{
  "name": "How a single ScreenConnect incident exposed a massive campaign",
  "slug": "how-a-single-screenconnect-incident-exposed-a-massive-campaign",
  "description": "A massive campaign distributes malicious installer archives hosted on spoofed websites masquerading as popular software like OBS Studio, DNS Jumper, DS4Windows, and Bandicam. Over 90 domain names localized across 10 languages were discovered. The malicious archives bundle a legitimate Microsoft-signed install.exe binary with a rogue install.res.1033.dll library deployed via DLL sideloading. This installs the ScreenConnect remote access service, which then deploys AsyncRAT payloads through PowerShell and VBS scripts. The threat actors leverage SEO techniques to position fraudulent sites at the top of search engine results, targeting both individual users and corporate networks. The infrastructure spans three IP addresses with domains registered between October 2025 and March 2026, creating a global footprint with multi-language support.",
  "published": "2026-07-01T16:52:43.983000+00:00",
  "created_at": "2026-07-02T07:15:22.771000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-07-02T07:15:22.771000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "asyncrat",
    "c2 infrastructure",
    "dll sideloading",
    "fake software",
    "powershell loader",
    "process hollowing",
    "remote access trojan",
    "screenconnect",
    "seo poisoning",
    "typosquatting"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "4e6ac419-1c76-417b-8ba8-87ecf0f6a0ba",
        "name": "dns-jumper.com"
      },
      {
        "id": "bc815901-ab1d-4c71-b8ef-75cb7ea55750",
        "name": "45.145.41.205"
      },
      {
        "id": "f9df6fa1-0f63-4e55-9265-1d1dbf5bce4e",
        "name": "185.254.97.249"
      },
      {
        "id": "d6fd72bd-5e4f-46ac-8aa7-bf5d205a8182",
        "name": "dnsjumper.io"
      },
      {
        "id": "9dfc4917-394f-4779-842a-997494da893c",
        "name": "edgeserv.ru"
      },
      {
        "id": "12845fd9-95c3-4512-b2e0-b26ff3cbda59",
        "name": "2.59.134.97"
      },
      {
        "id": "41eb55ae-08a7-4176-bd6b-ff35918bc963",
        "name": "ds4windows.net"
      },
      {
        "id": "f9216278-f496-4dfd-af7b-0ac4240ee079",
        "name": "studioobs.pro"
      },
      {
        "id": "15e5c9c6-6724-4d5b-b0e1-19714c8bb749",
        "name": "198.23.185.81"
      },
      {
        "id": "bceda157-d431-449a-9963-38a7a2026425",
        "name": "mediaplayerclassic.pro"
      },
      {
        "id": "e33c145c-40cd-4124-9929-e76eae16b9dd",
        "name": "r.manage-server.xyz"
      },
      {
        "id": "e4772d58-d41a-406b-8144-bd87cdf5bdac",
        "name": "monster-hunterwilds.com"
      },
      {
        "id": "ec08278d-b2a5-4570-a8be-b3caed86a6df",
        "name": "https://fileget.loseyourip.com/obs-studio-windows-full/gVOMs5VZ9BtlcaM"
      },
      {
        "id": "8a290b0d-1985-4f63-97d2-14b67df668ab",
        "name": "crosshairx.pro"
      },
      {
        "id": "263ed3f3-5f0e-4677-8956-5a3710e8cdc2",
        "name": "lossless-scaling.online"
      },
      {
        "id": "d8a2fe99-1c61-44f4-bce6-89e8d17bc380",
        "name": "ehostservers.xyz"
      },
      {
        "id": "4e0db22f-1b5a-411e-b112-d77201bf5ac9",
        "name": "fileget.loseyourip.com"
      },
      {
        "id": "dbf47f5f-ed3a-4081-a09f-ef8a707867bd",
        "name": "vlc-media.com"
      },
      {
        "id": "51592d07-e217-4852-9471-d53445d45650",
        "name": "bandicam.io"
      },
      {
        "id": "8b61154c-0883-48bd-9cd5-3e5c7cca94fb",
        "name": "losslessscaling.pro"
      },
      {
        "id": "5b72d057-9faf-480d-acbe-fefe782dd17e",
        "name": "kms-tools.com"
      },
      {
        "id": "eba28e82-3718-433e-ad66-70b82713e86e",
        "name": "www.studioobs.com"
      },
      {
        "id": "2757e46a-a754-4d69-a361-a2dd3eb0dd92",
        "name": "mgba.pro"
      },
      {
        "id": "7795eb24-8043-4313-80a8-c6d5fdf889b8",
        "name": "fernbus-simulator.com"
      },
      {
        "id": "42bd5592-e6a1-459e-9dfa-4b05e117bd66",
        "name": "managedevice.xyz"
      },
      {
        "id": "6e541090-ca06-45ab-8f6e-7dc726e6e1cb",
        "name": "vlc-player.net"
      },
      {
        "id": "39511876-67d5-4946-b25e-c24feada7c65",
        "name": "clair-obscur-33.com"
      },
      {
        "id": "ec30a71b-c15d-458d-91e3-d707301152a3",
        "name": "arksurvival-ascended.com"
      },
      {
        "id": "cc7d31f3-5568-4d56-8bf6-51bc5db52bfd",
        "name": "crosshairx.site"
      },
      {
        "id": "2cd57e4b-7464-48a7-91c7-f0d7c4eb4e08",
        "name": "crosshairx2.com"
      },
      {
        "id": "332f0b16-1c61-48ee-83d9-4cfd04c90795",
        "name": "r.servermanagemen.xyz"
      },
      {
        "id": "541632e2-be70-4867-89a8-b220499df3ba",
        "name": "cpuz.pro"
      },
      {
        "id": "8e78820c-1e1e-4a81-876b-0293c19df8b1",
        "name": "crusader-kings.church"
      },
      {
        "id": "ac795cf0-1ede-44dd-a7bd-64a0cd54c743",
        "name": "crosshairx.net"
      },
      {
        "id": "1f65265b-5ddb-41d3-a491-24788b3697b5",
        "name": "studio-obs.net"
      },
      {
        "id": "d8c66377-6acb-4360-b872-b61671eb929a",
        "name": "tmod-loader.com"
      },
      {
        "id": "ce15d870-a60c-470b-8e57-6db69ed339c3",
        "name": "manageserver.xyz"
      },
      {
        "id": "2241b343-b720-4a0f-a87f-850c93d50e14",
        "name": "162.216.241.242"
      },
      {
        "id": "26d36de9-8534-487c-bd9b-1b12d2aeeaa1",
        "name": "obs-studio.site"
      },
      {
        "id": "264d9a26-cb86-461c-ae39-7348e0fec588",
        "name": "6ed15aec7504081c3e14a9f6064d7b754aa283e4adb1a59edf3beff65369bc55"
      },
      {
        "id": "0337ff28-4297-4ec6-ae66-3b800ceb2e47",
        "name": "gom-player.net"
      },
      {
        "id": "d2d8de56-1f26-4762-9ee0-5e8482ec86c3",
        "name": "bandizip.net"
      },
      {
        "id": "35938ea4-ec56-42c5-9871-83d7aff4eef7",
        "name": "mgba.dev"
      },
      {
        "id": "80b29d72-eccc-4fa9-8107-557abb0a573c",
        "name": "kms-tools.net"
      },
      {
        "id": "089b8f89-3007-4b8e-9dd6-fff639fa3234",
        "name": "lossless-scaling.download"
      },
      {
        "id": "997390d0-8285-43be-9c25-63bde6e83938",
        "name": "studioobs.com"
      },
      {
        "id": "b1f27a29-0f5c-454f-89a8-07da99f6fcd7",
        "name": "crystaldiskmark.cc"
      },
      {
        "id": "011f5979-3724-42c4-bff9-e2601504b537",
        "name": "processhacker.org"
      },
      {
        "id": "7abbb2f1-62bf-48a4-81e1-b06e5b72d535",
        "name": "ready-ornot.com"
      },
      {
        "id": "8e299155-7a4c-4acb-92a3-c4b060f7790d",
        "name": "bandizip.pro"
      },
      {
        "id": "3120cd3d-7444-4edd-976d-a8553d845732",
        "name": "tmodloader.org"
      },
      {
        "id": "e31e0964-fa52-4ee5-8694-3d0ba1833d00",
        "name": "crusader-kings.com"
      },
      {
        "id": "8efe4e1a-fa89-4e74-8add-a1015dfe5808",
        "name": "8d08136a1964c72b6b450b11d9bf2b3d3d289c26dfadfc9f021114eac2cea1ca"
      },
      {
        "id": "a82d89a8-0dfa-425b-8654-e846ff2b4f11",
        "name": "3cbd65ae3ff5039324b03a66947a1d1b808ea5ddb09da917ed8f1323c34e80f7"
      },
      {
        "id": "9c74f83d-06bf-43ac-a232-d10e949aa124",
        "name": "antimicrox.pro"
      },
      {
        "id": "3d2fd784-5a14-4b5f-af66-1748f2290ecd",
        "name": "servermanagemen.xyz"
      },
      {
        "id": "e791df60-b277-40e2-98df-4976023a99ec",
        "name": "defendercontrol.download"
      },
      {
        "id": "a707e2f9-bb8d-4167-84bf-5d26ac1242c4",
        "name": "processhacker.net"
      },
      {
        "id": "bbec6df3-9765-41a1-9b64-c8ed4e83f07e",
        "name": "http://fileget.loseyourip.com/obs-studio-windows-full/gVOMs5VZ9BtlcaM"
      },
      {
        "id": "f0c6d7b5-0977-415c-9017-7d7dba7d4647",
        "name": "defendercontrol.org"
      },
      {
        "id": "38fb678b-1847-48a7-9a12-2dd7cd03a3eb",
        "name": "defendercontrol.pro"
      },
      {
        "id": "0cb67c85-6f3c-4a83-aa91-53923c5a971b",
        "name": "clair-obscur-33.town"
      },
      {
        "id": "0f86db28-658c-4303-9223-a20f1b11c520",
        "name": "https://www.studioobs.com/"
      },
      {
        "id": "c8f9f8b1-256b-4e0e-933d-425f3568be33",
        "name": "bandicam.cc"
      },
      {
        "id": "0b92a9ff-5b5f-405a-8802-26e9781edba7",
        "name": "glary-utilities.com"
      },
      {
        "id": "e9b8df39-2fb8-423a-a658-3598fc15520c",
        "name": "mora1987.work.gd"
      },
      {
        "id": "2992aad1-71fe-41da-bcb2-5dd20a7e7df3",
        "name": "winservec.net"
      },
      {
        "id": "d56d07ea-5509-4efb-b743-f34d01ac3558",
        "name": "dnsjumper.pro"
      },
      {
        "id": "c1d8a9ce-c258-4023-b402-6a34f30221e2",
        "name": "mediaplayerclassic.net"
      },
      {
        "id": "aa225ab0-d917-49fb-bc25-0cd4e7e994b1",
        "name": "tmodloader.pro"
      },
      {
        "id": "1caa55ff-86d3-4627-8142-ffda51580554",
        "name": "steamtools.cc"
      },
      {
        "id": "79927e98-e692-467b-b38a-643e54146897",
        "name": "km-player.pro"
      },
      {
        "id": "9dc5abb4-094e-4ecc-8485-5ebceedcc93c",
        "name": "ds4windows.io"
      },
      {
        "id": "d2919d7c-1784-4b49-a219-fc0b135d6a47",
        "name": "deadreset.com"
      },
      {
        "id": "0cdf0363-4592-4abb-ae41-76885bb5de68",
        "name": "studio-obs.com"
      },
      {
        "id": "cc18c924-e31a-4ae5-9a6a-fd1bd4555042",
        "name": "apexlegends.org"
      },
      {
        "id": "c812be37-bc20-4f2f-89e4-53820013083f",
        "name": "pingpanl.pro"
      },
      {
        "id": "b027c6fd-3e2c-469d-a4d0-b6e30147afd3",
        "name": "tmodloader.download"
      },
      {
        "id": "c08a9357-40d2-4f13-8e72-13e0b9a46b74",
        "name": "5b95e1d05d913676e9ebbd897a403ddfa6476524651a038d08ecebde29159b9a"
      },
      {
        "id": "a4fe15eb-98c2-4d2b-b144-c58f384e2720",
        "name": "arma-reforger.com"
      },
      {
        "id": "3f025787-8fc8-4a8f-8cc7-2c5822fa43fb",
        "name": "download-full-version.ooguy.com"
      },
      {
        "id": "39bea59e-ed63-4883-a017-15bea7a3156d",
        "name": "ds4windows.pro"
      },
      {
        "id": "cf323f3c-ec2b-45ac-9495-97fc4f3f1e95",
        "name": "km-player.com"
      },
      {
        "id": "fac65b70-984a-4218-82f2-5e5023550bfd",
        "name": "crosshair-x.com"
      },
      {
        "id": "fdb82e81-8b8d-49df-9c23-46230267a3ca",
        "name": "trojan.js.sagent.sb"
      },
      {
        "id": "d0cf4777-5302-4dd5-a828-38783592dbf2",
        "name": "ovr-advanced-settings.com"
      },
      {
        "id": "a6fc072d-6ccb-49ef-bf33-0a0823066ff3",
        "name": "crosshairxv2.com"
      },
      {
        "id": "7ec22aec-229a-49f5-89d2-a7e92aa5ad07",
        "name": "antimicrox.net"
      },
      {
        "id": "18aaaf30-d713-45a6-be85-b62e322f5655",
        "name": "ferdium.pro"
      },
      {
        "id": "7a10f254-0fef-448f-b57b-e0e07d4157d6",
        "name": "7f53fade6f3942f710b230d52a574fc6066ea282e739e417ca039800dc1bb08e"
      },
      {
        "id": "33d992f1-2af9-460c-b21c-66c4f0b31e53",
        "name": "free-download.camdvr.org"
      },
      {
        "id": "14852f1b-3303-4030-8012-f243e187afb9",
        "name": "serverdnsplan.net"
      },
      {
        "id": "9cf683bf-5e6d-4f7f-a289-76a718dc1e24",
        "name": "elden-ringnightreign.com"
      },
      {
        "id": "acfe953a-48dc-4726-96ce-67e71b9adb56",
        "name": "libreoffice.pro"
      },
      {
        "id": "836ccea6-07c3-415c-bdcf-0ada3285d431",
        "name": "crystaldiskmark.dev"
      },
      {
        "id": "1bea404e-e8ab-4381-b556-abf24431b02a",
        "name": "all-toll-free.loseyourip.com"
      },
      {
        "id": "cd1345db-4ec3-452b-a80a-536e8186317a",
        "name": "corel-draw.net"
      },
      {
        "id": "a207e2fe-6eeb-4841-9af4-32a79aa7ed90",
        "name": "ovr-toolkit.com"
      },
      {
        "id": "ea657974-2261-4308-872d-9e1348ca214d",
        "name": "vlc-media.net"
      },
      {
        "id": "e5147a22-9597-4059-a45d-8ec33cbed0cb",
        "name": "crystaldiskmark.io"
      },
      {
        "id": "df6e9aa0-c9d8-4991-bf7b-780fdc988bc4",
        "name": "steamtools.pro"
      },
      {
        "id": "cea07764-5c6e-443b-96f1-08ba3d1516ab",
        "name": "obs-studio.pro"
      },
      {
        "id": "6558cf4a-8fba-47a3-b445-570aa4d2b18e",
        "name": "pingserv.pro"
      },
      {
        "id": "20317f4e-3278-431d-96ce-f41935e85e3b",
        "name": "processhacker.dev"
      },
      {
        "id": "ee95ec26-cfaf-4f30-b9eb-adb3537435ff",
        "name": "studio-obs.pro"
      },
      {
        "id": "1904d9e3-19a3-48f1-b773-e0b497613706",
        "name": "cloudsynn.com"
      },
      {
        "id": "0e1f54c5-1e26-4704-9bdd-ec8fae92b02e",
        "name": "defender-control.com"
      },
      {
        "id": "2eda6d7d-39fc-4aed-860e-67c55640dd14",
        "name": "crystaldiskmark.pro"
      }
    ],
    "attack_patterns": [
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7dc1bc79-ccad-419e-b7c0-0f7fa8522270",
        "name": "T1055.012"
      },
      {
        "id": "840f859f-575f-487e-8083-6ffd01a13a84",
        "name": "T1218.007"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "9e784d22-5a6c-4da6-968a-5fab2f019efd",
        "name": "T1059.005"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "1e573653-8e3c-42df-abd2-df73bd3e1266",
        "name": "T1218.004"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      }
    ],
    "malware": [
      {
        "id": "f200fb60-5446-493f-9712-9f26d65956cc",
        "name": "AsyncRAT",
        "slug": "asyncrat"
      },
      {
        "id": "b9a94179-fee8-4a2e-bcfb-ce9c0dd34433",
        "name": "ScreenConnect",
        "slug": "screenconnect"
      }
    ],
    "observables": [
      {
        "id": "fb603007-c6be-41e3-8217-8493623c8b19",
        "name": "deadreset.com"
      },
      {
        "id": "d1ce9dcd-3390-42b0-8eb0-daa4718078a3",
        "name": "crusader-kings.com"
      },
      {
        "id": "320cc778-06d7-4992-abc3-2a7265079842",
        "name": "crosshairx2.com"
      },
      {
        "id": "d626bb27-7506-4f3b-b834-b5c511080f5c",
        "name": "lossless-scaling.download"
      },
      {
        "id": "d390a1de-073b-4485-9980-f14e2825ea6b",
        "name": "studio-obs.com"
      },
      {
        "id": "e1b5da7a-a1fc-49d4-9fec-2da253ebf96d",
        "name": "pingserv.pro"
      },
      {
        "id": "5ddb3a1c-2f60-4360-94f4-db8991650d4d",
        "name": "apexlegends.org"
      },
      {
        "id": "8e8bab51-efcb-440a-99b2-cb46aaf99c0b",
        "name": "manageserver.xyz"
      },
      {
        "id": "a9b29ecb-acf8-4cfa-83b9-114cc765ff36",
        "name": "gom-player.net"
      },
      {
        "id": "26558bda-ade0-4ba7-b6dc-06c5916f8a64",
        "name": "arma-reforger.com"
      },
      {
        "id": "1efb1cd7-6c38-47b1-8e37-1c4bbf5b21b9",
        "name": "vlc-player.net"
      },
      {
        "id": "d5f1cf19-7445-471e-b748-9b42e1b772af",
        "name": "ferdium.pro"
      },
      {
        "id": "4503204b-7ea3-49b1-9b5e-53a0b6916b53",
        "name": "kms-tools.net"
      },
      {
        "id": "dc220649-5e7c-4326-94bc-ab5ea9eb2eed",
        "name": "steamtools.pro"
      },
      {
        "id": "3a34b70f-3d4c-4101-942d-4e4c72c922a4",
        "name": "mediaplayerclassic.net"
      },
      {
        "id": "ef0b01a2-def8-4150-95c8-882854dc7193",
        "name": "crosshairx.pro"
      },
      {
        "id": "22204c5a-081d-4759-b7ad-1efa70fbe656",
        "name": "elden-ringnightreign.com"
      },
      {
        "id": "83efc490-49de-4df1-85b4-ad22ce83d36b",
        "name": "vlc-media.net"
      },
      {
        "id": "5a5751bf-f74b-40e4-b43a-2635b85b6909",
        "name": "libreoffice.pro"
      },
      {
        "id": "191704a5-b5f1-4d53-8ff3-03a9e467c8dd",
        "name": "ovr-advanced-settings.com"
      },
      {
        "id": "1921ca36-8268-4834-9c96-4c840d044aaf",
        "name": "ds4windows.pro"
      },
      {
        "id": "d7ff0224-72a7-48d2-971c-302cdb663245",
        "name": "tmod-loader.com"
      },
      {
        "id": "a96c06f9-dbf3-49a9-bcdd-2202f61f08f6",
        "name": "studioobs.com"
      },
      {
        "id": "afb3b487-e4b5-40ce-b983-babdbef7f5fe",
        "name": "defender-control.com"
      },
      {
        "id": "0811bf4c-0181-4362-b3b9-60b166c15be2",
        "name": "crystaldiskmark.io"
      },
      {
        "id": "8a08e3af-9044-4b23-9235-92ca0856200d",
        "name": "pingpanl.pro"
      },
      {
        "id": "dab1b7ea-5086-4aa7-9ca7-6ad49ee8594f",
        "name": "cpuz.pro"
      },
      {
        "id": "3ece3133-dbf9-4945-98c4-ccec297511fe",
        "name": "crusader-kings.church"
      },
      {
        "id": "c23dffbe-a53a-480f-a30d-c4fda80da7f7",
        "name": "studio-obs.pro"
      },
      {
        "id": "545b69f1-fac4-4134-923c-060cead04990",
        "name": "antimicrox.pro"
      },
      {
        "id": "07e89dff-b4e3-4aa7-84cc-f1482b910f16",
        "name": "crosshairxv2.com"
      },
      {
        "id": "2f60dd4d-f944-4112-a5a0-74809e242767",
        "name": "mgba.pro"
      },
      {
        "id": "c3aa4bc7-6614-4bb1-9d2a-820d8925a926",
        "name": "studioobs.pro"
      },
      {
        "id": "cbc3be1c-6d84-4b4b-bb01-b65543cab1dc",
        "name": "crystaldiskmark.pro"
      },
      {
        "id": "e54c2939-9c37-4837-94d7-82f64c4acb4e",
        "name": "defendercontrol.download"
      },
      {
        "id": "4d891770-2886-4c4b-bfea-2e55ad75681a",
        "name": "bandicam.io"
      },
      {
        "id": "c8f70a78-0193-4ee9-9e5c-1abdb5cddf18",
        "name": "obs-studio.site"
      },
      {
        "id": "3724f55c-4479-4974-a0d1-73605614b5be",
        "name": "vlc-media.com"
      },
      {
        "id": "e59bbf0b-a30c-42e4-ab4f-b73fa8b0eda1",
        "name": "ds4windows.io"
      },
      {
        "id": "83ebb93e-91c6-4e73-b547-e7709645b32d",
        "name": "obs-studio.pro"
      },
      {
        "id": "a4f28b7d-48d2-46f9-9039-9c8340d60c9b",
        "name": "bandizip.net"
      },
      {
        "id": "c5d0bcbd-a894-42b4-9333-03a98f4c71b8",
        "name": "dnsjumper.io"
      },
      {
        "id": "df7d3c39-7d40-4283-8396-7336280ae504",
        "name": "processhacker.dev"
      },
      {
        "id": "2acf3f61-7c22-4980-a269-c38633e9ff26",
        "name": "km-player.pro"
      },
      {
        "id": "31c5ec2f-d5d4-4ff3-b3ff-dbea05e1c1f5",
        "name": "arksurvival-ascended.com"
      },
      {
        "id": "8a203133-874e-44d0-89c1-4467431a3ce7",
        "name": "km-player.com"
      },
      {
        "id": "f36c02aa-ee5a-4566-b1b9-d37548d8f1c2",
        "name": "crosshairx.net"
      },
      {
        "id": "19b3cd6b-4441-4917-a5cc-d30a70515029",
        "name": "servermanagemen.xyz"
      },
      {
        "id": "d0a5abef-a434-4260-a2a3-7007272dd9df",
        "name": "winservec.net"
      },
      {
        "id": "f7324fe4-b8df-484d-90f0-56a1601feece",
        "name": "clair-obscur-33.town"
      },
      {
        "id": "2b28c9b4-b10a-410f-a11a-d86586586185",
        "name": "dns-jumper.com"
      },
      {
        "id": "5ffc7c1a-2009-44e6-af6d-82d78259dd08",
        "name": "kms-tools.com"
      },
      {
        "id": "82a03d99-daa8-4a51-9245-a9a3f299d9c9",
        "name": "defendercontrol.pro"
      },
      {
        "id": "13deacf7-661d-4112-aad4-c33b758f06e4",
        "name": "serverdnsplan.net"
      },
      {
        "id": "a60f3414-0196-41d0-b06d-c6e4723bf4b5",
        "name": "clair-obscur-33.com"
      },
      {
        "id": "983da98c-4f28-4534-bd0c-010299728d9b",
        "name": "crosshair-x.com"
      },
      {
        "id": "287bb78c-135e-401d-b7ca-a215e7799648",
        "name": "losslessscaling.pro"
      },
      {
        "id": "d65e3607-73ad-4db2-9b69-48402bd598df",
        "name": "edgeserv.ru"
      },
      {
        "id": "d59399d7-6af0-435f-9e60-274c390018d2",
        "name": "crosshairx.site"
      },
      {
        "id": "84b071c6-2ac9-4633-a26e-d0dc49b179d0",
        "name": "studio-obs.net"
      },
      {
        "id": "10c202da-a69d-4b4a-8d69-fbc506d11ee2",
        "name": "managedevice.xyz"
      },
      {
        "id": "18b752c7-0507-481f-9dd2-f79d9d02e6e0",
        "name": "corel-draw.net"
      },
      {
        "id": "fbc7a83a-c979-44d8-b93e-8355f396e89c",
        "name": "antimicrox.net"
      },
      {
        "id": "73c5fd5d-2a34-4c0c-98fd-f0be3036cea6",
        "name": "lossless-scaling.online"
      },
      {
        "id": "b047e2ab-5a35-4137-842a-1d6562cd7679",
        "name": "processhacker.net"
      },
      {
        "id": "0fa74491-93c2-40a9-aea6-e4955ec47288",
        "name": "defendercontrol.org"
      },
      {
        "id": "f8f0106a-e298-4d00-a5ab-59a160d89f5a",
        "name": "tmodloader.org"
      },
      {
        "id": "93924ed3-f923-42ce-bf57-77633fae9bfc",
        "name": "mediaplayerclassic.pro"
      },
      {
        "id": "8e691237-4745-4c45-8ee6-fdbb7a2f00b2",
        "name": "ehostservers.xyz"
      },
      {
        "id": "f52623bd-c9e1-4548-803a-0950f0a8077a",
        "name": "tmodloader.pro"
      },
      {
        "id": "1f501389-8e0b-4253-829f-a9b5cd23f37b",
        "name": "monster-hunterwilds.com"
      },
      {
        "id": "b9a17806-18e2-4440-9d0f-1dca719957c1",
        "name": "processhacker.org"
      },
      {
        "id": "a007800c-88b3-4054-b624-acc04cfc707c",
        "name": "tmodloader.download"
      },
      {
        "id": "274bbeda-0cac-4eaa-a86d-b34b3f7d15e0",
        "name": "cloudsynn.com"
      },
      {
        "id": "a2f4ed08-98a4-40a6-b582-41735e645ada",
        "name": "crystaldiskmark.cc"
      },
      {
        "id": "d541fde6-3525-4ea2-8f7c-82edc2353831",
        "name": "ovr-toolkit.com"
      },
      {
        "id": "20cb52d8-b666-40c3-b4bd-7b5effdbf0f8",
        "name": "dnsjumper.pro"
      },
      {
        "id": "522e29c3-6924-4687-9c7c-3a8f53187003",
        "name": "fernbus-simulator.com"
      },
      {
        "id": "a74c0969-499f-4ac8-b2f9-e07d5dde5904",
        "name": "glary-utilities.com"
      },
      {
        "id": "e760c6b4-0e5d-4f13-af5c-9ad44528d0e8",
        "name": "bandizip.pro"
      },
      {
        "id": "08472439-ca53-4d72-9873-a49b1511db9c",
        "name": "ds4windows.net"
      },
      {
        "id": "0c828c0a-4759-4b01-a815-bc5eb99babb7",
        "name": "steamtools.cc"
      },
      {
        "id": "432bfdb2-72dd-44c3-a56a-8d8cc4c81f08",
        "name": "mgba.dev"
      },
      {
        "id": "415825ae-ca11-4743-a980-f28607e18f18",
        "name": "ready-ornot.com"
      },
      {
        "id": "87c25fd2-8552-43aa-8aa2-0a8a1a31bc7f",
        "name": "crystaldiskmark.dev"
      },
      {
        "id": "6270ff8e-128f-478a-8b16-5e0c34586d07",
        "name": "bandicam.cc"
      },
      {
        "id": "66d325ad-45b9-46e9-8ce0-a147c66ab135",
        "name": "free-download.camdvr.org"
      },
      {
        "id": "6cc33c3c-bab7-464d-9919-3f8f17956f80",
        "name": "download-full-version.ooguy.com"
      },
      {
        "id": "e670100d-1d8f-41e6-bc1e-98833a9ad4fe",
        "name": "www.studioobs.com"
      },
      {
        "id": "629d7288-25b7-4ce3-941f-9db0ecd43e49",
        "name": "r.servermanagemen.xyz"
      },
      {
        "id": "7f6eec5c-a0e1-4424-9332-42c431c9147f",
        "name": "r.manage-server.xyz"
      },
      {
        "id": "44c54635-20d1-4f1c-94af-7a2890618ef9",
        "name": "trojan.js.sagent.sb"
      },
      {
        "id": "0b0fd90d-671f-4c66-a6bd-0ee42b1b7886",
        "name": "all-toll-free.loseyourip.com"
      },
      {
        "id": "3c1dcfdf-09cb-44c2-9e34-9c400083da1a",
        "name": "mora1987.work.gd"
      },
      {
        "id": "9d693765-89c0-45a2-8dec-2f9e6093990a",
        "name": "fileget.loseyourip.com"
      },
      {
        "id": "4656197e-e737-46f3-8fbc-8741f815f3a9",
        "name": "162.216.241.242"
      },
      {
        "id": "c360fffc-7a9c-4dcd-86b0-f66396f8c88e",
        "name": "2.59.134.97"
      },
      {
        "id": "def77e2f-3900-450f-84c2-8dbf832c396d",
        "name": "45.145.41.205"
      },
      {
        "id": "431c6a9b-c24c-4d49-a7e4-0cdd9bf88188",
        "name": "198.23.185.81"
      },
      {
        "id": "84317fe6-2332-477b-ad7a-150303730cdf",
        "name": "185.254.97.249"
      },
      {
        "id": "4797a72f-6eec-4c3c-9cfb-3d88e10a0c8f",
        "name": "https://www.studioobs.com/"
      },
      {
        "id": "59ec2afe-95b2-4048-9061-38200fec757a",
        "name": "http://fileget.loseyourip.com/obs-studio-windows-full/gVOMs5VZ9BtlcaM"
      },
      {
        "id": "15c94a7c-3a88-4640-a15c-0e793d137da0",
        "name": "https://fileget.loseyourip.com/obs-studio-windows-full/gVOMs5VZ9BtlcaM"
      }
    ]
  },
  "external_refs": [
    {
      "id": "1256479a-9817-4e9a-937b-182c9fa5d074",
      "standard_id": "external-reference--16051d94-5322-5d71-9ec3-787063773ea3",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://securelist.com/tr/the-soc-files-screenconnect-campaign-with-asyncrat/120472/",
      "hash": null,
      "external_id": null,
      "created": "2026-07-02T07:15:21.384Z",
      "modified": "2026-07-02T07:15:21.384Z",
      "createdById": null
    },
    {
      "id": "14d4def5-197b-4f98-9266-05729d78c21e",
      "standard_id": "external-reference--194755c6-8a46-5c51-9d9d-d5e1eebba74a",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a4545dbc77aff75fe16cee7",
      "hash": null,
      "external_id": "6a4545dbc77aff75fe16cee7",
      "created": "2026-07-02T07:15:21.346Z",
      "modified": "2026-07-02T07:15:21.346Z",
      "createdById": null
    }
  ]
}