapen", "nargs syncolor", "nargs synlink", "syncolor type", "syncolor ignore", "syncolor added", "preproc synlink", "type synlink", "special synlink", "budden", "ingo karkat", "myk taylor", "install syntax", "syntax au", "systemverilog", "verilog syntax", "tads", "amir karger", "karger", "history info", "syntaxtags", "tak2", "tak3", "tak2000", "tak compare", "tak output", "load tak", "tar listing", "type let", "john florian", "wed jul", "key names", "values", "characters", "uuids syn", "rufus cable", "verbose tap", "rufus", "tap output", "pass", "foolman", "cmovsetj", "borland", "united force", "vector graphics", "verbose", "known template", "xfire user", "tcshvarlist", "tcsh", "gautam iyer", "ttlconstant", "term language", "tera term", "kcpy kcrt", "eenlrtbfs", "xhp xhpa", "xt xenl", "msgr", "tclspecialc", "tcltk", "taylor venable", "taylor", "system", "geometry", "tss syn", "typescript", "kao weiko", "jose elera", "campana", "zhao yi", "scott shattuck", "irc channel", "freenode", "vim filetype", "andy lester", "tt2topcluster", "typescriptreact", "react", "strpart", "include perl", "rawperl", "moriki", "atsushi", "ucnumber", "unrealscript", "openwrt unified", "colin caine", "fancy", "normal let", "typstcode", "matchgroupnoise", "noise highlight", "hashtag", "typstmarkup", "noise", "motif uil", "user interface", "thomas koehler", "september", "import hi", "anton", "prunefs", "prunenames", "prunepaths", "prunebindmounts", "upstart", "upstart job", "michael biebl", "biebl", "james hunt", "archivebit syn", "datelimit syn", "daysold syn", "deleted syn", "destination syn", "dirsonly syn", "drivealias syn", "filedate syn", "filedelete syn", "files syn", "msid", "innovation data", "rob owens", "ull ulls", "msg types", "ip address", "agtpcsrv", "profile", "version date", "ms windows", "action devpath", "valgrind memory", "debugger output", "roger luethi", "program url", "christoph gysin", "valve data", "tag syn", "wend", "prather", "pratam", "minor", "iskeyword", "xnor xor", "veraparengroup", "veralabelgroup", "vhdl", "linting", "vhsic", "high speed", "new style", "verilog", "mun johl", "485763", "vos cm", "andrew mcgill", "az syn", "bwlfdgh", "fdgh", "bwlqofdgh", "psect", "virata aconfig", "virata", "viratahexnumber", "execoptions", "ewind", "uffer", "malt", "wind", "vrmlevents", "vrmlfields", "vrmlcomment", "vrmlprotos", "vrmlnodes start", "externproto", "proto", "vgrindefs", "vgrindefs file", "profilesetzss", "java source", "parmp", "novimmain", "extern", "mswin", "featguimswin", "vimdll", "editnone", "level", "heading level", "vimtestsetup", "noop", "java language", "nontext", "returns", "chapter", "annotations", "labels", "text text", "tag head", "void", "htmlsnippets", "object", "object apply", "object bb", "no operation", "u003b", "n value", "pair", "long", "generics", "predicate", "vimtestsetup hi", "error import", "nontext class", "see jls", "declaration", "taggable", "binaryoperator", "i1 x", "i1 y", "string str", "taggable i1", "letters", "letters alpha", "letters beta", "tag tail", "use identity", "supplier", "tests", "identity", "comparable", "intfunction", "a dummy", "tggabl", "string s", "string tostring", "do not", "this file", "indent4", "indent2", "indent8", "tggabls", "fields", "classlock", "defines demo", "testable", "serviceloader", "malformed", "woof", "string s1", "string s2", "browns", "jumpss", "string s4", "string s6", "string apply", "string bay", "as quick", "woofs", "beta", "yieldable", "t yield", "other", "colon", "arrow", "unfoldenable", "italic", "strikethrough", "bold italic", "foobar", "modula2 pim", "test file", "colouring", "is licensed", "under the", "from system", "modula2 iso", "retain", "to do", "modula2 r10", "unsafe", "cardinal", "var abc", "variableb", "variablec", "var3", "var4", "var5", "var6", "variablea", "variabled", "variablee", "variable3", "varb", "variable1", "variable2", "varc", "vard", "variable4", "function1", "function4", "function2", "function3", "eq ne", "gt ge", "le lt", "ne gt", "ge le", "variableathis", "valsubfunc", "below", "reply", "issue", "cfoo", "ifoo", "interrupt", "ctrlc", "e123 catch", "varvalue", "cdpath", "backuptype", "defaultdevice", "executefbackup", "shall", "please wait", "buffer foo", "nargs range", "completer1 foo", "completer2 foo", "foo2", "bang", "nargs foo", "foo delcommand", "multiline", "commenttitle", "end augroup", "autocmd", "fixme call", "matched", "start not", "end not", "end call", "xterm call", "givename", "vim9", "test const", "foo def", "ex command", "dict", "end endfunction", "end enddef", "answer", "warningmsg", "endwhile", "dotest3", "dotest4", "dotest5", "dotest6", "test1", "test2", "test3", "test4", "test5", "funa", "dofuna", "funb", "dofunb", "func", "dofunc", "fund", "dofund", "foo delfunction", "foo function", "foo comment", "foo none", "guifg", "comment none", "ctermfgcyan", "end end", "end let", "end line", "end line1", "a basic", "rhs map", "foo bar", "fubar", "needle", "foogroup foo", "foogroup", "homeinclude", "defabc", "snomagicfoobar", "smagicfoobar", "special", "line comment", "b special", "char0x0044", "testcluster", "cchar", "keywords list", "vim line", "element", "x1f xf", "31 3", "u02a4 u000002a4", "string escape", "hexadecimal", "0xff echo", "decimal", "octal echo", "0377 echo", "vim shebang", "instance", "pairclasstest", "vim keymap", "end const", "expr", "foo unlet", "vim comment", "vim9 ex", "end foo", "xterm foo", "eof foo", "vim9script", "s vim9script", "12345", "0b10101010", "192939", "0777", "0o777", "0xabcdef00", "0x12345678", "runtest", "rticle", "syntax test", "file 0", "dougkearns", "2024 jun", "13 0", "test failures", "when comparing", "italicized text", "eading level", "igure", "eader", "frame", "diomatic text", "nput", "utput", "icture", "rogres", "cript", "earch", "ection", "elect", "reformat", "failure 0", "egend", "oscript", "bject", "ptgroup", "ption", "trong", "tyle", "able", "emplate", "extarea", "itle", "ource", "olgroup", "atalist", "etails", "ialog", "ieldset", "igcaption", "eleted text", "mphasis", "mbed", "side", "udio", "lockquote", "anvas", "aption", "ring at", "ideo", "cronym", "rame", "rameset", "arque", "enuitem", "rack", "narticulated an", "oframes", "trike", "ortal", "aram", "trikethrough", "highlighted", "elements have", "never be", "mage", "interface 0", "efault 0", "mport 0", "redundant", "tail", "alue", "nterface 0", "primer", "label 0", "tatic 0", "oid 0", "edundant", "identity cast", "expres", "to nest", "typeuse an", "htmlcom", "here is", "snip", "tmlsnip", "egion 0", "literal", "html com", "no entry", "point method", "code main", "return 0", "code nul", "eturn 0", "noop1", "may be", "used after", "noop2", "literalu0", "is proces", "return 8", "noop5", "nbsp", "noop6", "noop7", "link j0", "javaignorej0", "vimtestsetup s0", "fen 0", "nt 0", "majorversion", "empty string", "rotected 0", "compares this", "instance with", "the pas", "code that", "no period", "for the", "above sum", "rivate 0", "htmlsnip", "return an", "link m0", "execute", "match visual", "fen c0", "ref0", "literals", "clas", "tostring", "start 0", "ostring 0", "replace 0", "ubstring 0", "noop8", "noop9", "markdowncom", "arkdownsnip", "markdown com", "code public", "the method", "must be", "declared", "code 0", "the major", "java version", "used with", "inal 0", "markdownsnip", "blanks and", "re 0", "static void", "param a0", "rgs 0", "optional c0", "arguments 0", "invoke", "nontext 0", "hrow 0", "ew 0", "object module", "object open", "exports opens", "requires", "bject 0", "eplacement 0", "ar 0", "opens", "object opens", "object provides", "object requires", "object to", "uses", "xtends 0", "mplements 0", "ealed 0", "ermits 0", "bstract 0", "c1 i0", "noop3", "noop4", "a sum", "foldingtests", "static", "object b", "escapestests", "static final", "string hel", "har 0", "0ffffff0", "1200", "1210", "1230", "1240", "1250", "1260", "1270", "1300", "1310", "2040", "3240", "0100", "0120", "0130", "0140", "0150", "0160", "0170", "0200", "0210", "0230", "biginteger", "t1 x", "uper 0", "e element", "radix", "ecord 0", "tatic", "t dum", "isempty", "ublic 0", "ase 0", "ong 0", "witch 0", "genericstests", "todo 0", "3400", "3410", "3420", "3430", "3450", "3460", "3470", "3500", "3510", "3520", "sempty", "opal", "opsome", "ushal", "ushsome", "adix", "romdecimal", "lambdaexpres", "leftconst07", "leftconst08", "leftconst09", "i1 0", "leftconst10", "leftconst1", "leftconst01", "leftconst02", "leftconst03", "leftconst04", "leftconst05", "leftconst06", "leftconst", "const1", "const2", "witch", "hen 0", "alpha w0", "beta w0", "equals", "leftconst12", "typearguments", "identifier 0", "nteger", "ashcode", "omparable", "ry 0", "atch 0", "unction", "tring", "length", "ntfunction", "intsup", "clone", "naryoperator", "alueof", "quals", "redicate", "equalist", "gymnastics for", "ipredicate", "superequalist", "ethodhandle", "invokepredicate", "methodhandle mh", "throwable th", "a dum", "b dum", "t extends", "stringer", "ostring", "ntvalue", "onsumer", "println", "uperequalist", "nvokepredicate", "ethodhandle mh", "remember", "num 0", "asci", "stylable", "t e0", "tringer", "ative 0", "ynchronized 0", "trictfp 0", "thread", "qualist", "ransient 0", "methodstests", "string t0", "la s", "string name", "equires 0", "odule 0", "this module", "to the", "sample project", "published at", "mport m0", "related sup", "ransitive 0", "xports 0", "pens 0", "jdk 23", "ses 0", "rovides 0", "ith 0", "doautocmd", "syntax 0", "0xp0", "ouble 0", "minusoned", "xap1", "doto", "numberstests", "ouble", "loat 0", "maxdecf", "maxhexf", "mindecf", "minhexfa", "minhexfb", "maxdecd", "maxhexd", "minhex", "minoct", "minbin", "minusonehex", "minusoneoct", "minusonebin", "maxhexl", "maxoctl", "minusonehexl", "minusoneoctl", "minusonebinl", "jdk 21", "object o", "rue 0", "alse 0", "stringtests", "a quick", "brown fox", "jumps over", "the lazy", "there are", "lf after", "jumps0", "ver the0", "a nested", "string ap", "brown", "jumps", "over the", "nested com", "switchtests", "ield", "a or", "ield 0", "yte 0", "1let", "hort", "hort 0", "nofoldenable 0", "0000 0", "unfoldingtests", "reak 0", "old italic", "s1024", "talic", "inheritdoc", "object ap", "hile 0", "for vim", "file is", "licensed under", "the vim", "license 0", "efinition 0", "rom 0", "predefined", "ype 0", "ointer 0", "il 0", "nter", "ninter", "octal", "pragmas", "with emphasis", "opyright 0", "uthor 0", "fred flintstone", "icense 0", "baz bam", "ispose 0", "oc 0", "ord 0", "dr 0", "ast 0", "size 0", "rocedure 0", "egin 0", "nd 0", "ixme 0", "eprecated 0", "procedures", "ewfo", "nteger 0", "disabled", "hile fo", "do 0", "while", "synonyms", "itset 0", "roc 0", "roces", "ewproces", "ransfer 0", "ystem 0", "ongcard 0", "bozo bim", "dada jingle", "etbar", "lias 0", "defined pragmas", "numeric", "xcafed0", "inline", "noinline", "implementation", "cho 0", "this for", "done", "is a", "very handy", "solution and", "no real", "replacement", "available", "unction1", "a text", "shel", "his is", "home 0", "ariable10", "this is", "with a", "nset 0", "962 0", "f true", "unab", "abclear 0", "bclear 0", "java module", "changefilename", "restorefilename", "todo highlight", "author", "antonio colombo", "delete", "processing", "hebrew" ], "references": [ "vimrc", "bugreport.vim", "evim.vim", "delmenu.vim", "defaults.vim", "ftplugof.vim", "ftoff.vim", "gvim.desktop", "ftplugin.vim", "gvimrc_example.vim", "indent.vim", "indoff.vim", "mswin.vim", "scripts.vim", "optwin.vim", "vim.desktop", "menu.vim", "vimrc_example.vim", "synmenu.vim", "filetype.vim", "Make_mvc.mak", "Make_all.mak", "README.ru.utf-8.txt", "README.txt", "tutor", "tutor.bar.utf-8", "tutor.ca.utf-8", "tutor.bg.utf-8", "tutor.cs.utf-8", "tutor.da.utf-8", "tutor.de.utf-8", "tutor.el.utf-8", "tutor.eo.utf-8", "tutor.es.utf-8", "tutor.fr.utf-8", "tutor.hr.utf-8", "tutor.ja.utf-8", "tutor.hu.utf-8", "tutor.it.utf-8", "tutor.ko", "tutor.ko.utf-8", "tutor.lt.utf-8", "tutor.lv.utf-8", "tutor.nb.utf-8", "tutor.nl.utf-8", "tutor.no.utf-8", "tutor.pt.utf-8", "tutor.pl.utf-8", "tutor.ru.utf-8", "tutor.tr.utf-8", "tutor.sr.utf-8", "tutor.sv.utf-8", "tutor.sk.utf-8", "tutor.vim", "tutor.zh_cn.utf-8", "tutor.utf-8", "tutor.vi.utf-8", "tutor.uk.utf-8", "tutor.zh_tw.utf-8", "tutor.zh.utf-8", "vimspell.txt", "xcmdsrv_client.c", "ref", "vim132", "vimm", "vim_vs_net.cmd", "shtags.1", "unicode.vim", "shtags.pl", "ccfilter_README.txt", "blink.c", "efm_filter.txt", "demoserver.py", "ccfilter.c", "efm_filter.pl", "ccfilter.1", "efm_perl.pl", "pltags.pl", "mve.txt", "emoji_list.vim", "mve.awk", "a65.vim", "aap.vim", "abap.vim", "abc.vim", "abel.vim", "abaqus.vim", "acedb.vim", "a2ps.vim", "ada.vim", "ahdl.vim", "8th.vim", "aflex.vim", "aidl.vim", "2html.vim", "alsaconf.vim", "amiga.vim", "ampl.vim", "antlr4.vim", "apachestyle.vim", "apache.vim", "antlr.vim", "ant.vim", "aml.vim", "arch.vim", "aptconf.vim", "arduino.vim", "art.vim", "asm.vim", "asciidoc.vim", "asn.vim", "aspperl.vim", "asm68k.vim", "aspvbs.vim", "asteriskvm.vim", "atlas.vim", "asy.vim", "autodoc.vim", "autohotkey.vim", "autoit.vim", "automake.vim", "ave.vim", "asmh8300.vim", "avra.vim", "awk.vim", "astro.vim", "ayacc.vim", "asterisk.vim", "bash.vim", "b.vim", "bdf.vim", "bib.vim", "basic.vim", "bindzone.vim", "bc.vim", "blank.vim", "bitbake.vim", "bsdl.vim", "bst.vim", "bzl.vim", "btm.vim", "bzr.vim", "baan.vim", "cabal.vim", "cabalconfig.vim", "cabalproject.vim", "c.vim", "catalog.vim", "cdl.vim", "cdrdaoconf.vim", "cfg.vim", "cgdbrc.vim", "cf.vim", "cdrtoc.vim", "ch.vim", "chaiscript.vim", "change.vim", "chaskell.vim", "changelog.vim", "chatito.vim", "cheetah.vim", "chicken.vim", "chordpro.vim", "chill.vim", "calendar.vim", "chuck.vim", "clean.vim", "clipper.vim", "cmakecache.vim", "cl.vim", "cmod.vim", "cmusrc.vim", "coco.vim", "colortest.vim", "clojure.vim", "conf.vim", "config.vim", "confini.vim", "conaryrecipe.vim", "crm.vim", "cmake.vim", "crontab.vim", "cpp.vim", "context.vim", "csc.vim", "csh.vim", "cs.vim", "csp.vim", "csv.vim", "cterm.vim", "csdl.vim", "cobol.vim", "ctrlh.vim", "css.vim", "cuda.vim", "cuplsim.vim", "cvs.vim", "cweb.vim", "cvsrc.vim", "cucumber.vim", "cupl.vim", "cynpp.vim", "cynlib.vim", "deb822sources.vim", "dcd.vim", "d.vim", "dcl.vim", "dart.vim", "debchangelog.vim", "debcontrol.vim", "datascript.vim", "debcopyright.vim", "def.vim", "dep3patch.vim", "denyhosts.vim", "debsources.vim", "desc.vim", "dictconf.vim", "dictdconf.vim", "diff.vim", "dircolors.vim", "dirpager.vim", "diva.vim", "desktop.vim", "django.vim", "dns.vim", "docbksgml.vim", "docbkxml.vim", "docbk.vim", "dockerfile.vim", "dosbatch.vim", "dosini.vim", "dot.vim", "dracula.vim", "dsl.vim", "dtml.vim", "doxygen.vim", "dts.vim", "dtrace.vim", "dtd.vim", "dune.vim", "dylanintr.vim", "dylanlid.vim", "dylan.vim", "dnsmasq.vim", "editorconfig.vim", "edif.vim", "ecd.vim", "elmfilt.vim", "elf.vim", "elinks.vim", "eiffel.vim", "elm.vim", "erlang.vim", "esmtprc.vim", "esqlc.vim", "esterel.vim", "euphoria3.vim", "eterm.vim", "eruby.vim", "euphoria4.vim", "exim.vim", "expect.vim", "exports.vim", "eviews.vim", "fasm.vim", "fdcc.vim", "falcon.vim", "fan.vim", "fetchmail.vim", "fgl.vim", "fish.vim", "flexwiki.vim", "focexec.vim", "fpcmake.vim", "forth.vim", "form.vim", "framescript.vim", "foxpro.vim", "fortran.vim", "freebasic.vim", "fvwm2m4.vim", "fstab.vim", "fvwm.vim", "gdmo.vim", "gdresource.vim", "gdb.vim", "gemtext.vim", "gdshader.vim", "git.vim", "gift.vim", "gedcom.vim", "gdscript.vim", "gitattributes.vim", "gitcommit.vim", "gitconfig.vim", "gitignore.vim", "gitolite.vim", "gitrebase.vim", "gitsendemail.vim", "gkrellmrc.vim", "goaccess.vim", "glsl.vim", "godoc.vim", "go.vim", "gnuplot.vim", "gp.vim", "gpg.vim", "gprof.vim", "gretl.vim", "grads.vim", "gnash.vim", "groff.vim", "grub.vim", "groovy.vim", "gtkrc.vim", "group.vim", "gyp.vim", "gsp.vim", "gvpr.vim", "update_date.vim", "README.md", "gen_syntax_vim.vim", "vim.vim.base", "haml.vim", "hamster.vim", "hare.vim", "haredoc.vim", "haste.vim", "haskell.vim", "hastepreproc.vim", "hb.vim", "hcl.vim", "help_ru.vim", "hex.vim", "help.vim", "hercules.vim", "hgcommit.vim", "hitest.vim", "hlsplaylist.vim", "hog.vim", "hostsaccess.vim", "hostconf.vim", "htmlcheetah.vim", "htmlangular.vim", "html.vim", "htmlm4.vim", "htmlos.vim", "htmldjango.vim", "i3config.vim", "ia64.vim", "ibasic.vim", "icemenu.vim", "idlang.vim", "idl.vim", "icon.vim", "initex.vim", "initng.vim", "ipfilter.vim", "inittab.vim", "inform.vim", "j.vim", "iss.vim", "ishd.vim", "jal.vim", "ist.vim", "jam.vim", "jargon.vim", "javascript.vim", "javascriptreact.vim", "java.vim", "jinja.vim", "jess.vim", "jgraph.vim", "javacc.vim", "jq.vim", "jsp.vim", "json.vim", "jsonc.vim", "json5.vim", "kconfig.vim", "julia.vim", "kdl.vim", "kotlin.vim", "kix.vim", "kwt.vim", "krl.vim", "kscript.vim", "kivy.vim", "lace.vim", "latte.vim", "lc.vim", "ld.vim", "ldapconf.vim", "iso.vim", "pim.vim", "r10.vim", "ldif.vim", "less.vim", "lftp.vim", "lhaskell.vim", "libao.vim", "lex.vim", "lifelines.vim", "liquid.vim", "limits.vim", "lilo.vim", "lite.vim", "livebook.vim", "lisp.vim", "litestep.vim", "lotos.vim", "loginaccess.vim", "logtalk.vim", "logindefs.vim", "lout.vim", "lprolog.vim", "lpc.vim", "lsl.vim", "lscript.vim", "lss.vim", "luau.vim", "lua.vim", "lynx.vim", "lyrics.vim", "m3quake.vim", "m3build.vim", "m4.vim", "mailaliases.vim", "mail.vim", "mailcap.vim", "mallard.vim", "make.vim", "manual.vim", "manconf.vim", "mason.vim", "masm.vim", "maple.vim", "master.vim", "matlab.vim", "maxima.vim", "mermaid.vim", "meson.vim", "mediawiki.vim", "messages.vim", "mel.vim", "man.vim", "markdown.vim", "mf.vim", "mgp.vim", "mgl.vim", "mib.vim", "mix.vim", "mmix.vim", "mmp.vim", "modconf.vim", "model.vim", "mma.vim", "modula2.vim", "modula3.vim", "moo.vim", "mojo.vim", "monk.vim", "mp.vim", "mplayerconf.vim", "mrxvtrc.vim", "msmessages.vim", "msidl.vim", "msql.vim", "modsim3.vim", "murphi.vim", "mush.vim", "mupad.vim", "muttrc.vim", "mysql.vim", "named.vim", "nanorc.vim", "nastran.vim", "n1ql.vim", "natural.vim", "nasm.vim", "ncf.vim", "netrc.vim", "netrw.vim", "ninja.vim", "nix.vim", "nosyntax.vim", "nroff.vim", "neomuttrc.vim", "nsis.vim", "nqc.vim", "nginx.vim", "obj.vim", "objcpp.vim", "odin.vim", "occam.vim", "omnimark.vim", "ocaml.vim", "ondir.vim", "objc.vim", "openscad.vim", "openroad.vim", "opl.vim", "openvpn.vim", "obse.vim", "opam.vim", "pamenv.vim", "pacmanlog.vim", "ora.vim", "pamconf.vim", "pandoc.vim", "papp.vim", "pcap.vim", "pbtxt.vim", "pascal.vim", "passwd.vim", "pccts.vim", "pf.vim", "phtml.vim", "perl.vim", "pic.vim", "pdf.vim", "pilrc.vim", "pfmain.vim", "pike.vim", "pine.vim", "pinfo.vim", "plaintex.vim", "php.vim", "plm.vim", "plp.vim", "pli.vim", "pod.vim", "poefilter.vim", "po.vim", "ppd.vim", "pov.vim", "povini.vim", "ppwiz.vim", "plsql.vim", "prescribe.vim", "procmail.vim", "privoxy.vim", "prolog.vim", "promela.vim", "postscr.vim", "protocols.vim", "proto.vim", "psf.vim", "psl.vim", "ps1.vim", "purifylog.vim", "ptcap.vim", "pymanifest.vim", "pyrex.vim", "progress.vim", "python.vim", "python2.vim", "quarto.vim", "qf.vim", "quake.vim", "qb64.vim", "r.vim", "qml.vim", "radiance.vim", "racc.vim", "racket.vim", "raml.vim", "rasi.vim", "rc.vim", "ratpoison.vim", "rapid.vim", "raku.vim", "rcslog.vim", "rcs.vim", "rebol.vim", "readline.vim", "registry.vim", "rego.vim", "remind.vim", "requirements.vim", "reva.vim", "resolv.vim", "rhelp.vim", "rexx.vim", "rnc.vim", "rng.vim", "rnoweb.vim", "rib.vim", "redif.vim", "rrst.vim", "rpcgen.vim", "routeros.vim", "rpl.vim", "rmd.vim", "rtf.vim", "rst.vim", "salt.vim", "robots.vim", "samba.vim", "ruby.vim", "sas.vim", "sass.vim", "rust.vim", "sbt.vim", "scdoc.vim", "sather.vim", "scilab.vim", "scala.vim", "scheme.vim", "screen.vim", "scss.vim", "sd.vim", "sdc.vim", "sdl.vim", "sensors.vim", "sed.vim", "services.vim", "sendpr.vim", "setserial.vim", "sexplib.vim", "sgmldecl.vim", "sgmllnx.vim", "sh.vim", "sgml.vim", "context-data-metafun.vim", "context-data-tex.vim", "hgcommitDiff.vim", "context-data-context.vim", "context-data-interfaces.vim", "debversions.vim", "typescriptcommon.vim", "sicad.vim", "sil.vim", "simula.vim", "sinda.vim", "sindacmp.vim", "sindaout.vim", "sieve.vim", "skill.vim", "sl.vim", "sisu.vim", "slang.vim", "slpconf.vim", "slpreg.vim", "slpspi.vim", "slrnsc.vim", "sm.vim", "smarty.vim", "slice.vim", "smcl.vim", "smith.vim", "smil.vim", "sml.vim", "snnsnet.vim", "snnspat.vim", "slrnrc.vim", "snobol4.vim", "solidity.vim", "spice.vim", "splint.vim", "spec.vim", "specman.vim", "spyce.vim", "spup.vim", "snnsres.vim", "sql.vim", "sqlforms.vim", "sqlj.vim", "sqlhana.vim", "sqlinformix.vim", "sqlanywhere.vim", "sqloracle.vim", "srec.vim", "sqr.vim", "squirrel.vim", "squid.vim", "srt.vim", "ssa.vim", "st.vim", "sshconfig.vim", "sshdconfig.vim", "stp.vim", "stata.vim", "strace.vim", "structurizr.vim", "stylus.vim", "sudoers.vim", "swift.vim", "swig.vim", "swiftgyb.vim", "swayconfig.vim", "syncolor.vim", "svn.vim", "synload.vim", "sysctl.vim", "systemverilog.vim", "tads.vim", "tags.vim", "tak.vim", "takcmp.vim", "takout.vim", "tar.vim", "taskdata.vim", "taskedit.vim", "tap.vim", "tasm.vim", "svg.vim", "syntax.vim", "template.vim", "tcsh.vim", "teraterm.vim", "terminfo.vim", "terraform.vim", "systemd.vim", "tcl.vim", "tssgm.vim", "typescript.vim", "tsv.vim", "tt2js.vim", "tssop.vim", "typescriptreact.vim", "tt2.vim", "tt2html.vim", "uc.vim", "uci.vim", "typst.vim", "udevconf.vim", "udevperm.vim", "uil.vim", "unison.vim", "updatedb.vim", "upstart.vim", "upstreamdat.vim", "upstreaminstalllog.vim", "upstreamlog.vim", "upstreamrpt.vim", "usw2kagtlog.vim", "urlshortcut.vim", "udevrules.vim", "valgrind.vim", "vdf.vim", "vb.vim", "verilogams.vim", "vera.vim", "vhdl.vim", "viminfo.vim", "verilog.vim", "voscm.vim", "vmasm.vim", "virata.vim", "vim.vim", "vrml.vim", "vgrindefs.vim", "usserverlog.vim", "c.c", "html.html", "java_comments_markdown.java", "java_annotations_signature.java", "java_comments.java", "java_enfoldment.java", "java_escapes.java", "java_generics_signature.java", "java_generics.java", "java_contextual_keywords.java", "java_lambda_expressions_signature.java", "java_annotations.java", "java_lambda_expressions.java", "java_method_references_signature.java", "java_methods_indent4.java", "java_methods_indent2.java", "java_methods_indent4_signature.java", "java_methods_indent2_signature.java", "java_methods_indent8_signature.java", "java_methods_style.java", "java_module_info.java", "java_methods_style_signature.java", "java_numbers.java", "java_previews_430.java", "java_string.java", "java_previews_455.java", "java_switch.java", "java_methods_indent8.java", "java_unfoldment.java", "markdown_conceal.markdown", "modula2_pim.def", "modula2_iso.def", "modula2_r10.def", "progress_comments.p", "sh_02.sh", "sh_01.sh", "sh_04.sh", "sh_03.sh", "sh_05.sh", "sh_07.sh", "sh_09.sh", "sh_08.sh", "sh_10.sh", "sh_11.sh", "vim_ex_abbreviate.vim", "vim_ex_behave.vim", "vim_ex_call.vim", "vim_ex_catch.vim", "sh_06.sh", "vim_ex_command.vim", "vim_ex_comment_strings.vim", "vim_ex_comment-vim9.vim", "vim_ex_comment.vim", "vim_ex_augroup.vim", "vim_ex_commands.vim", "vim_ex_def_nested.vim", "vim_ex_def_nested_fold.vim", "vim_ex_def_fold.vim", "vim_ex_def.vim", "vim_ex_echo.vim", "vim_ex_execute.vim", "vim_ex_function_def_tail_comment_errors.vim", "vim_ex_function_def_tail_comments.vim", "vim_ex_function_nested_fold.vim", "vim_ex_function_nested.vim", "vim_ex_function_fold.vim", "vim_ex_highlight.vim", "vim_ex_let_heredoc.vim", "vim_ex_loadkeymap_after_bar.vim", "vim_ex_loadkeymap_after_colon.vim", "vim_ex_map.vim", "vim_ex_function.vim", "vim_ex_menu.vim", "vim_ex_menutranslate.vim", "vim_ex_no_comment_strings.vim", "vim_ex_match.vim", "vim_ex_range.vim", "vim_ex_set.vim", "vim_ex_sleep.vim", "vim_ex_substitute.vim", "vim_ex_throw.vim", "vim_keymap.vim", "vim_ex_syntax.vim", "vim_key_notation.vim", "vim_line_continuation.vim", "vim_expr.vim", "vim_new.vim", "vim_shebang.vim", "vim_object_methods.vim", "vim_variables.vim", "vim9_ex_comment_strings.vim", "vim9_ex_commands.vim", "vim9_ex_no_comment_strings.vim", "vim9_ex_function_def_tail_comments.vim", "vim9_expr.vim", "vim9_keymap.vim", "vim9_ex_function_def_tail_comment_errors.vim", "vim9_legacy_header_fold.vim", "vim9_legacy_header.vim", "vim9_shebang.vim", "yaml.yaml", "dots_03", "dots_05", "dots_02", "dots_04", "dots_01", "dots_06", "dots_08", "dots_09", "dots_10", "dots_07", "dots_11", "dots_12", "dots_14", "dots_13", "dots_15", "dots_16", "dots_17", "dots_18", "dots_19", "dots_20", "html_00.dump", "html_03.dump", "html_05.dump", "html_04.dump", "html_06.dump", "html_02.dump", "html_01.dump", "html_07.dump", "html_08.dump", "java_annotations_01.dump", "java_annotations_00.dump", "java_annotations_02.dump", "java_annotations_03.dump", "java_annotations_04.dump", "java_annotations_signature_00.dump", "java_annotations_signature_02.dump", "java_annotations_signature_01.dump", "java_annotations_signature_03.dump", "java_annotations_signature_04.dump", "java_comments_html_01.dump", "java_comments_html_02.dump", "java_comments_html_03.dump", "java_comments_html_00.dump", "java_comments_html_04.dump", "java_comments_html_05.dump", "java_comments_markdown_00.dump", "java_comments_html_07.dump", "java_comments_markdown_03.dump", "java_comments_markdown_01.dump", "java_comments_html_06.dump", "java_comments_markdown_04.dump", "java_comments_markdown_02.dump", "java_comments_markdown_05.dump", "java_comments_markdown_06.dump", "java_comments_markdown_07.dump", "java_contextual_keywords_00.dump", "java_comments_markdown_08.dump", "java_contextual_keywords_01.dump", "java_contextual_keywords_02.dump", "java_enfoldment_01.dump", "java_contextual_keywords_03.dump", "java_enfoldment_00.dump", "java_enfoldment_02.dump", "java_escapes_00.dump", "java_escapes_01.dump", "java_escapes_03.dump", "java_escapes_05.dump", "java_escapes_07.dump", "java_escapes_02.dump", "java_escapes_06.dump", "java_generics_01.dump", "java_generics_03.dump", "java_generics_02.dump", "java_generics_04.dump", "java_generics_05.dump", "java_generics_07.dump", "java_generics_00.dump", "java_generics_06.dump", "java_escapes_04.dump", "java_generics_signature_00.dump", "java_generics_signature_01.dump", "java_generics_signature_02.dump", "java_generics_signature_03.dump", "java_generics_signature_04.dump", "java_generics_signature_05.dump", "java_generics_signature_07.dump", "java_generics_signature_06.dump", "java_lambda_expressions_00.dump", "java_lambda_expressions_01.dump", "java_lambda_expressions_03.dump", "java_lambda_expressions_02.dump", "java_lambda_expressions_04.dump", "java_lambda_expressions_05.dump", "java_lambda_expressions_06.dump", "java_lambda_expressions_07.dump", "java_lambda_expressions_08.dump", "java_lambda_expressions_signature_00.dump", "java_lambda_expressions_signature_01.dump", "java_lambda_expressions_signature_02.dump", "java_lambda_expressions_signature_03.dump", "java_lambda_expressions_signature_04.dump", "java_lambda_expressions_signature_05.dump", "java_lambda_expressions_signature_06.dump", "java_lambda_expressions_signature_07.dump", "java_lambda_expressions_signature_08.dump", "java_method_references_00.dump", "java_method_references_01.dump", "java_method_references_03.dump", "java_method_references_04.dump", "java_method_references_06.dump", "java_method_references_05.dump", "java_method_references_07.dump", "java_method_references_08.dump", "java_method_references_09.dump", "java_method_references_10.dump", "java_method_references_signature_00.dump", "java_method_references_signature_01.dump", "java_method_references_02.dump", "java_method_references_signature_02.dump", "java_method_references_signature_03.dump", "java_method_references_signature_04.dump", "java_method_references_signature_05.dump", "java_method_references_signature_07.dump", "java_method_references_signature_08.dump", "java_method_references_signature_09.dump", "java_methods_indent2_00.dump", "java_methods_indent2_00.vim", "java_methods_indent2_01.dump", "java_methods_indent2_01.vim", "java_methods_indent2_02.dump", "java_methods_indent2_02.vim", "java_method_references_signature_10.dump", "java_methods_indent2_03.vim", "java_methods_indent2_03.dump", "java_methods_indent2_04.dump", "java_methods_indent2_04.vim", "java_methods_indent2_05.dump", "java_methods_indent2_05.vim", "java_method_references_signature_06.dump", "java_methods_indent2_signature_00.vim", "java_methods_indent2_signature_01.dump", "java_methods_indent2_signature_01.vim", "java_methods_indent2_signature_02.dump", "java_methods_indent2_signature_02.vim", "java_methods_indent2_signature_03.dump", "java_methods_indent2_signature_03.vim", "java_methods_indent2_signature_04.dump", "java_methods_indent2_signature_04.vim", "java_methods_indent2_signature_05.dump", "java_methods_indent2_signature_05.vim", "java_methods_indent4_00.vim", "java_methods_indent4_01.vim", "java_methods_indent4_01.dump", "java_methods_indent4_02.dump", "java_methods_indent2_signature_00.dump", "java_methods_indent4_02.vim", "java_methods_indent4_03.vim", "java_methods_indent4_03.dump", "java_methods_indent4_04.dump", "java_methods_indent4_04.vim", "java_methods_indent4_05.dump", "java_methods_indent4_06.dump", "java_methods_indent4_05.vim", "java_methods_indent4_signature_00.dump", "java_methods_indent4_signature_01.dump", "java_methods_indent4_signature_01.vim", "java_methods_indent4_signature_02.dump", "java_methods_indent4_signature_02.vim", "java_methods_indent4_signature_03.dump", "java_methods_indent4_signature_03.vim", "java_methods_indent4_signature_04.dump", "java_methods_indent4_signature_04.vim", "java_methods_indent4_signature_05.dump", "java_methods_indent4_signature_05.vim", "java_methods_indent8_00.dump", "java_methods_indent4_signature_06.dump", "java_methods_indent8_00.vim", "java_methods_indent8_01.dump", "java_methods_indent8_01.vim", "java_methods_indent4_signature_00.vim", "java_methods_indent8_02.dump", "java_methods_indent8_02.vim", "java_methods_indent8_03.dump", "java_methods_indent8_03.vim", "java_methods_indent8_04.dump", "java_methods_indent8_05.dump", "java_methods_indent8_06.dump", "java_methods_indent8_05.vim", "java_methods_indent8_signature_00.dump", "java_methods_indent8_signature_01.dump", "java_methods_indent8_signature_01.vim", "java_methods_indent8_signature_02.dump", "java_methods_indent8_signature_02.vim", "java_methods_indent8_signature_00.vim", "java_methods_indent8_signature_03.dump", "java_methods_indent8_signature_03.vim", "java_methods_indent8_signature_04.dump", "java_methods_indent8_signature_04.vim", "java_methods_indent8_signature_05.vim", "java_methods_indent8_signature_05.dump", "java_methods_indent8_signature_06.dump", "java_methods_indent8_signature_06.vim", "java_methods_style_00.dump", "java_methods_style_00.vim", "java_methods_style_01.vim", "java_methods_style_02.vim", "java_methods_indent8_04.vim", "java_methods_style_03.dump", "java_methods_style_04.dump", "java_methods_style_02.dump", "java_methods_style_signature_00.dump", "java_methods_style_signature_00.vim", "java_methods_style_signature_01.vim", "java_methods_style_03.vim", "java_methods_style_signature_02.vim", "java_methods_style_01.dump", "java_methods_style_signature_03.dump", "java_methods_style_signature_03.vim", "java_methods_style_signature_04.dump", "java_methods_style_signature_01.dump", "java_module_info_00.dump", "java_methods_style_04.vim", "java_module_info_01.dump", "java_module_info_02.dump", "java_numbers_01.dump", "java_numbers_02.dump", "java_methods_style_signature_04.vim", "java_numbers_00.dump", "java_numbers_03.dump", "java_numbers_04.dump", "java_numbers_05.dump", "java_previews_430_00.dump", "java_previews_455_00.dump", "java_previews_455_01.dump", "java_previews_455_02.dump", "java_previews_455_03.dump", "java_methods_style_signature_02.dump", "java_methods_indent4_00.dump", "java_string_00.dump", "java_string_01.dump", "java_string_02.dump", "java_string_04.dump", "java_string_03.dump", "java_string_05.dump", "java_switch_00.dump", "java_switch_02.dump", "java_switch_01.dump", "java_switch_04.dump", "java_switch_03.dump", "java_switch_05.dump", "java_switch_07.dump", "java_unfoldment_00.dump", "java_switch_06.dump", "java_unfoldment_01.dump", "java_unfoldment_05.dump", "java_unfoldment_02.dump", "markdown_conceal_00.dump", "java_unfoldment_03.dump", "modula2_iso_00.dump", "modula2_iso_01.dump", "modula2_iso_03.dump", "modula2_iso_02.dump", "modula2_iso_04.dump", "modula2_iso_05.dump", "modula2_pim_00.dump", "modula2_iso_06.dump", "modula2_pim_01.dump", "modula2_pim_02.dump", "modula2_pim_03.dump", "modula2_pim_04.dump", "modula2_pim_06.dump", "modula2_pim_05.dump", "modula2_r10_00.dump", "modula2_r10_03.dump", "sh_07_01.dump", "sh_08_02.dump", "sh_11_00.dump", "vim_ex_abbreviate_01.dump", "vim_ex_command_00.dump", "java_module_info.vim", "markdown_conceal.vim", "cleanadd.vim", "yi.vim", "he.vim" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Esc", "display_name": "Esc", "target": null }, { "id": "SelectAll", "display_name": "SelectAll", "target": null }, { "id": "Vim Tutor", "display_name": "Vim Tutor", "target": null }, { "id": "Todo", "display_name": "Todo", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1030", "name": "Data Transfer Size Limits", "display_name": "T1030 - Data Transfer Size Limits" } ], "industries": [], "TLP": "white", "cloned_from": "67a7efe28a685d9a19cc0417", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "email": 520, "hostname": 407, "URL": 1044, "FileHash-SHA1": 8, "domain": 244, "FileHash-SHA256": 375, "FileHash-MD5": 4 }, "indicator_count": 2603, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "22 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d5f37c65fbf136884dae98", "name": "CAPE Sandbox RIP.exe BLOODBANK.exe", "description": "A Cuckoo executable, for MS Windows, runs at 12:12:57 on the morning of 11 November, 2024, and ends in an unauthorised binary that ends up in a box full of data.- rip.exe tied to a gov domain is a treat.", "modified": "2026-05-08T06:44:52.553000", "created": "2026-04-08T06:19:40.539000", "tags": [ "shell folders", "cname", "ip address", "nothing", "registry keys", "cape sandbox", "file type", "file size", "sha256", "mwdb", "accept", "shutdown", "windows sandbox", "calls process", "nethandle", "net1510000", "fastly", "skyca3", "po box", "city", "san francisco", "stateprov", "postalcode", "orgtechhandle", "orgnochandle", "orgid", "orgabuseref", "orgname", "cidr", "text process", "user", "default", "xport", "use my", "gmt ifnonematch", "microsoft excel", "pe file", "https", "contains", "spawns", "reads", "aslr", "seterrormode", "window", "malicious", "next", "csv text", "ascii text", "process", "queries memory", "network info", "dropped info", "persistence", "javascript", "please", "strong", "toggle", "mitre att", "advapi32", "windows", "dynamicloader", "sspicli", "name", "pid parent", "first", "threads", "path", "pegasus", "crypt32", "virustotal", "enterprise", "service", "close", "performs dns", "urls", "found", "united", "jpeg image", "jfif", "json", "tls version", "mitre attack", "creates", "phishing", "clear filters", "thumbprint", "temp", "full path", "windir", "behavior", "selfdeleting", "bat file", "address", "port", "report", "system process", "downloads", "binary", "hxojc8o", "signatures", "success", "regopenkeyexw", "regopenkeyexa", "hkeycurrentuser", "hkeyclassesroot", "createfilew", "regcreatekeyexw", "regsetvalueexw", "genericread", "readfile", "desktop", "webview", "fail" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/6c375dc240faf5cde2a8eafd44351309edfa18c7e11ea52c2437701584ec2579_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775626394&Signature=mjMxHo8L7UrEZ%2B0mpGMaevi%2Fnyxg566NrZjoVPOa6T3Cbyv9SjUxWf%2BLTZqUG6wgBgPDMrC9WYvpluFNlA3a8CmS9FgO5Wk4ihVivuBtOPhisX8aQoky6AhLHqi%2FTU6pVryey1kfBt6MlRl0gEZ6OJtKADUb2hPUfxXN0b6zIDrBlBpDlzmi73JWdo%2BTl7HWhJzFk%2FDQy3DniCvgLRSPVSK0WPg%2BpvgzruUYB%2F5pkH20cP", "https://vtbehaviour.commondatastorage.googleapis.com/1d5f970b7378625145832550f06d4eb5543258aee214e4d72172e4018c2d88a3_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775626418&Signature=TwvqChaO8lqc0vzwz%2BZ7W7IIwZZZt6%2FhJ4DzgyGjlwl%2Bev3Aj3iyAMtUxNhwGhTz10UGTbYuZcmLUPKLpQ81mgT%2B8axs57DfzVt1BoJTH5lWYK%2BOI8LDJGXD8tZ8DGKuNa6dHqqdQ9gDvuEpnhGfMmpJovXa%2B0drHScs%2BE%2FQKF%2BRTqOXjfSVxMdoqYnlB3zMc6AU2CYPv%2FE1mP06q5yCaRjgA0aIcnf7ADr9", "https://vtbehaviour.commondatastorage.googleapis.com/6c375dc240faf5cde2a8eafd44351309edfa18c7e11ea52c2437701584ec2579_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775626474&Signature=kfjlpWuwZbaZbbP6fMcuay73HaFSKrqF520LJELy0GSL34yjKdsQSvLU8g4sBtj69rWQb6rJwENSsxoLQizFVcBSn04iqFQqS6VlgbQsMMJd57JpVb9gcQPuRc5iP37IN5crnnQjwWgIDQAxcMFVgX8L2SW2Eji5xGKVeIoJ6MJFYKxoyfiZD3779nqt8YvoaK1E4DWe5%2F9TzZWks0%2BaP5dwYHpoPnvYsj4k0X61JFQChNE5cZcNNbUH8i", "https://vtbehaviour.commondatastorage.googleapis.com/1d5f970b7378625145832550f06d4eb5543258aee214e4d72172e4018c2d88a3_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775626915&Signature=A8EIjrcllVER4J%2FPzV2FRPV1NC%2FPha6J1APjMga6WlTRSe%2By092MDDTg4tF9ILYLxQtuQgmgwx93nasQfll6ffrd12FvlAsin2zj4vtdTT4AcIXmxJcKO0d%2FoLnozrBzi1R36TlEknCbXkqQPX%2BdvF%2BwroU1F61f6IOtIfgIK2uxK0KIG5I41N7fQcNOUNIwHoCvfAlSb2OqY1V4ESvWxMJ4MjdBn%2F%2B%2FUAOfpOh%2B7c", "https://vtbehaviour.commondatastorage.googleapis.com/1d4dd113c9924d71398d9db20e2fcf347cad29c3d3bdc9612a44dfd47c1971aa_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775627160&Signature=K5%2FGwGNRKy0XCvva8zcyKHnsarNPNRQXXQI%2FV%2B1Susn9nmU9j%2Fm1SKT0f3LpBrVV5dyaLLy%2FYMPBmGKun3XY4WEmEl0KQkg17reIGCcLSeFbgDwpUm2DyN3ENt5d%2BkePCG6FvM5jUx7Cpf1ZTyw0PYePphEx1shaRArarvvSWz1kosuQhe%2BZ8tBYqt1c35e7%2BjQrwmLeZ489ungWsKJvhuXHetKJVJVEhY%2FLb3%2FBgTDodLwx3l", "https://vtbehaviour.commondatastorage.googleapis.com/0526bc88565de11e5c67b8e01590ba1184e3c6130fc1ced3d1ecacb00c51a7fa_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775627259&Signature=LB8UpSFAWpkptxq2TpSlVUjgaYsD8ZVxTie7HZDfh0FJ9h5o0dlAfn3fQ2KoL66TnUg2S0MIsEXMxl5O%2BL%2FFPweNRNyFyFK8M4aHPEHTZZlcAopz6ofdP7b0rYACYLl%2BH51rdDSCCDGVFB2AxZXaz54b748ZJBd0lCSxvueW2MVVLJcFl5w4hcNIIwnXuHCQD02rsYzffmjBIO6CC1hPulQwohf%2FTZKDK5iuOAhPoVWWswdroV2A7M6M6PUg9g", "https://vtbehaviour.commondatastorage.googleapis.com/1d5f970b7378625145832550f06d4eb5543258aee214e4d72172e4018c2d88a3_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775627300&Signature=ZqM8a%2BUX0F1D8t51nlp1%2BcYFN0ozRLI92p85KFn1f3Aey19YDGw%2BAAEbxD1JMvi%2BsMRGGfYTPACg4h9DM0VFKT8yq4FOOqED%2FO17EAyZrz6YSyQcMMnozviy%2B%2FdpS0Sqd8sas9FdpgcUAS%2FzEEcqa%2FsQVtkpv2rp9BZLKqvbpquNXBlA9rnKzvbtNwEP7meNDc%2FXDspVqf%2Frb9bWY8uHq7hJl6pMWknVtV", "https://vtbehaviour.commondatastorage.googleapis.com/faa6f8935bf337bb6f98bfe73e3b74f6e785da6929775e6bacbbd20d90ecf2c3_SNDBOX.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775627494&Signature=lBb52t94Lck4SSu4FORagQFNGojj5%2Bi7JRPlb68HqacyPusyn33LTlV%2F72P5M52r2EZ8ylUROPiRnCRBg0ry%2B2D1ctl1uWtP%2F1HDdBpnbxxUtkcM97MGzmUbIfTSOAsXsbB3f4Y6ZOIM%2BLYzCo%2BxwRmun4K%2Bo8K3mYHMatcF3mBtKcBPnP7WM5%2FHTz3XqJGMH9TCDIfe7j%2F3SAnx7X0tt0BgUcwPe4OkmHkUutihMBfek2MBp%2B", "https://vtbehaviour.commondatastorage.googleapis.com/0526bc88565de11e5c67b8e01590ba1184e3c6130fc1ced3d1ecacb00c51a7fa_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775627608&Signature=nc6gUdC0NeDtHUOIT6P0pC0i9EKDBHTO%2BMbcwHvgjPzFPqDFGMq%2Fei9aUhg8ub9H4poa985bQO4xz1xEEOmGhEihgwKvDZ5u0QETkzbQJLxzzm5g9t%2Fx4iBeBHToQjDXdMrSu0ML%2FYBep0l%2F%2BkYortodmtnjHYhAEYOOLSZn4gSAWaPoq5vxXF9gtsRojKf9RIk5VuzDXFGY6BGsDKn2tch7nTJ3SmYKodEv4iWyVn4jp5g%2B4", "https://vtbehaviour.commondatastorage.googleapis.com/0c5a10f10eb29b8251a5dfe15fa74f7e25c281b4f9be7c87839a9ae3d34dfe6d_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775627783&Signature=FHIZFXnHZsAaWvZbG2O1vXTFfRz6BqTP8ikzyyXMpZ4VG6WEVnK3yHhhrnLfoLQqUCUgXvWOb1ThHRM6WXJGEx4jLnKM%2Fp6YkHmVEj1nFXBd%2BQ0IPGVwZRJfZcttoBFwmLwJ%2BTXEzUvqX%2FTXDGgeIKFac4IFl%2FGXPEmxi43CSXwZsWuD5CLfaHxEu65DvnuniHqPovnhBOp%2B2rEM2jSLgHuouV%2B9LiZwjgsSXeUVh1BFN5XrPPojB0Lk", "https://vtbehaviour.commondatastorage.googleapis.com/644031a68bde879af85bcc9cb3e6fa1e9a6b0f61d49307581974b5dbc09d3de8_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775628069&Signature=Tqx0WDIqoieH9yCo18tkPUdcYvTU0l0vEGnEzncxScNgePm2%2Bm5dMzcVkPb2dN4j43pL0c6xFpyqUmgcAaV4yJd1bWnukU%2FSoTPxrfzwEEPlXeMoapx9eeELYqF6WZWyor0m%2F4qv%2FuaYFkLWO2D8iOkqIiaNQBvu6nVuNBM3I%2FkrnXhWRxt3C8KQlAF%2Fo3ft05L0QBoJH6mQquOx2C777xrO6tjr31CGKjIMIAih66ud8Oskb57I%2B6zt", "https://vtbehaviour.commondatastorage.googleapis.com/aa2691bc8ec9abf5359396a356551d1e2de12c9c5035c259650650ced6607c6f_VirusTotal%20R2DBox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775628175&Signature=C%2Bm0zPP%2FHfqcIuof%2F2O%2F0UbWPaY37tDrVB%2FZMr2M9H%2BjPTiynLMHNyn5vNT97ndboi7U21mT93t30I4UMIqdICdXtc%2BlGG7rYgE2ruFbI6U%2BBxHCmlKEUYh1FZY%2BPsskjCqojS2K4I1w%2BfsLyUwkpsGHzh92WF%2B5h5FbNY5PySi2Fd3B4ns1okQyrU6i%2F0PdPGs%2BjnHvLfdB%2Bx%2FOjTJPOcKqkwk", "https://vtbehaviour.commondatastorage.googleapis.com/6c375dc240faf5cde2a8eafd44351309edfa18c7e11ea52c2437701584ec2579_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775628363&Signature=dlMT8ox9JTkziQZLJ6FL%2BRBc%2Fz%2BeAIvgi4qr%2FO3pMT9vAKLgbGFgQum2bJ74s07XpftMHPBj1fCgNY5xK7EIouHXhmpyiD%2B5zsfcKaNckOkNoIo6A9%2FfM6g42hN5djOg3pDclOqwj0ECuBWrtZXqZcrc5nv%2BU51qwqs6AAkIaiZWOX341r7RHPc49dpGRK0DG1XQDRGxacXm5erHEQmAAO8I8yR%2FzKT%2BZ6EJK6xC99uC", "https://vtbehaviour.commondatastorage.googleapis.com/000001ea2ae617d6de171f648d2683ff43b52cc01bc077f131cfd1be7549704a_Dr.Web%20vxCube.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775628967&Signature=cw9IN04sKdFEDdQTLeqNWDt35Spbg0yI2vZFSrsk%2FJ6%2BD%2BRC5pt7QZKTQlutBh8zpYG9b4%2F7TjCFxf5jo1s6uYpiVA8s%2F5c5ZVy2Ia387UGrip6kYJ9s2cfp%2BgQ1o2RHEQRhukeRqR6uQpb87IVhWb1VjeABoOqT%2Buy%2BeXUckwOcInk8tcs9wCI1xhRe3raMJ1EC1gIdXCGzMqLU%2F874cclP6LWAUiQ08FPQe8VZtob", "https://vtbehaviour.commondatastorage.googleapis.com/012f268838dbc4f0877ea47f272bcd5acdc15ac4584c3d3cddeae2f5107d09de_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775629156&Signature=qIGYvmHwkDg5a1aWpPn%2FCFierOaHWS9Gyvi4Owjd4sJ7YytEl%2F5qxIIpo84v%2F7J%2BvxGYG9PrPDBHbH5jiJc2VOMkKroiRdzapAh%2FFwXVnVhn%2FCJ1eu6xMH2KJ6bs578zBbSbt6QJ2KPBU2E7RJQ5o%2FxLV93YjttPgspSTvjqiC1vCSwx78AdV7nt4xmxTCpqZB3OJuH%2ByROH7tWED9Qzq%2BVgwf7AmK9UrFuIKnmo07prAMKfo1k1", "https://vtcuckoo.commondatastorage.googleapis.com/000001ea2ae617d6de171f648d2683ff43b52cc01bc077f131cfd1be7549704a?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775629192&Signature=gnfHVeS3e3cryOoChL6czgBUI9mEJwFk8OZ22bAN4U7V1r1yCjBq7i3y7Sarv1O34zp2Yabguk5BQI4cgnZ64Dj1uLdrx9dUaYo%2FzBoITjzCiJ7djJCvB0alIiIw%2Bok%2BqRGGtIFbrfS61QNeDiXmFpeD1d%2F1lGe8ZoBd0nLLqtP5xdbRALcJbrvbCeln9nFuu199svtMraGxafiWFWiEC4GRx1BmdMZYVqC%2B%2FukhirOXs7MyPd6i1%2FsSjSWfGa8ss4pgIMD" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 164, "FileHash-SHA1": 161, "FileHash-SHA256": 463, "domain": 56, "hostname": 396, "URL": 456, "CIDR": 1, "email": 7 }, "indicator_count": 1704, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "23 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4f2d9ce86a445b484593b", "name": "VirusTotal report\n for sample.crx", "description": "A small sample of malware has been identified by researchers at the University of Oregon in the US, and the results are published on the web, as well as on Google's Chrome extension and other sites.", "modified": "2026-05-07T12:05:50.774000", "created": "2026-04-07T12:04:41.097000", "tags": [ "file type", "json", "ascii text", "png image", "crlf line", "ascii", "rgba", "unicode text", "utf8 text", "defense evasion", "malicious" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 668, "FileHash-MD5": 668, "FileHash-SHA1": 675, "URL": 153, "domain": 230, "hostname": 177, "email": 2 }, "indicator_count": 2573, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "23 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4f2db0b3448671adcce16", "name": "VirusTotal report\n for sample.crx", "description": "A small sample of malware has been identified by researchers at the University of Oregon in the US, and the results are published on the web, as well as on Google's Chrome extension and other sites.", "modified": "2026-05-07T12:05:50.774000", "created": "2026-04-07T12:04:43.156000", "tags": [ "file type", "json", "ascii text", "png image", "crlf line", "ascii", "rgba", "unicode text", "utf8 text", "defense evasion", "malicious" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 668, "FileHash-MD5": 668, "FileHash-SHA1": 675, "URL": 153, "domain": 230, "hostname": 177, "email": 2 }, "indicator_count": 2573, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "23 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4f2dd828bbf0ac5efaa23", "name": "VirusTotal report\n for sample.crx", "description": "A small sample of malware has been identified by researchers at the University of Oregon in the US, and the results are published on the web, as well as on Google's Chrome extension and other sites.", "modified": "2026-05-07T12:05:50.774000", "created": "2026-04-07T12:04:44.957000", "tags": [ "file type", "json", "ascii text", "png image", "crlf line", "ascii", "rgba", "unicode text", "utf8 text", "defense evasion", "malicious" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 668, "FileHash-MD5": 668, "FileHash-SHA1": 675, "URL": 153, "domain": 230, "hostname": 177, "email": 2 }, "indicator_count": 2573, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "23 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d46ee073b843b1b52f59a2", "name": "VirusTotal report\n for l-Management-System-School-ERP-nulled-by-CodeAlright.Com.zip", "description": "A look at the results of a report generated by the University of California, Los Angeles (UCLA) and compiled by codecanyon, a university-instikit and an academy.", "modified": "2026-05-07T02:13:20.636000", "created": "2026-04-07T02:41:36.582000", "tags": [ "file type", "unix", "mitre attack", "network info", "wed jun", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "persistence", "malicious", "next", "newstoday2", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "file", "operations", "process open", "python", "javascript", "html", "sample", "test", "urls", "united", "extra info", "uncomment", "performs dns", "layer protocol", "attack network", "info dropped", "info processes", "info", "may try", "ascii text", "png image", "https", "reads cpu", "tls version", "ascii", "usrliblog" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/01f57cc95906a44558c5c1f19ef3191fe6f2f1cc03e1d10d1da421b7c604903f_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529261&Signature=RJNKrp%2FaK0APCyfk557hpXXr%2BMWPGME1nJO1%2BQCUEm9xRuKB0DlxP%2BfDSiZsLcJsAhaI%2FWxbH%2F%2FdbHllDXKgjJl92HzsTFyTAT0eMx%2BzlFLXKn0VyBmCHKLgKoFS4fDODUKy6SKJxdUav7aDP1aVhAXMPp%2BT3yWjDdSos0HQalqAt%2FcsVg1w28zfPjvVVGv%2B%2FvJeCIgzhXeE2pX6Npumx67Yym8jiiqV75WoDu", "https://vtbehaviour.commondatastorage.googleapis.com/00913627185b352deaf0ec837f85a7f606b27112956875de5d610fba8151306c_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529477&Signature=s8ZCWLcVqjdBgBGejTcqippuMvftwgsdUQHUAjBnm45yUvqDsHIMIA29%2BJcb%2BrruXxHPD5tQv1BwAzlV1o7EuhxX4qMqDcFWSLqoc%2FqAnEVxLg0zXohtwMkHxv0z%2Bp5AL0jLyAwNYz7bH56tnmUs3tHPYc48OeM4AanV030U%2FnmXlF8kJ6cjAemipfTNe1QRx3ecbONm9c3B51FK0BbzZEdRX0pTHIM4AK1M", "https://vtbehaviour.commondatastorage.googleapis.com/0347ed7ffd09f6728c494128b1d11792893d5cde9e4effdc2bcc8f9ebb12a0e1_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529533&Signature=diQ6r2CuvkDxYGybQtlzxVxtH8iGMt6XlgZBEpk7B5n%2FVtwOuZaPpuNyM%2Fr4VbSp2H67%2FddXTZ3XJG8LdUMwLVXsSDKIq%2BjyQHccTuCS0HXEDbllONqfU6gWICxxtdC%2F4wdaL8fVyCE%2FHHcnWm5PufAa002Tn02MbSx9cFdNZS4R86MEMARaMiXSCiGQuiLR2STQCGqU%2Byg16ky%2FYjPbLtB6WD5skgEs3AgDmDNlDLjtbb", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529640&Signature=G0ONarqL7o1MkYvMlqktPKmEpNw5A3hwHYnIBwD8r%2F0xQfBDCaCPoL6%2BMxjj5Ftsb47O6KGvZzp2CS1xFcRHfbhEnUGRJR9o2%2FjSPy6NAV226GNwtSGdDXxPJFfETfpFlDEj%2FOCd26qtcBDdT4lX2saiGfx0%2FunV94XcNq3cUTVm%2Fsf0BO74945PnFWtBu3Oq%2FBm9AlaLwnyEZ5TDLfhXyqiTv1Qsx%2FWmBk0PIieA9MtTm", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529701&Signature=BDpq68evTIZGfF61fRMAYEM%2BQtXgDfwPgp7qnaSE1mJStRV1ikHnSjRDxrMwGqkg0kaXqLEpQ%2BLuSCdJ9wJJzfrkQuV1%2Bbcg0cctnCOLgWhiXjekyol4iul%2FPXEGu6%2F1a20JEEoUfg9Dq6%2FosKMN9fmk%2BtqQcFa6PODcE3qJcO23YhWwDpmSYZ7t8JNsALFm98c6r%2BfBLLjnCSpVql2zQJifkl%2BteR57LTZG7W2lbENV", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529758&Signature=zXDmSolL1BXRVntoMjKFPJaZtQ0tI1lf56M%2BqCFh1c0JirSCS7DGBgxMdHuaZG8hsB%2FV1nO0JEfDegHE1Ibm55QO9TriIg9yCH6dZSsofTmiHiBOUZtTMSH1Pg1z%2FnuElFFvVDHQ2Ryhog0fw%2BwfS0Fpe5ZOoTF8KK883iH45dmOAcVEphu7K5A%2FrzfFG93bFibxA7MRKbLLGBbrIVz4yFSuuFHimac0dVn%" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 158, "FileHash-SHA1": 158, "FileHash-SHA256": 1127, "URL": 116, "hostname": 49, "domain": 182, "email": 1 }, "indicator_count": 1791, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d46ee1379578309fae9a4a", "name": "VirusTotal report\n for l-Management-System-School-ERP-nulled-by-CodeAlright.Com.zip", "description": "A look at the results of a report generated by the University of California, Los Angeles (UCLA) and compiled by codecanyon, a university-instikit and an academy.", "modified": "2026-05-07T02:13:20.636000", "created": "2026-04-07T02:41:37.877000", "tags": [ "file type", "unix", "mitre attack", "network info", "wed jun", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "persistence", "malicious", "next", "newstoday2", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "file", "operations", "process open", "python", "javascript", "html", "sample", "test", "urls", "united", "extra info", "uncomment", "performs dns", "layer protocol", "attack network", "info dropped", "info processes", "info", "may try", "ascii text", "png image", "https", "reads cpu", "tls version", "ascii", "usrliblog" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/01f57cc95906a44558c5c1f19ef3191fe6f2f1cc03e1d10d1da421b7c604903f_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529261&Signature=RJNKrp%2FaK0APCyfk557hpXXr%2BMWPGME1nJO1%2BQCUEm9xRuKB0DlxP%2BfDSiZsLcJsAhaI%2FWxbH%2F%2FdbHllDXKgjJl92HzsTFyTAT0eMx%2BzlFLXKn0VyBmCHKLgKoFS4fDODUKy6SKJxdUav7aDP1aVhAXMPp%2BT3yWjDdSos0HQalqAt%2FcsVg1w28zfPjvVVGv%2B%2FvJeCIgzhXeE2pX6Npumx67Yym8jiiqV75WoDu", "https://vtbehaviour.commondatastorage.googleapis.com/00913627185b352deaf0ec837f85a7f606b27112956875de5d610fba8151306c_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529477&Signature=s8ZCWLcVqjdBgBGejTcqippuMvftwgsdUQHUAjBnm45yUvqDsHIMIA29%2BJcb%2BrruXxHPD5tQv1BwAzlV1o7EuhxX4qMqDcFWSLqoc%2FqAnEVxLg0zXohtwMkHxv0z%2Bp5AL0jLyAwNYz7bH56tnmUs3tHPYc48OeM4AanV030U%2FnmXlF8kJ6cjAemipfTNe1QRx3ecbONm9c3B51FK0BbzZEdRX0pTHIM4AK1M", "https://vtbehaviour.commondatastorage.googleapis.com/0347ed7ffd09f6728c494128b1d11792893d5cde9e4effdc2bcc8f9ebb12a0e1_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529533&Signature=diQ6r2CuvkDxYGybQtlzxVxtH8iGMt6XlgZBEpk7B5n%2FVtwOuZaPpuNyM%2Fr4VbSp2H67%2FddXTZ3XJG8LdUMwLVXsSDKIq%2BjyQHccTuCS0HXEDbllONqfU6gWICxxtdC%2F4wdaL8fVyCE%2FHHcnWm5PufAa002Tn02MbSx9cFdNZS4R86MEMARaMiXSCiGQuiLR2STQCGqU%2Byg16ky%2FYjPbLtB6WD5skgEs3AgDmDNlDLjtbb", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529640&Signature=G0ONarqL7o1MkYvMlqktPKmEpNw5A3hwHYnIBwD8r%2F0xQfBDCaCPoL6%2BMxjj5Ftsb47O6KGvZzp2CS1xFcRHfbhEnUGRJR9o2%2FjSPy6NAV226GNwtSGdDXxPJFfETfpFlDEj%2FOCd26qtcBDdT4lX2saiGfx0%2FunV94XcNq3cUTVm%2Fsf0BO74945PnFWtBu3Oq%2FBm9AlaLwnyEZ5TDLfhXyqiTv1Qsx%2FWmBk0PIieA9MtTm", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529701&Signature=BDpq68evTIZGfF61fRMAYEM%2BQtXgDfwPgp7qnaSE1mJStRV1ikHnSjRDxrMwGqkg0kaXqLEpQ%2BLuSCdJ9wJJzfrkQuV1%2Bbcg0cctnCOLgWhiXjekyol4iul%2FPXEGu6%2F1a20JEEoUfg9Dq6%2FosKMN9fmk%2BtqQcFa6PODcE3qJcO23YhWwDpmSYZ7t8JNsALFm98c6r%2BfBLLjnCSpVql2zQJifkl%2BteR57LTZG7W2lbENV", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529758&Signature=zXDmSolL1BXRVntoMjKFPJaZtQ0tI1lf56M%2BqCFh1c0JirSCS7DGBgxMdHuaZG8hsB%2FV1nO0JEfDegHE1Ibm55QO9TriIg9yCH6dZSsofTmiHiBOUZtTMSH1Pg1z%2FnuElFFvVDHQ2Ryhog0fw%2BwfS0Fpe5ZOoTF8KK883iH45dmOAcVEphu7K5A%2FrzfFG93bFibxA7MRKbLLGBbrIVz4yFSuuFHimac0dVn%" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 158, "FileHash-SHA1": 158, "FileHash-SHA256": 1127, "URL": 110, "hostname": 45, "domain": 179 }, "indicator_count": 1777, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d45947ce0025cf5afbb117", "name": "VirusTotal Windows Sandbox - steganography", "description": "A full analysis of data gathered from an archive of files stored on a server at the University of California, Los Angeles, and stored in a secure server, has been published online by the National Security Agency (NSA).", "modified": "2026-05-07T01:01:09.875000", "created": "2026-04-07T01:09:27.333000", "tags": [ "windows sandbox", "calls clear", "file type", "png image", "rgba", "ms windows", "mpeg adts", "monaural", "jpeg image", "jfif", "gif image", "ascii text", "burma", "persistence", "window", "malicious", "union", "next", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "file", "operations", "process open", "write delete", "move time", "php script", "ascii", "crlf line", "unix", "mitre attack", "wed jun", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "creates", "network info", "sigma", "defense evasion", "sample", "t1055 process" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/fdaa5bef329a103c6a38f971023a23214954b2038f74091fcb85a6c5b3ee6793_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524056&Signature=IRSYa160YBvfdiw9tFfaCqtY9z8rs45D1Ve6%2BpTMouiseLJI%2F4JyM0rAk55VfNmIzUGfryzxeHvYct6ob6QriZBkNDXCbk6M3QVOAqXQrpNBhFRpRMzqvG4bGBzfXaGO3JH%2FTaYejWQRB7Mjas3ENDiTanlcgTbBa9F0dlIn9glEYIvRq5IaDr1xMbyygt4IT0oJ2B27OxFY8TcpM4T3emxrp17iYN%2FF3Imo6bFRTYVHFbPF", "https://vtbehaviour.commondatastorage.googleapis.com/1cf762ebb36225bf2de49fd9baa4a724fb6fc6552982f7cde3eb8750a1396dec_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524101&Signature=YafvX%2FKbHVKXFED6nVuUgoWZdNWqqwItgxDl5Bp9Zdo%2Ff%2FTWC5kJWRGA47ZowHZh4EHc%2FFCAhOR4hifZEhlDC9cbmSs%2FMY5ulZLp78eChDgCY4CIs2SwjotobahaTms3z7t7TRUdIHKGnwY%2BBKFBQDjnoeTV7AOaSpqizw51XA60Hu%2BUYVLPbGrLff%2B64VYK3uuHUNH1TrAYfUa%2BkJqwlpueD%2Bcp4iqLPBZC%2Fje1DnEVe8e%", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524206&Signature=gWMfmLkoqQlDMb2RkNFcKrRqEBTNwkGuJnOc9uYaCYYGUohkAqUCNV2fjuOBD99RjZOm8wqWNn%2FXYjXHsOu2xg1EehIoxPcojD6qR1oGvRdqYtGScazp5qTmu2Mt95kBncGOrN3FpTiqA2TEqGmHrtBquZHDt7huxi3puJ3z0X1nqPFbmirt%2FRkfDFS9TEQp6piBIbuuoVClP9myw%2FdSfLOMovw4i0CKwtUFikUQ", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524231&Signature=Wv5G2ljAtLZs5UD7wbg53RFvucHo7IiRhkyNVLmeK6NA42BzJseS4otL9OJksO0gkN3drBP2pHrsvpqZqi7sTKiOXrVsQiR9kD1qF4wp7uKJfdbPjqUwlanEbw5yw5kd0CSm9P6dQm1uok3EVaAdczKUEAbW2aMMiUzm4WkW2MEFZaL0f2guNhLxgcALLfBbr%2BaPq6FvfadgfDFj1rHHbiG7L4%2FWVnyJeK%2BpMRcTKcx%2FvKJPKycGQtIQzPlg7a", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524270&Signature=Yn%2ByoAMXhl%2Fwe0poWrffqiJpt3ipHbmhmOj3wrO%2Bv0aI4XM%2BGTb3WYnUbwO%2BB4%2FvHy5B2E%2FI7lF5iq%2BFIW9tRm2ZBhCZY8p9zroZfwv1uFCqifhQLOzXFHGMp%2FptY89k%2B3c4Yi%2BoV6DCdRmHM9fAY5Y%2F%2FSzimGN6G2gOBFIFrOiAaMr1OO4tCC2KBL0a7pAYEx7pUEonfvjmdj2S7X8ZF2s4yhp30aASJGdx", "https://vtbehaviour.commondatastorage.googleapis.com/de5a9417dec59d03c07c57078270197621ac62397b5a691f07af522441f7e58a_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524306&Signature=cXthPzwlRZxsgwUQSNKMDsPG6OynZQby1pdDJzqxAgQCcbcq37BfhqePhPxs9aKAB2o1j55rzzqlUEwiBke5LjKvRpZTJih560GCz5YWc9qeHPBBv%2FVcUEL%2FhoqasTTjfAJjT1l%2BzRVeQ%2B%2F8cuEf9QIfBl%2BvXhzSB%2B9p0JtpepQKunyqYNbRyzJ5S23SKkW3sqxPkbN0ywosD9wAT%2FqPRrowVS1rou", "https://vtbehaviour.commondatastorage.googleapis.com/de5a9417dec59d03c07c57078270197621ac62397b5a691f07af522441f7e58a_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524330&Signature=ZJzvK6ex%2B4WDprMFZXUHM%2BlO6Ocvx3kqb%2FSV%2Br7oW4AldeE%2FSYCUkm1fOjShI0dT2puSwxTD0dbfVH%2FxiHe5YY9c68q0bgC%2FdWgIIlm5IPfDNaglObv3%2BFsaR%2Bbt%2F2za%2FHaRujccLsITjfKH55VkVPdFNOTWeypsbVndDtzOkIkK3VmWNZQGEQnJ1HqMlPPfWvp5r58eVXUhAT%2BbwZ9Sg9LXqdGPZsBgt5hdKVT%2Bev4h" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 71, "FileHash-SHA1": 74, "FileHash-SHA256": 2921, "URL": 194, "domain": 120, "hostname": 101 }, "indicator_count": 3481, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4594ea685ae6b9912f97b", "name": "VirusTotal Windows Sandbox - steganography", "description": "A full analysis of data gathered from an archive of files stored on a server at the University of California, Los Angeles, and stored in a secure server, has been published online by the National Security Agency (NSA).", "modified": "2026-05-07T01:01:09.875000", "created": "2026-04-07T01:09:34.613000", "tags": [ "windows sandbox", "calls clear", "file type", "png image", "rgba", "ms windows", "mpeg adts", "monaural", "jpeg image", "jfif", "gif image", "ascii text", "burma", "persistence", "window", "malicious", "union", "next", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "file", "operations", "process open", "write delete", "move time", "php script", "ascii", "crlf line", "unix", "mitre attack", "wed jun", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "creates", "network info", "sigma", "defense evasion", "sample", "t1055 process" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/fdaa5bef329a103c6a38f971023a23214954b2038f74091fcb85a6c5b3ee6793_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524056&Signature=IRSYa160YBvfdiw9tFfaCqtY9z8rs45D1Ve6%2BpTMouiseLJI%2F4JyM0rAk55VfNmIzUGfryzxeHvYct6ob6QriZBkNDXCbk6M3QVOAqXQrpNBhFRpRMzqvG4bGBzfXaGO3JH%2FTaYejWQRB7Mjas3ENDiTanlcgTbBa9F0dlIn9glEYIvRq5IaDr1xMbyygt4IT0oJ2B27OxFY8TcpM4T3emxrp17iYN%2FF3Imo6bFRTYVHFbPF", "https://vtbehaviour.commondatastorage.googleapis.com/1cf762ebb36225bf2de49fd9baa4a724fb6fc6552982f7cde3eb8750a1396dec_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524101&Signature=YafvX%2FKbHVKXFED6nVuUgoWZdNWqqwItgxDl5Bp9Zdo%2Ff%2FTWC5kJWRGA47ZowHZh4EHc%2FFCAhOR4hifZEhlDC9cbmSs%2FMY5ulZLp78eChDgCY4CIs2SwjotobahaTms3z7t7TRUdIHKGnwY%2BBKFBQDjnoeTV7AOaSpqizw51XA60Hu%2BUYVLPbGrLff%2B64VYK3uuHUNH1TrAYfUa%2BkJqwlpueD%2Bcp4iqLPBZC%2Fje1DnEVe8e%", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524206&Signature=gWMfmLkoqQlDMb2RkNFcKrRqEBTNwkGuJnOc9uYaCYYGUohkAqUCNV2fjuOBD99RjZOm8wqWNn%2FXYjXHsOu2xg1EehIoxPcojD6qR1oGvRdqYtGScazp5qTmu2Mt95kBncGOrN3FpTiqA2TEqGmHrtBquZHDt7huxi3puJ3z0X1nqPFbmirt%2FRkfDFS9TEQp6piBIbuuoVClP9myw%2FdSfLOMovw4i0CKwtUFikUQ", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524231&Signature=Wv5G2ljAtLZs5UD7wbg53RFvucHo7IiRhkyNVLmeK6NA42BzJseS4otL9OJksO0gkN3drBP2pHrsvpqZqi7sTKiOXrVsQiR9kD1qF4wp7uKJfdbPjqUwlanEbw5yw5kd0CSm9P6dQm1uok3EVaAdczKUEAbW2aMMiUzm4WkW2MEFZaL0f2guNhLxgcALLfBbr%2BaPq6FvfadgfDFj1rHHbiG7L4%2FWVnyJeK%2BpMRcTKcx%2FvKJPKycGQtIQzPlg7a", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524270&Signature=Yn%2ByoAMXhl%2Fwe0poWrffqiJpt3ipHbmhmOj3wrO%2Bv0aI4XM%2BGTb3WYnUbwO%2BB4%2FvHy5B2E%2FI7lF5iq%2BFIW9tRm2ZBhCZY8p9zroZfwv1uFCqifhQLOzXFHGMp%2FptY89k%2B3c4Yi%2BoV6DCdRmHM9fAY5Y%2F%2FSzimGN6G2gOBFIFrOiAaMr1OO4tCC2KBL0a7pAYEx7pUEonfvjmdj2S7X8ZF2s4yhp30aASJGdx", "https://vtbehaviour.commondatastorage.googleapis.com/de5a9417dec59d03c07c57078270197621ac62397b5a691f07af522441f7e58a_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524306&Signature=cXthPzwlRZxsgwUQSNKMDsPG6OynZQby1pdDJzqxAgQCcbcq37BfhqePhPxs9aKAB2o1j55rzzqlUEwiBke5LjKvRpZTJih560GCz5YWc9qeHPBBv%2FVcUEL%2FhoqasTTjfAJjT1l%2BzRVeQ%2B%2F8cuEf9QIfBl%2BvXhzSB%2B9p0JtpepQKunyqYNbRyzJ5S23SKkW3sqxPkbN0ywosD9wAT%2FqPRrowVS1rou", "https://vtbehaviour.commondatastorage.googleapis.com/de5a9417dec59d03c07c57078270197621ac62397b5a691f07af522441f7e58a_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524330&Signature=ZJzvK6ex%2B4WDprMFZXUHM%2BlO6Ocvx3kqb%2FSV%2Br7oW4AldeE%2FSYCUkm1fOjShI0dT2puSwxTD0dbfVH%2FxiHe5YY9c68q0bgC%2FdWgIIlm5IPfDNaglObv3%2BFsaR%2Bbt%2F2za%2FHaRujccLsITjfKH55VkVPdFNOTWeypsbVndDtzOkIkK3VmWNZQGEQnJ1HqMlPPfWvp5r58eVXUhAT%2BbwZ9Sg9LXqdGPZsBgt5hdKVT%2Bev4h" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 71, "FileHash-SHA1": 74, "FileHash-SHA256": 2921, "URL": 194, "domain": 120, "hostname": 101 }, "indicator_count": 3481, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4595a99f229f5b99ce366", "name": "VirusTotal Windows Sandbox - steganography", "description": "A full analysis of data gathered from an archive of files stored on a server at the University of California, Los Angeles, and stored in a secure server, has been published online by the National Security Agency (NSA).", "modified": "2026-05-07T01:01:09.875000", "created": "2026-04-07T01:09:46.696000", "tags": [ "windows sandbox", "calls clear", "file type", "png image", "rgba", "ms windows", "mpeg adts", "monaural", "jpeg image", "jfif", "gif image", "ascii text", "burma", "persistence", "window", "malicious", "union", "next", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "file", "operations", "process open", "write delete", "move time", "php script", "ascii", "crlf line", "unix", "mitre attack", "wed jun", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "creates", "network info", "sigma", "defense evasion", "sample", "t1055 process" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/fdaa5bef329a103c6a38f971023a23214954b2038f74091fcb85a6c5b3ee6793_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524056&Signature=IRSYa160YBvfdiw9tFfaCqtY9z8rs45D1Ve6%2BpTMouiseLJI%2F4JyM0rAk55VfNmIzUGfryzxeHvYct6ob6QriZBkNDXCbk6M3QVOAqXQrpNBhFRpRMzqvG4bGBzfXaGO3JH%2FTaYejWQRB7Mjas3ENDiTanlcgTbBa9F0dlIn9glEYIvRq5IaDr1xMbyygt4IT0oJ2B27OxFY8TcpM4T3emxrp17iYN%2FF3Imo6bFRTYVHFbPF", "https://vtbehaviour.commondatastorage.googleapis.com/1cf762ebb36225bf2de49fd9baa4a724fb6fc6552982f7cde3eb8750a1396dec_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524101&Signature=YafvX%2FKbHVKXFED6nVuUgoWZdNWqqwItgxDl5Bp9Zdo%2Ff%2FTWC5kJWRGA47ZowHZh4EHc%2FFCAhOR4hifZEhlDC9cbmSs%2FMY5ulZLp78eChDgCY4CIs2SwjotobahaTms3z7t7TRUdIHKGnwY%2BBKFBQDjnoeTV7AOaSpqizw51XA60Hu%2BUYVLPbGrLff%2B64VYK3uuHUNH1TrAYfUa%2BkJqwlpueD%2Bcp4iqLPBZC%2Fje1DnEVe8e%", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524206&Signature=gWMfmLkoqQlDMb2RkNFcKrRqEBTNwkGuJnOc9uYaCYYGUohkAqUCNV2fjuOBD99RjZOm8wqWNn%2FXYjXHsOu2xg1EehIoxPcojD6qR1oGvRdqYtGScazp5qTmu2Mt95kBncGOrN3FpTiqA2TEqGmHrtBquZHDt7huxi3puJ3z0X1nqPFbmirt%2FRkfDFS9TEQp6piBIbuuoVClP9myw%2FdSfLOMovw4i0CKwtUFikUQ", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524231&Signature=Wv5G2ljAtLZs5UD7wbg53RFvucHo7IiRhkyNVLmeK6NA42BzJseS4otL9OJksO0gkN3drBP2pHrsvpqZqi7sTKiOXrVsQiR9kD1qF4wp7uKJfdbPjqUwlanEbw5yw5kd0CSm9P6dQm1uok3EVaAdczKUEAbW2aMMiUzm4WkW2MEFZaL0f2guNhLxgcALLfBbr%2BaPq6FvfadgfDFj1rHHbiG7L4%2FWVnyJeK%2BpMRcTKcx%2FvKJPKycGQtIQzPlg7a", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524270&Signature=Yn%2ByoAMXhl%2Fwe0poWrffqiJpt3ipHbmhmOj3wrO%2Bv0aI4XM%2BGTb3WYnUbwO%2BB4%2FvHy5B2E%2FI7lF5iq%2BFIW9tRm2ZBhCZY8p9zroZfwv1uFCqifhQLOzXFHGMp%2FptY89k%2B3c4Yi%2BoV6DCdRmHM9fAY5Y%2F%2FSzimGN6G2gOBFIFrOiAaMr1OO4tCC2KBL0a7pAYEx7pUEonfvjmdj2S7X8ZF2s4yhp30aASJGdx", "https://vtbehaviour.commondatastorage.googleapis.com/de5a9417dec59d03c07c57078270197621ac62397b5a691f07af522441f7e58a_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524306&Signature=cXthPzwlRZxsgwUQSNKMDsPG6OynZQby1pdDJzqxAgQCcbcq37BfhqePhPxs9aKAB2o1j55rzzqlUEwiBke5LjKvRpZTJih560GCz5YWc9qeHPBBv%2FVcUEL%2FhoqasTTjfAJjT1l%2BzRVeQ%2B%2F8cuEf9QIfBl%2BvXhzSB%2B9p0JtpepQKunyqYNbRyzJ5S23SKkW3sqxPkbN0ywosD9wAT%2FqPRrowVS1rou", "https://vtbehaviour.commondatastorage.googleapis.com/de5a9417dec59d03c07c57078270197621ac62397b5a691f07af522441f7e58a_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524330&Signature=ZJzvK6ex%2B4WDprMFZXUHM%2BlO6Ocvx3kqb%2FSV%2Br7oW4AldeE%2FSYCUkm1fOjShI0dT2puSwxTD0dbfVH%2FxiHe5YY9c68q0bgC%2FdWgIIlm5IPfDNaglObv3%2BFsaR%2Bbt%2F2za%2FHaRujccLsITjfKH55VkVPdFNOTWeypsbVndDtzOkIkK3VmWNZQGEQnJ1HqMlPPfWvp5r58eVXUhAT%2BbwZ9Sg9LXqdGPZsBgt5hdKVT%2Bev4h" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 71, "FileHash-SHA1": 74, "FileHash-SHA256": 2921, "URL": 194, "domain": 120, "hostname": 101 }, "indicator_count": 3481, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4595b8c340900560463a8", "name": "VirusTotal Windows Sandbox - steganography", "description": "A full analysis of data gathered from an archive of files stored on a server at the University of California, Los Angeles, and stored in a secure server, has been published online by the National Security Agency (NSA).", "modified": "2026-05-07T01:01:09.875000", "created": "2026-04-07T01:09:47.893000", "tags": [ "windows sandbox", "calls clear", "file type", "png image", "rgba", "ms windows", "mpeg adts", "monaural", "jpeg image", "jfif", "gif image", "ascii text", "burma", "persistence", "window", "malicious", "union", "next", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "file", "operations", "process open", "write delete", "move time", "php script", "ascii", "crlf line", "unix", "mitre attack", "wed jun", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "creates", "network info", "sigma", "defense evasion", "sample", "t1055 process" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/fdaa5bef329a103c6a38f971023a23214954b2038f74091fcb85a6c5b3ee6793_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524056&Signature=IRSYa160YBvfdiw9tFfaCqtY9z8rs45D1Ve6%2BpTMouiseLJI%2F4JyM0rAk55VfNmIzUGfryzxeHvYct6ob6QriZBkNDXCbk6M3QVOAqXQrpNBhFRpRMzqvG4bGBzfXaGO3JH%2FTaYejWQRB7Mjas3ENDiTanlcgTbBa9F0dlIn9glEYIvRq5IaDr1xMbyygt4IT0oJ2B27OxFY8TcpM4T3emxrp17iYN%2FF3Imo6bFRTYVHFbPF", "https://vtbehaviour.commondatastorage.googleapis.com/1cf762ebb36225bf2de49fd9baa4a724fb6fc6552982f7cde3eb8750a1396dec_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524101&Signature=YafvX%2FKbHVKXFED6nVuUgoWZdNWqqwItgxDl5Bp9Zdo%2Ff%2FTWC5kJWRGA47ZowHZh4EHc%2FFCAhOR4hifZEhlDC9cbmSs%2FMY5ulZLp78eChDgCY4CIs2SwjotobahaTms3z7t7TRUdIHKGnwY%2BBKFBQDjnoeTV7AOaSpqizw51XA60Hu%2BUYVLPbGrLff%2B64VYK3uuHUNH1TrAYfUa%2BkJqwlpueD%2Bcp4iqLPBZC%2Fje1DnEVe8e%", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524206&Signature=gWMfmLkoqQlDMb2RkNFcKrRqEBTNwkGuJnOc9uYaCYYGUohkAqUCNV2fjuOBD99RjZOm8wqWNn%2FXYjXHsOu2xg1EehIoxPcojD6qR1oGvRdqYtGScazp5qTmu2Mt95kBncGOrN3FpTiqA2TEqGmHrtBquZHDt7huxi3puJ3z0X1nqPFbmirt%2FRkfDFS9TEQp6piBIbuuoVClP9myw%2FdSfLOMovw4i0CKwtUFikUQ", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524231&Signature=Wv5G2ljAtLZs5UD7wbg53RFvucHo7IiRhkyNVLmeK6NA42BzJseS4otL9OJksO0gkN3drBP2pHrsvpqZqi7sTKiOXrVsQiR9kD1qF4wp7uKJfdbPjqUwlanEbw5yw5kd0CSm9P6dQm1uok3EVaAdczKUEAbW2aMMiUzm4WkW2MEFZaL0f2guNhLxgcALLfBbr%2BaPq6FvfadgfDFj1rHHbiG7L4%2FWVnyJeK%2BpMRcTKcx%2FvKJPKycGQtIQzPlg7a", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524270&Signature=Yn%2ByoAMXhl%2Fwe0poWrffqiJpt3ipHbmhmOj3wrO%2Bv0aI4XM%2BGTb3WYnUbwO%2BB4%2FvHy5B2E%2FI7lF5iq%2BFIW9tRm2ZBhCZY8p9zroZfwv1uFCqifhQLOzXFHGMp%2FptY89k%2B3c4Yi%2BoV6DCdRmHM9fAY5Y%2F%2FSzimGN6G2gOBFIFrOiAaMr1OO4tCC2KBL0a7pAYEx7pUEonfvjmdj2S7X8ZF2s4yhp30aASJGdx", "https://vtbehaviour.commondatastorage.googleapis.com/de5a9417dec59d03c07c57078270197621ac62397b5a691f07af522441f7e58a_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524306&Signature=cXthPzwlRZxsgwUQSNKMDsPG6OynZQby1pdDJzqxAgQCcbcq37BfhqePhPxs9aKAB2o1j55rzzqlUEwiBke5LjKvRpZTJih560GCz5YWc9qeHPBBv%2FVcUEL%2FhoqasTTjfAJjT1l%2BzRVeQ%2B%2F8cuEf9QIfBl%2BvXhzSB%2B9p0JtpepQKunyqYNbRyzJ5S23SKkW3sqxPkbN0ywosD9wAT%2FqPRrowVS1rou", "https://vtbehaviour.commondatastorage.googleapis.com/de5a9417dec59d03c07c57078270197621ac62397b5a691f07af522441f7e58a_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524330&Signature=ZJzvK6ex%2B4WDprMFZXUHM%2BlO6Ocvx3kqb%2FSV%2Br7oW4AldeE%2FSYCUkm1fOjShI0dT2puSwxTD0dbfVH%2FxiHe5YY9c68q0bgC%2FdWgIIlm5IPfDNaglObv3%2BFsaR%2Bbt%2F2za%2FHaRujccLsITjfKH55VkVPdFNOTWeypsbVndDtzOkIkK3VmWNZQGEQnJ1HqMlPPfWvp5r58eVXUhAT%2BbwZ9Sg9LXqdGPZsBgt5hdKVT%2Bev4h" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 71, "FileHash-SHA1": 74, "FileHash-SHA256": 2921, "URL": 194, "domain": 120, "hostname": 101 }, "indicator_count": 3481, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4595bad55db9318902436", "name": "VirusTotal Windows Sandbox - steganography", "description": "A full analysis of data gathered from an archive of files stored on a server at the University of California, Los Angeles, and stored in a secure server, has been published online by the National Security Agency (NSA).", "modified": "2026-05-07T01:01:09.875000", "created": "2026-04-07T01:09:47.753000", "tags": [ "windows sandbox", "calls clear", "file type", "png image", "rgba", "ms windows", "mpeg adts", "monaural", "jpeg image", "jfif", "gif image", "ascii text", "burma", "persistence", "window", "malicious", "union", "next", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "file", "operations", "process open", "write delete", "move time", "php script", "ascii", "crlf line", "unix", "mitre attack", "wed jun", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "creates", "network info", "sigma", "defense evasion", "sample", "t1055 process" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/fdaa5bef329a103c6a38f971023a23214954b2038f74091fcb85a6c5b3ee6793_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524056&Signature=IRSYa160YBvfdiw9tFfaCqtY9z8rs45D1Ve6%2BpTMouiseLJI%2F4JyM0rAk55VfNmIzUGfryzxeHvYct6ob6QriZBkNDXCbk6M3QVOAqXQrpNBhFRpRMzqvG4bGBzfXaGO3JH%2FTaYejWQRB7Mjas3ENDiTanlcgTbBa9F0dlIn9glEYIvRq5IaDr1xMbyygt4IT0oJ2B27OxFY8TcpM4T3emxrp17iYN%2FF3Imo6bFRTYVHFbPF", "https://vtbehaviour.commondatastorage.googleapis.com/1cf762ebb36225bf2de49fd9baa4a724fb6fc6552982f7cde3eb8750a1396dec_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524101&Signature=YafvX%2FKbHVKXFED6nVuUgoWZdNWqqwItgxDl5Bp9Zdo%2Ff%2FTWC5kJWRGA47ZowHZh4EHc%2FFCAhOR4hifZEhlDC9cbmSs%2FMY5ulZLp78eChDgCY4CIs2SwjotobahaTms3z7t7TRUdIHKGnwY%2BBKFBQDjnoeTV7AOaSpqizw51XA60Hu%2BUYVLPbGrLff%2B64VYK3uuHUNH1TrAYfUa%2BkJqwlpueD%2Bcp4iqLPBZC%2Fje1DnEVe8e%", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524206&Signature=gWMfmLkoqQlDMb2RkNFcKrRqEBTNwkGuJnOc9uYaCYYGUohkAqUCNV2fjuOBD99RjZOm8wqWNn%2FXYjXHsOu2xg1EehIoxPcojD6qR1oGvRdqYtGScazp5qTmu2Mt95kBncGOrN3FpTiqA2TEqGmHrtBquZHDt7huxi3puJ3z0X1nqPFbmirt%2FRkfDFS9TEQp6piBIbuuoVClP9myw%2FdSfLOMovw4i0CKwtUFikUQ", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524231&Signature=Wv5G2ljAtLZs5UD7wbg53RFvucHo7IiRhkyNVLmeK6NA42BzJseS4otL9OJksO0gkN3drBP2pHrsvpqZqi7sTKiOXrVsQiR9kD1qF4wp7uKJfdbPjqUwlanEbw5yw5kd0CSm9P6dQm1uok3EVaAdczKUEAbW2aMMiUzm4WkW2MEFZaL0f2guNhLxgcALLfBbr%2BaPq6FvfadgfDFj1rHHbiG7L4%2FWVnyJeK%2BpMRcTKcx%2FvKJPKycGQtIQzPlg7a", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524270&Signature=Yn%2ByoAMXhl%2Fwe0poWrffqiJpt3ipHbmhmOj3wrO%2Bv0aI4XM%2BGTb3WYnUbwO%2BB4%2FvHy5B2E%2FI7lF5iq%2BFIW9tRm2ZBhCZY8p9zroZfwv1uFCqifhQLOzXFHGMp%2FptY89k%2B3c4Yi%2BoV6DCdRmHM9fAY5Y%2F%2FSzimGN6G2gOBFIFrOiAaMr1OO4tCC2KBL0a7pAYEx7pUEonfvjmdj2S7X8ZF2s4yhp30aASJGdx", "https://vtbehaviour.commondatastorage.googleapis.com/de5a9417dec59d03c07c57078270197621ac62397b5a691f07af522441f7e58a_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524306&Signature=cXthPzwlRZxsgwUQSNKMDsPG6OynZQby1pdDJzqxAgQCcbcq37BfhqePhPxs9aKAB2o1j55rzzqlUEwiBke5LjKvRpZTJih560GCz5YWc9qeHPBBv%2FVcUEL%2FhoqasTTjfAJjT1l%2BzRVeQ%2B%2F8cuEf9QIfBl%2BvXhzSB%2B9p0JtpepQKunyqYNbRyzJ5S23SKkW3sqxPkbN0ywosD9wAT%2FqPRrowVS1rou", "https://vtbehaviour.commondatastorage.googleapis.com/de5a9417dec59d03c07c57078270197621ac62397b5a691f07af522441f7e58a_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524330&Signature=ZJzvK6ex%2B4WDprMFZXUHM%2BlO6Ocvx3kqb%2FSV%2Br7oW4AldeE%2FSYCUkm1fOjShI0dT2puSwxTD0dbfVH%2FxiHe5YY9c68q0bgC%2FdWgIIlm5IPfDNaglObv3%2BFsaR%2Bbt%2F2za%2FHaRujccLsITjfKH55VkVPdFNOTWeypsbVndDtzOkIkK3VmWNZQGEQnJ1HqMlPPfWvp5r58eVXUhAT%2BbwZ9Sg9LXqdGPZsBgt5hdKVT%2Bev4h" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 71, "FileHash-SHA1": 74, "FileHash-SHA256": 2921, "URL": 194, "domain": 120, "hostname": 101 }, "indicator_count": 3481, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4595beae76fc81c99cf63", "name": "VirusTotal Windows Sandbox - steganography", "description": "A full analysis of data gathered from an archive of files stored on a server at the University of California, Los Angeles, and stored in a secure server, has been published online by the National Security Agency (NSA).", "modified": "2026-05-07T01:01:09.875000", "created": "2026-04-07T01:09:47.895000", "tags": [ "windows sandbox", "calls clear", "file type", "png image", "rgba", "ms windows", "mpeg adts", "monaural", "jpeg image", "jfif", "gif image", "ascii text", "burma", "persistence", "window", "malicious", "union", "next", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "file", "operations", "process open", "write delete", "move time", "php script", "ascii", "crlf line", "unix", "mitre attack", "wed jun", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "creates", "network info", "sigma", "defense evasion", "sample", "t1055 process" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/fdaa5bef329a103c6a38f971023a23214954b2038f74091fcb85a6c5b3ee6793_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524056&Signature=IRSYa160YBvfdiw9tFfaCqtY9z8rs45D1Ve6%2BpTMouiseLJI%2F4JyM0rAk55VfNmIzUGfryzxeHvYct6ob6QriZBkNDXCbk6M3QVOAqXQrpNBhFRpRMzqvG4bGBzfXaGO3JH%2FTaYejWQRB7Mjas3ENDiTanlcgTbBa9F0dlIn9glEYIvRq5IaDr1xMbyygt4IT0oJ2B27OxFY8TcpM4T3emxrp17iYN%2FF3Imo6bFRTYVHFbPF", "https://vtbehaviour.commondatastorage.googleapis.com/1cf762ebb36225bf2de49fd9baa4a724fb6fc6552982f7cde3eb8750a1396dec_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524101&Signature=YafvX%2FKbHVKXFED6nVuUgoWZdNWqqwItgxDl5Bp9Zdo%2Ff%2FTWC5kJWRGA47ZowHZh4EHc%2FFCAhOR4hifZEhlDC9cbmSs%2FMY5ulZLp78eChDgCY4CIs2SwjotobahaTms3z7t7TRUdIHKGnwY%2BBKFBQDjnoeTV7AOaSpqizw51XA60Hu%2BUYVLPbGrLff%2B64VYK3uuHUNH1TrAYfUa%2BkJqwlpueD%2Bcp4iqLPBZC%2Fje1DnEVe8e%", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524206&Signature=gWMfmLkoqQlDMb2RkNFcKrRqEBTNwkGuJnOc9uYaCYYGUohkAqUCNV2fjuOBD99RjZOm8wqWNn%2FXYjXHsOu2xg1EehIoxPcojD6qR1oGvRdqYtGScazp5qTmu2Mt95kBncGOrN3FpTiqA2TEqGmHrtBquZHDt7huxi3puJ3z0X1nqPFbmirt%2FRkfDFS9TEQp6piBIbuuoVClP9myw%2FdSfLOMovw4i0CKwtUFikUQ", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524231&Signature=Wv5G2ljAtLZs5UD7wbg53RFvucHo7IiRhkyNVLmeK6NA42BzJseS4otL9OJksO0gkN3drBP2pHrsvpqZqi7sTKiOXrVsQiR9kD1qF4wp7uKJfdbPjqUwlanEbw5yw5kd0CSm9P6dQm1uok3EVaAdczKUEAbW2aMMiUzm4WkW2MEFZaL0f2guNhLxgcALLfBbr%2BaPq6FvfadgfDFj1rHHbiG7L4%2FWVnyJeK%2BpMRcTKcx%2FvKJPKycGQtIQzPlg7a", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524270&Signature=Yn%2ByoAMXhl%2Fwe0poWrffqiJpt3ipHbmhmOj3wrO%2Bv0aI4XM%2BGTb3WYnUbwO%2BB4%2FvHy5B2E%2FI7lF5iq%2BFIW9tRm2ZBhCZY8p9zroZfwv1uFCqifhQLOzXFHGMp%2FptY89k%2B3c4Yi%2BoV6DCdRmHM9fAY5Y%2F%2FSzimGN6G2gOBFIFrOiAaMr1OO4tCC2KBL0a7pAYEx7pUEonfvjmdj2S7X8ZF2s4yhp30aASJGdx", "https://vtbehaviour.commondatastorage.googleapis.com/de5a9417dec59d03c07c57078270197621ac62397b5a691f07af522441f7e58a_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524306&Signature=cXthPzwlRZxsgwUQSNKMDsPG6OynZQby1pdDJzqxAgQCcbcq37BfhqePhPxs9aKAB2o1j55rzzqlUEwiBke5LjKvRpZTJih560GCz5YWc9qeHPBBv%2FVcUEL%2FhoqasTTjfAJjT1l%2BzRVeQ%2B%2F8cuEf9QIfBl%2BvXhzSB%2B9p0JtpepQKunyqYNbRyzJ5S23SKkW3sqxPkbN0ywosD9wAT%2FqPRrowVS1rou", "https://vtbehaviour.commondatastorage.googleapis.com/de5a9417dec59d03c07c57078270197621ac62397b5a691f07af522441f7e58a_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524330&Signature=ZJzvK6ex%2B4WDprMFZXUHM%2BlO6Ocvx3kqb%2FSV%2Br7oW4AldeE%2FSYCUkm1fOjShI0dT2puSwxTD0dbfVH%2FxiHe5YY9c68q0bgC%2FdWgIIlm5IPfDNaglObv3%2BFsaR%2Bbt%2F2za%2FHaRujccLsITjfKH55VkVPdFNOTWeypsbVndDtzOkIkK3VmWNZQGEQnJ1HqMlPPfWvp5r58eVXUhAT%2BbwZ9Sg9LXqdGPZsBgt5hdKVT%2Bev4h" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 71, "FileHash-SHA1": 74, "FileHash-SHA256": 2921, "URL": 194, "domain": 120, "hostname": 101 }, "indicator_count": 3481, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4595cd9283fc7a5aa03ab", "name": "VirusTotal Windows Sandbox - steganography", "description": "A full analysis of data gathered from an archive of files stored on a server at the University of California, Los Angeles, and stored in a secure server, has been published online by the National Security Agency (NSA).", "modified": "2026-05-07T01:01:09.875000", "created": "2026-04-07T01:09:48.152000", "tags": [ "windows sandbox", "calls clear", "file type", "png image", "rgba", "ms windows", "mpeg adts", "monaural", "jpeg image", "jfif", "gif image", "ascii text", "burma", "persistence", "window", "malicious", "union", "next", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "file", "operations", "process open", "write delete", "move time", "php script", "ascii", "crlf line", "unix", "mitre attack", "wed jun", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "creates", "network info", "sigma", "defense evasion", "sample", "t1055 process" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/fdaa5bef329a103c6a38f971023a23214954b2038f74091fcb85a6c5b3ee6793_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524056&Signature=IRSYa160YBvfdiw9tFfaCqtY9z8rs45D1Ve6%2BpTMouiseLJI%2F4JyM0rAk55VfNmIzUGfryzxeHvYct6ob6QriZBkNDXCbk6M3QVOAqXQrpNBhFRpRMzqvG4bGBzfXaGO3JH%2FTaYejWQRB7Mjas3ENDiTanlcgTbBa9F0dlIn9glEYIvRq5IaDr1xMbyygt4IT0oJ2B27OxFY8TcpM4T3emxrp17iYN%2FF3Imo6bFRTYVHFbPF", "https://vtbehaviour.commondatastorage.googleapis.com/1cf762ebb36225bf2de49fd9baa4a724fb6fc6552982f7cde3eb8750a1396dec_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524101&Signature=YafvX%2FKbHVKXFED6nVuUgoWZdNWqqwItgxDl5Bp9Zdo%2Ff%2FTWC5kJWRGA47ZowHZh4EHc%2FFCAhOR4hifZEhlDC9cbmSs%2FMY5ulZLp78eChDgCY4CIs2SwjotobahaTms3z7t7TRUdIHKGnwY%2BBKFBQDjnoeTV7AOaSpqizw51XA60Hu%2BUYVLPbGrLff%2B64VYK3uuHUNH1TrAYfUa%2BkJqwlpueD%2Bcp4iqLPBZC%2Fje1DnEVe8e%", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524206&Signature=gWMfmLkoqQlDMb2RkNFcKrRqEBTNwkGuJnOc9uYaCYYGUohkAqUCNV2fjuOBD99RjZOm8wqWNn%2FXYjXHsOu2xg1EehIoxPcojD6qR1oGvRdqYtGScazp5qTmu2Mt95kBncGOrN3FpTiqA2TEqGmHrtBquZHDt7huxi3puJ3z0X1nqPFbmirt%2FRkfDFS9TEQp6piBIbuuoVClP9myw%2FdSfLOMovw4i0CKwtUFikUQ", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524231&Signature=Wv5G2ljAtLZs5UD7wbg53RFvucHo7IiRhkyNVLmeK6NA42BzJseS4otL9OJksO0gkN3drBP2pHrsvpqZqi7sTKiOXrVsQiR9kD1qF4wp7uKJfdbPjqUwlanEbw5yw5kd0CSm9P6dQm1uok3EVaAdczKUEAbW2aMMiUzm4WkW2MEFZaL0f2guNhLxgcALLfBbr%2BaPq6FvfadgfDFj1rHHbiG7L4%2FWVnyJeK%2BpMRcTKcx%2FvKJPKycGQtIQzPlg7a", "https://vtbehaviour.commondatastorage.googleapis.com/85b51c6796de06101424d187c6bca9f90da990eabe4045a0006bc7c1bf8dc4b3_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524270&Signature=Yn%2ByoAMXhl%2Fwe0poWrffqiJpt3ipHbmhmOj3wrO%2Bv0aI4XM%2BGTb3WYnUbwO%2BB4%2FvHy5B2E%2FI7lF5iq%2BFIW9tRm2ZBhCZY8p9zroZfwv1uFCqifhQLOzXFHGMp%2FptY89k%2B3c4Yi%2BoV6DCdRmHM9fAY5Y%2F%2FSzimGN6G2gOBFIFrOiAaMr1OO4tCC2KBL0a7pAYEx7pUEonfvjmdj2S7X8ZF2s4yhp30aASJGdx", "https://vtbehaviour.commondatastorage.googleapis.com/de5a9417dec59d03c07c57078270197621ac62397b5a691f07af522441f7e58a_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524306&Signature=cXthPzwlRZxsgwUQSNKMDsPG6OynZQby1pdDJzqxAgQCcbcq37BfhqePhPxs9aKAB2o1j55rzzqlUEwiBke5LjKvRpZTJih560GCz5YWc9qeHPBBv%2FVcUEL%2FhoqasTTjfAJjT1l%2BzRVeQ%2B%2F8cuEf9QIfBl%2BvXhzSB%2B9p0JtpepQKunyqYNbRyzJ5S23SKkW3sqxPkbN0ywosD9wAT%2FqPRrowVS1rou", "https://vtbehaviour.commondatastorage.googleapis.com/de5a9417dec59d03c07c57078270197621ac62397b5a691f07af522441f7e58a_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775524330&Signature=ZJzvK6ex%2B4WDprMFZXUHM%2BlO6Ocvx3kqb%2FSV%2Br7oW4AldeE%2FSYCUkm1fOjShI0dT2puSwxTD0dbfVH%2FxiHe5YY9c68q0bgC%2FdWgIIlm5IPfDNaglObv3%2BFsaR%2Bbt%2F2za%2FHaRujccLsITjfKH55VkVPdFNOTWeypsbVndDtzOkIkK3VmWNZQGEQnJ1HqMlPPfWvp5r58eVXUhAT%2BbwZ9Sg9LXqdGPZsBgt5hdKVT%2Bev4h" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 71, "FileHash-SHA1": 74, "FileHash-SHA256": 2921, "URL": 195, "domain": 120, "hostname": 101, "CVE": 1 }, "indicator_count": 3483, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d45104133846ffc6b2a6fe", "name": "CAPE Sandbox -y2k", "description": "> full text of the full report on this year's EU Referendum, which will take place on 26 May 2017, has been published by BBC Radio 5 live in the UK and Ireland.>y2k status", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:34:12.507000", "tags": [ "html document", "ascii text", "language" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 308, "FileHash-SHA256": 1270, "domain": 168, "hostname": 31, "URL": 98 }, "indicator_count": 2185, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4510678007ab57751a513", "name": "CAPE Sandbox -y2k", "description": "> full text of the full report on this year's EU Referendum, which will take place on 26 May 2017, has been published by BBC Radio 5 live in the UK and Ireland.>y2k status", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:34:14.009000", "tags": [ "html document", "ascii text", "language" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 308, "FileHash-SHA256": 1270, "domain": 168, "hostname": 31, "URL": 98 }, "indicator_count": 2185, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d45107d82d67453e8ade06", "name": "CAPE Sandbox -y2k", "description": "> full text of the full report on this year's EU Referendum, which will take place on 26 May 2017, has been published by BBC Radio 5 live in the UK and Ireland.>y2k status", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:34:15.789000", "tags": [ "html document", "ascii text", "language" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 308, "FileHash-SHA256": 1270, "domain": 168, "hostname": 31, "URL": 98 }, "indicator_count": 2185, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4510870e9906d58e7a554", "name": "CAPE Sandbox -y2k", "description": "> full text of the full report on this year's EU Referendum, which will take place on 26 May 2017, has been published by BBC Radio 5 live in the UK and Ireland.>y2k status", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:34:16.928000", "tags": [ "html document", "ascii text", "language" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 308, "FileHash-SHA256": 1270, "domain": 168, "hostname": 31, "URL": 98 }, "indicator_count": 2185, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d452d1096350bb560f7fee", "name": "VirusTotal Box of Apples Sandbox report", "description": "", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:41:53.433000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1066, "FileHash-MD5": 6, "FileHash-SHA1": 11, "domain": 111, "hostname": 66, "URL": 104 }, "indicator_count": 1364, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d452d5b2ebb31d314f0325", "name": "VirusTotal Box of Apples Sandbox report", "description": "", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:41:57.173000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1066, "FileHash-MD5": 6, "FileHash-SHA1": 11, "domain": 111, "hostname": 66, "URL": 104 }, "indicator_count": 1364, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d452d748d0f072544a4564", "name": "VirusTotal Box of Apples Sandbox report", "description": "", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:41:59.068000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1066, "FileHash-MD5": 6, "FileHash-SHA1": 11, "domain": 111, "hostname": 66, "URL": 104 }, "indicator_count": 1364, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d452df7c1ea9136ee627df", "name": "VirusTotal Box of Apples Sandbox report", "description": "", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:42:07.725000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1066, "FileHash-MD5": 6, "FileHash-SHA1": 11, "domain": 111, "hostname": 67, "URL": 104 }, "indicator_count": 1365, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4569a944adf94a75efcf9", "name": "VirusTotal report\n for download.rar", "description": "0347ed7f6728c494128d5cde9e4effdc2bcc8f944d78bca8d, as well as 1.3m2.", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:58:02.158000", "tags": [ "json text", "json" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 287, "FileHash-SHA1": 283, "FileHash-SHA256": 2301, "URL": 113, "domain": 169, "hostname": 75 }, "indicator_count": 3228, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4569dc87656b4a255a124", "name": "VirusTotal report\n for download.rar", "description": "0347ed7f6728c494128d5cde9e4effdc2bcc8f944d78bca8d, as well as 1.3m2.", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:58:05.842000", "tags": [ "json text", "json" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 281, "FileHash-SHA1": 277, "FileHash-SHA256": 2208, "URL": 113, "domain": 169, "hostname": 75 }, "indicator_count": 3123, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d44428ad43f231ff43e175", "name": "VirusTotal report\n for install.sh", "description": "", "modified": "2026-05-06T23:07:30.047000", "created": "2026-04-06T23:39:20.767000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 43, "FileHash-SHA1": 45, "FileHash-SHA256": 1421, "URL": 261, "hostname": 73, "domain": 235, "email": 1 }, "indicator_count": 2079, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4442a0b5217c34bbcbd2d", "name": "VirusTotal report\n for install.sh", "description": "", "modified": "2026-05-06T23:07:30.047000", "created": "2026-04-06T23:39:22.105000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 43, "FileHash-SHA1": 45, "FileHash-SHA256": 1421, "URL": 261, "hostname": 73, "domain": 235, "email": 1 }, "indicator_count": 2079, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4462288245b27cf606f42", "name": "VirusTotal Box of Apples Sandbox report", "description": "<<< full text of the following:.1.2 (2.4m) in text, in the form of file, has been published online by the Linux operating system, known as Linux.>>>", "modified": "2026-05-06T00:02:38.802000", "created": "2026-04-06T23:47:46.697000", "tags": [ "file type", "unix", "wed jun", "thu jun" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1023, "hostname": 54, "FileHash-MD5": 12, "FileHash-SHA1": 12, "URL": 146, "domain": 230 }, "indicator_count": 1477, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d4462886e53e706aae1674", "name": "VirusTotal Box of Apples Sandbox report", "description": "<<< full text of the following:.1.2 (2.4m) in text, in the form of file, has been published online by the Linux operating system, known as Linux.>>>", "modified": "2026-05-06T00:02:38.802000", "created": "2026-04-06T23:47:52.536000", "tags": [ "file type", "unix", "wed jun", "thu jun" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1023, "hostname": 54, "FileHash-MD5": 12, "FileHash-SHA1": 12, "URL": 146, "domain": 230 }, "indicator_count": 1477, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d44629b6a6bc546fdd357a", "name": "VirusTotal Box of Apples Sandbox report", "description": "<<< full text of the following:.1.2 (2.4m) in text, in the form of file, has been published online by the Linux operating system, known as Linux.>>>", "modified": "2026-05-06T00:02:38.802000", "created": "2026-04-06T23:47:53.256000", "tags": [ "file type", "unix", "wed jun", "thu jun" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1023, "hostname": 54, "FileHash-MD5": 12, "FileHash-SHA1": 12, "URL": 146, "domain": 230 }, "indicator_count": 1477, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ccd2f7984fad6feebb4ca4", "name": "VirusTotal report\n for index.html", "description": "The full text of the full report-to-gws, which was published on 1 April 2026, has been published online by the Csp website, following a request from the BBC>pretext .", "modified": "2026-05-01T08:03:52.918000", "created": "2026-04-01T08:10:31.621000", "tags": [ "self", "downlink rtt", "html document", "ascii text", "crlf line", "windows", "linux", "build web", "html", "javascript", "https", "acceptencoding", "cookie", "dynamic", "authorization", "contentmd5", "wp engine", "xmsedgeref ref", "bl2edge1520 ref", "expires sun", "gmt date", "gmt xcache", "tcphit", "gmt etag", "b8glwd", "afeap", "bmxagc", "e5bfse", "bgs6mb", "bjwmce", "ciztgb", "kqhykb", "cxxawb", "fevhcf", "code", "server", "registrar abuse", "admin country", "expiration date", "registry domain", "registrar iana", "creation date", "admin city", "redmond tech", "samesitelax", "path", "httponly", "secure", "priorityhigh", "gmt contenttype", "contentlength", "connection", "cfray", "accept", "anycast", "wifi display", "android", "hdtv", "anycast og", "anything", "big screen", "mobileoptimized", "try shopify", "platform", "businesses", "shopify fb", "shopify og", "snapchat", "chat", "snaps", "a snap", "utc google", "adobe dynamic", "tag management", "amazon", "utc amazon", "utc facebook", "connect na", "analytics na", "tag manager", "gdlname", "miss", "drupal", "miss xtimer", "ve9 xcache", "miss date", "gmt link", "build", "home og", "cloudfront", "iad6", "kb body", "sha256", "aspen", "aspen one", "return", "transformed og", "aioseo", "site kit", "google", "file type", "name file", "html internet", "unicode text", "utf8 text" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 238, "URL": 367, "domain": 80, "hostname": 155, "FileHash-MD5": 115, "FileHash-SHA1": 105, "email": 5, "SSLCertFingerprint": 4 }, "indicator_count": 1069, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "29 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ccd2f93b5cf1fa8fcb0810", "name": "VirusTotal report\n for index.html", "description": "The full text of the full report-to-gws, which was published on 1 April 2026, has been published online by the Csp website, following a request from the BBC>pretext .", "modified": "2026-05-01T08:03:52.918000", "created": "2026-04-01T08:10:33.232000", "tags": [ "self", "downlink rtt", "html document", "ascii text", "crlf line", "windows", "linux", "build web", "html", "javascript", "https", "acceptencoding", "cookie", "dynamic", "authorization", "contentmd5", "wp engine", "xmsedgeref ref", "bl2edge1520 ref", "expires sun", "gmt date", "gmt xcache", "tcphit", "gmt etag", "b8glwd", "afeap", "bmxagc", "e5bfse", "bgs6mb", "bjwmce", "ciztgb", "kqhykb", "cxxawb", "fevhcf", "code", "server", "registrar abuse", "admin country", "expiration date", "registry domain", "registrar iana", "creation date", "admin city", "redmond tech", "samesitelax", "path", "httponly", "secure", "priorityhigh", "gmt contenttype", "contentlength", "connection", "cfray", "accept", "anycast", "wifi display", "android", "hdtv", "anycast og", "anything", "big screen", "mobileoptimized", "try shopify", "platform", "businesses", "shopify fb", "shopify og", "snapchat", "chat", "snaps", "a snap", "utc google", "adobe dynamic", "tag management", "amazon", "utc amazon", "utc facebook", "connect na", "analytics na", "tag manager", "gdlname", "miss", "drupal", "miss xtimer", "ve9 xcache", "miss date", "gmt link", "build", "home og", "cloudfront", "iad6", "kb body", "sha256", "aspen", "aspen one", "return", "transformed og", "aioseo", "site kit", "google", "file type", "name file", "html internet", "unicode text", "utf8 text" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 181, "URL": 262, "domain": 28, "hostname": 114, "FileHash-MD5": 105, "FileHash-SHA1": 93, "email": 3 }, "indicator_count": 786, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "29 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69c1bb46dd9f4d876aa704e9", "name": "TheContructor", "description": "<<<>> UAlberta Alfresco & Edmonton Police Compromise (HR Files) & TX - 05.24.26 - edit", "modified": "2026-05-24T19:48:36.416000", "created": "2026-05-24T19:48:36.416000", "tags": [], "references": [ "https://www.virustotal.com/graph/embed/g3238715200b747f1a237e03037a4d5ff15d85564ee0740439750d8ff75347031?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology", "Healthcare", "Government", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "UCP_GoA23", "id": "382539", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 200, "FileHash-MD5": 60, "FileHash-SHA1": 59, "FileHash-SHA256": 1097, "IPv4": 397, "domain": 341, "hostname": 407 }, "indicator_count": 2561, "is_author": false, "is_subscribing": null, "subscriber_count": 18, "modified_text": "6 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a10a079d3a0831710f3a0ab", "name": "Catastrophic DataBreach confirmed - UAlberta & Edmonton Police Services - 05.22.26", "description": "BEC/ATO (reported) and unauthorized use & abuse of Stolen Identity/Access/Credentials from the University of Alberta has been demonstrated as the cause of catastrophic Data-Breaches across the ualberta[.]ca domain and Edmonton Police Services (EPS).\nData is comprehensive, includes HR Records, PII/PHI, employment data, addresses, contact information.", "modified": "2026-05-22T18:29:13.092000", "created": "2026-05-22T18:29:13.092000", "tags": [], "references": [ "https://www.virustotal.com/graph/embed/g3238715200b747f1a237e03037a4d5ff15d85564ee0740439750d8ff75347031?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Government", "Healthcare", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "UCP_GoA23", "id": "382539", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 200, "FileHash-MD5": 61, "FileHash-SHA1": 60, "FileHash-SHA256": 1032, "IPv4": 393, "domain": 340, "hostname": 387 }, "indicator_count": 2473, "is_author": false, "is_subscribing": null, "subscriber_count": 19, "modified_text": "8 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0e936ce3f3ebd4b76fee29", "name": "MAV-en * VirusTotal report for setup-maven-master.zip", "description": "[The full text of the statement on the subject of human rights, as compiled by BBC Radio 4's Panorama, will be published on Wednesday, 27 March.. and will appear on BBC iPlayer]usernotificationsd, \"freeze_skip_reason:\" : \"none\",\n \"pid\" : 851,\n \"cpuTime\" : 0.52999799999999997,\n \"name\" : \"HeuristicInterpreter\",\n country_code\":\"US\",\"agent\":\"parsecd\\/1 (iPhone17,4; iPhone OS 26.3.1 23D8133) parsecd\\/", "modified": "2026-05-21T23:45:08.365000", "created": "2026-05-21T05:09:00.942000", "tags": [ "file type", "ascii", "ascii text", "java source", "json", "unicode text", "utf8 text", "c source", "sgml document", "creates", "persistence", "malicious", "next", "windows sandbox", "calls clear", "png image", "svg scalable", "vector graphics", "rgba", "crlf line", "ms windows", "title", "installer", "template", "pcx ver", "code helper", "helper", "plugin", "renderer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "mitre attack", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339747&Signature=R%2FOTx2wxfF3MkMsUAEbX76dOSFXtiY%2BBtXR6Kl7PxVGTXaylNjmhXaxofJAQ0RP2z7ICeXit4nmXky1HIQZnPX74ZyD16ICTt3%2BAXA6yZSU%2Fw%2Fks9M2Ju1xi3m8IMloiUH7Z9Le5L5Mlfrw5QO4ZO%2FgDHG3ATHUk0qk%2BFUT2gsjT8jS6aztZHjZo4xVQLlmmwWY2%2F8%2FKZejJlFptwLfMZEA%2BDW1ZbssKpkNsXZGu69SkdNPO9c", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339770&Signature=tPgwja3MWoODqbVlxhsock2mBa1WfALhB00A%2FSu4klEizmiV6VxM5y6vH%2FGm%2FFf67mLtz5mR6Mt17RKGQUPK11iYmQax86WhcCuxTpR0mDpo12tG4HAI5ht8qM4xgOQcjspEhBgsXPDvw2Np7e9trD0l8MytxvCqOuA7DVNdiUL2xvLNXAG1yCptFpvqyZo7kokLxp4RwsvDJuOrH8%2FGrNAOjdaHFQ8FWGhgkhyO6Q767Szi", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339792&Signature=O6r4LzVdjNFj7wZVT%2B0a4%2BGemB4yEqip9waMS7NlonESXy80tfqV33UBqEEp8i%2B2qOg6S%2Ba4cSwzi3nXOtjSaUaFAI43DmvSsxq5Y5WsA8cMb4Ul6FhGON6Cr0JT1xoEMtACmSdxG8Vo%2Be4PVcu93v6CBeWMZnFb8exU8ku4GUDY8ZEFW%2FJqeu266wn59KD9gFKRwlqx3NuRzMLdwqMA7f9o6QLPcM8WWnB%2BkvJVFk3BnxJAfBn7T2JO", "https://vtbehaviour.commondatastorage.googleapis.com/f839e941d0d2b6d9c5d6fd9b8b9ea9d34629182973bb9cc8af28e1e3ccdbbdd4_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339838&Signature=GgSFM3a3czj9g63hY67%2B%2FAyC%2FcGgMmTIqhErAonJ7vV9C8snHKwK0GtHZ6drm%2Fd%2BKaMonYJwSmh1LrRzYF9toBJc5rBwpR%2BPlsrS9EArViMI%2Bd%2Fb8ZZBHgqFsmCiiSWfzz4kIQRPM0RB4osCHqQxKmGW2i1uyWrytYjA4V%2FZREm1%2Bm2EEWx38PebvBFrM9pMznjF6rghFHp8ls6tzuolbXD4WUfR0OSoXjcAaAgihobJ%2FmOd", "https://vtbehaviour.commondatastorage.googleapis.com/e2f820daf9f578d5f3219ae8b3c6391017badf913a68c4aaac4e52c5155c566f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339867&Signature=l%2F%2BDGW7ZLqIfVvi1NOyg4%2FCgXPJBdSweWglJKW7iMb5GfnK0pX4yYYVL3OKkqrzAbMUcR2fqLUXHJfnMwSKBhQxjGR8LGF1nh7TeXxVGIQVh8kAyEZBCuXNHsZfzxR0zVbZfKAIEvC9D8S2%2FwBmpI6xztHiC7vmaJ5OhJD%2BoPDojRqXH2bmBpCz1XTZd7JphPNXRIbefZL4mR%2FrRe7o8WO2JHylOy9rIodNKKPEv5W9Q54%2BaA%2FG926", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339948&Signature=JA8BamPMfn7P8xM9CTv8ndNuaNtng0n%2Btofwj05768pJwsCB6Mgd6GU18%2BpNjCvwwZg%2F%2Bw0a2xOYIsvuqdDQAFzoO3jl3EUYKu7dPoOelD2NPrIcyCAHc8qKhqpPdjZKpo%2B8AJCxvO13OXHoSh94%2B%2Bht9h6mIJs8y7YO2CUo%2FqlV8M0fa5Px90aErgl%2BarD7%2ByQWlt0QD2caFKl%2BHViTViTx", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779340034&Signature=tbq82yoC%2BAKXaH%2F2XjmRWiAbt911K91ltP8zHTYrstzi0i1UKrzJxM48ky9ypV%2B%2FvrYdgBnaOfI9MzgZH0C%2FOFJUaVJ3WB87ULkjglD%2F6GeEDDcPtDX%2BY6aw2%2Bb8WaJU2xLc%2F9JbwoTbPP0n83pJv1qe0KLqckLIjEN4iREH1zU%2FldO5TBRicvB%2BxjeAxpPFZnjNZmyFl%2FNHbavuuvRc%2FMNR0DbjnriB2Mub" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 204, "FileHash-SHA1": 90, "FileHash-SHA256": 1997, "IPv4": 49, "domain": 34, "hostname": 124, "URL": 429, "URI": 1, "CIDR": 16 }, "indicator_count": 2944, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "9 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0e935a4a7df45548fe942d", "name": "MAV-en * VirusTotal report for setup-maven-master.zip", "description": "[The full text of the statement on the subject of human rights, as compiled by BBC Radio 4's Panorama, will be published on Wednesday, 27 March.. and will appear on BBC iPlayer]usernotificationsd, \"freeze_skip_reason:\" : \"none\",\n \"pid\" : 851,\n \"cpuTime\" : 0.52999799999999997,\n \"name\" : \"HeuristicInterpreter\",\n country_code\":\"US\",\"agent\":\"parsecd\\/1 (iPhone17,4; iPhone OS 26.3.1 23D8133) parsecd\\/", "modified": "2026-05-21T05:21:46.242000", "created": "2026-05-21T05:08:42.394000", "tags": [ "file type", "ascii", "ascii text", "java source", "json", "unicode text", "utf8 text", "c source", "sgml document", "creates", "persistence", "malicious", "next", "windows sandbox", "calls clear", "png image", "svg scalable", "vector graphics", "rgba", "crlf line", "ms windows", "title", "installer", "template", "pcx ver", "code helper", "helper", "plugin", "renderer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "mitre attack", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339747&Signature=R%2FOTx2wxfF3MkMsUAEbX76dOSFXtiY%2BBtXR6Kl7PxVGTXaylNjmhXaxofJAQ0RP2z7ICeXit4nmXky1HIQZnPX74ZyD16ICTt3%2BAXA6yZSU%2Fw%2Fks9M2Ju1xi3m8IMloiUH7Z9Le5L5Mlfrw5QO4ZO%2FgDHG3ATHUk0qk%2BFUT2gsjT8jS6aztZHjZo4xVQLlmmwWY2%2F8%2FKZejJlFptwLfMZEA%2BDW1ZbssKpkNsXZGu69SkdNPO9c", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339770&Signature=tPgwja3MWoODqbVlxhsock2mBa1WfALhB00A%2FSu4klEizmiV6VxM5y6vH%2FGm%2FFf67mLtz5mR6Mt17RKGQUPK11iYmQax86WhcCuxTpR0mDpo12tG4HAI5ht8qM4xgOQcjspEhBgsXPDvw2Np7e9trD0l8MytxvCqOuA7DVNdiUL2xvLNXAG1yCptFpvqyZo7kokLxp4RwsvDJuOrH8%2FGrNAOjdaHFQ8FWGhgkhyO6Q767Szi", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339792&Signature=O6r4LzVdjNFj7wZVT%2B0a4%2BGemB4yEqip9waMS7NlonESXy80tfqV33UBqEEp8i%2B2qOg6S%2Ba4cSwzi3nXOtjSaUaFAI43DmvSsxq5Y5WsA8cMb4Ul6FhGON6Cr0JT1xoEMtACmSdxG8Vo%2Be4PVcu93v6CBeWMZnFb8exU8ku4GUDY8ZEFW%2FJqeu266wn59KD9gFKRwlqx3NuRzMLdwqMA7f9o6QLPcM8WWnB%2BkvJVFk3BnxJAfBn7T2JO", "https://vtbehaviour.commondatastorage.googleapis.com/f839e941d0d2b6d9c5d6fd9b8b9ea9d34629182973bb9cc8af28e1e3ccdbbdd4_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339838&Signature=GgSFM3a3czj9g63hY67%2B%2FAyC%2FcGgMmTIqhErAonJ7vV9C8snHKwK0GtHZ6drm%2Fd%2BKaMonYJwSmh1LrRzYF9toBJc5rBwpR%2BPlsrS9EArViMI%2Bd%2Fb8ZZBHgqFsmCiiSWfzz4kIQRPM0RB4osCHqQxKmGW2i1uyWrytYjA4V%2FZREm1%2Bm2EEWx38PebvBFrM9pMznjF6rghFHp8ls6tzuolbXD4WUfR0OSoXjcAaAgihobJ%2FmOd", "https://vtbehaviour.commondatastorage.googleapis.com/e2f820daf9f578d5f3219ae8b3c6391017badf913a68c4aaac4e52c5155c566f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339867&Signature=l%2F%2BDGW7ZLqIfVvi1NOyg4%2FCgXPJBdSweWglJKW7iMb5GfnK0pX4yYYVL3OKkqrzAbMUcR2fqLUXHJfnMwSKBhQxjGR8LGF1nh7TeXxVGIQVh8kAyEZBCuXNHsZfzxR0zVbZfKAIEvC9D8S2%2FwBmpI6xztHiC7vmaJ5OhJD%2BoPDojRqXH2bmBpCz1XTZd7JphPNXRIbefZL4mR%2FrRe7o8WO2JHylOy9rIodNKKPEv5W9Q54%2BaA%2FG926", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339948&Signature=JA8BamPMfn7P8xM9CTv8ndNuaNtng0n%2Btofwj05768pJwsCB6Mgd6GU18%2BpNjCvwwZg%2F%2Bw0a2xOYIsvuqdDQAFzoO3jl3EUYKu7dPoOelD2NPrIcyCAHc8qKhqpPdjZKpo%2B8AJCxvO13OXHoSh94%2B%2Bht9h6mIJs8y7YO2CUo%2FqlV8M0fa5Px90aErgl%2BarD7%2ByQWlt0QD2caFKl%2BHViTViTx", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779340034&Signature=tbq82yoC%2BAKXaH%2F2XjmRWiAbt911K91ltP8zHTYrstzi0i1UKrzJxM48ky9ypV%2B%2FvrYdgBnaOfI9MzgZH0C%2FOFJUaVJ3WB87ULkjglD%2F6GeEDDcPtDX%2BY6aw2%2Bb8WaJU2xLc%2F9JbwoTbPP0n83pJv1qe0KLqckLIjEN4iREH1zU%2FldO5TBRicvB%2BxjeAxpPFZnjNZmyFl%2FNHbavuuvRc%2FMNR0DbjnriB2Mub" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 216, "FileHash-SHA1": 122, "FileHash-SHA256": 2487, "IPv4": 19, "domain": 47, "hostname": 73, "URL": 205, "URI": 1, "email": 1 }, "indicator_count": 3171, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "10 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0e936aec67867b0f6d29f3", "name": "MAV-en * VirusTotal report for setup-maven-master.zip", "description": "[The full text of the statement on the subject of human rights, as compiled by BBC Radio 4's Panorama, will be published on Wednesday, 27 March.. and will appear on BBC iPlayer]usernotificationsd, \"freeze_skip_reason:\" : \"none\",\n \"pid\" : 851,\n \"cpuTime\" : 0.52999799999999997,\n \"name\" : \"HeuristicInterpreter\",\n country_code\":\"US\",\"agent\":\"parsecd\\/1 (iPhone17,4; iPhone OS 26.3.1 23D8133) parsecd\\/", "modified": "2026-05-21T05:13:23.417000", "created": "2026-05-21T05:08:58.537000", "tags": [ "file type", "ascii", "ascii text", "java source", "json", "unicode text", "utf8 text", "c source", "sgml document", "creates", "persistence", "malicious", "next", "windows sandbox", "calls clear", "png image", "svg scalable", "vector graphics", "rgba", "crlf line", "ms windows", "title", "installer", "template", "pcx ver", "code helper", "helper", "plugin", "renderer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "mitre attack", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339747&Signature=R%2FOTx2wxfF3MkMsUAEbX76dOSFXtiY%2BBtXR6Kl7PxVGTXaylNjmhXaxofJAQ0RP2z7ICeXit4nmXky1HIQZnPX74ZyD16ICTt3%2BAXA6yZSU%2Fw%2Fks9M2Ju1xi3m8IMloiUH7Z9Le5L5Mlfrw5QO4ZO%2FgDHG3ATHUk0qk%2BFUT2gsjT8jS6aztZHjZo4xVQLlmmwWY2%2F8%2FKZejJlFptwLfMZEA%2BDW1ZbssKpkNsXZGu69SkdNPO9c", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339770&Signature=tPgwja3MWoODqbVlxhsock2mBa1WfALhB00A%2FSu4klEizmiV6VxM5y6vH%2FGm%2FFf67mLtz5mR6Mt17RKGQUPK11iYmQax86WhcCuxTpR0mDpo12tG4HAI5ht8qM4xgOQcjspEhBgsXPDvw2Np7e9trD0l8MytxvCqOuA7DVNdiUL2xvLNXAG1yCptFpvqyZo7kokLxp4RwsvDJuOrH8%2FGrNAOjdaHFQ8FWGhgkhyO6Q767Szi", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339792&Signature=O6r4LzVdjNFj7wZVT%2B0a4%2BGemB4yEqip9waMS7NlonESXy80tfqV33UBqEEp8i%2B2qOg6S%2Ba4cSwzi3nXOtjSaUaFAI43DmvSsxq5Y5WsA8cMb4Ul6FhGON6Cr0JT1xoEMtACmSdxG8Vo%2Be4PVcu93v6CBeWMZnFb8exU8ku4GUDY8ZEFW%2FJqeu266wn59KD9gFKRwlqx3NuRzMLdwqMA7f9o6QLPcM8WWnB%2BkvJVFk3BnxJAfBn7T2JO", "https://vtbehaviour.commondatastorage.googleapis.com/f839e941d0d2b6d9c5d6fd9b8b9ea9d34629182973bb9cc8af28e1e3ccdbbdd4_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339838&Signature=GgSFM3a3czj9g63hY67%2B%2FAyC%2FcGgMmTIqhErAonJ7vV9C8snHKwK0GtHZ6drm%2Fd%2BKaMonYJwSmh1LrRzYF9toBJc5rBwpR%2BPlsrS9EArViMI%2Bd%2Fb8ZZBHgqFsmCiiSWfzz4kIQRPM0RB4osCHqQxKmGW2i1uyWrytYjA4V%2FZREm1%2Bm2EEWx38PebvBFrM9pMznjF6rghFHp8ls6tzuolbXD4WUfR0OSoXjcAaAgihobJ%2FmOd", "https://vtbehaviour.commondatastorage.googleapis.com/e2f820daf9f578d5f3219ae8b3c6391017badf913a68c4aaac4e52c5155c566f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339867&Signature=l%2F%2BDGW7ZLqIfVvi1NOyg4%2FCgXPJBdSweWglJKW7iMb5GfnK0pX4yYYVL3OKkqrzAbMUcR2fqLUXHJfnMwSKBhQxjGR8LGF1nh7TeXxVGIQVh8kAyEZBCuXNHsZfzxR0zVbZfKAIEvC9D8S2%2FwBmpI6xztHiC7vmaJ5OhJD%2BoPDojRqXH2bmBpCz1XTZd7JphPNXRIbefZL4mR%2FrRe7o8WO2JHylOy9rIodNKKPEv5W9Q54%2BaA%2FG926", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339948&Signature=JA8BamPMfn7P8xM9CTv8ndNuaNtng0n%2Btofwj05768pJwsCB6Mgd6GU18%2BpNjCvwwZg%2F%2Bw0a2xOYIsvuqdDQAFzoO3jl3EUYKu7dPoOelD2NPrIcyCAHc8qKhqpPdjZKpo%2B8AJCxvO13OXHoSh94%2B%2Bht9h6mIJs8y7YO2CUo%2FqlV8M0fa5Px90aErgl%2BarD7%2ByQWlt0QD2caFKl%2BHViTViTx", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779340034&Signature=tbq82yoC%2BAKXaH%2F2XjmRWiAbt911K91ltP8zHTYrstzi0i1UKrzJxM48ky9ypV%2B%2FvrYdgBnaOfI9MzgZH0C%2FOFJUaVJ3WB87ULkjglD%2F6GeEDDcPtDX%2BY6aw2%2Bb8WaJU2xLc%2F9JbwoTbPP0n83pJv1qe0KLqckLIjEN4iREH1zU%2FldO5TBRicvB%2BxjeAxpPFZnjNZmyFl%2FNHbavuuvRc%2FMNR0DbjnriB2Mub" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 204, "FileHash-SHA1": 88, "FileHash-SHA256": 1993, "IPv4": 19, "domain": 34, "hostname": 60, "URL": 203, "URI": 1 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "10 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0e9368acb77419bf65660d", "name": "MAV-en * VirusTotal report for setup-maven-master.zip", "description": "[The full text of the statement on the subject of human rights, as compiled by BBC Radio 4's Panorama, will be published on Wednesday, 27 March.. and will appear on BBC iPlayer]usernotificationsd, \"freeze_skip_reason:\" : \"none\",\n \"pid\" : 851,\n \"cpuTime\" : 0.52999799999999997,\n \"name\" : \"HeuristicInterpreter\",\n country_code\":\"US\",\"agent\":\"parsecd\\/1 (iPhone17,4; iPhone OS 26.3.1 23D8133) parsecd\\/", "modified": "2026-05-21T05:13:16.005000", "created": "2026-05-21T05:08:56.934000", "tags": [ "file type", "ascii", "ascii text", "java source", "json", "unicode text", "utf8 text", "c source", "sgml document", "creates", "persistence", "malicious", "next", "windows sandbox", "calls clear", "png image", "svg scalable", "vector graphics", "rgba", "crlf line", "ms windows", "title", "installer", "template", "pcx ver", "code helper", "helper", "plugin", "renderer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "mitre attack", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339747&Signature=R%2FOTx2wxfF3MkMsUAEbX76dOSFXtiY%2BBtXR6Kl7PxVGTXaylNjmhXaxofJAQ0RP2z7ICeXit4nmXky1HIQZnPX74ZyD16ICTt3%2BAXA6yZSU%2Fw%2Fks9M2Ju1xi3m8IMloiUH7Z9Le5L5Mlfrw5QO4ZO%2FgDHG3ATHUk0qk%2BFUT2gsjT8jS6aztZHjZo4xVQLlmmwWY2%2F8%2FKZejJlFptwLfMZEA%2BDW1ZbssKpkNsXZGu69SkdNPO9c", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339770&Signature=tPgwja3MWoODqbVlxhsock2mBa1WfALhB00A%2FSu4klEizmiV6VxM5y6vH%2FGm%2FFf67mLtz5mR6Mt17RKGQUPK11iYmQax86WhcCuxTpR0mDpo12tG4HAI5ht8qM4xgOQcjspEhBgsXPDvw2Np7e9trD0l8MytxvCqOuA7DVNdiUL2xvLNXAG1yCptFpvqyZo7kokLxp4RwsvDJuOrH8%2FGrNAOjdaHFQ8FWGhgkhyO6Q767Szi", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339792&Signature=O6r4LzVdjNFj7wZVT%2B0a4%2BGemB4yEqip9waMS7NlonESXy80tfqV33UBqEEp8i%2B2qOg6S%2Ba4cSwzi3nXOtjSaUaFAI43DmvSsxq5Y5WsA8cMb4Ul6FhGON6Cr0JT1xoEMtACmSdxG8Vo%2Be4PVcu93v6CBeWMZnFb8exU8ku4GUDY8ZEFW%2FJqeu266wn59KD9gFKRwlqx3NuRzMLdwqMA7f9o6QLPcM8WWnB%2BkvJVFk3BnxJAfBn7T2JO", "https://vtbehaviour.commondatastorage.googleapis.com/f839e941d0d2b6d9c5d6fd9b8b9ea9d34629182973bb9cc8af28e1e3ccdbbdd4_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339838&Signature=GgSFM3a3czj9g63hY67%2B%2FAyC%2FcGgMmTIqhErAonJ7vV9C8snHKwK0GtHZ6drm%2Fd%2BKaMonYJwSmh1LrRzYF9toBJc5rBwpR%2BPlsrS9EArViMI%2Bd%2Fb8ZZBHgqFsmCiiSWfzz4kIQRPM0RB4osCHqQxKmGW2i1uyWrytYjA4V%2FZREm1%2Bm2EEWx38PebvBFrM9pMznjF6rghFHp8ls6tzuolbXD4WUfR0OSoXjcAaAgihobJ%2FmOd", "https://vtbehaviour.commondatastorage.googleapis.com/e2f820daf9f578d5f3219ae8b3c6391017badf913a68c4aaac4e52c5155c566f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339867&Signature=l%2F%2BDGW7ZLqIfVvi1NOyg4%2FCgXPJBdSweWglJKW7iMb5GfnK0pX4yYYVL3OKkqrzAbMUcR2fqLUXHJfnMwSKBhQxjGR8LGF1nh7TeXxVGIQVh8kAyEZBCuXNHsZfzxR0zVbZfKAIEvC9D8S2%2FwBmpI6xztHiC7vmaJ5OhJD%2BoPDojRqXH2bmBpCz1XTZd7JphPNXRIbefZL4mR%2FrRe7o8WO2JHylOy9rIodNKKPEv5W9Q54%2BaA%2FG926", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339948&Signature=JA8BamPMfn7P8xM9CTv8ndNuaNtng0n%2Btofwj05768pJwsCB6Mgd6GU18%2BpNjCvwwZg%2F%2Bw0a2xOYIsvuqdDQAFzoO3jl3EUYKu7dPoOelD2NPrIcyCAHc8qKhqpPdjZKpo%2B8AJCxvO13OXHoSh94%2B%2Bht9h6mIJs8y7YO2CUo%2FqlV8M0fa5Px90aErgl%2BarD7%2ByQWlt0QD2caFKl%2BHViTViTx", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779340034&Signature=tbq82yoC%2BAKXaH%2F2XjmRWiAbt911K91ltP8zHTYrstzi0i1UKrzJxM48ky9ypV%2B%2FvrYdgBnaOfI9MzgZH0C%2FOFJUaVJ3WB87ULkjglD%2F6GeEDDcPtDX%2BY6aw2%2Bb8WaJU2xLc%2F9JbwoTbPP0n83pJv1qe0KLqckLIjEN4iREH1zU%2FldO5TBRicvB%2BxjeAxpPFZnjNZmyFl%2FNHbavuuvRc%2FMNR0DbjnriB2Mub" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 204, "FileHash-SHA1": 88, "FileHash-SHA256": 1993, "IPv4": 19, "domain": 34, "hostname": 60, "URL": 203, "URI": 1 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "10 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0e936b647274be6ed25227", "name": "MAV-en * VirusTotal report for setup-maven-master.zip", "description": "[The full text of the statement on the subject of human rights, as compiled by BBC Radio 4's Panorama, will be published on Wednesday, 27 March.. and will appear on BBC iPlayer]usernotificationsd, \"freeze_skip_reason:\" : \"none\",\n \"pid\" : 851,\n \"cpuTime\" : 0.52999799999999997,\n \"name\" : \"HeuristicInterpreter\",\n country_code\":\"US\",\"agent\":\"parsecd\\/1 (iPhone17,4; iPhone OS 26.3.1 23D8133) parsecd\\/", "modified": "2026-05-21T05:13:13.100000", "created": "2026-05-21T05:08:59.081000", "tags": [ "file type", "ascii", "ascii text", "java source", "json", "unicode text", "utf8 text", "c source", "sgml document", "creates", "persistence", "malicious", "next", "windows sandbox", "calls clear", "png image", "svg scalable", "vector graphics", "rgba", "crlf line", "ms windows", "title", "installer", "template", "pcx ver", "code helper", "helper", "plugin", "renderer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "mitre attack", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339747&Signature=R%2FOTx2wxfF3MkMsUAEbX76dOSFXtiY%2BBtXR6Kl7PxVGTXaylNjmhXaxofJAQ0RP2z7ICeXit4nmXky1HIQZnPX74ZyD16ICTt3%2BAXA6yZSU%2Fw%2Fks9M2Ju1xi3m8IMloiUH7Z9Le5L5Mlfrw5QO4ZO%2FgDHG3ATHUk0qk%2BFUT2gsjT8jS6aztZHjZo4xVQLlmmwWY2%2F8%2FKZejJlFptwLfMZEA%2BDW1ZbssKpkNsXZGu69SkdNPO9c", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339770&Signature=tPgwja3MWoODqbVlxhsock2mBa1WfALhB00A%2FSu4klEizmiV6VxM5y6vH%2FGm%2FFf67mLtz5mR6Mt17RKGQUPK11iYmQax86WhcCuxTpR0mDpo12tG4HAI5ht8qM4xgOQcjspEhBgsXPDvw2Np7e9trD0l8MytxvCqOuA7DVNdiUL2xvLNXAG1yCptFpvqyZo7kokLxp4RwsvDJuOrH8%2FGrNAOjdaHFQ8FWGhgkhyO6Q767Szi", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339792&Signature=O6r4LzVdjNFj7wZVT%2B0a4%2BGemB4yEqip9waMS7NlonESXy80tfqV33UBqEEp8i%2B2qOg6S%2Ba4cSwzi3nXOtjSaUaFAI43DmvSsxq5Y5WsA8cMb4Ul6FhGON6Cr0JT1xoEMtACmSdxG8Vo%2Be4PVcu93v6CBeWMZnFb8exU8ku4GUDY8ZEFW%2FJqeu266wn59KD9gFKRwlqx3NuRzMLdwqMA7f9o6QLPcM8WWnB%2BkvJVFk3BnxJAfBn7T2JO", "https://vtbehaviour.commondatastorage.googleapis.com/f839e941d0d2b6d9c5d6fd9b8b9ea9d34629182973bb9cc8af28e1e3ccdbbdd4_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339838&Signature=GgSFM3a3czj9g63hY67%2B%2FAyC%2FcGgMmTIqhErAonJ7vV9C8snHKwK0GtHZ6drm%2Fd%2BKaMonYJwSmh1LrRzYF9toBJc5rBwpR%2BPlsrS9EArViMI%2Bd%2Fb8ZZBHgqFsmCiiSWfzz4kIQRPM0RB4osCHqQxKmGW2i1uyWrytYjA4V%2FZREm1%2Bm2EEWx38PebvBFrM9pMznjF6rghFHp8ls6tzuolbXD4WUfR0OSoXjcAaAgihobJ%2FmOd", "https://vtbehaviour.commondatastorage.googleapis.com/e2f820daf9f578d5f3219ae8b3c6391017badf913a68c4aaac4e52c5155c566f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339867&Signature=l%2F%2BDGW7ZLqIfVvi1NOyg4%2FCgXPJBdSweWglJKW7iMb5GfnK0pX4yYYVL3OKkqrzAbMUcR2fqLUXHJfnMwSKBhQxjGR8LGF1nh7TeXxVGIQVh8kAyEZBCuXNHsZfzxR0zVbZfKAIEvC9D8S2%2FwBmpI6xztHiC7vmaJ5OhJD%2BoPDojRqXH2bmBpCz1XTZd7JphPNXRIbefZL4mR%2FrRe7o8WO2JHylOy9rIodNKKPEv5W9Q54%2BaA%2FG926", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339948&Signature=JA8BamPMfn7P8xM9CTv8ndNuaNtng0n%2Btofwj05768pJwsCB6Mgd6GU18%2BpNjCvwwZg%2F%2Bw0a2xOYIsvuqdDQAFzoO3jl3EUYKu7dPoOelD2NPrIcyCAHc8qKhqpPdjZKpo%2B8AJCxvO13OXHoSh94%2B%2Bht9h6mIJs8y7YO2CUo%2FqlV8M0fa5Px90aErgl%2BarD7%2ByQWlt0QD2caFKl%2BHViTViTx", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779340034&Signature=tbq82yoC%2BAKXaH%2F2XjmRWiAbt911K91ltP8zHTYrstzi0i1UKrzJxM48ky9ypV%2B%2FvrYdgBnaOfI9MzgZH0C%2FOFJUaVJ3WB87ULkjglD%2F6GeEDDcPtDX%2BY6aw2%2Bb8WaJU2xLc%2F9JbwoTbPP0n83pJv1qe0KLqckLIjEN4iREH1zU%2FldO5TBRicvB%2BxjeAxpPFZnjNZmyFl%2FNHbavuuvRc%2FMNR0DbjnriB2Mub" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 204, "FileHash-SHA1": 88, "FileHash-SHA256": 1993, "IPv4": 19, "domain": 34, "hostname": 60, "URL": 203, "URI": 1 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "10 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0e936cb4a9e6db51876ae2", "name": "MAV-en * VirusTotal report for setup-maven-master.zip", "description": "[The full text of the statement on the subject of human rights, as compiled by BBC Radio 4's Panorama, will be published on Wednesday, 27 March.. and will appear on BBC iPlayer]usernotificationsd, \"freeze_skip_reason:\" : \"none\",\n \"pid\" : 851,\n \"cpuTime\" : 0.52999799999999997,\n \"name\" : \"HeuristicInterpreter\",\n country_code\":\"US\",\"agent\":\"parsecd\\/1 (iPhone17,4; iPhone OS 26.3.1 23D8133) parsecd\\/", "modified": "2026-05-21T05:13:12.402000", "created": "2026-05-21T05:09:00.401000", "tags": [ "file type", "ascii", "ascii text", "java source", "json", "unicode text", "utf8 text", "c source", "sgml document", "creates", "persistence", "malicious", "next", "windows sandbox", "calls clear", "png image", "svg scalable", "vector graphics", "rgba", "crlf line", "ms windows", "title", "installer", "template", "pcx ver", "code helper", "helper", "plugin", "renderer", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "mitre attack", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "ultimate file", "info file", "zip archive" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339747&Signature=R%2FOTx2wxfF3MkMsUAEbX76dOSFXtiY%2BBtXR6Kl7PxVGTXaylNjmhXaxofJAQ0RP2z7ICeXit4nmXky1HIQZnPX74ZyD16ICTt3%2BAXA6yZSU%2Fw%2Fks9M2Ju1xi3m8IMloiUH7Z9Le5L5Mlfrw5QO4ZO%2FgDHG3ATHUk0qk%2BFUT2gsjT8jS6aztZHjZo4xVQLlmmwWY2%2F8%2FKZejJlFptwLfMZEA%2BDW1ZbssKpkNsXZGu69SkdNPO9c", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339770&Signature=tPgwja3MWoODqbVlxhsock2mBa1WfALhB00A%2FSu4klEizmiV6VxM5y6vH%2FGm%2FFf67mLtz5mR6Mt17RKGQUPK11iYmQax86WhcCuxTpR0mDpo12tG4HAI5ht8qM4xgOQcjspEhBgsXPDvw2Np7e9trD0l8MytxvCqOuA7DVNdiUL2xvLNXAG1yCptFpvqyZo7kokLxp4RwsvDJuOrH8%2FGrNAOjdaHFQ8FWGhgkhyO6Q767Szi", "https://vtbehaviour.commondatastorage.googleapis.com/366e8b8ac409bec588ae02fbd3fb9678f1feb43c5fec92670577bbe2c01c2b2e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339792&Signature=O6r4LzVdjNFj7wZVT%2B0a4%2BGemB4yEqip9waMS7NlonESXy80tfqV33UBqEEp8i%2B2qOg6S%2Ba4cSwzi3nXOtjSaUaFAI43DmvSsxq5Y5WsA8cMb4Ul6FhGON6Cr0JT1xoEMtACmSdxG8Vo%2Be4PVcu93v6CBeWMZnFb8exU8ku4GUDY8ZEFW%2FJqeu266wn59KD9gFKRwlqx3NuRzMLdwqMA7f9o6QLPcM8WWnB%2BkvJVFk3BnxJAfBn7T2JO", "https://vtbehaviour.commondatastorage.googleapis.com/f839e941d0d2b6d9c5d6fd9b8b9ea9d34629182973bb9cc8af28e1e3ccdbbdd4_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339838&Signature=GgSFM3a3czj9g63hY67%2B%2FAyC%2FcGgMmTIqhErAonJ7vV9C8snHKwK0GtHZ6drm%2Fd%2BKaMonYJwSmh1LrRzYF9toBJc5rBwpR%2BPlsrS9EArViMI%2Bd%2Fb8ZZBHgqFsmCiiSWfzz4kIQRPM0RB4osCHqQxKmGW2i1uyWrytYjA4V%2FZREm1%2Bm2EEWx38PebvBFrM9pMznjF6rghFHp8ls6tzuolbXD4WUfR0OSoXjcAaAgihobJ%2FmOd", "https://vtbehaviour.commondatastorage.googleapis.com/e2f820daf9f578d5f3219ae8b3c6391017badf913a68c4aaac4e52c5155c566f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339867&Signature=l%2F%2BDGW7ZLqIfVvi1NOyg4%2FCgXPJBdSweWglJKW7iMb5GfnK0pX4yYYVL3OKkqrzAbMUcR2fqLUXHJfnMwSKBhQxjGR8LGF1nh7TeXxVGIQVh8kAyEZBCuXNHsZfzxR0zVbZfKAIEvC9D8S2%2FwBmpI6xztHiC7vmaJ5OhJD%2BoPDojRqXH2bmBpCz1XTZd7JphPNXRIbefZL4mR%2FrRe7o8WO2JHylOy9rIodNKKPEv5W9Q54%2BaA%2FG926", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779339948&Signature=JA8BamPMfn7P8xM9CTv8ndNuaNtng0n%2Btofwj05768pJwsCB6Mgd6GU18%2BpNjCvwwZg%2F%2Bw0a2xOYIsvuqdDQAFzoO3jl3EUYKu7dPoOelD2NPrIcyCAHc8qKhqpPdjZKpo%2B8AJCxvO13OXHoSh94%2B%2Bht9h6mIJs8y7YO2CUo%2FqlV8M0fa5Px90aErgl%2BarD7%2ByQWlt0QD2caFKl%2BHViTViTx", "https://vtbehaviour.commondatastorage.googleapis.com/44ea6ddc04caa89b23fb4acec5625975088c6079d823abfd8c77c95d4edc321b_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779340034&Signature=tbq82yoC%2BAKXaH%2F2XjmRWiAbt911K91ltP8zHTYrstzi0i1UKrzJxM48ky9ypV%2B%2FvrYdgBnaOfI9MzgZH0C%2FOFJUaVJ3WB87ULkjglD%2F6GeEDDcPtDX%2BY6aw2%2Bb8WaJU2xLc%2F9JbwoTbPP0n83pJv1qe0KLqckLIjEN4iREH1zU%2FldO5TBRicvB%2BxjeAxpPFZnjNZmyFl%2FNHbavuuvRc%2FMNR0DbjnriB2Mub" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 204, "FileHash-SHA1": 88, "FileHash-SHA256": 1993, "IPv4": 19, "domain": 34, "hostname": 60, "URL": 203, "URI": 1 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "10 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0bff94564a0098e02ab37d", "name": "Alfresco Archive // b257cc536324cd2566432555666307b43d27ee9cbda5e45707e3e97b61b3dff6 - 05.19.26", "description": "The full list of Edmonton police officers, officers and staff, as part of the city's Police Complaints Commission (PCC), has been released.", "modified": "2026-05-19T06:16:59.932000", "created": "2026-05-19T06:13:40.134000", "tags": [ "UAlberta", "Edmonton", "Edmontonpolice", "EPS", "YEG" ], "references": [ "https://www.virustotal.com/gui/collection/3f5e2fc684dd1957828c6f9c0d1b7d13524218c8402a4a0a91e9135fb662f127", "https://www.virustotal.com/gui/collection/3f5e2fc684dd1957828c6f9c0d1b7d13524218c8402a4a0a91e9135fb662f127/iocs", "https://www.virustotal.com/graph/embed/g3238715200b747f1a237e03037a4d5ff15d85564ee0740439750d8ff75347031?theme=dark", "b257cc536324cd2566432555666307b43d27ee9cbda5e45707e3e97b61b3dff6" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Government", "Education", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "UCP_GoA23", "id": "382539", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 58, "FileHash-SHA1": 57, "FileHash-SHA256": 952, "IPv4": 393, "URL": 200, "domain": 340, "hostname": 367 }, "indicator_count": 2367, "is_author": false, "is_subscribing": null, "subscriber_count": 19, "modified_text": "12 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "stackoverflow.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "stackoverflow.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780211049.6678095 }