www.cisa.gov
Open in
urlscan Pro
2a02:26f0:7100:8a8::447a
Public Scan
URL:
https://www.cisa.gov/sites/default/files/2024-05/AA24-131A.stix_.xml
Submission: On June 12 via manual from AU — Scanned from FR
Submission: On June 12 via manual from AU — Scanned from FR
Form analysis 0 forms found in the DOM
Text Content
AA24-131A #StopRansomware: Black Basta Indicators The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC) (hereafter referred to as the authoring organizations) are releasing this joint CSA to provide information on Black Basta, a ransomware variant whose actors have encrypted and stolen data from 12 out of 16 critical infrastructure sectors, including the Healthcare and Public Health (HPH) Sector. This joint CSA provides TTPs and IOCs obtained from FBI investigations and third-party reporting. Black Basta is considered a ransomware-as-a-service (RaaS) variant and was first identified in April 2022. Some Black Basta affiliates have impacted a wide range of businesses and critical infrastructure in North America, Europe, and Australia. As of May 2024, Black Basta affiliates have impacted over 500 organizations globally. //node() | //@* DISCLAIMER: CISA has not independently verified this information. CISA does not provide any warranties of any kind regarding this information. The information in this report is being provided "as is" for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked or referenced within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA. This document is being shared subject to Traffic Light Protocol (TLP) marking TLP:WHITE. TLP:WHITE means that recipients may share this information without restriction. Information is subject to standard copyright rules For more information on the Traffic Light Protocol, see https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage. 2024-05-10T00:00:00Z Malicious URL Indicator URL Watchlist fy9.36c44903529fa273afff3c9b7ef323432e223d22ae1d625c4a3957d57.015c16eff32356bf566c4fd3590c6ff9b2f6e8c587444ecbfc4bcae7.f71995aff9e6f22f8daffe9d2ad9050abc928b8f93bb0d42682fd3c3.445de2118.588027fa.dns.realbumblebee.net Malicious FQDN Indicator Domain Watchlist literoved.ru Malicious FQDN Indicator Domain Watchlist winklen.ch Malicious FQDN Indicator Domain Watchlist xkpal.1a4a64b6.dns.blocktoday.net Malicious FQDN Indicator Domain Watchlist nuher.1d67bbcf4.456d87aa6.2d84dfba.dns.specialdrills.com Malicious URL Indicator URL Watchlist nuher.3577125d2a75f6a277fc5714ff536c5c6af5283d928a66daad6825b9a.7aaf8bba88534e88ec89251c57b01b322c7f52c7f1a5338930ae2a50.cbb47411f60fe58f76cf79d300c03bdecfb9e83379f59d80b8494951.e10c20f77.7fcc0eb6.dns.blocktoday.net Malicious FQDN Indicator Domain Watchlist blocktoday.net Malicious FQDN Indicator Domain Watchlist xkpal.d6597fa.dns.blocktoday.net Malicious URL Indicator URL Watchlist fy9.39d9030e5d3a8e2352daae2f4cd3c417b36f64c6644a783b9629147a1.afd8b8a4615358e0313bad8c544a1af0d8efcec0e8056c2c8eee96c7.b06d1825c0247387e38851b06be0272b0bd619b7c9636bc17b09aa70.a46890f27.588027fa.dns.realbumblebee.net Malicious FQDN Indicator Domain Watchlist my.2a91c002002.588027fa.dns.realbumblebee.net Malicious FQDN Indicator Domain Watchlist dns.artspathgroupe.net Malicious FQDN Indicator Domain Watchlist dns.trailshop.net Malicious FQDN Indicator Domain Watchlist 0gpw.588027fa.dns.realbumblebee.net Malicious IPv4 Indicator IP Watchlist 83.243.40.10 Malicious IPv4 Indicator IP Watchlist 88.198.198.90 Malicious IPv4 Indicator IP Watchlist 183.181.86.147 Malicious IPv4 Indicator IP Watchlist 80.239.207.200 Malicious IPv4 Indicator IP Watchlist 155.138.246.122 Malicious IPv4 Indicator IP Watchlist 46.8.10.134 Malicious IPv4 Indicator IP Watchlist 188.130.137.181 Malicious IPv4 Indicator IP Watchlist 188.130.218.39 Malicious IPv4 Indicator IP Watchlist 5.183.130.92 Malicious IPv4 Indicator IP Watchlist 107.189.30.69 Malicious IPv4 Indicator IP Watchlist 185.7.214.79 Malicious IPv4 Indicator IP Watchlist 46.8.16.77 Malicious IPv4 Indicator IP Watchlist 5.78.115.67 Malicious IPv4 Indicator IP Watchlist 185.219.221.136 Malicious IPv4 Indicator IP Watchlist 95.181.173.227 Malicious File Indicator File Hash Watchlist MD5 B3FE23DD4701ED00D79C03043B0B952E Malicious File Indicator File Hash Watchlist MD5 2642EC377C0CEE3235571832CB472870 Malicious File Indicator File Hash Watchlist MD5 4C897334E6391E7A2FA3CBCBF773D5A4 Malicious File Indicator File Hash Watchlist SHA256 B32DAF27AA392D26BDF5FAAFBAAE6B21CD6C918D461FF59F548A73D447A96DD9 Malicious File Indicator File Hash Watchlist SHA256 3337A7A9CCDD06ACDD6E3CF4AF40D871172D0A0E96FC48787B574AC93689622A Malicious File Indicator File Hash Watchlist SHA256 69192821F8CE4561CF9C9CB494A133584179116CB2E7409BEA3E18901A1CA944 Malicious File Indicator File Hash Watchlist SHA256 0A8297B274AEAB986D6336B395B39B3AF1BB00464CF5735D1ECDB506FEF9098E Malicious File Indicator File Hash Watchlist SHA256 42F05F5D4A2617B7AE0BC601DD6C053BF974F9A337A8FCC51F9338B108811B78 Malicious File Indicator File Hash Watchlist SHA256 17879ED48C2A2E324D4F5175112F51B75F4A8AB100B8833C82E6DDB7CD817F20 Malicious File Indicator File Hash Watchlist SHA256 3090A37E591554D7406107DF87B3DC21BDA059DF0BC66244E8ABEF6A5678AF35 Malicious File Indicator File Hash Watchlist SHA256 37A5CD265F7F555F2FE320A68D70553B7AA9601981212921D1AC2C114E662004 Malicious File Indicator File Hash Watchlist SHA256 3C50F6369F0938F42D47DB29A1F398E754ACB2A8D96FD4B366246AC2CCBE250A Malicious File Indicator File Hash Watchlist SHA256 462BBB8FD7BE98129AA73EFA91E2D88FA9CAFC7B47431B8227D1957F5D0C8BA7 Malicious File Indicator File Hash Watchlist SHA256 F039EAACED72618EABA699D2985F9E10D252AC5FE85D609C217B45BC8C3614F4 Malicious File Indicator File Hash Watchlist SHA256 D73F6E240766DDD6C3C16EFF8DB50794AB8AB95C6A616D4AB2BC96780F13464D Malicious File Indicator File Hash Watchlist SHA256 ACB60F0DD19A9A26AAAEFD3326DB8C28F546B6B0182ED2DCC23170BCB0AF6D8F Malicious File Indicator File Hash Watchlist SHA256 FAFAFF3D665B26B5C057E64B4238980589DEB0DFF0501497AC50BE1BC91B3E08 Malicious File Indicator File Hash Watchlist SHA256 90BA27750A04D1308115FA6A90F36503398A8F528C974C5ADC07AE8A6CD630E7 Malicious File Indicator File Hash Watchlist SHA256 7AD4324EA241782EA859AF12094F89F9A182236542627E95B6416C8FB9757C59 Malicious File Indicator File Hash Watchlist SHA256 62E63388953BB30669B403867A3AC2C8130332CF78133F7FD4A7F23CDC939087 Malicious File Indicator File Hash Watchlist SHA256 0554EB2FFA3582B000D558B6950EC60E876F1259C41ACFF2EAC47AB78A53E94A Malicious File Indicator File Hash Watchlist SHA256 360C9C8F0A62010D455F35588EF27817AD35C715A5F291E43449CE6CB1986B98 Malicious File Indicator File Hash Watchlist SHA256 1C1B2D7F790750D60A14BD661DAE5C5565F00C6CA7D03D062ADCECDA807E1779 Malicious File Indicator File Hash Watchlist SHA256 86A4DD6BE867846B251460D2A0874E6413589878D27F2C4482B54CEC134CC737 Malicious File Indicator File Hash Watchlist SHA256 A7B36482BA5BCA7A143A795074C432ED627D6AFA5BC64DE97FA660FAA852F1A6 Malicious File Indicator File Hash Watchlist SHA256 05EBAE760340FE44362AB7C8F70B2D89D6C9BA9B9EE8A9F747B2F19D326C3431 Malicious File Indicator File Hash Watchlist SHA256 5942143614D8ED34567EA472C2B819777EDD25C00B3E1B13B1AE98D7F9E28D43 Malicious File Indicator File Hash Watchlist SHA256 D15BFBC181AAC8CE9FAA05C2063EF4695C09B718596F43EDC81CA02EF03110D1 Malicious File Indicator File Hash Watchlist SHA256 5B2178C7A0FD69AB00CEF041F446E04098BBB397946EDA3F6755F9D94D53C221 Malicious File Indicator File Hash Watchlist SHA256 39939EACFBC20A2607064994497E3E886C90CD97B25926478434F46C95BD8EAD Malicious File Indicator File Hash Watchlist SHA256 58DDBEA084CE18CFB3439219EBCF2FC5C1605D2F6271610B1C7AF77B8D0484BD Malicious File Indicator File Hash Watchlist SHA256 88C8B472108E0D79D16A1634499C1B45048A10A38EE799054414613CC9DCCCCC Malicious File Indicator File Hash Watchlist SHA256 B6A4F4097367D9C124F51154D8750EA036A812D5BADDE0BAF9C5F183BB53DD24 Malicious File Indicator File Hash Watchlist SHA256 F21240E0BF9F0A391D514E34D4FA24ECB997D939379D2260EBCE7C693E55F061 Malicious File Indicator File Hash Watchlist SHA256 8501E14EE6EE142122746333B936C9AB0FC541328F37B5612B6804E6CDC2C2C6 Malicious File Indicator File Hash Watchlist SHA256 034B5FE047920B2AE9493451623633B14A85176F5EEA0C7AADC110EA1730EE79 Malicious File Indicator File Hash Watchlist SHA256 D503090431FDD99C9DF3451D9B73C5737C79EDA6EB80C148B8DC71E84623401F Malicious File Indicator File Hash Watchlist SHA256 C26A5CB62A78C467CC6B6867C7093FBB7B1A96D92121D4D6C3F0557EF9C881E0 Malicious File Indicator File Hash Watchlist SHA256 819CB9BCF62BE7666DB5666A693524070B0DF589C58309B067191B30480B0C3A Malicious File Indicator File Hash Watchlist SHA256 4AC69411ED124DA06AD66EE8BFBCEA2F593B5B199A2C38496E1EE24F9D04F34A Malicious File Indicator File Hash Watchlist SHA256 3A8FC07CADC08EEB8BE342452636A754158403C3D4EBFF379A4AE66F8298D9A6 Malicious File Indicator File Hash Watchlist SHA256 808C96CB90B7DE7792A827C6946FF48123802959635A23BF9D98478AE6A259F9 Malicious File Indicator File Hash Watchlist SHA256 3C65DA7F7BFDAF9ACC6445ABBEDD9C4E927D37BB9E3629F34AFC338058680407 Malicious File Indicator File Hash Watchlist SHA256 D3683BECA3A40574E5FD68D30451137E4A8BBACA8C428EBB781D565D6A70385E Malicious FQDN Indicator Domain Watchlist artspathgroupe.net Malicious FQDN Indicator Domain Watchlist thetrailbig.net Malicious FQDN Indicator Domain Watchlist rasapool.net Malicious FQDN Indicator Domain Watchlist specialdrills.com Malicious FQDN Indicator Domain Watchlist thesmartcloudusa.com Malicious FQDN Indicator Domain Watchlist tomlawcenter.com Malicious FQDN Indicator Domain Watchlist limitedtoday.com Malicious FQDN Indicator Domain Watchlist realbumblebee.net Malicious FQDN Indicator Domain Watchlist kekeoamigo.com Malicious FQDN Indicator Domain Watchlist recentbee.net Malicious FQDN Indicator Domain Watchlist myfinancialexperts.com Malicious FQDN Indicator Domain Watchlist childrensdolls.com Malicious FQDN Indicator Domain Watchlist buyblocknow.com Malicious FQDN Indicator Domain Watchlist artspathgroup.net Malicious FQDN Indicator Domain Watchlist trailshop.net Malicious FQDN Indicator Domain Watchlist webnubee.com Malicious FQDN Indicator Domain Watchlist investrealtydom.net Malicious FQDN Indicator Domain Watchlist magentoengineers.com Malicious IPv4 Indicator IP Watchlist 64.176.219.106 Malicious FQDN Indicator Domain Watchlist nebraska-lawyers.com Malicious FQDN Indicator Domain Watchlist adslsdfdsfmo.world Malicious FQDN Indicator Domain Watchlist consulheartinc.com Malicious FQDN Indicator Domain Watchlist businessprofessionalllc.com Malicious FQDN Indicator Domain Watchlist otxcosmeticscare.com Malicious FQDN Indicator Domain Watchlist otxcarecosmetics.com Malicious FQDN Indicator Domain Watchlist artstrailman.com Malicious FQDN Indicator Domain Watchlist ontexcare.com Malicious FQDN Indicator Domain Watchlist securecloudmanage.com Malicious FQDN Indicator Domain Watchlist startupbuss.com Malicious FQDN Indicator Domain Watchlist oneblackwood.com Malicious FQDN Indicator Domain Watchlist recentbeelive.com Malicious FQDN Indicator Domain Watchlist trailcosolutions.com Malicious FQDN Indicator Domain Watchlist onedogsclub.com Malicious FQDN Indicator Domain Watchlist trailcocompany.com Malicious FQDN Indicator Domain Watchlist artstrailreviews.com Malicious FQDN Indicator Domain Watchlist wipresolutions.com Malicious FQDN Indicator Domain Watchlist trackgroup.net Malicious FQDN Indicator Domain Watchlist modernbeem.net Malicious FQDN Indicator Domain Watchlist currentbee.net Malicious FQDN Indicator Domain Watchlist buygreenstudio.com Malicious FQDN Indicator Domain Watchlist topglobaltv.com Malicious FQDN Indicator Domain Watchlist usaglobalnews.com Malicious FQDN Indicator Domain Watchlist startupmartec.net Malicious File Indicator File Hash Watchlist MD5 1BF171B1F388691C3985DF6FB6C3F0D1 SHA1 FDB92FAC37232790839163A3CAE5F37372DB7235 SHA256 0112E3B20872760DDA5F658F6B546C85F126E803E27F0577B294F335FFA5A298 SSDEEP 196608:puRTOvaeQyt37NKNGZH5c4Eo8qqBNoNdRn+ILwIjKek529:p4TheZaGZZc4Eoko0IcIRkA9 Malicious FQDN Indicator Domain Watchlist startupbusiness24.net Malicious FQDN Indicator Domain Watchlist jenshol.com Malicious FQDN Indicator Domain Watchlist simorten.com Malicious FQDN Indicator Domain Watchlist investmentgblog.net Malicious FQDN Indicator Domain Watchlist protectionek.com Malicious FQDN Indicator Domain Watchlist technologgies.com Malicious FQDN Indicator Domain Watchlist unougn.com Malicious FQDN Indicator Domain Watchlist getfnewsolutions.com Malicious FQDN Indicator Domain Watchlist withclier.com Malicious FQDN Indicator Domain Watchlist bluenetworking.net Malicious FQDN Indicator Domain Watchlist erihudeg.com Malicious FQDN Indicator Domain Watchlist seohomee.com Malicious FQDN Indicator Domain Watchlist allcompanycenter.com Malicious FQDN Indicator Domain Watchlist taskthebox.net Malicious FQDN Indicator Domain Watchlist getfnewssolutions.com Malicious FQDN Indicator Domain Watchlist softradar.net Malicious FQDN Indicator Domain Watchlist businesforhome.com Malicious FQDN Indicator Domain Watchlist gartenlofti.com Malicious FQDN Indicator Domain Watchlist karmafisker.com Malicious FQDN Indicator Domain Watchlist cloudworldst.net Malicious FQDN Indicator Domain Watchlist monitor-websystem.net Malicious FQDN Indicator Domain Watchlist prettyanimals.net Malicious FQDN Indicator Domain Watchlist startuptechnologyw.net Malicious FQDN Indicator Domain Watchlist trailgroupl.net Malicious FQDN Indicator Domain Watchlist monitorsystem.net Malicious FQDN Indicator Domain Watchlist ionoslaba.com Malicious FQDN Indicator Domain Watchlist stockinvestlab.net Malicious FQDN Indicator Domain Watchlist airbusco.net Malicious FQDN Indicator Domain Watchlist jessvisser.com Malicious FQDN Indicator Domain Watchlist maluisepaul.com Malicious FQDN Indicator Domain Watchlist mytrailinvest.net Malicious FQDN Indicator Domain Watchlist garbagemoval.com Malicious FQDN Indicator Domain Watchlist constrtionfirst.com Malicious FQDN Indicator Domain Watchlist wardeli.com Malicious FQDN Indicator Domain Watchlist caspercan.com Malicious FQDN Indicator Domain Watchlist masterunix.net Malicious FQDN Indicator Domain Watchlist brendonline.com Malicious FQDN Indicator Domain Watchlist septcntr.com Malicious FQDN Indicator Domain Watchlist unitedfrom.com Malicious FQDN Indicator Domain Watchlist kolinileas.com Malicious FQDN Indicator Domain Watchlist animalsfast.net Malicious FQDN Indicator Domain Watchlist auuditoe.com Malicious FQDN Indicator Domain Watchlist investmentrealtyhp.net Malicious FQDN Indicator Domain Watchlist clearsystemwo.net Malicious FQDN Indicator Domain Watchlist audsystemecll.net Malicious FQDN Indicator Domain Watchlist welausystem.net Malicious FQDN Indicator Domain Watchlist treeauwin.net Malicious FQDN Indicator Domain Watchlist reelsysmoona.net Malicious FQDN Indicator Domain Watchlist investmendvisor.net Malicious FQDN Indicator Domain Watchlist wellsystemte.net Malicious FQDN Indicator Domain Watchlist steamteamdev.net Malicious FQDN Indicator Domain Watchlist startupbizaud.net Malicious File Indicator File Hash Watchlist 723d1cf3d74fb3ce95a77ed9dff257a78c8af8e67a82963230dd073781074224 MD5 6441D7260944BCEDC5958C5C8A05D16D SHA1 46257982840493ECA90E051FF1749E7040895584 SHA256 723D1CF3D74FB3CE95A77ED9DFF257A78C8AF8E67A82963230DD073781074224 SSDEEP 24576:1p2gwjk6ikYhJ9lvGnYZvy48/V33ck7LnBAyldFu8hod/Qodly:1AgxkmvGnYWccjBAwFadRd Malicious IPv4 Indicator IP Watchlist 116.203.186.178 Malicious File Indicator File Hash Watchlist minipath.exe 1499648 MD5 B365FAEBAF416681B5F376C8AA4F4470 SHA1 591D363928F0D5F4629196D60FD899469267DA09 SHA256 FFF35C2DA67EEF6F1A10C585B427AC32E7F06F4E4460542207ABCD62264E435F SSDEEP 24576:wjlZDq1Een/s9NUuKF+gEn7gKheviz6GYtVb9BXpV7wldFu8hod/Qodly:wjlreiUuKFS70A059/V7GFadRd Malicious File Indicator File Hash Watchlist UpdateReminder.exe MD5 A292FEE8D8DB83711E72C06D6F82562D SHA1 82F88C1AF036181EE4E92A2F9338C152D1FF0C58 SHA256 DF5B004BE71717362E6B1AD22072F9EE4113B95B5D78C496A90857977A9FB415 SSDEEP 12288:RcOlvT7Zom3rITxaVDrd5vUa69Ghj91nlQocyW7/P6E4kKjqnes9PBVW/g:RDJJDbcJ90jtH0bP6ELVne2 Malicious File Indicator File Hash Watchlist MD5 BC95F228B11FA3B4E91C30D98F9F3BFF SHA1 25CE6C74A6F39289717522CAD5EACDF5B9F4BAE8 SHA256 882019D1024778E13841DB975D5E60AAAE1482FCF86BA669E819A68CE980D7D3 SSDEEP 24576:llm7yYs6kQ2WxeisU09E3b6E/IwU5jjpBAPy:B6YWxG9E3b6Nz5jjpBGy Malicious File Indicator File Hash Watchlist 51eb749d6cbd08baf9d43c2f83abd9d4d86eb5206f62ba43b768251a98ce9d3e MD5 E83D6092439A90AF2B4B1DB2AD3A9C5A SHA1 4DA6FEF533B37A12ED1E357DF66802DE29C1AB5C SHA256 51EB749D6CBD08BAF9D43C2F83ABD9D4D86EB5206F62BA43B768251A98CE9D3E SSDEEP 24576:zvA0H/qL9fu4c8JZHSE6biXLemW34Mi+4LKH:UHL9fu4hSLbiXLer4MD4WH Malicious File Indicator File Hash Watchlist 350ba7fca67721c74385faff083914ecdd66ef107a765dfb7ac08b38d5c9c0bd MD5 0BF7BC20496143A9F028E77AB47B4698 SHA1 AA54013AEB502B4A936331DEB76A6411F1F1ADE7 SHA256 350BA7FCA67721C74385FAFF083914ECDD66EF107A765DFB7AC08B38D5C9C0BD SSDEEP 12288:bO+sm75a7DI9Mv53VI/XfaUs442JbV24chSS1i2wZbDFMMWzVFq:rh75a7M9S3VYa4npY4cFM2MWhY Malicious File Indicator File Hash Watchlist 07117c02a09410f47a326b52c7f17407e63ba5e6ff97277446efc75b862d2799 MD5 AFA27795C0C86B6AFEB138D0FB09506B SHA1 D32E44F7E04A8C84E7159ED020DCF26B6E51416E SHA256 07117C02A09410F47A326B52C7F17407E63BA5E6FF97277446EFC75B862D2799 SSDEEP 24576:pyAo7FAIP03acBtXWKe25ep59MxQU08wHG3MJAQof1hB:Lo7ARBtmKe28MSU08wHaM6Qo1hB Malicious File Indicator File Hash Watchlist e28188e516db1bda9015c30de59a2e91996b67c2e2b44989a6b0f562577fd757 MD5 59DB7BD22D4EC503B768ECE646205C27 SHA1 FF57CDA4829978D8B6F7F1F31356F291B37ACAA6 SHA256 E28188E516DB1BDA9015C30DE59A2E91996B67C2E2B44989A6B0F562577FD757 SSDEEP 12288:lMJYSP5VV3VG7rYyPT+p/VYXMJ8oD536bGIqs7GBvw0QygfmHp:lMVj3IXYETQV1XD5VIZ7GOg1J Malicious IPv4 Indicator IP Watchlist 46.161.27.151 Malicious File Indicator File Hash Watchlist 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc MD5 C115BBBDB1A61F8C553D74802BFD78FB SHA1 1F439569E3C1C14EA9F02235F8F45C49E2764160 SHA256 9A55F55886285EEF7FFABDD55C0232D1458175B1D868C03D3E304CE7D98980BC SSDEEP 12288:trkm8R9qXgmj3d7khtgfpedbKbiTuDZWhswtik5j2w+f:2Ujt7+twpedbKb1dWhse9K Malicious File Indicator File Hash Watchlist c:windowssystem32mrpy2bfa7.dll; 96339a7e87ffce6ced247feb9b4cb7c05b83ca315976a9522155bad726b8e5be 209170 MD5 7688C1B7A1124C1CD9413F4B535B2F44 SHA1 8CCAC360E2CA37B2FA9F5FA81B22114FB8936120 SHA256 96339A7E87FFCE6CED247FEB9B4CB7C05B83CA315976A9522155BAD726B8E5BE SSDEEP 6144:OUjqtclKpiqKLICZM5cUq29shXs6u7ulx97Z52Gd:fqt4KoVkCm9oV Malicious File Indicator File Hash Watchlist ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e; ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e.bin 556576 MD5 53FDEB923B1890D29B8F29DA77995938 SHA1 A996CCD0D58125BF299E89F4C03FF37AFDAB33FC SHA256 AE7C868713E1D02B4DB60128C651EB1E3F6A33C02544CC4CB57C3AA6C6581B6E SSDEEP 12288:M1DTMHixr1moQqUiXINDl/m1s6BQio67VlAU:AzmoQqUiXw2s6yiVxR Malicious File Indicator File Hash Watchlist 3f400f30415941348af21d515a2fc6a3; 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa 576512 MD5 3F400F30415941348AF21D515A2FC6A3 SHA1 BD0BF9C987288CA434221D7D81C54A47E913600A SHA256 5D2204F3A20E163120F52A2E3595DB19890050B2FAA96C6CBA6B094B0A52B0AA SSDEEP 12288:TFx0B/O7JxPzW9JPlHKtxYRkG7zLfpXE6SbJ:Rx7zW9JPlGskG1v Malicious File Indicator File Hash Watchlist 17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90.bin MD5 267D5C3137D313CE1A86C2F255A835E6 SHA1 C7A37C0EDEFFD23777CCA44F9B49076BE1BD43E6 SHA256 17205C43189C22DFCB278F5CC45C2562F622B0B6280DCD43CC1D3C274095EB90 SSDEEP 12288:aEky5bwpy02iRaeXCP2CIcdoKAXMr+Mr+kJZ4:j02iRaeHPcdo18rTrf6 Malicious IPv4 Indicator IP Watchlist 185.220.101.149 Malicious IPv4 Indicator IP Watchlist 185.220.100.240 Malicious FQDN Indicator Domain Watchlist xserver.jp Initial Access - Exploit Public-Facing Application [T1190] Initial Access - Phishing [T1566] Initial Access - Valid Accounts [T1078] Execution - Command and Scripting Interpreter: PowerShell [T1059.001] Privilege Escalation - Exploitation for Privilege Escalation [T1068] Defense Evasion - Impair Defenses: Disable or Modify Tools [T1562.001] Defense Evasion - Masquerading [T1036] Impact - Data Encrypted for Impact [T1486] Impact - Inhibit System Recovery [T1490] This XML file does not appear to have any style information associated with it. The document tree is shown below. <!-- Generated by MPE 0.6.1 on 05/10/2024 --> <stix:STIX_Package xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1" xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1" xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2" xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1" xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1" xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2" xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2" xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2" xmlns:stixCommon="http://stix.mitre.org/common-1" xmlns:indicator="http://stix.mitre.org/Indicator-2" xmlns:cybox="http://cybox.mitre.org/cybox-2" xmlns:marking="http://data-marking.mitre.org/Marking-1" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:ttp="http://stix.mitre.org/TTP-1" xmlns:stix="http://stix.mitre.org/stix-1" xmlns:CISA="http://www.us-cert.gov/nccic" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1 http://stix.mitre.org/XMLSchema/extensions/marking/terms_of_use/1.1/terms_of_use_marking.xsd http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.2/tlp_marking.xsd http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.2/stix_common.xsd http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.2/indicator.xsd http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.2/data_marking.xsd http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.2/ttp.xsd http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.2/stix_core.xsd" id="NPG-16914826" version="1.1.1" timestamp="2024-05-10T19:52:50"> <stix:STIX_Header> <stix:Title>AA24-131A #StopRansomware: Black Basta</stix:Title> <stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Indicators</stix:Package_Intent> <stix:Description>The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC) (hereafter referred to as the authoring organizations) are releasing this joint CSA to provide information on Black Basta, a ransomware variant whose actors have encrypted and stolen data from 12 out of 16 critical infrastructure sectors, including the Healthcare and Public Health (HPH) Sector. This joint CSA provides TTPs and IOCs obtained from FBI investigations and third-party reporting. Black Basta is considered a ransomware-as-a-service (RaaS) variant and was first identified in April 2022. Some Black Basta affiliates have impacted a wide range of businesses and critical infrastructure in North America, Europe, and Australia. As of May 2024, Black Basta affiliates have impacted over 500 organizations globally. </stix:Description> <stix:Handling> <marking:Marking> <marking:Controlled_Structure>//node() | //@*</marking:Controlled_Structure> <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> <TOUMarking:Terms_Of_Use>DISCLAIMER: CISA has not independently verified this information. CISA does not provide any warranties of any kind regarding this information. The information in this report is being provided "as is" for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked or referenced within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA. This document is being shared subject to Traffic Light Protocol (TLP) marking TLP:WHITE. TLP:WHITE means that recipients may share this information without restriction. Information is subject to standard copyright rules For more information on the Traffic Light Protocol, see https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage. </TOUMarking:Terms_Of_Use> ... </marking:Marking_Structure> <marking:Marking_Structure xsi:type="tlpMarking:TLPMarkingStructureType" color="WHITE"/> ... </marking:Marking> ... </stix:Handling> <stix:Information_Source> <stixCommon:Time> <cyboxCommon:Produced_Time>2024-05-10T00:00:00Z</cyboxCommon:Produced_Time> ... </stixCommon:Time> ... </stix:Information_Source> ... </stix:STIX_Header> <stix:Indicators> <stix:Indicator id="CISA:Indicator-32c40f99-85e2-4154-ba60-b5503a672925" timestamp="2024-05-10T19:52:50.214143+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious URL Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-a6de085d-5d32-4408-9335-83ce653c13d5"> <cybox:Object id="CISA:Object-78431014-7b60-41aa-8a9e-a592d6d3f063"> <cybox:Properties xsi:type="URIObj:URIObjectType" type="URL"> <URIObj:Value condition="Equals">fy9.36c44903529fa273afff3c9b7ef323432e223d22ae1d625c4a3957d57.015c16eff32356bf566c4fd3590c6ff9b2f6e8c587444ecbfc4bcae7.f71995aff9e6f22f8daffe9d2ad9050abc928b8f93bb0d42682fd3c3.445de2118.588027fa.dns.realbumblebee.net</URIObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-d33bf2c7-b37c-42c5-9ca2-e41e892d26d7" timestamp="2024-05-10T19:52:50.215878+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-404a01cf-976c-4030-bd09-6357ae2fbc14"> <cybox:Object id="CISA:Object-85064016-63e7-4b99-adc3-4841d070d1a8"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">literoved.ru</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-6772eacf-e35e-4b33-b744-47950bb7804d" timestamp="2024-05-10T19:52:50.216356+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-6c2b008c-3935-4939-b105-192a93513d1b"> <cybox:Object id="CISA:Object-6346e1ea-e470-4157-b607-9744c28f2c26"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">winklen.ch</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-b704647b-7df7-4651-abe0-73bda3b10eb3" timestamp="2024-05-10T19:52:50.216745+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-5c898ed9-7851-4ef0-a5c0-940a5475b1b1"> <cybox:Object id="CISA:Object-81b3fe0d-7e65-46a4-afa9-41c48f78a544"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">xkpal.1a4a64b6.dns.blocktoday.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-35a97bb4-b1ed-438d-8a9f-1f1c5d9b6fee" timestamp="2024-05-10T19:52:50.217123+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-ad89cd86-61f5-4436-bd0d-f32496fd8b75"> <cybox:Object id="CISA:Object-f6e82e61-245f-40bb-9856-bd4c1603c85d"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">nuher.1d67bbcf4.456d87aa6.2d84dfba.dns.specialdrills.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-25e592ef-ae93-4f3a-a544-81b7501486ea" timestamp="2024-05-10T19:52:50.217545+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious URL Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-56d97885-afd1-4f1e-af69-89d0b6dc9170"> <cybox:Object id="CISA:Object-e96a436c-b10b-4084-b0f4-02d2930d4756"> <cybox:Properties xsi:type="URIObj:URIObjectType" type="URL"> <URIObj:Value condition="Equals">nuher.3577125d2a75f6a277fc5714ff536c5c6af5283d928a66daad6825b9a.7aaf8bba88534e88ec89251c57b01b322c7f52c7f1a5338930ae2a50.cbb47411f60fe58f76cf79d300c03bdecfb9e83379f59d80b8494951.e10c20f77.7fcc0eb6.dns.blocktoday.net</URIObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-0402204b-f32d-44e5-b9d1-367d74044e5d" timestamp="2024-05-10T19:52:50.217929+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-cfdd9b47-427b-402a-b65a-591c35080eae"> <cybox:Object id="CISA:Object-5ed45418-d92e-402a-ac7f-c65644ac9df6"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">blocktoday.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-2306b62e-0ad5-4e0c-9f60-ebfb73f7404d" timestamp="2024-05-10T19:52:50.218367+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-7bef7d7d-9692-4278-8a42-e81df889b161"> <cybox:Object id="CISA:Object-ae833f36-9f09-4038-b346-3017d47775a7"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">xkpal.d6597fa.dns.blocktoday.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-47463b95-7196-41e1-9796-150076aed149" timestamp="2024-05-10T19:52:50.218757+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious URL Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-88c399d6-96f2-4900-9ff2-b8d38dd321d6"> <cybox:Object id="CISA:Object-d4103783-4961-4c7d-9264-baeaf9be8f9a"> <cybox:Properties xsi:type="URIObj:URIObjectType" type="URL"> <URIObj:Value condition="Equals">fy9.39d9030e5d3a8e2352daae2f4cd3c417b36f64c6644a783b9629147a1.afd8b8a4615358e0313bad8c544a1af0d8efcec0e8056c2c8eee96c7.b06d1825c0247387e38851b06be0272b0bd619b7c9636bc17b09aa70.a46890f27.588027fa.dns.realbumblebee.net</URIObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-c51c6bcc-52e2-4406-9d2e-be539bedb707" timestamp="2024-05-10T19:52:50.219147+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-1b587ec9-c327-4c0b-9af3-f0255a45bcf6"> <cybox:Object id="CISA:Object-e117e4c9-e67d-4960-b486-5fdf9414aff4"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">my.2a91c002002.588027fa.dns.realbumblebee.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-a647955e-81aa-4d21-8654-7514b506635c" timestamp="2024-05-10T19:52:50.219635+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-0beab089-8f31-443a-a4d4-e7456ed2345b"> <cybox:Object id="CISA:Object-e76d122c-dd56-437d-b9d3-fada434fab44"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">dns.artspathgroupe.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-ff2dcdd0-c961-42f1-bfb8-4c2d3b7524ca" timestamp="2024-05-10T19:52:50.220008+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-055cee2d-22e8-4f60-ad2b-b86ea7533ca4"> <cybox:Object id="CISA:Object-297c2687-4b72-4df6-a5d8-6808c0f81606"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">dns.trailshop.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-8c7946f4-2f7e-4061-b759-9e55b93196aa" timestamp="2024-05-10T19:52:50.220428+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-f79c1ead-e0af-4a8c-9f2c-7aca5eebe55b"> <cybox:Object id="CISA:Object-ecf841c9-57f2-49bb-9cc9-38b28e120686"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">0gpw.588027fa.dns.realbumblebee.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-6bf830d1-0329-4c42-a21c-adce8be8dc47" timestamp="2024-05-10T19:52:50.220802+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-60e34028-dc52-45cc-a3b3-f230f44a1ed2"> <cybox:Object id="CISA:Object-4cf436a8-36fa-4c13-b4b6-543ddda02e57"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">83.243.40.10</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-366b3181-d418-417d-b299-1c9ee4b11352" timestamp="2024-05-10T19:52:50.221189+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-021f6c10-128b-47d1-9f2c-12b5e4d4571b"> <cybox:Object id="CISA:Object-de83d187-64bb-48a6-93a8-0fb5fcd8ef74"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">88.198.198.90</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-db6dcd4e-7d00-4d4f-a22c-dae7d73387dd" timestamp="2024-05-10T19:52:50.221602+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-6d10e9cd-4c8e-490c-a265-ba398c868ae6"> <cybox:Object id="CISA:Object-f0d867d0-073e-4416-9ca2-87b26706d075"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">183.181.86.147</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-c3858a6a-648e-4b0a-bcbd-f7234f4b6f0e" timestamp="2024-05-10T19:52:50.221976+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-a64c2da8-58bf-44cd-bd19-e3f9756a4643"> <cybox:Object id="CISA:Object-f08eaf23-2e38-446f-984f-d98d33bf040e"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">80.239.207.200</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-7afbc182-583d-4dee-b158-89c57a673ae5" timestamp="2024-05-10T19:52:50.222399+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-e3bdc0c8-2665-4251-bf61-f8fe3406dcf4"> <cybox:Object id="CISA:Object-ec260542-c032-4fa4-84b3-6151842e9023"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">155.138.246.122</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-4a41167d-077a-46d4-b694-f3ba2169e702" timestamp="2024-05-10T19:52:50.222773+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-fa4f9c51-d2c2-4aae-8ad7-59c2a5082766"> <cybox:Object id="CISA:Object-b5d1eff7-7e78-4f8e-898d-deb09973b985"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">46.8.10.134</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-7ce62a13-ba09-4f76-85a7-6cf700671b09" timestamp="2024-05-10T19:52:50.223144+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-4d28bcfc-66ce-4411-9f56-2eaf3135c85e"> <cybox:Object id="CISA:Object-6a5fc3a9-4b59-49a1-af3a-e118f16a3e92"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">188.130.137.181</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-d6b607e5-7e7a-4953-bc55-610f01e4b02d" timestamp="2024-05-10T19:52:50.223550+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-f557ddd0-4c66-4c7f-a69c-aadda9715baf"> <cybox:Object id="CISA:Object-eb2beda7-b386-4478-b578-357034da6e48"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">188.130.218.39</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-8234f45a-331f-4d1f-ac46-8ea9ce04f6a6" timestamp="2024-05-10T19:52:50.223981+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-0322af80-800e-43f0-9665-eeb74356c920"> <cybox:Object id="CISA:Object-378f9abb-7c86-4c2e-ac71-dafc00c10b38"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">5.183.130.92</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-eabe2104-8179-4636-8163-178b4c9ea53c" timestamp="2024-05-10T19:52:50.224388+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-e279d4a2-046e-4307-9286-384aee046e10"> <cybox:Object id="CISA:Object-a265b3d0-d617-463f-ae3f-f5cd948becdd"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">107.189.30.69</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-4a93a102-862b-4103-810b-a074d00d432c" timestamp="2024-05-10T19:52:50.224761+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-fb3e6561-f562-46a3-8fe1-7c6a1874253f"> <cybox:Object id="CISA:Object-69e829fd-9052-4354-bbd0-d693813e70b4"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">185.7.214.79</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-1ee3dd44-404d-45a3-986c-981ece88ad67" timestamp="2024-05-10T19:52:50.225133+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-fbef9059-c1f2-4a9a-b16e-ad4790bb70b7"> <cybox:Object id="CISA:Object-5b26002a-4961-4f4a-83ee-20ce1ad1ea0d"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">46.8.16.77</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-5f5aa8c8-518c-4df3-8bc6-070b8ce1e610" timestamp="2024-05-10T19:52:50.225536+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-99b43410-9168-4cf8-a4c0-12d1f4d1d4b1"> <cybox:Object id="CISA:Object-c16d00ce-cc23-4034-bb5f-62fe7c7fc200"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">5.78.115.67</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-054fdfb8-af74-40e5-b677-ddaedfad24a8" timestamp="2024-05-10T19:52:50.225906+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-754e619b-ab25-434e-af7d-a9bec349e2c8"> <cybox:Object id="CISA:Object-a13cde1f-47ff-4701-bf94-f4503533d507"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">185.219.221.136</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-2080944b-ba1b-4015-a7d3-a2795ad29fb7" timestamp="2024-05-10T19:52:50.226325+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-bdf6e964-57b2-4dda-b106-3d19391040b4"> <cybox:Object id="CISA:Object-78ac4876-a0ff-4fc3-93c3-ba06a588d2b5"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">95.181.173.227</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-4fae12f0-b2d0-424c-bc68-b3888d6d829f" timestamp="2024-05-10T19:52:50.226698+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-660a58b7-2ae8-4919-aca3-255be0253985"> <cybox:Object id="CISA:Object-3a96c826-19b2-4431-91f3-a25654ff851f"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">B3FE23DD4701ED00D79C03043B0B952E</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-d64b7798-ac23-4d77-bbde-21174893697e" timestamp="2024-05-10T19:52:50.227394+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-95549f89-9362-419b-96b9-4217bc7dd70f"> <cybox:Object id="CISA:Object-660e6430-9ac0-46d4-8965-5d927bfe7439"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">2642EC377C0CEE3235571832CB472870</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-1b30e47d-8789-4087-99d6-cc6290d399b5" timestamp="2024-05-10T19:52:50.227842+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-c2591985-a670-4f8c-890c-3df6f8e2c55d"> <cybox:Object id="CISA:Object-035ff42d-f704-47a4-b314-954632cafff4"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">4C897334E6391E7A2FA3CBCBF773D5A4</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-c581c012-ca60-4c8f-a653-de752d7f3a49" timestamp="2024-05-10T19:52:50.228377+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-ffc3ef2d-21a0-4a52-af7f-e527ba25c901"> <cybox:Object id="CISA:Object-00bba8b3-44c1-4046-bdf9-62916a702486"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">B32DAF27AA392D26BDF5FAAFBAAE6B21CD6C918D461FF59F548A73D447A96DD9</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-2c02ebe3-246e-4257-bd55-99564e5f991f" timestamp="2024-05-10T19:52:50.228813+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-10102fe0-37bf-408b-a1de-836ec42e8e98"> <cybox:Object id="CISA:Object-b8bd2a48-e99a-4f19-b15c-ee1cf6643a1e"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">3337A7A9CCDD06ACDD6E3CF4AF40D871172D0A0E96FC48787B574AC93689622A</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-5d225b80-094d-4a58-8c48-df04b8a29a03" timestamp="2024-05-10T19:52:50.229274+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-80c3aad8-d036-49b8-a630-972cbbef4eee"> <cybox:Object id="CISA:Object-05f1b695-72bc-4d99-a2b6-d9293e62f68e"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">69192821F8CE4561CF9C9CB494A133584179116CB2E7409BEA3E18901A1CA944</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-1caaf451-6d8a-429b-a291-112417d80059" timestamp="2024-05-10T19:52:50.229716+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-75adcb6b-0ddd-4427-a490-dd27cb8ee3d5"> <cybox:Object id="CISA:Object-1d963eb3-777d-49b9-9126-18ff614b06b2"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">0A8297B274AEAB986D6336B395B39B3AF1BB00464CF5735D1ECDB506FEF9098E</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-4f91fac3-c4d5-4a7b-a259-40b03e926984" timestamp="2024-05-10T19:52:50.230168+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-4566775a-efc3-492c-ab2b-d1991b5b00ba"> <cybox:Object id="CISA:Object-65c9006e-5ba0-4cb1-a20a-a8e94fd4db8b"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">42F05F5D4A2617B7AE0BC601DD6C053BF974F9A337A8FCC51F9338B108811B78</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-e21aa3d7-be60-4fc4-94c1-3ac8649cfe56" timestamp="2024-05-10T19:52:50.230636+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-89a4397f-f3cf-4827-a5b5-e5c39bab1189"> <cybox:Object id="CISA:Object-b9941157-7571-4044-848f-759099580ef7"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">17879ED48C2A2E324D4F5175112F51B75F4A8AB100B8833C82E6DDB7CD817F20</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-375debb1-2691-4ba8-b1ab-febd2de0c560" timestamp="2024-05-10T19:52:50.231070+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-9b01a30d-b4df-49ba-bace-497778ed8811"> <cybox:Object id="CISA:Object-14469a88-83da-49b2-b4e6-bd94eae04a6c"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">3090A37E591554D7406107DF87B3DC21BDA059DF0BC66244E8ABEF6A5678AF35</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-802e944f-af54-4e97-9af4-dab5524a9db8" timestamp="2024-05-10T19:52:50.231534+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-fe9852a4-2b5d-4ff7-9097-dbfd33170a2d"> <cybox:Object id="CISA:Object-5f29ad3f-a17d-4126-ad74-1ea067793775"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">37A5CD265F7F555F2FE320A68D70553B7AA9601981212921D1AC2C114E662004</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-9aa1d4e4-05a7-437f-9921-c0d1238b5fa7" timestamp="2024-05-10T19:52:50.231967+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-93225715-a60b-412e-8555-6757142ee15c"> <cybox:Object id="CISA:Object-88d40950-c531-4e71-9599-7efa18b53c64"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">3C50F6369F0938F42D47DB29A1F398E754ACB2A8D96FD4B366246AC2CCBE250A</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-a791b5d6-70b7-4cd5-8581-e3b8809c1bea" timestamp="2024-05-10T19:52:50.232430+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-f057405a-5916-4fd0-a613-6987ced10765"> <cybox:Object id="CISA:Object-0f9f93ac-68e8-44e0-bb70-fbc98b5a979e"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">462BBB8FD7BE98129AA73EFA91E2D88FA9CAFC7B47431B8227D1957F5D0C8BA7</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-0f5e4f99-5264-446c-a691-7444dd8a2e09" timestamp="2024-05-10T19:52:50.232933+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-a18329b1-ca76-4707-a527-2e086130df6c"> <cybox:Object id="CISA:Object-bbe12017-8fe8-4f3d-9dee-a9f24c6750a8"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">F039EAACED72618EABA699D2985F9E10D252AC5FE85D609C217B45BC8C3614F4</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-2a37ff22-11cd-4163-8dd5-64e4bdf999c5" timestamp="2024-05-10T19:52:50.233394+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-013f7e07-23fa-47c9-baf2-5e458299233b"> <cybox:Object id="CISA:Object-bc89c167-edc4-4e21-b610-729647fe1c95"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">D73F6E240766DDD6C3C16EFF8DB50794AB8AB95C6A616D4AB2BC96780F13464D</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-0fca6c19-ac12-44bf-86ce-764326a6b7b6" timestamp="2024-05-10T19:52:50.233836+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-20fd6442-50d6-4197-8f9f-5b0d3d4653e4"> <cybox:Object id="CISA:Object-dede4d67-850e-4e52-a302-7eac06e84244"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">ACB60F0DD19A9A26AAAEFD3326DB8C28F546B6B0182ED2DCC23170BCB0AF6D8F</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-9b653190-dfd7-471b-9100-9f3dac2203de" timestamp="2024-05-10T19:52:50.234317+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-c3cfd4ce-6b7e-44b5-80eb-7b310d4aa146"> <cybox:Object id="CISA:Object-b7e0f9ad-4152-41cb-b1d4-fbc2875316a2"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">FAFAFF3D665B26B5C057E64B4238980589DEB0DFF0501497AC50BE1BC91B3E08</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-a09d9196-a832-4fc6-bf72-ea0dce5f2c33" timestamp="2024-05-10T19:52:50.234751+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-d491d9cc-7abe-4592-9bba-e1195afbc6f5"> <cybox:Object id="CISA:Object-65ec104e-26c3-4649-bba5-f8c06984594b"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">90BA27750A04D1308115FA6A90F36503398A8F528C974C5ADC07AE8A6CD630E7</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-3377b991-7fba-45a9-bc12-e0735ea42cb8" timestamp="2024-05-10T19:52:50.235182+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-afbbfefd-0ea0-42f3-913d-f90067efd7ea"> <cybox:Object id="CISA:Object-1fe7785f-f98d-4666-9c3f-283d1e38aead"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">7AD4324EA241782EA859AF12094F89F9A182236542627E95B6416C8FB9757C59</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-0cf099b3-d25a-4178-a857-29354ebe89d4" timestamp="2024-05-10T19:52:50.235665+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-55fc350e-f803-48fe-91cf-3364769df3e8"> <cybox:Object id="CISA:Object-f5bc3ca7-1bf8-4993-aa3c-fa93bae9abbc"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">62E63388953BB30669B403867A3AC2C8130332CF78133F7FD4A7F23CDC939087</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-de1415fe-5260-40a4-b652-0cec6e2c0611" timestamp="2024-05-10T19:52:50.236101+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-50ff561c-195d-48c8-b348-cbd72bdc8c02"> <cybox:Object id="CISA:Object-a5db2386-75b7-4478-99a9-4b6ca138ad49"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">0554EB2FFA3582B000D558B6950EC60E876F1259C41ACFF2EAC47AB78A53E94A</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-5eb6f57c-3886-4cf9-9c27-ede840b8dd46" timestamp="2024-05-10T19:52:50.236585+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-6d8160a7-fee6-4f37-bea0-2cfd50c1d6c9"> <cybox:Object id="CISA:Object-5444a345-3135-4e92-99e0-c722ca1faf64"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">360C9C8F0A62010D455F35588EF27817AD35C715A5F291E43449CE6CB1986B98</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-fe23976b-b643-4d8e-a768-b260d37955c0" timestamp="2024-05-10T19:52:50.237079+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-75dbf4a9-d4cc-4f36-a341-e98e143b724b"> <cybox:Object id="CISA:Object-1ccf1bd4-1abf-4509-83f8-6a3108cf9b37"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">1C1B2D7F790750D60A14BD661DAE5C5565F00C6CA7D03D062ADCECDA807E1779</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-027fdca3-2d0c-495f-a123-b12558b01177" timestamp="2024-05-10T19:52:50.237553+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-c003f505-9099-4077-b2c2-f85f416e78e5"> <cybox:Object id="CISA:Object-63698edc-0793-452b-a33c-a81f2fa4b6e8"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">86A4DD6BE867846B251460D2A0874E6413589878D27F2C4482B54CEC134CC737</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-5d11804e-5ce9-4a1e-8ea5-094788f0ce8a" timestamp="2024-05-10T19:52:50.238006+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-2864cb88-81d2-4e13-a15e-68af7e294d63"> <cybox:Object id="CISA:Object-4fb7ceff-39c7-44c8-aab3-31e6daa4675e"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">A7B36482BA5BCA7A143A795074C432ED627D6AFA5BC64DE97FA660FAA852F1A6</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-2274374c-af38-4ce1-9155-1a22dc202e52" timestamp="2024-05-10T19:52:50.238483+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-6a1fa483-2cde-4374-a8a2-d4dc41c77c75"> <cybox:Object id="CISA:Object-35838389-8134-48b9-8a24-55cafea61489"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">05EBAE760340FE44362AB7C8F70B2D89D6C9BA9B9EE8A9F747B2F19D326C3431</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-f2724ac3-5b47-40b9-b149-09b09fb61fae" timestamp="2024-05-10T19:52:50.238921+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-9174abfc-2eb5-4125-9b0e-24fcfff8f160"> <cybox:Object id="CISA:Object-19cbb059-3036-4a45-962a-ca14817d2430"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">5942143614D8ED34567EA472C2B819777EDD25C00B3E1B13B1AE98D7F9E28D43</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-b47d05d8-6139-4b4a-858d-0ed7e75dd3c5" timestamp="2024-05-10T19:52:50.239381+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-8a322904-4ea9-48fb-b40f-d0338c813fd0"> <cybox:Object id="CISA:Object-9f7a83be-7c9b-41d0-8ce3-7e35f4b170bb"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">D15BFBC181AAC8CE9FAA05C2063EF4695C09B718596F43EDC81CA02EF03110D1</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-f536e77a-3aca-45c5-ac89-3852cca5509f" timestamp="2024-05-10T19:52:50.239813+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-d23c6ba9-8b09-43c5-8537-bf72cdcc6d38"> <cybox:Object id="CISA:Object-9053fe61-400d-4b32-8f05-532cea6cb3bf"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">5B2178C7A0FD69AB00CEF041F446E04098BBB397946EDA3F6755F9D94D53C221</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-45c59053-a10e-4694-8e31-beac3e0f13b1" timestamp="2024-05-10T19:52:50.240285+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-db4decf1-f1d0-4395-bdc0-2d9ee98a1dcd"> <cybox:Object id="CISA:Object-aef7f996-e54b-4a59-ae62-15dfee022638"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">39939EACFBC20A2607064994497E3E886C90CD97B25926478434F46C95BD8EAD</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-0578e2df-7eb2-4f31-aee3-da7add4646d0" timestamp="2024-05-10T19:52:50.240724+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-2fe18a7d-970a-4ae2-9637-d5c425b61895"> <cybox:Object id="CISA:Object-3b9c03e0-18eb-48ff-9e29-ece81357d864"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">58DDBEA084CE18CFB3439219EBCF2FC5C1605D2F6271610B1C7AF77B8D0484BD</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-7e4f2f49-b91e-4f61-bbce-9c3a23670cec" timestamp="2024-05-10T19:52:50.241153+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-a1e93def-508a-465e-a6cb-35a81044c059"> <cybox:Object id="CISA:Object-40b034b5-60e1-4e71-8ad6-c6363b8ba7ee"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">88C8B472108E0D79D16A1634499C1B45048A10A38EE799054414613CC9DCCCCC</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-cb29e744-6bc3-43a7-abe7-38593a98b6cb" timestamp="2024-05-10T19:52:50.241675+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-a8aff21a-0f02-46d7-9cdd-b59d0fb79791"> <cybox:Object id="CISA:Object-f7e7ed02-caff-4dba-bb83-a87c672742c6"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">B6A4F4097367D9C124F51154D8750EA036A812D5BADDE0BAF9C5F183BB53DD24</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-871c1a79-d8e2-4d3b-af51-118f8d8a1bb1" timestamp="2024-05-10T19:52:50.242127+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-c48fa8e1-9b8e-45d8-928b-9db2a233c6a5"> <cybox:Object id="CISA:Object-5c6b799b-8bc0-43ed-9749-043d8fd33fb0"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">F21240E0BF9F0A391D514E34D4FA24ECB997D939379D2260EBCE7C693E55F061</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-c8aa90c1-c807-4d3f-b74f-fad70446aa2e" timestamp="2024-05-10T19:52:50.242591+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-184ed68e-a9f2-49f2-b2c7-0a0ae0076a2b"> <cybox:Object id="CISA:Object-83d665a6-2142-4e1e-a2a7-b19d79c539b4"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">8501E14EE6EE142122746333B936C9AB0FC541328F37B5612B6804E6CDC2C2C6</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-c48abcce-be4b-467c-aa80-f47e8c6fa9aa" timestamp="2024-05-10T19:52:50.243020+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-597b4a52-1d0d-40b5-ba7c-35cc866854b8"> <cybox:Object id="CISA:Object-d423e91d-fd0a-42eb-887d-ec8cc6d3e487"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">034B5FE047920B2AE9493451623633B14A85176F5EEA0C7AADC110EA1730EE79</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-cdba2463-8e28-42e4-9555-f3437c997cc0" timestamp="2024-05-10T19:52:50.243501+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-79650656-42b7-427f-92d4-b50958a08fed"> <cybox:Object id="CISA:Object-f46621f6-1b6c-4b1e-a2f8-63abf80613c9"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">D503090431FDD99C9DF3451D9B73C5737C79EDA6EB80C148B8DC71E84623401F</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-7ae48c35-80a2-4bbb-af70-083e49476f7e" timestamp="2024-05-10T19:52:50.243938+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-ea4fd591-2920-4b9d-8f5a-5862e8e476b0"> <cybox:Object id="CISA:Object-5e9ae8fb-70a8-42d1-aeef-752a3c7eeeb0"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">C26A5CB62A78C467CC6B6867C7093FBB7B1A96D92121D4D6C3F0557EF9C881E0</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-ba6e7523-dcb1-4010-bde4-89f407cda7bb" timestamp="2024-05-10T19:52:50.244418+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-183df7f1-76e3-45de-8941-8534d8cd1748"> <cybox:Object id="CISA:Object-45f115a4-0978-41fb-bc1b-e85146c844ee"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">819CB9BCF62BE7666DB5666A693524070B0DF589C58309B067191B30480B0C3A</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-21f62488-43e0-435d-9f99-fc4faf7c694a" timestamp="2024-05-10T19:52:50.244855+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-1e15d177-2374-433b-93b2-9079de6a1595"> <cybox:Object id="CISA:Object-5fd26ff1-8c26-455c-8094-c9b8ef6f69f0"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">4AC69411ED124DA06AD66EE8BFBCEA2F593B5B199A2C38496E1EE24F9D04F34A</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-0f20341e-a4a3-4b73-8040-3aeb949aa11e" timestamp="2024-05-10T19:52:50.245326+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-7d3b2ba3-c2ca-4580-a8e4-8447d4e2f193"> <cybox:Object id="CISA:Object-6186573a-8738-4a8a-b39c-6b2643b62820"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">3A8FC07CADC08EEB8BE342452636A754158403C3D4EBFF379A4AE66F8298D9A6</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-87e193a1-0954-49d1-96ab-36d871c6f989" timestamp="2024-05-10T19:52:50.245759+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-60f99e26-17f5-45ad-91ad-eb00a52a6b33"> <cybox:Object id="CISA:Object-6a0fb013-028e-4342-9fb0-1d85942f31a2"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">808C96CB90B7DE7792A827C6946FF48123802959635A23BF9D98478AE6A259F9</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-f1a1e76a-eeea-41ed-bb0c-2a1287de8332" timestamp="2024-05-10T19:52:50.246298+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-b8853b7e-71e9-41c2-9245-33fc831388eb"> <cybox:Object id="CISA:Object-1af8d0a8-1a66-475c-9cae-8e7d25c25ac7"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">3C65DA7F7BFDAF9ACC6445ABBEDD9C4E927D37BB9E3629F34AFC338058680407</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-058288dc-9da5-4980-8193-cba4ca083165" timestamp="2024-05-10T19:52:50.246747+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-08cbe685-9732-4f71-a227-7b4cd6801434"> <cybox:Object id="CISA:Object-dcbbcbe3-2743-47f8-9705-c036554328b2"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">D3683BECA3A40574E5FD68D30451137E4A8BBACA8C428EBB781D565D6A70385E</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-a2bc7ed7-be5d-4540-b20a-65c2019b264c" timestamp="2024-05-10T19:52:50.247198+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-b2cdd1cc-302d-481d-a6c8-da92c1af91a8"> <cybox:Object id="CISA:Object-04a05438-20bf-45d3-9629-62d6a7150920"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">artspathgroupe.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-70700583-a52d-4657-80ea-c6481c8419df" timestamp="2024-05-10T19:52:50.247619+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-b7c18efe-2319-44ff-9fc1-a0d00f0722c8"> <cybox:Object id="CISA:Object-89249329-2aba-44c9-853a-63c7c0abb26b"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">thetrailbig.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-40dd1c60-e466-4770-b8fe-1b5d16824f75" timestamp="2024-05-10T19:52:50.248013+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-94ca5c44-e429-4bc5-950f-fcb652e8e3f9"> <cybox:Object id="CISA:Object-bcfae15a-b2c1-45fd-8bd1-eeaff1ca9afc"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">rasapool.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-39b63052-70d1-46f0-a67e-151776aae2dc" timestamp="2024-05-10T19:52:50.248447+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-4fd40702-aacd-46a4-b1dc-aba5373acb7c"> <cybox:Object id="CISA:Object-f393e706-e07e-4288-be37-9bb138510b3d"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">specialdrills.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-4a5b7508-a4a2-4671-979d-fb5938577b13" timestamp="2024-05-10T19:52:50.248817+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-4f20cf84-549c-4bc2-9cf2-0f3e7f0c5184"> <cybox:Object id="CISA:Object-be945d4c-d024-4c95-b6b8-9bcbb6d403c0"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">thesmartcloudusa.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-44d093bb-ea5c-4806-9964-0c0d693c3fd8" timestamp="2024-05-10T19:52:50.249187+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-78818f9d-47d4-4914-987b-4d144119ef92"> <cybox:Object id="CISA:Object-652270b1-3186-41ea-8175-220c2e616394"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">tomlawcenter.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-4a387e76-aa50-464b-8b78-5dc43a5c822d" timestamp="2024-05-10T19:52:50.249594+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-4e0c981d-74ed-4125-9911-30e70db74b0e"> <cybox:Object id="CISA:Object-5c99b0ff-e9bf-47ae-91be-d112f5dea07c"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">limitedtoday.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-6ed55ad7-6b0d-4431-a95d-c22dfc4ce7cf" timestamp="2024-05-10T19:52:50.249965+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-416870a1-13a5-4466-9099-2835cf3dabb1"> <cybox:Object id="CISA:Object-75c4ade3-8aad-4dfc-8173-bd131a361860"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">realbumblebee.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-bdf72cfe-73b1-4ca4-a602-51e6a1ae575a" timestamp="2024-05-10T19:52:50.250445+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-cac2d8e9-74bf-4898-966c-076944e5d0de"> <cybox:Object id="CISA:Object-251fdaa8-181a-411a-a9a6-40f5f72d61fe"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">kekeoamigo.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-c4164f13-032c-4b4f-85ec-29fb8fab4e03" timestamp="2024-05-10T19:52:50.250818+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-4a6a8e67-8733-40d7-9be6-4d02382c077b"> <cybox:Object id="CISA:Object-5b76b5ee-7943-404d-a411-27f703ff9132"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">recentbee.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-6859188a-98d8-4690-9fef-155ce9f2ebb0" timestamp="2024-05-10T19:52:50.251182+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-cf189b74-0374-4797-a192-270ffe2d35de"> <cybox:Object id="CISA:Object-0472684d-f26e-4261-b39b-be04554ddc6d"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">myfinancialexperts.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-135bcea9-65cc-4641-8352-414dae91518c" timestamp="2024-05-10T19:52:50.251598+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-c42b2d53-fbe5-4267-996f-16a6a17179b1"> <cybox:Object id="CISA:Object-d17a5357-b7a4-4964-9e63-e6cd08326dbf"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">childrensdolls.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-9ace791c-b261-4249-b0aa-c94c3559f12b" timestamp="2024-05-10T19:52:50.251962+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-6c577b0e-4433-4f61-9312-4de4d6c11cdd"> <cybox:Object id="CISA:Object-15a8f0fa-2dcc-483a-b2f2-8e7829acd499"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">buyblocknow.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-197677f3-3177-4537-8fa9-0b6ee3bb720d" timestamp="2024-05-10T19:52:50.252366+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-a3ff85be-b212-491d-bb13-adf74ded79bc"> <cybox:Object id="CISA:Object-0d6ecd3d-070c-4634-8110-ed5b951828de"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">artspathgroup.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-f553c1ac-13fc-4692-b39e-48a4e399ad7d" timestamp="2024-05-10T19:52:50.252737+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-2027f510-be77-44ad-95d8-d343926f7bde"> <cybox:Object id="CISA:Object-90293069-c8ab-4228-9635-9151ae04f430"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">trailshop.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-401265d7-4025-4179-8122-e65adb20f70a" timestamp="2024-05-10T19:52:50.253106+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-d7118489-61ef-43a1-803d-e065dbab9ab9"> <cybox:Object id="CISA:Object-87aaa50b-4e26-4723-97a5-63e59999d180"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">webnubee.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-41c5ad8f-702c-41fd-ab3c-d3924dc392b3" timestamp="2024-05-10T19:52:50.253515+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-412005a1-1ed0-4c2f-8fb5-50e1c0e85e75"> <cybox:Object id="CISA:Object-384c1da0-1a29-4912-b5ad-73aa6e124a60"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">investrealtydom.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-5aaa6c3d-61bc-45e0-a39c-ade3171a61fc" timestamp="2024-05-10T19:52:50.253881+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-bbd5f09a-2273-4a32-9dc5-8c7d66277548"> <cybox:Object id="CISA:Object-f698e979-b1d8-4976-8a35-e6355b65bdd7"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">magentoengineers.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-6ade8e6e-47ad-40a1-8873-2de97f133315" timestamp="2024-05-10T19:52:50.254291+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-e813e9bf-44ad-4072-b3dc-e7352963ad3b"> <cybox:Object id="CISA:Object-459f362f-b8e9-4e49-8b69-10f426f4a6d7"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">64.176.219.106</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-8cf46d46-fb3d-4dfd-966b-00e4a8760db0" timestamp="2024-05-10T19:52:50.254667+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-8e76e67b-1252-4094-aa75-3d459d3dd441"> <cybox:Object id="CISA:Object-8f5bcc3c-3dbb-4def-a072-79fe589dc49b"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">nebraska-lawyers.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-1382a23a-b68c-4980-9f61-ba9f5878671f" timestamp="2024-05-10T19:52:50.255741+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-100cb96c-c361-4cdd-89b6-f1c5a2479491"> <cybox:Object id="CISA:Object-848d8cd7-0e3d-49e3-b429-7fbdcc1a0e14"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">adslsdfdsfmo.world</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-1245323c-59a7-4cf6-b985-0c9f537fa0ae" timestamp="2024-05-10T19:52:50.256111+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-9809ff3d-fea2-4ff5-9000-4512d123e366"> <cybox:Object id="CISA:Object-a3668c6d-ce9b-45bd-b071-63baf29a8325"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">consulheartinc.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-dadb6327-8905-41f7-a3c6-35933a06d4bc" timestamp="2024-05-10T19:52:50.256521+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-8c65c9c1-8e37-4dea-a549-83d5f064c88b"> <cybox:Object id="CISA:Object-3e3c6e53-9b6c-4736-8b0d-c2e425fe211e"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">businessprofessionalllc.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-fc517d3e-e0a9-4b94-a41f-bfadfccd0e15" timestamp="2024-05-10T19:52:50.256888+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-af640ba5-62c8-47b5-9065-8893c140a0a4"> <cybox:Object id="CISA:Object-13d5971f-c72a-4425-a4d6-2fced0a38d02"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">otxcosmeticscare.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-524c229f-88b7-41dd-984c-665116f8f1f8" timestamp="2024-05-10T19:52:50.257278+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-f692d37e-d6b5-4ef5-a447-fb8c95823901"> <cybox:Object id="CISA:Object-0191c644-f2aa-4ae6-9df3-17823fd3729c"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">otxcarecosmetics.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-9e1f4a59-3e3d-4aac-8693-af44d27fb373" timestamp="2024-05-10T19:52:50.257650+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-478af297-2eae-4e37-85ee-c15dffc57b1a"> <cybox:Object id="CISA:Object-ee93e661-dc17-4bde-ba1a-35c32cad744e"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">artstrailman.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-a03d283a-96f2-446c-aac8-279e1ceaa0a3" timestamp="2024-05-10T19:52:50.258033+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-6f84b5b2-b8ef-4fc0-af42-d9867c5b57cc"> <cybox:Object id="CISA:Object-1e5f27c8-7604-49d8-af35-d9e08fca7820"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">ontexcare.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-435a2de7-d089-4c77-86d7-4f7c65839847" timestamp="2024-05-10T19:52:50.258452+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-06dc066b-9fb8-41ad-a748-cbdeb5017b92"> <cybox:Object id="CISA:Object-73d3915c-6520-4fc5-9375-64ede0aa7bcd"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">securecloudmanage.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-d1898537-5428-491b-93cc-c3a0b3a95277" timestamp="2024-05-10T19:52:50.258822+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-995b669e-ce06-45ef-a79c-f58b0a4fd233"> <cybox:Object id="CISA:Object-7beec808-0f1e-4187-a88a-522a8e490a70"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">startupbuss.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-1f7f7381-8099-42ab-8f03-6cf9ab355e48" timestamp="2024-05-10T19:52:50.259188+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-5b8172aa-13b1-44e8-a774-48459b286901"> <cybox:Object id="CISA:Object-a1f4e8d3-4d07-4b5d-9651-770d95d1de41"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">oneblackwood.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-a8f69ef3-113d-4f7d-b6dd-470f00c71841" timestamp="2024-05-10T19:52:50.259591+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-7aa5e986-9941-4c21-85f9-b0ad474136bf"> <cybox:Object id="CISA:Object-46ba1b23-4da8-45ae-ba29-b3fc8cfcf8e0"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">recentbeelive.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-91ce1d86-9889-45dd-9389-fe43db8136b7" timestamp="2024-05-10T19:52:50.260016+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-031b9e9b-9473-4e04-b18a-cde7b909f9a0"> <cybox:Object id="CISA:Object-710a4f88-305a-4119-bbca-7550bbfa588b"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">trailcosolutions.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-1a532981-62c0-4191-8435-585643d0d350" timestamp="2024-05-10T19:52:50.260424+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-308c630b-e5c6-4df5-b8f7-f220b7cad1b0"> <cybox:Object id="CISA:Object-5c229e73-8eba-49b5-a19b-da6609696271"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">onedogsclub.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-e95aa256-0623-426f-ae53-ca30e6408073" timestamp="2024-05-10T19:52:50.260795+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-8b48d250-30bb-40ab-8e68-b76652e0dc07"> <cybox:Object id="CISA:Object-eb7333fe-e049-401a-b77a-07dde9de8061"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">trailcocompany.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-9a58ca26-f88b-4f07-a8e4-adeb13d2d7b7" timestamp="2024-05-10T19:52:50.261159+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-293d6e8a-fb05-423c-9461-71b03201fe75"> <cybox:Object id="CISA:Object-c7d1042c-cf61-44fe-8f84-f47794936aab"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">artstrailreviews.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-4f1f210c-1d04-451d-8833-b2be67e131e1" timestamp="2024-05-10T19:52:50.261576+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-78fa2cee-8c60-4b42-9f77-ea45e39cbe18"> <cybox:Object id="CISA:Object-bdabcba1-d9b9-4394-abca-434f5166988e"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">wipresolutions.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-2981a61f-d805-42b5-9004-e3e356048274" timestamp="2024-05-10T19:52:50.261942+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-e9d546ea-740b-4e26-b947-8ad3077fdb01"> <cybox:Object id="CISA:Object-4a083c98-ebc4-4e3c-b206-68612ded9e30"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">trackgroup.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-c3ee306a-31ae-4aeb-b485-5246c89497a9" timestamp="2024-05-10T19:52:50.262354+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-d64247aa-1ac0-4de7-b1a8-9a1efa810cb4"> <cybox:Object id="CISA:Object-bb2a78af-bbb1-44ad-9036-7f89a1f635f8"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">modernbeem.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-e7fdf225-c1c6-4e7c-a956-222083011283" timestamp="2024-05-10T19:52:50.262721+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-5002ff2d-a232-415a-b908-f84a42772f73"> <cybox:Object id="CISA:Object-cb54824f-1f99-4afe-9fd4-49d29508028b"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">currentbee.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-9c0bfe95-b83f-4cb7-87d0-5aa7fa0090f7" timestamp="2024-05-10T19:52:50.263086+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-c2b032ad-6d30-482f-89c9-0c70afe87b22"> <cybox:Object id="CISA:Object-11cedacf-b82f-4126-9430-cbfaae530be0"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">buygreenstudio.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-711db21c-8a8e-4da4-9f96-987f7950f23b" timestamp="2024-05-10T19:52:50.263485+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-fafe3c35-257a-4e6d-86b4-9a930842fca8"> <cybox:Object id="CISA:Object-5d7c406a-a8ae-469d-9699-3e935a761b81"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">topglobaltv.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-10a209f1-cc09-4582-ad1d-e98265172447" timestamp="2024-05-10T19:52:50.263849+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-fab26d68-619a-45d0-90a5-2675b8524ab6"> <cybox:Object id="CISA:Object-fd6d901c-0aac-428c-8f9d-365f2fda7dd1"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">usaglobalnews.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-65b16a6b-24da-4bfe-83fd-a88ea3ec8a91" timestamp="2024-05-10T19:52:50.264299+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-f0b31b26-186b-4c04-a0a8-601cc9a600f6"> <cybox:Object id="CISA:Object-c30e4f30-f9ae-4c76-9b87-2997e1965562"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">startupmartec.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-9bb2e8e7-68e5-41ff-a895-c85cadf66f27" timestamp="2024-05-10T19:52:50.264667+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-ece43707-d9e8-4e45-8d8b-c47217a9b2ee"> <cybox:Object id="CISA:Object-4e6ae7d5-aae3-4e78-8c11-f8cff9774922"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">1BF171B1F388691C3985DF6FB6C3F0D1</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">FDB92FAC37232790839163A3CAE5F37372DB7235</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">0112E3B20872760DDA5F658F6B546C85F126E803E27F0577B294F335FFA5A298</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SSDEEP</cyboxCommon:Type> <cyboxCommon:Fuzzy_Hash_Value condition="Equals">196608:puRTOvaeQyt37NKNGZH5c4Eo8qqBNoNdRn+ILwIjKek529:p4TheZaGZZc4Eoko0IcIRkA9</cyboxCommon:Fuzzy_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2017-04-20T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-b171acc9-10ec-4452-b719-93cec33cc024" timestamp="2024-05-10T19:52:50.265289+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-dee063ff-4585-4d07-a06b-89202a3d11f3"> <cybox:Object id="CISA:Object-1b63b1c8-ff2c-4c9b-b231-8234b5b95d0c"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">startupbusiness24.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-dd510e12-282c-4207-ac24-1d0a910619b8" timestamp="2024-05-10T19:52:50.265665+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-856b4211-c4ff-4293-b538-eb629b43e62b"> <cybox:Object id="CISA:Object-dc7d39e1-b6af-4e01-af9c-4c4e59f8d6ff"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">jenshol.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-d9b1c1e7-44f4-4fd9-9acc-dbf9f46fb444" timestamp="2024-05-10T19:52:50.266050+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-79b92e57-d1b9-4c2f-b64d-c8db93125017"> <cybox:Object id="CISA:Object-1c48e2b0-e1df-485f-a131-a6a61e0f6f69"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">simorten.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-47d18d06-655d-4915-bedc-b1a096f40705" timestamp="2024-05-10T19:52:50.266449+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-e2f21b2c-21c1-4709-b2e0-06938b0b8be4"> <cybox:Object id="CISA:Object-7ac21efd-3d4f-47ce-b168-8f3da77a1703"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">investmentgblog.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-cefa878b-d3d0-472b-a441-20259db67c34" timestamp="2024-05-10T19:52:50.266817+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-5b9c351c-8779-49b1-ae32-cd4fb89bee52"> <cybox:Object id="CISA:Object-7fb6486e-e526-4dc2-a3db-bf8820947555"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">protectionek.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-155acdf9-76fe-4581-8df2-bdc0947f8c3a" timestamp="2024-05-10T19:52:50.267184+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-9cf07843-e5ba-4d59-8f94-e2eca262ea54"> <cybox:Object id="CISA:Object-a7e303fd-75b0-483c-ae8f-78619bfa2902"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">technologgies.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-e5a2b3fa-e78e-4c2c-8e5c-a2b4b7e3f414" timestamp="2024-05-10T19:52:50.267587+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-85efc10b-1161-4f7a-9fd8-26ecbe500840"> <cybox:Object id="CISA:Object-6c7055e7-a559-4d5e-95e2-80b81434d8b8"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">unougn.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-5894b777-5ac6-42ea-9e19-f451cc8c749d" timestamp="2024-05-10T19:52:50.267955+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-51c716ac-e622-4267-af63-c6a097cd706c"> <cybox:Object id="CISA:Object-64e60e6a-1765-4e29-a9f8-96fdc654648e"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">getfnewsolutions.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-e578d8a1-8013-47a7-98d3-595947abc7c2" timestamp="2024-05-10T19:52:50.268368+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-ba48b25f-903c-4b73-801a-845e5d6f2892"> <cybox:Object id="CISA:Object-0bf2a721-f4c1-436e-b2cb-f89aab9ad5d7"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">withclier.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-7973bd53-6c76-4833-bf6c-8fb7ff198c9d" timestamp="2024-05-10T19:52:50.268797+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-718cb0d9-dd5e-4c00-ae03-f476eca84a6b"> <cybox:Object id="CISA:Object-f4493533-756f-4401-93de-2f06b15f186a"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">bluenetworking.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-13695833-5400-4e72-b9dd-5e2d62b46336" timestamp="2024-05-10T19:52:50.269165+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-afcd895e-0459-4959-89db-b7a414255093"> <cybox:Object id="CISA:Object-fd04e0c6-b8eb-4ae8-abbe-2b78d011709d"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">erihudeg.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-736abbee-d888-43e0-91bc-d31508c01648" timestamp="2024-05-10T19:52:50.269572+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-7dac59a8-c7e0-4b36-a5dc-9c45b35d805e"> <cybox:Object id="CISA:Object-315837ff-4f8e-4668-ba75-8fe48acdc1a0"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">seohomee.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-8912b6fe-132f-4bdc-a57f-98a50bc24e42" timestamp="2024-05-10T19:52:50.269941+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-5b585b22-a61e-496c-9d5a-22337fcf29e7"> <cybox:Object id="CISA:Object-9802448a-2bd8-44b5-a081-558994873032"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">allcompanycenter.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-65a41ca9-b589-4df3-8c49-2592b69fd577" timestamp="2024-05-10T19:52:50.270359+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-511c3125-60bc-44c3-844b-13b2cb88dbf3"> <cybox:Object id="CISA:Object-9518b799-45d3-419c-b6fe-2e9150b16aa0"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">taskthebox.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-b81f4f1a-45aa-41d4-b3fd-705e0bc297b7" timestamp="2024-05-10T19:52:50.270731+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-a623ef1f-56e7-46a6-b738-0a3b7b120e4a"> <cybox:Object id="CISA:Object-26468f9a-466d-4e40-99e0-16d9a29096e8"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">getfnewssolutions.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-2137b24b-d342-4e7a-a99b-2168e668e295" timestamp="2024-05-10T19:52:50.271095+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-44d7445d-098f-4eb6-b961-505ec3a0f297"> <cybox:Object id="CISA:Object-cadc997f-b556-436d-b2f4-57b04ca62ef8"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">softradar.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-d639f19e-d171-48c3-acbd-a8c9a150ffa5" timestamp="2024-05-10T19:52:50.271496+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-ebeeb534-3400-45bf-80c6-930f0e36aace"> <cybox:Object id="CISA:Object-148fa263-b2b3-4f6b-8e4b-86b2acb20a9f"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">businesforhome.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-55d32b1e-9db7-4502-98ad-6c2d176b5705" timestamp="2024-05-10T19:52:50.271860+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-bfce57a3-8b04-4687-b41d-9986001d1565"> <cybox:Object id="CISA:Object-34e641dd-0698-4e20-ac39-73ad3f4a21ee"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">gartenlofti.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-22add504-8e5a-44e9-bccd-046cbd1e484d" timestamp="2024-05-10T19:52:50.272263+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-694acd9f-8c14-4e57-967e-999c2b3d0f65"> <cybox:Object id="CISA:Object-9a7d2394-531a-4e16-bdc0-285579249fd9"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">karmafisker.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-ba91dcff-2ef4-4818-b09f-390c37d5fa90" timestamp="2024-05-10T19:52:50.272638+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-5b70123a-d2c7-49d7-9ecc-ff1b23e73881"> <cybox:Object id="CISA:Object-2f1a56ec-ef77-44ba-b50f-544e7a6e8515"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">cloudworldst.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-90902af3-e0a1-429e-b3f5-4356df3c3197" timestamp="2024-05-10T19:52:50.273062+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-2f783609-74ef-4040-ac4b-da7dfce3378b"> <cybox:Object id="CISA:Object-153e88ce-98e2-4a4d-94d8-874c44a3dd9b"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">monitor-websystem.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-07a3b381-96a2-4e3c-afc4-0cc5ef7fb218" timestamp="2024-05-10T19:52:50.273467+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-88990134-6854-4458-8f44-79fd60772adf"> <cybox:Object id="CISA:Object-0ee1d3e0-4344-449f-aeea-fb9a5d025673"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">prettyanimals.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-728c3595-86da-41b2-afb3-578c51d3b6c1" timestamp="2024-05-10T19:52:50.273837+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-81441e47-e19e-4e8f-b30d-9e0dcf46b6b2"> <cybox:Object id="CISA:Object-a000b0e9-324a-463e-ad8f-6b1a82cb6b96"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">startuptechnologyw.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-9423be2e-ea5c-4b1b-bd8f-c26939a0c019" timestamp="2024-05-10T19:52:50.274249+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-d149066a-c6e6-42b1-80c6-fde8e013770d"> <cybox:Object id="CISA:Object-c003bb06-b2f5-40f7-b1e1-35e9ea177f19"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">trailgroupl.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-187980bf-32a8-4479-9452-5770fcb87d33" timestamp="2024-05-10T19:52:50.274628+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-32a00312-bc92-41e6-b999-573855d3ec3c"> <cybox:Object id="CISA:Object-805f43fb-61af-4c40-9372-bedcd4b94a54"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">monitorsystem.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-1f3fb546-a27f-4396-86ee-2adef29f7184" timestamp="2024-05-10T19:52:50.274997+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-b961f5d5-b8a7-475d-b813-69237cd87536"> <cybox:Object id="CISA:Object-c712f4c1-edd9-416f-aa28-c6b4bc607431"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">ionoslaba.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-3f10bb3e-c2e0-458d-92aa-ff7db33aab6d" timestamp="2024-05-10T19:52:50.275392+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-625aa4d6-c57c-434b-b7e9-e7dea43adf12"> <cybox:Object id="CISA:Object-b58e3639-9322-4eef-b008-a5477f0b42a1"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">stockinvestlab.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-c1534d4b-544a-4b97-b892-f89a1a981fad" timestamp="2024-05-10T19:52:50.275763+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-3c2dc3ec-91db-4087-bd0e-b6565b786459"> <cybox:Object id="CISA:Object-04ef2dbb-6776-43ec-b5c9-49c786444f4c"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">airbusco.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-41f1b90e-1149-42c3-a1f6-db700bdc241c" timestamp="2024-05-10T19:52:50.276133+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-81473d1d-efe5-4f9b-8a4e-03ac68264db5"> <cybox:Object id="CISA:Object-d2ef037a-31fc-4396-848d-1cee6e661ae8"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">jessvisser.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-1987d077-7df9-423b-b7bc-996205744931" timestamp="2024-05-10T19:52:50.276530+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-4d3f4870-b2e6-4788-8140-a5d3801dceba"> <cybox:Object id="CISA:Object-d339c3b1-0c1e-44ce-b072-9452c67c76c0"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">maluisepaul.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-4348bb08-17fb-4be3-ad20-f4d51a79c6c7" timestamp="2024-05-10T19:52:50.276940+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-66213d54-e4e7-48c0-984e-08b97dbba968"> <cybox:Object id="CISA:Object-0262f110-e4e1-4cf6-ba34-0f6d7999cd52"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">mytrailinvest.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-bfc449f1-15de-4802-b8fc-b64f7c449c64" timestamp="2024-05-10T19:52:50.277367+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-c0415aaf-39a9-4a72-a719-0ccc86526078"> <cybox:Object id="CISA:Object-6794a38b-7a96-4a60-91e5-c18bc767c010"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">garbagemoval.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-80082f07-75e2-4f6c-9651-adf321fb3333" timestamp="2024-05-10T19:52:50.277801+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-432678b9-6cc2-47c7-8a38-097e839b6d14"> <cybox:Object id="CISA:Object-d557c14c-07c8-4c90-9916-6ed7265609c3"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">constrtionfirst.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-05ef8703-cc97-4d56-b299-f3d1a6fb9e33" timestamp="2024-05-10T19:52:50.278202+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-a1e852f6-803a-485f-b0c6-31e1d72a386a"> <cybox:Object id="CISA:Object-d61b7277-2472-4c3d-be88-fddb84c47788"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">wardeli.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-0687fe4a-789c-41dc-bc8e-537d40572e1d" timestamp="2024-05-10T19:52:50.278644+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-b7b7c580-04be-4c56-8da9-b10b16f8fefe"> <cybox:Object id="CISA:Object-87f2b1ff-5388-4a34-9d2b-d66998d5dfd0"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">caspercan.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-c718d859-026f-45e5-912d-e8d4ba4062c3" timestamp="2024-05-10T19:52:50.279010+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-5c3c0849-9fa2-4794-8354-d97a05321847"> <cybox:Object id="CISA:Object-da9afdb4-2eac-48e6-bc7c-a54d1eb13b11"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">masterunix.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-94b77f50-61a1-4030-9f40-476b3711b14c" timestamp="2024-05-10T19:52:50.279428+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-bc0017aa-87ba-4799-baaf-ba535ec933aa"> <cybox:Object id="CISA:Object-07485ce4-8368-45e2-8dc1-9d58aeec0023"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">brendonline.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-a3e70664-ce55-422f-ac33-23343468de69" timestamp="2024-05-10T19:52:50.279818+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-6030b9ae-d94a-425e-bbd1-4f1402d0f5db"> <cybox:Object id="CISA:Object-e7bf65c5-77d5-47cb-a622-a86665f7896c"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">septcntr.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-df0f004f-ca7a-4f1c-934a-303edb9850ec" timestamp="2024-05-10T19:52:50.280205+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-ba99bf81-626d-4d8e-a65b-214bb2f24ede"> <cybox:Object id="CISA:Object-1afc0abc-1084-4730-96c4-fee551f38d15"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">unitedfrom.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-b878adab-ada3-45ea-96d6-5a16cbfb2ad0" timestamp="2024-05-10T19:52:50.280615+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-ab42adf9-6e24-46f8-91aa-1ebb83c74cc4"> <cybox:Object id="CISA:Object-c1e9a7cb-25f2-4024-ae07-bf83137af0d2"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">kolinileas.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-fc94f532-285d-497d-99e6-f85c15aaeb31" timestamp="2024-05-10T19:52:50.281001+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-a6dd7146-2fa4-4e8c-b0bc-7eb31d8707d2"> <cybox:Object id="CISA:Object-5b7764ac-aa7a-4488-a39d-b22c943f03ab"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">animalsfast.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-7d4ea787-938b-4b28-9938-d206c25b34c5" timestamp="2024-05-10T19:52:50.281420+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-e939867f-8a54-45a3-b237-9cb28e3ae41d"> <cybox:Object id="CISA:Object-7a38c16d-45ba-4f17-b88c-93c2cea165ba"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">auuditoe.com</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-ac0511a6-ca4e-4661-9003-f650a50fc4a7" timestamp="2024-05-10T19:52:50.281820+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-fb666f1f-9487-44dd-b23f-3d2d20543a7e"> <cybox:Object id="CISA:Object-6391d88b-62e9-470f-a3c5-dd40a6df6477"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">investmentrealtyhp.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-396b303a-43d5-4cbc-b065-56c0d0d40a27" timestamp="2024-05-10T19:52:50.282305+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-ecb6aed7-581d-4555-9745-d4ad490f7722"> <cybox:Object id="CISA:Object-1f9e0c1b-87ab-4650-931b-929842d2a647"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">clearsystemwo.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-a312f1f2-284b-4efb-abb8-ad708751a8cb" timestamp="2024-05-10T19:52:50.282717+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-7b31a210-4225-4596-9326-1760e80a1de7"> <cybox:Object id="CISA:Object-47068e2d-513c-4c84-a8fa-a9c18b79a43a"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">audsystemecll.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-6a3e63d2-78a0-4b98-8250-426f46c74453" timestamp="2024-05-10T19:52:50.283114+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-1149a538-7c23-4932-8f0a-b4be8817b7c7"> <cybox:Object id="CISA:Object-6d013ac5-4aeb-45cf-88dc-540639f4ea46"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">welausystem.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-c5baef1e-3b06-4c9d-b20d-a35049def635" timestamp="2024-05-10T19:52:50.283537+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-ec0a4351-16cf-4e23-ba41-cbb849cc6977"> <cybox:Object id="CISA:Object-25dd9b0e-7e28-4486-865d-9408b8014af8"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">treeauwin.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-7f3cf14d-698f-42a8-aa26-55ac8022c873" timestamp="2024-05-10T19:52:50.283942+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-947cfcaa-520c-4d06-a198-10fb3aa13fa8"> <cybox:Object id="CISA:Object-9a3bcfb5-35d8-47bc-8ab3-d822400e7dab"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">reelsysmoona.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-b8083127-677d-4d04-9aad-b9590670fa20" timestamp="2024-05-10T19:52:50.284375+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-d9291264-40d3-4215-9eb4-cbbe1ee2470c"> <cybox:Object id="CISA:Object-7275a6a3-a6eb-4c55-a026-2bb4595ac80e"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">investmendvisor.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-bf2180d1-2403-4dc4-b82e-9dd43911387c" timestamp="2024-05-10T19:52:50.284743+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-49c706bd-7eb3-4227-9814-af00724ed194"> <cybox:Object id="CISA:Object-d65bf398-f4a8-460c-991e-fea51126eb4c"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">wellsystemte.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-7308c851-e14c-4478-b1e7-10c0b5a6cb48" timestamp="2024-05-10T19:52:50.285147+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-c4cd96de-41d1-4560-b61b-3c033829e305"> <cybox:Object id="CISA:Object-0aceb1b4-5495-4b0e-817f-0875b62b287f"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">steamteamdev.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-910acb0d-8cf0-4428-82be-bc8bc126e9d5" timestamp="2024-05-10T19:52:50.285583+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-470be3af-d88a-4532-a96c-23c1f93ae301"> <cybox:Object id="CISA:Object-eb233eb9-6fb9-4746-96f9-ec965f3cbd25"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">startupbizaud.net</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-3491e9fc-fcea-433c-9c72-d4e978615e78" timestamp="2024-05-10T19:52:50.285958+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-560ae7b1-6680-423c-b299-f7370063d8a4"> <cybox:Object id="CISA:Object-41276daf-173b-4100-91ef-c269c2c98d5e"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:File_Name condition="Equals">723d1cf3d74fb3ce95a77ed9dff257a78c8af8e67a82963230dd073781074224</FileObj:File_Name> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">6441D7260944BCEDC5958C5C8A05D16D</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">46257982840493ECA90E051FF1749E7040895584</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">723D1CF3D74FB3CE95A77ED9DFF257A78C8AF8E67A82963230DD073781074224</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SSDEEP</cyboxCommon:Type> <cyboxCommon:Fuzzy_Hash_Value condition="Equals">24576:1p2gwjk6ikYhJ9lvGnYZvy48/V33ck7LnBAyldFu8hod/Qodly:1AgxkmvGnYWccjBAwFadRd</cyboxCommon:Fuzzy_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-7515c939-437d-4dbe-9e25-d11f6203d834" timestamp="2024-05-10T19:52:50.286648+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-8dff81ca-7255-4692-aff1-ef3a7662abfa"> <cybox:Object id="CISA:Object-de2ea741-6b7c-4047-b59b-c63bd7eb219c"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">116.203.186.178</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-b660ac17-50ea-4db3-afc7-88cfeee28e53" timestamp="2024-05-10T19:52:50.287113+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-0a7eb615-3394-4e5c-9a2d-2464f0aa36f2"> <cybox:Object id="CISA:Object-5fef83cd-1b45-428c-ae5f-dfa651afd10b"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:File_Name condition="Equals">minipath.exe</FileObj:File_Name> <FileObj:Size_In_Bytes condition="Equals">1499648</FileObj:Size_In_Bytes> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">B365FAEBAF416681B5F376C8AA4F4470</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">591D363928F0D5F4629196D60FD899469267DA09</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">FFF35C2DA67EEF6F1A10C585B427AC32E7F06F4E4460542207ABCD62264E435F</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SSDEEP</cyboxCommon:Type> <cyboxCommon:Fuzzy_Hash_Value condition="Equals">24576:wjlZDq1Een/s9NUuKF+gEn7gKheviz6GYtVb9BXpV7wldFu8hod/Qodly:wjlreiUuKFS70A059/V7GFadRd</cyboxCommon:Fuzzy_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-fdfb0e83-5b32-4e52-8e56-433d461616b5" timestamp="2024-05-10T19:52:50.287825+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-4da66420-56bc-4101-abdc-9bc381ee8010"> <cybox:Object id="CISA:Object-30f353eb-acd3-4057-b8e1-fa38a04fea6b"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:File_Name condition="Equals">UpdateReminder.exe</FileObj:File_Name> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">A292FEE8D8DB83711E72C06D6F82562D</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">82F88C1AF036181EE4E92A2F9338C152D1FF0C58</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">DF5B004BE71717362E6B1AD22072F9EE4113B95B5D78C496A90857977A9FB415</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SSDEEP</cyboxCommon:Type> <cyboxCommon:Fuzzy_Hash_Value condition="Equals">12288:RcOlvT7Zom3rITxaVDrd5vUa69Ghj91nlQocyW7/P6E4kKjqnes9PBVW/g:RDJJDbcJ90jtH0bP6ELVne2</cyboxCommon:Fuzzy_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-6183e5d1-d9f7-49d0-8f37-1d2bbbe6aaab" timestamp="2024-05-10T19:52:50.288513+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-b7b3e3aa-1b17-4bae-a1e3-845cd0eff3e7"> <cybox:Object id="CISA:Object-d55055d6-f99b-4955-85ee-1e7cba26c04d"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">BC95F228B11FA3B4E91C30D98F9F3BFF</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">25CE6C74A6F39289717522CAD5EACDF5B9F4BAE8</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">882019D1024778E13841DB975D5E60AAAE1482FCF86BA669E819A68CE980D7D3</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SSDEEP</cyboxCommon:Type> <cyboxCommon:Fuzzy_Hash_Value condition="Equals">24576:llm7yYs6kQ2WxeisU09E3b6E/IwU5jjpBAPy:B6YWxG9E3b6Nz5jjpBGy</cyboxCommon:Fuzzy_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-19972b0f-63a7-4296-adae-d2784107f240" timestamp="2024-05-10T19:52:50.289109+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-38806399-cacb-4ed3-a9b3-6495908850da"> <cybox:Object id="CISA:Object-673c78f1-3c51-43dc-9b1f-b62ac7a0216e"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:File_Name condition="Equals">51eb749d6cbd08baf9d43c2f83abd9d4d86eb5206f62ba43b768251a98ce9d3e</FileObj:File_Name> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">E83D6092439A90AF2B4B1DB2AD3A9C5A</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">4DA6FEF533B37A12ED1E357DF66802DE29C1AB5C</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">51EB749D6CBD08BAF9D43C2F83ABD9D4D86EB5206F62BA43B768251A98CE9D3E</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SSDEEP</cyboxCommon:Type> <cyboxCommon:Fuzzy_Hash_Value condition="Equals">24576:zvA0H/qL9fu4c8JZHSE6biXLemW34Mi+4LKH:UHL9fu4hSLbiXLer4MD4WH</cyboxCommon:Fuzzy_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-6fd30076-2fdc-494a-a219-661a07c374e9" timestamp="2024-05-10T19:52:50.289780+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-abcbfa5b-572b-4f67-8115-8b0bbeb25ece"> <cybox:Object id="CISA:Object-49495f87-755d-4b9c-9972-bcd006714520"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:File_Name condition="Equals">350ba7fca67721c74385faff083914ecdd66ef107a765dfb7ac08b38d5c9c0bd</FileObj:File_Name> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">0BF7BC20496143A9F028E77AB47B4698</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">AA54013AEB502B4A936331DEB76A6411F1F1ADE7</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">350BA7FCA67721C74385FAFF083914ECDD66EF107A765DFB7AC08B38D5C9C0BD</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SSDEEP</cyboxCommon:Type> <cyboxCommon:Fuzzy_Hash_Value condition="Equals">12288:bO+sm75a7DI9Mv53VI/XfaUs442JbV24chSS1i2wZbDFMMWzVFq:rh75a7M9S3VYa4npY4cFM2MWhY</cyboxCommon:Fuzzy_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-621cad15-9bce-4b31-8d4e-26333a1aeeb2" timestamp="2024-05-10T19:52:50.290484+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-eb6890a3-05c4-4e8f-95da-33dff89652a2"> <cybox:Object id="CISA:Object-43de53a3-d240-4471-90f0-a195c343bfe2"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:File_Name condition="Equals">07117c02a09410f47a326b52c7f17407e63ba5e6ff97277446efc75b862d2799</FileObj:File_Name> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">AFA27795C0C86B6AFEB138D0FB09506B</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">D32E44F7E04A8C84E7159ED020DCF26B6E51416E</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">07117C02A09410F47A326B52C7F17407E63BA5E6FF97277446EFC75B862D2799</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SSDEEP</cyboxCommon:Type> <cyboxCommon:Fuzzy_Hash_Value condition="Equals">24576:pyAo7FAIP03acBtXWKe25ep59MxQU08wHG3MJAQof1hB:Lo7ARBtmKe28MSU08wHaM6Qo1hB</cyboxCommon:Fuzzy_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-68ba4599-0ddf-4e41-9846-e8bfbc2129a7" timestamp="2024-05-10T19:52:50.291127+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-e0274c52-9c83-4309-8622-4c2806a902e1"> <cybox:Object id="CISA:Object-5c26e16c-2b05-4f61-b91d-e420230ef018"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:File_Name condition="Equals">e28188e516db1bda9015c30de59a2e91996b67c2e2b44989a6b0f562577fd757</FileObj:File_Name> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">59DB7BD22D4EC503B768ECE646205C27</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">FF57CDA4829978D8B6F7F1F31356F291B37ACAA6</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">E28188E516DB1BDA9015C30DE59A2E91996B67C2E2B44989A6B0F562577FD757</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SSDEEP</cyboxCommon:Type> <cyboxCommon:Fuzzy_Hash_Value condition="Equals">12288:lMJYSP5VV3VG7rYyPT+p/VYXMJ8oD536bGIqs7GBvw0QygfmHp:lMVj3IXYETQV1XD5VIZ7GOg1J</cyboxCommon:Fuzzy_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-c7c16348-5076-44ce-8a81-9eab11f5faf8" timestamp="2024-05-10T19:52:50.291850+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-680a0b66-e720-4aab-8c1b-115a65f9fc12"> <cybox:Object id="CISA:Object-977a28aa-984f-4899-a153-1f2848bf3311"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">46.161.27.151</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2017-10-19T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-23d76594-758b-4a74-8d20-a7913b98ad7f" timestamp="2024-05-10T19:52:50.292252+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-7274220e-613c-4d29-b980-1a63c4b94ab8"> <cybox:Object id="CISA:Object-244713b7-e68f-4476-81eb-edc3a1fe0eb6"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:File_Name condition="Equals">9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc</FileObj:File_Name> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">C115BBBDB1A61F8C553D74802BFD78FB</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">1F439569E3C1C14EA9F02235F8F45C49E2764160</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">9A55F55886285EEF7FFABDD55C0232D1458175B1D868C03D3E304CE7D98980BC</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SSDEEP</cyboxCommon:Type> <cyboxCommon:Fuzzy_Hash_Value condition="Equals">12288:trkm8R9qXgmj3d7khtgfpedbKbiTuDZWhswtik5j2w+f:2Ujt7+twpedbKb1dWhse9K</cyboxCommon:Fuzzy_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-9d06a6d2-19d0-4eb1-a07f-63efa9f880e6" timestamp="2024-05-10T19:52:50.292892+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-28ea25d7-01ff-44d9-a673-079481cec8de"> <cybox:Object id="CISA:Object-89344eba-6207-4dfb-a458-c46aa762ff01"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:File_Name condition="Equals">c:windowssystem32mrpy2bfa7.dll; 96339a7e87ffce6ced247feb9b4cb7c05b83ca315976a9522155bad726b8e5be</FileObj:File_Name> <FileObj:Size_In_Bytes condition="Equals">209170</FileObj:Size_In_Bytes> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">7688C1B7A1124C1CD9413F4B535B2F44</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">8CCAC360E2CA37B2FA9F5FA81B22114FB8936120</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">96339A7E87FFCE6CED247FEB9B4CB7C05B83CA315976A9522155BAD726B8E5BE</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SSDEEP</cyboxCommon:Type> <cyboxCommon:Fuzzy_Hash_Value condition="Equals">6144:OUjqtclKpiqKLICZM5cUq29shXs6u7ulx97Z52Gd:fqt4KoVkCm9oV</cyboxCommon:Fuzzy_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2021-06-24T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-e8c1be96-7c66-4ee1-b613-fd92ebf333b8" timestamp="2024-05-10T19:52:50.293599+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-ac82cb3e-b6c5-40b6-a593-61aff51006da"> <cybox:Object id="CISA:Object-99b687e0-107f-451d-94e0-bb6d1c1e0f09"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:File_Name condition="Equals">ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e; ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e.bin</FileObj:File_Name> <FileObj:Size_In_Bytes condition="Equals">556576</FileObj:Size_In_Bytes> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">53FDEB923B1890D29B8F29DA77995938</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">A996CCD0D58125BF299E89F4C03FF37AFDAB33FC</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">AE7C868713E1D02B4DB60128C651EB1E3F6A33C02544CC4CB57C3AA6C6581B6E</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SSDEEP</cyboxCommon:Type> <cyboxCommon:Fuzzy_Hash_Value condition="Equals">12288:M1DTMHixr1moQqUiXINDl/m1s6BQio67VlAU:AzmoQqUiXw2s6yiVxR</cyboxCommon:Fuzzy_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2021-06-24T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-060359a4-3a3d-4616-b578-2f582e8f00a1" timestamp="2024-05-10T19:52:50.294289+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-95c45675-de90-43e8-b36f-d1c96a42ad2c"> <cybox:Object id="CISA:Object-b9726997-250b-49f6-9552-8eb9f45fec1c"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:File_Name condition="Equals">3f400f30415941348af21d515a2fc6a3; 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa</FileObj:File_Name> <FileObj:Size_In_Bytes condition="Equals">576512</FileObj:Size_In_Bytes> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">3F400F30415941348AF21D515A2FC6A3</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">BD0BF9C987288CA434221D7D81C54A47E913600A</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">5D2204F3A20E163120F52A2E3595DB19890050B2FAA96C6CBA6B094B0A52B0AA</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SSDEEP</cyboxCommon:Type> <cyboxCommon:Fuzzy_Hash_Value condition="Equals">12288:TFx0B/O7JxPzW9JPlHKtxYRkG7zLfpXE6SbJ:Rx7zW9JPlGskG1v</cyboxCommon:Fuzzy_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2021-06-24T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-5c496b7d-8666-4173-ab27-efd52a49d642" timestamp="2024-05-10T19:52:50.294937+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious File Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-5eb66d08-910d-4ff0-a523-18022695abc8"> <cybox:Object id="CISA:Object-2d2e95b3-1a87-4a00-b4d9-10bea68e7678"> <cybox:Properties xsi:type="FileObj:FileObjectType"> <FileObj:File_Name condition="Equals">17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90.bin</FileObj:File_Name> <FileObj:Hashes> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">267D5C3137D313CE1A86C2F255A835E6</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">C7A37C0EDEFFD23777CCA44F9B49076BE1BD43E6</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type> <cyboxCommon:Simple_Hash_Value condition="Equals">17205C43189C22DFCB278F5CC45C2562F622B0B6280DCD43CC1D3C274095EB90</cyboxCommon:Simple_Hash_Value> ... </cyboxCommon:Hash> <cyboxCommon:Hash> <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SSDEEP</cyboxCommon:Type> <cyboxCommon:Fuzzy_Hash_Value condition="Equals">12288:aEky5bwpy02iRaeXCP2CIcdoKAXMr+Mr+kJZ4:j02iRaeHPcdo18rTrf6</cyboxCommon:Fuzzy_Hash_Value> ... </cyboxCommon:Hash> ... </FileObj:Hashes> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2022-04-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-26a792e9-5a52-4c8e-b96a-75a435c4ec93" timestamp="2024-05-10T19:52:50.295582+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-02593eaf-c602-47ec-b8f3-e4629040de48"> <cybox:Object id="CISA:Object-e799ab01-f9cf-4f5c-bd37-66415f0ed1fc"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">185.220.101.149</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2017-12-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-6399cafe-8fb5-4dfc-b3cd-a32e0fa9c77d" timestamp="2024-05-10T19:52:50.296063+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious IPv4 Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-221da527-6fab-49aa-9357-88e31906128f"> <cybox:Object id="CISA:Object-11974cb1-b140-4731-9d22-66ed6d06a50e"> <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_spoofed="false"> <AddressObj:Address_Value condition="Equals">185.220.100.240</AddressObj:Address_Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2017-12-01T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> <stix:Indicator id="CISA:Indicator-b2917aa1-db1d-43a5-88a7-aa80f02d6df3" timestamp="2024-05-10T19:52:50.296485+00:00" xsi:type="indicator:IndicatorType"> <indicator:Title>Malicious FQDN Indicator</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> <indicator:Observable id="CISA:Observable-2c54bf31-1da3-433c-adca-378f0b4af0b8"> <cybox:Object id="CISA:Object-54de71ae-65e5-4b93-b387-d888f1727e94"> <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN"> <DomainNameObj:Value condition="Equals">xserver.jp</DomainNameObj:Value> ... </cybox:Properties> ... </cybox:Object> ... </indicator:Observable> <indicator:Sightings sightings_count="1"> <indicator:Sighting timestamp="2018-12-06T00:00:00"/> ... </indicator:Sightings> ... </stix:Indicator> ... </stix:Indicators> <stix:TTPs> <stix:TTP id="CISA:ttp-7dc73331-c9c7-4011-b3af-c63998db9162" timestamp="2024-05-10T19:52:50.210817+00:00" xsi:type="ttp:TTPType"> <ttp:Behavior> <ttp:Attack_Patterns> <ttp:Attack_Pattern> <ttp:Title>Initial Access - Exploit Public-Facing Application [T1190]</ttp:Title> ... </ttp:Attack_Pattern> ... </ttp:Attack_Patterns> ... </ttp:Behavior> ... </stix:TTP> <stix:TTP id="CISA:ttp-1d8a0d8f-3f13-4454-956c-aaed5a8481cf" timestamp="2024-05-10T19:52:50.212300+00:00" xsi:type="ttp:TTPType"> <ttp:Behavior> <ttp:Attack_Patterns> <ttp:Attack_Pattern> <ttp:Title>Initial Access - Phishing [T1566]</ttp:Title> ... </ttp:Attack_Pattern> ... </ttp:Attack_Patterns> ... </ttp:Behavior> ... </stix:TTP> <stix:TTP id="CISA:ttp-0e4b1e00-65e3-4f5a-9184-e532b24aae05" timestamp="2024-05-10T19:52:50.212442+00:00" xsi:type="ttp:TTPType"> <ttp:Behavior> <ttp:Attack_Patterns> <ttp:Attack_Pattern> <ttp:Title>Initial Access - Valid Accounts [T1078]</ttp:Title> ... </ttp:Attack_Pattern> ... </ttp:Attack_Patterns> ... </ttp:Behavior> ... </stix:TTP> <stix:TTP id="CISA:ttp-64fc2ece-8325-496d-87be-4a5c16f824af" timestamp="2024-05-10T19:52:50.212569+00:00" xsi:type="ttp:TTPType"> <ttp:Behavior> <ttp:Attack_Patterns> <ttp:Attack_Pattern> <ttp:Title>Execution - Command and Scripting Interpreter: PowerShell [T1059.001]</ttp:Title> ... </ttp:Attack_Pattern> ... </ttp:Attack_Patterns> ... </ttp:Behavior> ... </stix:TTP> <stix:TTP id="CISA:ttp-33b8246f-955a-4820-8c6d-0a8cb2cb2229" timestamp="2024-05-10T19:52:50.212693+00:00" xsi:type="ttp:TTPType"> <ttp:Behavior> <ttp:Attack_Patterns> <ttp:Attack_Pattern> <ttp:Title>Privilege Escalation - Exploitation for Privilege Escalation [T1068]</ttp:Title> ... </ttp:Attack_Pattern> ... </ttp:Attack_Patterns> ... </ttp:Behavior> ... </stix:TTP> <stix:TTP id="CISA:ttp-c07bae44-abce-45f8-8606-872e8a6f2483" timestamp="2024-05-10T19:52:50.212816+00:00" xsi:type="ttp:TTPType"> <ttp:Behavior> <ttp:Attack_Patterns> <ttp:Attack_Pattern> <ttp:Title>Defense Evasion - Impair Defenses: Disable or Modify Tools [T1562.001]</ttp:Title> ... </ttp:Attack_Pattern> ... </ttp:Attack_Patterns> ... </ttp:Behavior> ... </stix:TTP> <stix:TTP id="CISA:ttp-588324fb-f35f-45e5-a8ae-3d9f906c642f" timestamp="2024-05-10T19:52:50.212937+00:00" xsi:type="ttp:TTPType"> <ttp:Behavior> <ttp:Attack_Patterns> <ttp:Attack_Pattern> <ttp:Title>Defense Evasion - Masquerading [T1036]</ttp:Title> ... </ttp:Attack_Pattern> ... </ttp:Attack_Patterns> ... </ttp:Behavior> ... </stix:TTP> <stix:TTP id="CISA:ttp-fecfcc8d-61b9-47e5-bb8f-8e3c608f1488" timestamp="2024-05-10T19:52:50.213058+00:00" xsi:type="ttp:TTPType"> <ttp:Behavior> <ttp:Attack_Patterns> <ttp:Attack_Pattern> <ttp:Title>Impact - Data Encrypted for Impact [T1486]</ttp:Title> ... </ttp:Attack_Pattern> ... </ttp:Attack_Patterns> ... </ttp:Behavior> ... </stix:TTP> <stix:TTP id="CISA:ttp-687d4ef1-1735-4c1b-903e-c897daca65aa" timestamp="2024-05-10T19:52:50.213179+00:00" xsi:type="ttp:TTPType"> <ttp:Behavior> <ttp:Attack_Patterns> <ttp:Attack_Pattern> <ttp:Title>Impact - Inhibit System Recovery [T1490]</ttp:Title> ... </ttp:Attack_Pattern> ... </ttp:Attack_Patterns> ... </ttp:Behavior> ... </stix:TTP> <stix:Kill_Chains> <stixCommon:Kill_Chain reference="http://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf" number_of_phases="7" id="stix:KillChain-af3e707f-2fb9-49e5-8c37-14026ca0a5ff" definer="LMCO" name="LM Cyber Kill Chain"> <stixCommon:Kill_Chain_Phase ordinality="1" name="Reconnaissance" phase_id="stix:KillChainPhase-af1016d6-a744-4ed7-ac91-00fe2272185a"/> <stixCommon:Kill_Chain_Phase ordinality="2" name="Weaponization" phase_id="stix:KillChainPhase-445b4827-3cca-42bd-8421-f2e947133c16"/> <stixCommon:Kill_Chain_Phase ordinality="3" name="Delivery" phase_id="stix:KillChainPhase-79a0e041-9d5f-49bb-ada4-8322622b162d"/> <stixCommon:Kill_Chain_Phase ordinality="4" name="Exploitation" phase_id="stix:KillChainPhase-f706e4e7-53d8-44ef-967f-81535c9db7d0"/> <stixCommon:Kill_Chain_Phase ordinality="5" name="Installation" phase_id="stix:KillChainPhase-e1e4e3f7-be3b-4b39-b80a-a593cfd99a4f"/> <stixCommon:Kill_Chain_Phase ordinality="6" name="Command and Control" phase_id="stix:KillChainPhase-d6dc32b9-2538-4951-8733-3cb9ef1daae2"/> <stixCommon:Kill_Chain_Phase ordinality="7" name="Actions on Objectives" phase_id="stix:KillChainPhase-786ca8f9-2d9a-4213-b38e-399af4a2e5d6"/> ... </stixCommon:Kill_Chain> <stixCommon:Kill_Chain reference="https://attack.mitre.org/tactics/enterprise/" number_of_phases="12" id="CISA:KillChain-968782b1-64f0-4eab-8f85-ddf63cf0afbe" definer="MITRE" name="ATT&CK Tactics"> <stixCommon:Kill_Chain_Phase ordinality="1" name="Initial Access" phase_id="CISA:KillChainPhase-d7dcc502-4084-4f94-bbbf-082628eeab1f"/> <stixCommon:Kill_Chain_Phase ordinality="2" name="Execution" phase_id="CISA:KillChainPhase-09de39a7-fd05-4650-9216-4676008644b9"/> <stixCommon:Kill_Chain_Phase ordinality="3" name="Persistence" phase_id="CISA:KillChainPhase-ae90bca2-ef95-4007-8518-bcbdfe9aca8f"/> <stixCommon:Kill_Chain_Phase ordinality="4" name="Privilege Escalation" phase_id="CISA:KillChainPhase-c2044d94-6fcb-40a8-bc93-31e9a64b3b31"/> <stixCommon:Kill_Chain_Phase ordinality="5" name="Defense Evasion" phase_id="CISA:KillChainPhase-26903764-b2d4-4e67-94b7-85bd4702cc4a"/> <stixCommon:Kill_Chain_Phase ordinality="6" name="Credential Access" phase_id="CISA:KillChainPhase-fd05b7de-702b-494b-93f1-4317ee4f8a3e"/> <stixCommon:Kill_Chain_Phase ordinality="7" name="Discovery" phase_id="CISA:KillChainPhase-fbd6dd2f-5c07-4089-908d-3931eb27dfed"/> <stixCommon:Kill_Chain_Phase ordinality="8" name="Lateral Movement" phase_id="CISA:KillChainPhase-c90a5d62-9f66-4a41-adef-ffa6cb2d2f94"/> <stixCommon:Kill_Chain_Phase ordinality="9" name="Collection" phase_id="CISA:KillChainPhase-b9ee5299-93a2-4580-a100-ae7752cdfa3f"/> <stixCommon:Kill_Chain_Phase ordinality="10" name="Command and Control" phase_id="CISA:KillChainPhase-5740037d-87bd-4825-a174-722f4db359bc"/> <stixCommon:Kill_Chain_Phase ordinality="11" name="Exfiltration" phase_id="CISA:KillChainPhase-0db0901a-007c-452f-833a-b73e772b0dd0"/> <stixCommon:Kill_Chain_Phase ordinality="12" name="Impact" phase_id="CISA:KillChainPhase-d3aaef09-1a3a-4b12-8edc-fc4a68d7e3e7"/> ... </stixCommon:Kill_Chain> ... </stix:Kill_Chains> ... </stix:TTPs> ... </stix:STIX_Package>