{
  "Event": {
    "analysis": "1",
    "date": "2026-06-03",
    "extends_uuid": "",
    "info": "[Threat Intel] Espionage Campaign Targeted Stock Exchange Executive for Five Months",
    "protected": false,
    "publish_timestamp": "1781219326",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1781219326",
    "uuid": "0e570bbc-99bd-488e-81cb-9ba1dbd1c2b1",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#892644",
        "local": false,
        "name": "misp-galaxy:producer=\"Symantec\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#f28fb8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"OS Credential Dumping - T1003\"",
        "relationship_type": ""
      },
      {
        "colour": "#d74cce",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1548.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c8fe6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Email Collection - T1114.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9bb6d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#36a9d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e0269",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#0aebeb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Window - T1564.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#a05856",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Destruction - T1485\"",
        "relationship_type": ""
      },
      {
        "colour": "#f055aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Create Account - T1136\"",
        "relationship_type": ""
      },
      {
        "colour": "#e1e63b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#d92121",
        "local": false,
        "name": "rectifyq:target=\"targeted\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570845",
        "to_ids": false,
        "type": "link",
        "uuid": "8e7fe632-0987-47ba-9968-62d548d788da",
        "value": "https://www.security.com/threat-intelligence/stock-exchange-espionage"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570845",
        "to_ids": false,
        "type": "text",
        "uuid": "652a53ee-6f88-4efa-8150-bab0a397d63b",
        "value": "Unknown attackers conducted a five-month espionage campaign against a senior executive at a major global stock exchange, systematically stealing the victim's Outlook mailbox in incremental batches. The attackers demonstrated sophisticated operational discipline by using legitimate cloud services like Dropbox and OneDrive Personal for exfiltration and command-and-control infrastructure. They employed an Aspose-based mailbox stealer to extract OST files in date-range windows, beginning with historical emails from August 2025 and continuing with regular two-to-four-week intervals through February 2026. The intrusion maintained persistence through masquerading binaries and scheduled tasks themed around legitimate Adobe and Lenovo services. By extracting mailbox data incrementally and routing traffic through trusted cloud platforms, the attackers avoided detection while building a comprehensive intelligence picture of the executive's communications and organizational activities."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570845",
        "to_ids": false,
        "type": "text",
        "uuid": "cd35b351-655e-4cb6-839d-f28997d1d757",
        "value": "Name: Espionage Campaign Targeted Stock Exchange Executive for Five Months\nAuthor: AlienVault\nAdversary: \nTags: [\"stock exchange\", \"email theft\", \"frpc\", \"outlook ost\", \"secretsdump\"]\nTgtd countries: []\nMlwr families: [\"SharpDecryptPwd\", \"FRPC\", \"Secretsdump\", \"BypassUAC\"]\nAttack_ids: [\"T1053.005\", \"T1003\", \"T1548.002\", \"T1114.001\", \"T1140\", \"T1555\", \"T1055\", \"T1087\", \"T1102\", \"T1552.001\", \"T1562.001\", \"T1078\", \"T1027\", \"T1573\", \"T1203\", \"T1567.002\", \"T1564.003\", \"T1485\", \"T1136\", \"T1574.002\"]\nIndustries: [\"Finance\"]"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215038",
        "to_ids": true,
        "type": "sha256",
        "uuid": "97455fc1-acdb-47b9-b8b6-21a66b7c69f8",
        "value": "02048121fd0b3a51751ce7677155aa8818eba9d8ce67ea26fd1d7f43cfcdabd2",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215039",
        "to_ids": true,
        "type": "sha256",
        "uuid": "2c1a371d-aa0b-4d4c-a3d8-e199368ae726",
        "value": "22f335a65c479c26019f6187dae290624117c82a702a96acbb04fa325f730d3e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215040",
        "to_ids": true,
        "type": "sha256",
        "uuid": "c65283eb-be74-43e6-a15f-43100c1ef0c6",
        "value": "308351124c496d4f4effee65ab828506abf70385773c167ab1f32a7f030385ac",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215041",
        "to_ids": true,
        "type": "sha256",
        "uuid": "f764fcca-67a3-4eff-8836-5d8f46956e6a",
        "value": "3aae5a24e63f3cb1ca4759b9e4ee8e503ff139189423f5fd8cc923c6819697ca",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215042",
        "to_ids": true,
        "type": "sha256",
        "uuid": "e2cb6985-f33c-4bf5-9a10-b58cb17cfa48",
        "value": "3b6cb20891bce8602ce669187754871e402a1782031ef8b032cd007e3894bc5d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215043",
        "to_ids": true,
        "type": "sha256",
        "uuid": "4d7f3e0d-edaf-4aba-bbf8-009051a34bdb",
        "value": "611db3195d55e871dce67ce5c41e894bbaab88dd0d019af68f5a259f0108aef7",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215044",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5bae731e-c08d-4937-a257-7fd3efdc5d36",
        "value": "6a69ea2ce3fea0ebfd7a32a1dfc4251bd4d7d8a4fbd44aaa47b82290d0414a9f",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215045",
        "to_ids": true,
        "type": "sha256",
        "uuid": "d89dfa16-583d-4aeb-8667-66e4fa3bbb02",
        "value": "6c700ca4e6d917c7aa9d964e98604a0349d9b8b4673df96a3f73a3d2d042635a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215046",
        "to_ids": true,
        "type": "sha256",
        "uuid": "ba3cbe58-622d-45e0-acaf-2d7a50132795",
        "value": "8b283c954d19a839a724961ccaf025c56988c4e745acb2d31a15a006cda072bf",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215047",
        "to_ids": true,
        "type": "sha256",
        "uuid": "ecea1bfa-83e7-4666-a11c-521d08bcdf58",
        "value": "8c0871cd0f60bc603424e948a689945a1828d0bef926a6470ae18cf17d93f7cb",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215047",
        "to_ids": true,
        "type": "sha256",
        "uuid": "a9ede9f5-bd62-4308-8039-0948e7031a7e",
        "value": "acf5ed6e5bb90c44683938f35efeca551428064cdedbbaab8be69e3474fb806f",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215048",
        "to_ids": true,
        "type": "sha256",
        "uuid": "ff32fef5-4246-4eb2-ba21-e4e976738b00",
        "value": "cf731b82c471211938b210ae8a6dcc7ece4f44371e716f056fa05151a9910727",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215050",
        "to_ids": true,
        "type": "sha256",
        "uuid": "e0ece267-0883-4e77-838e-ba472e1c3163",
        "value": "d5e42104292513232d26ad7d9d317b5c779577da43e28fe27f8c2fb9318b0e8e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215050",
        "to_ids": true,
        "type": "sha256",
        "uuid": "9082d341-47a4-44f3-973b-d1e2b884f010",
        "value": "d78f64551d1b31a31e5998e442f0debd458e011e05019b3951d9ddde997f8384",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215051",
        "to_ids": true,
        "type": "sha256",
        "uuid": "988396c3-88be-4aaa-b1dc-3d8ce4281cb9",
        "value": "db59813e3f27fb8608a4876e758f60b69d9700dc22d15237ac095bb3166fb622",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215052",
        "to_ids": true,
        "type": "sha256",
        "uuid": "2c6ee093-ef04-42d9-9d69-dfb0abc88553",
        "value": "eaff006ac0eb7f7fe4db5fc6a4b5b1dc272d83ced66d510dcea185b1278bb453",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215053",
        "to_ids": true,
        "type": "sha256",
        "uuid": "26fc0079-1292-465f-a6de-6ab32c039f94",
        "value": "f72a8b71f12eaab6518873f72ea4be4572d9f3fb8e8706ade3b9a7314f236f22",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215179",
        "to_ids": true,
        "type": "url",
        "uuid": "fb446c99-b58e-497b-82f6-b06b1a7e4e36",
        "value": "https://onedrive.live.com/personal/b546062c8e96f77a/_api/web/GetFolderByServerRelativePath(DecodedUrl=@a1)/Files/AddUsingPath(DecodedUrl=@a2",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215200",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e3441c77-03aa-4b2b-b975-40bd872dbff2",
        "value": "13.107.137.11",
        "Tag": [
          {
            "colour": "#f84d98",
            "local": false,
            "name": "asn:asn=\"8068\"",
            "relationship_type": ""
          },
          {
            "colour": "#61ef58",
            "local": false,
            "name": "asn:as-owner=\"MICROSOFT-CORP-MSN-AS-BLOCK\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215221",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5e9db27f-f29b-4f26-8cb5-8294da8e4244",
        "value": "150.171.41.11",
        "Tag": [
          {
            "colour": "#f84d98",
            "local": false,
            "name": "asn:asn=\"8068\"",
            "relationship_type": ""
          },
          {
            "colour": "#61ef58",
            "local": false,
            "name": "asn:as-owner=\"MICROSOFT-CORP-MSN-AS-BLOCK\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215242",
        "to_ids": true,
        "type": "url",
        "uuid": "4ce1d0a1-cb3b-4ec8-9eb9-a1bd18e2a094",
        "value": "https://13.107.137.11/personal/b546062c8e96f77a/_api/web/GetFolderByServerRelativePath(DecodedUrl=@a1)/Files/AddUsingPath(DecodedUrl=@a2",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215263",
        "to_ids": true,
        "type": "url",
        "uuid": "3b11a4be-130a-4d4e-9b76-2e49f27f4fa8",
        "value": "https://150.171.41.11/personal/b546062c8e96f77a/_api/web/GetFolderByServerRelativePath(DecodedUrl=@a1)/Files/AddUsingPath(DecodedUrl=@a2",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215284",
        "to_ids": true,
        "type": "url",
        "uuid": "65299099-0a09-4cc4-b697-b9878b0e41d5",
        "value": "https://onedrive.live.com/personal/b546062c8e96f77a/_api/web/GetFolderByServerRelativePath(DecodedUrl=@a1)/Files/AddUsingPath(DecodedUrl=@a2,AutoCheckoutOnInvalidData=@a3,XorHash=@a4)?@a1=[REMOVED]&@a2=[REMOVED]&@a3=[REMOVED]&@a4=[REMOVED]",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215305",
        "to_ids": true,
        "type": "url",
        "uuid": "e617c970-97ac-492d-95e0-2a94ef09692e",
        "value": "https://13.107.137.11/personal/b546062c8e96f77a/_api/web/GetFolderByServerRelativePath(DecodedUrl=@a1)/Files/AddUsingPath(DecodedUrl=@a2,AutoCheckoutOnInvalidData=@a3,XorHash=@a4)?",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215326",
        "to_ids": true,
        "type": "url",
        "uuid": "79d41a59-9fc5-4fd9-8eaf-c129c5bc603a",
        "value": "https://150.171.41.11/personal/b546062c8e96f77a/_api/web/GetFolderByServerRelativePath(DecodedUrl=@a1)/Files/AddUsingPath(DecodedUrl=@a2,AutoCheckoutOnInvalidData=@a3,XorHash=@a4)?",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781215347",
        "uuid": "0d33c402-0371-47ee-8013-af8b322973e2",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781215347",
            "to_ids": true,
            "type": "md5",
            "uuid": "bbc311f9-e2a4-4ccb-915b-82ee57482951",
            "value": "96ec8798bba011d5be952e0e6398795d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781215035",
            "to_ids": true,
            "type": "sha1",
            "uuid": "40d9dcfc-e7fa-40ea-a03e-d658b491cd0f",
            "value": "af7c73c47c62d70c546b62c8e1cc707841ec10e3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781215035",
            "to_ids": true,
            "type": "sha256",
            "uuid": "cf1de826-7e89-4250-8900-8eaf58b3c574",
            "value": "c3405d9c9d593d75d773c0615254e69d0362954384058ee970a3ec0944519c37",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781212969",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "2328b81c-ffa1-4547-8889-5c27a978d6e1",
            "value": "98304:gP9cgRyyVyGHAeBSut+aFNnLlPLeqNZ8hY/1KbxabdDk1duupRWQgWseI9eIfbkr:C9hlX+aFFLlPKQ8hY/DkWWst9e4ge+"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781212969",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3d4a1f35-5f0d-4d9c-98bf-b78a7c2cfedb",
            "value": "6221727"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781212969",
            "to_ids": true,
            "type": "vhash",
            "uuid": "70b123dd-fdaf-45bc-8717-4f5db3ff7026",
            "value": "066066656d1515156az5dvz17z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781212969",
            "to_ids": true,
            "type": "filename",
            "uuid": "8b90870d-ef52-4b8c-bdc7-afc7e929c1f8",
            "value": "secretsdump.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 12/06/2026\nLast-scan\t:  10/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781212969",
            "to_ids": false,
            "type": "text",
            "uuid": "34eff417-7779-4f95-8b4a-d72bbd8a42e2",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Skeeyah.B!rfn\nVT Total Detection:43/71\nFirst Submission:2018-07-29T16:56:37.000000+00:00\nLast Submission:2026-02-08T11:19:33.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781215368",
        "uuid": "1ddc2910-7032-47e5-b938-dd1455d2b1dd",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781215368",
            "to_ids": true,
            "type": "md5",
            "uuid": "657c727e-acdb-4e39-a009-b62ff813a2a3",
            "value": "6ca5c7421c246efeb938eb73d3a93dd0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781215036",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a020321e-ffb5-4fbf-83a8-c8ef740aca1a",
            "value": "a02f862bbb6ce85a25d09e9ccf2ed9fc85379432",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781215036",
            "to_ids": true,
            "type": "sha256",
            "uuid": "249d21ce-f93d-4924-9976-f47d11c21aec",
            "value": "1f385acf11f8ea6673d7295be6492ea9913b525da25dcc037ea49ef4f86a9d58",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781212991",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c4c1ad4b-2d0c-4ede-aa9c-4a3f8c1f1040",
            "value": "6144:Q52X9StKjjVYkDMTr/SMZd68ZXE0glnQa/8GVyx1DpAB0NEl/xVXKLh5B2u6UKFg:4EV9ufOlQa61FAXnY2phFxCOV1qvPIs"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781212991",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "07e1393b-27c4-4135-848f-ff90d828971f",
            "value": "615936"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781212991",
            "to_ids": true,
            "type": "vhash",
            "uuid": "6ba4bcac-8810-46ba-b48b-a2c5ae876c02",
            "value": "2650365515114082067410042b"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781212991",
            "to_ids": true,
            "type": "filename",
            "uuid": "f6062914-9dae-4714-bcdf-b5bcc1351c43",
            "value": "SharpDecryptPwd.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 12/06/2026\nLast-scan\t:  10/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781212991",
            "to_ids": false,
            "type": "text",
            "uuid": "ddffcd43-fbec-4027-8067-e5ddf9d9fd7f",
            "value": "Type Description: Win32 EXE\nMicrosoft: VirTool:MSIL/DarkStealer.A!MTB\nVT Total Detection:55/71\nFirst Submission:2020-05-06T08:05:10.000000+00:00\nLast Submission:2026-01-17T14:58:24.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781215390",
        "uuid": "81eafc7d-8bc7-4903-87d2-0f290e4dee20",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781215390",
            "to_ids": true,
            "type": "md5",
            "uuid": "8e98502e-ccdf-429b-80a7-43e818ac1b95",
            "value": "c44dd637c3f3dcf693140ffa2ed6d631",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781215037",
            "to_ids": true,
            "type": "sha1",
            "uuid": "292d0a2b-fff8-4565-bcb6-d9206e3079a3",
            "value": "88735301cfa7240b83bf279b5573598545e9f897",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781215037",
            "to_ids": true,
            "type": "sha256",
            "uuid": "86d71779-7fb3-435e-b4d5-dfd1806eaf80",
            "value": "2587217bc685527480c803ddf34a56ae9d9bf02681828a8a2081acc775312cf3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781213056",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "817a681b-bf84-4807-b3f4-a870d4c709b8",
            "value": "98304:ntiDgPrff7ibloevNWmX+Dq5BcfW8rgwqctHUEFNbjN8cKVApetkc:tiDuL2FSWAbOEHbjN8tVAQtk"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781213056",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "09b83e23-d120-4660-bd50-8c030e876f2d",
            "value": "12709376"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781213056",
            "to_ids": true,
            "type": "vhash",
            "uuid": "dcfd63e2-fe1d-4f00-910e-8a4248de45d2",
            "value": "017066656d6d15641az29!z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781213056",
            "to_ids": true,
            "type": "filename",
            "uuid": "97b73fa2-a93e-4553-bcf3-a24692ee57da",
            "value": "frpc.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 12/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781213056",
            "to_ids": false,
            "type": "text",
            "uuid": "ffefdd9f-f6f5-4739-8350-c91bbfffa78f",
            "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:Win32/NetTool!MSR\nVT Total Detection:36/71\nFirst Submission:2023-07-02T04:18:48.000000+00:00\nLast Submission:2025-05-09T17:51:41.000000+00:00"
          }
        ]
      }
    ]
  }
}