{
  "Event": {
    "analysis": "1",
    "date": "2026-06-08",
    "extends_uuid": "",
    "info": "[Threat Intel] Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency",
    "protected": false,
    "publish_timestamp": "1781329214",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1781329214",
    "uuid": "29bff44e-4d3a-406f-b82a-37294ad2fe5d",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#2d8ee7",
        "local": false,
        "name": "misp-galaxy:producer=\"Proofpoint\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#110e53",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#029dd6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Extensions - T1176\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#c84641",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"GUI Input Capture - T1056.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d37d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#865fd1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Credential Manager - T1555.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#98f3da",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#5884a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b8ab01",
        "local": false,
        "name": "misp-galaxy:target-information=\"United States\"",
        "relationship_type": ""
      },
      {
        "colour": "#b990dd",
        "local": false,
        "name": "misp-galaxy:target-information=\"Australia\"",
        "relationship_type": ""
      },
      {
        "colour": "#c94db5",
        "local": false,
        "name": "misp-galaxy:target-information=\"Brazil\"",
        "relationship_type": ""
      },
      {
        "colour": "#15ccfd",
        "local": false,
        "name": "misp-galaxy:target-information=\"France\"",
        "relationship_type": ""
      },
      {
        "colour": "#5ed128",
        "local": false,
        "name": "misp-galaxy:target-information=\"Germany\"",
        "relationship_type": ""
      },
      {
        "colour": "#013748",
        "local": false,
        "name": "misp-galaxy:target-information=\"India\"",
        "relationship_type": ""
      },
      {
        "colour": "#26fab6",
        "local": false,
        "name": "misp-galaxy:target-information=\"Israel\"",
        "relationship_type": ""
      },
      {
        "colour": "#5887a6",
        "local": false,
        "name": "misp-galaxy:target-information=\"Japan\"",
        "relationship_type": ""
      },
      {
        "colour": "#48df7e",
        "local": false,
        "name": "misp-galaxy:target-information=\"Netherlands\"",
        "relationship_type": ""
      },
      {
        "colour": "#3b9849",
        "local": false,
        "name": "misp-galaxy:target-information=\"Saudi Arabia\"",
        "relationship_type": ""
      },
      {
        "colour": "#f439e5",
        "local": false,
        "name": "misp-galaxy:target-information=\"Spain\"",
        "relationship_type": ""
      },
      {
        "colour": "#2613b0",
        "local": false,
        "name": "misp-galaxy:target-information=\"Taiwan\"",
        "relationship_type": ""
      },
      {
        "colour": "#ce59f1",
        "local": false,
        "name": "misp-galaxy:target-information=\"United Kingdom\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#1a0065",
        "local": false,
        "name": "rectifyq:topic=\"crypto-related\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781002810",
        "to_ids": false,
        "type": "link",
        "uuid": "a0b6d750-b15e-4b0f-9777-fc2d4b19f756",
        "value": "https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781002810",
        "to_ids": false,
        "type": "text",
        "uuid": "41e786b4-2763-472b-aa23-f741bd9f3f49",
        "value": "Between April and May 2026, a likely North Korean threat actor conducted phishing campaigns targeting developers across nearly 100 organizations in finance, cryptocurrency, education, and technology sectors. The attacks used recruitment and code review themes, delivering emails with links to actor-controlled GitHub repositories hosting malicious scripts. The infection chain exploited Visual Studio Code workflows and deployed malicious Visual Studio Extensions (VSIX) requiring minimal user interaction. Cross-platform malware was executed on macOS, Linux, and Windows systems, including the open-source Overlord framework. The campaigns specifically targeted developer assets including API tokens, cryptocurrency wallets, and credentials. Attackers employed fake company personas and professional-looking repositories masquerading as legitimate cryptocurrency and blockchain projects to establish credibility and lure victims."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781002810",
        "to_ids": false,
        "type": "text",
        "uuid": "1354aeb2-9b48-4245-9110-d728829b1892",
        "value": "Name: Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency\nAuthor: AlienVault\nAdversary: UNK_DeadDrop\nTags: [\"wallet exfiltration\", \"ottercookie\", \"cryptocurrency theft\", \"north korea\", \"flexibleferret\", \"invisible ferret\", \"vsix extensions\", \"overlord\", \"github repositories\", \"unk_deaddrop\", \"developer targeting\", \"credential theft\", \"visual studio code\", \"overlord framework\"]\nTgtd countries: [\"United States of America\"]\nMlwr families: [\"Overlord\", \"OtterCookie\", \"Invisible Ferret\", \"FlexibleFerret\"]\nAttack_ids: [\"T1539\", \"T1071.004\", \"T1566.002\", \"T1082\", \"T1176\", \"T1005\", \"T1140\", \"T1555.003\", \"T1552.001\", \"T1041\", \"T1059.001\", \"T1547.001\", \"T1056.002\", \"T1027\", \"T1059.006\", \"T1555.004\", \"T1070.004\", \"T1071.001\", \"T1059.005\", \"T1204.001\"]\nIndustries: [\"Finance\", \"Technology\", \"Education\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316370",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "7d2c8668-5c36-4ffd-873f-c17ad96e909a",
        "value": "UNK_DeadDrop",
        "Tag": [
          {
            "colour": "#2d8ee7",
            "local": false,
            "name": "misp-galaxy:producer=\"Proofpoint\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"north korea\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325185",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "bd85c8ef-7fc9-4997-bc43-b33a97dc807f",
        "value": "23.137.105.75",
        "Tag": [
          {
            "colour": "#182065",
            "local": false,
            "name": "asn:asn=\"22295\"",
            "relationship_type": ""
          },
          {
            "colour": "#301d1e",
            "local": false,
            "name": "asn:as-owner=\"ADVIN\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323474",
        "to_ids": true,
        "type": "sha256",
        "uuid": "d76e9416-5387-4e2f-bbb9-418a2ddff04d",
        "value": "4f7a8c3d2e1b5f9071a6b2c8d4e3f50a92b1c7d6e8f4a30b5c2d9e1f7a6b8c4d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325206",
        "to_ids": true,
        "type": "domain",
        "uuid": "9947526d-29a7-436a-aa0f-ae3272bc41ce",
        "value": "alphanonega.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325227",
        "to_ids": true,
        "type": "domain",
        "uuid": "ac968943-f1bf-4d54-a172-d099cc46577e",
        "value": "asteara.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325248",
        "to_ids": true,
        "type": "domain",
        "uuid": "4d8854f9-c7ba-49c8-9170-09508155a2dc",
        "value": "careerpredictto.space",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325270",
        "to_ids": true,
        "type": "domain",
        "uuid": "bdb169c8-be6c-4e4d-959d-3c8276148af6",
        "value": "careerpulsynk.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325292",
        "to_ids": true,
        "type": "domain",
        "uuid": "352fbd0f-47d1-4dd1-abcc-d06374045849",
        "value": "careertrixauvex.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325313",
        "to_ids": true,
        "type": "domain",
        "uuid": "e3403ad0-ee53-4b41-a0de-60cf90a3c3fd",
        "value": "ceronet.work",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325335",
        "to_ids": true,
        "type": "domain",
        "uuid": "a6f77aaf-1a4c-4d0a-abfa-bf985dfa8522",
        "value": "ceronetwork.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325356",
        "to_ids": true,
        "type": "domain",
        "uuid": "1b7d82d0-3770-4dfc-a7f0-120cedb05103",
        "value": "connectptogether.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325377",
        "to_ids": true,
        "type": "domain",
        "uuid": "07ecf3aa-237b-43e3-b187-342824fa3ae0",
        "value": "contactpredicttogether.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325399",
        "to_ids": true,
        "type": "domain",
        "uuid": "3b487f18-cc80-4c4e-bf8c-8515d6d2e6d0",
        "value": "contactpulsynk.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325420",
        "to_ids": true,
        "type": "domain",
        "uuid": "dbdfebd4-d28d-4bf7-aa39-01b8c6c2f8e6",
        "value": "contacttrixauvex.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325441",
        "to_ids": true,
        "type": "domain",
        "uuid": "96e4c577-59d2-4554-a7c6-406928398647",
        "value": "coslyintra.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325463",
        "to_ids": true,
        "type": "domain",
        "uuid": "6f8979c0-81a3-4582-9c6a-7364a85c9448",
        "value": "cotrixauvex.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325484",
        "to_ids": true,
        "type": "domain",
        "uuid": "0b445eb9-6753-493f-acec-3fff91463d46",
        "value": "culyrax.us",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325505",
        "to_ids": true,
        "type": "domain",
        "uuid": "b7211ed7-96d3-4328-b0fd-b896a28d9aed",
        "value": "deep-ai-guard.store",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325526",
        "to_ids": true,
        "type": "domain",
        "uuid": "a5fb4c3d-45de-4d01-bac3-1a87b2447754",
        "value": "domatisc.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325547",
        "to_ids": true,
        "type": "domain",
        "uuid": "5fec8d18-0b84-471e-aa30-3a40185507d6",
        "value": "doxxela.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325568",
        "to_ids": true,
        "type": "domain",
        "uuid": "2d51d89f-7087-4dde-b856-e5ba9b733bbb",
        "value": "elsavora.us",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325589",
        "to_ids": true,
        "type": "domain",
        "uuid": "8b8ef5a3-44f8-4069-bd9c-cec1de83b656",
        "value": "empowerpharmacy.space",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325611",
        "to_ids": true,
        "type": "domain",
        "uuid": "8e5cabf6-1085-4d99-8acd-a2ad1c21cb4f",
        "value": "hyperdevpipline.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325632",
        "to_ids": true,
        "type": "domain",
        "uuid": "1fd0c3e2-6661-485b-ad07-9e0518c11b11",
        "value": "mailpredicttogether.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325653",
        "to_ids": true,
        "type": "domain",
        "uuid": "43a975d3-2c85-4997-9b93-109a67b35105",
        "value": "mailpulsynk.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325674",
        "to_ids": true,
        "type": "domain",
        "uuid": "c323ab9c-a129-41d5-9b48-07edf3d85a3a",
        "value": "mailtrixauvex.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325695",
        "to_ids": true,
        "type": "domain",
        "uuid": "b2e723b0-a0ed-4bb8-8384-9d450434b5b1",
        "value": "migadyn.info",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325718",
        "to_ids": true,
        "type": "domain",
        "uuid": "5230dbe2-2473-40f8-ba6d-ef6616aca6fb",
        "value": "nemesis.work",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325739",
        "to_ids": true,
        "type": "domain",
        "uuid": "e304fa64-ff88-4f81-838c-be640ce4fe01",
        "value": "nemesistrade.work",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325760",
        "to_ids": true,
        "type": "domain",
        "uuid": "f9e2308e-6a02-45fa-9c62-2ec6bfe99432",
        "value": "notifypulsynk.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325782",
        "to_ids": true,
        "type": "domain",
        "uuid": "80f683ae-95ad-452c-90cb-3601b08162d9",
        "value": "nowurisch.fit",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325803",
        "to_ids": true,
        "type": "domain",
        "uuid": "9d9725e8-a7ab-4acb-911b-98d2c8f19286",
        "value": "nxlog.tech",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325824",
        "to_ids": true,
        "type": "domain",
        "uuid": "e6bb018a-dd00-4866-85a4-bc137ecb0b30",
        "value": "ondofinance.tech",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325845",
        "to_ids": true,
        "type": "domain",
        "uuid": "ebb5a2ac-735e-48ce-895e-4ac98f07ab10",
        "value": "onoplainai.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325866",
        "to_ids": true,
        "type": "domain",
        "uuid": "4aff9332-a9c6-47f6-a071-3cd13b9dab9d",
        "value": "onoplanoai.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325887",
        "to_ids": true,
        "type": "domain",
        "uuid": "9998e588-866d-4d72-bfb5-97fe5ba951a2",
        "value": "optixauvex.us",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325909",
        "to_ids": true,
        "type": "domain",
        "uuid": "b0014735-b55e-43ce-8503-6206caecf6d7",
        "value": "predictcareertogether.space",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325930",
        "to_ids": true,
        "type": "domain",
        "uuid": "cbca5965-27f2-4de8-99f1-5479bd889ce0",
        "value": "predicttocareer.space",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325951",
        "to_ids": true,
        "type": "domain",
        "uuid": "f2539512-08e6-4af3-b57e-633e34433082",
        "value": "predicttogerecruit.store",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325972",
        "to_ids": true,
        "type": "domain",
        "uuid": "e9861451-b3fd-4722-b0a4-54ed7f2b25b4",
        "value": "predicttogether.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781325993",
        "to_ids": true,
        "type": "domain",
        "uuid": "662bde61-5ee7-4568-999a-15570e00edaa",
        "value": "predicttogetherrecruit.store",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326015",
        "to_ids": true,
        "type": "domain",
        "uuid": "ec44073c-875c-4a97-9a68-239fc2497ee8",
        "value": "pulsnyk.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326036",
        "to_ids": true,
        "type": "domain",
        "uuid": "efea234d-c17e-4eba-b5cd-12f312ee8567",
        "value": "pulsynk.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326057",
        "to_ids": true,
        "type": "domain",
        "uuid": "989ff167-f8f6-4827-aadc-b7acaf741356",
        "value": "raxvatange.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326083",
        "to_ids": true,
        "type": "domain",
        "uuid": "f154a647-81af-410c-82f1-e6e81de76126",
        "value": "recruitptogether.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326105",
        "to_ids": true,
        "type": "domain",
        "uuid": "5b018637-3090-4198-bdcf-32afd086356f",
        "value": "recruitvex.us",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326126",
        "to_ids": true,
        "type": "domain",
        "uuid": "544975f8-b732-4d92-9caf-f3b7d65ff2b1",
        "value": "talentnexhr.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326147",
        "to_ids": true,
        "type": "domain",
        "uuid": "be2d3bca-bb50-426b-8475-3184142f0f88",
        "value": "teampulsynk.team",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326168",
        "to_ids": true,
        "type": "domain",
        "uuid": "ccf6acbc-62c0-49d4-b26c-ba4554c7cb51",
        "value": "togetherhire.fun",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326189",
        "to_ids": true,
        "type": "domain",
        "uuid": "35ce8d0b-0c5f-406c-9663-02129004adb1",
        "value": "trixauvex.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326210",
        "to_ids": true,
        "type": "domain",
        "uuid": "a3ae9a41-0fc5-42f9-91a0-2dc2e6778317",
        "value": "trixauvexnet.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326232",
        "to_ids": true,
        "type": "domain",
        "uuid": "f3b1eb3d-bea6-4ef3-85fb-02c021724428",
        "value": "valorecuiting.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326254",
        "to_ids": true,
        "type": "hostname",
        "uuid": "39345290-dbb4-4407-9b01-5587ee40cc3a",
        "value": "hr.onoplanoai.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326275",
        "to_ids": true,
        "type": "hostname",
        "uuid": "632dc4b7-b068-4f70-a6e8-28c98b191816",
        "value": "hr.predicttocareer.space",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326296",
        "to_ids": true,
        "type": "hostname",
        "uuid": "6d805a57-f52c-437b-99a7-7747ea798789",
        "value": "hr.trixauvex.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326318",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8256eaee-2729-4187-b9bf-30b4c504688f",
        "value": "hr.mailpulsynk.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326339",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5ee4dc82-884c-48f9-94d3-6be7a38c743d",
        "value": "hr.pulsynk.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326361",
        "to_ids": true,
        "type": "hostname",
        "uuid": "af0501d6-4952-412a-bd48-9808e45c7ff6",
        "value": "hr.recruitvex.us",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326382",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9e7e48b6-95f1-4271-8755-56c8b6799d79",
        "value": "hr.mailtrixauvex.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326403",
        "to_ids": true,
        "type": "hostname",
        "uuid": "aa209bef-5466-4e80-80d1-67726e674dfc",
        "value": "hr.trixauvexnet.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326424",
        "to_ids": true,
        "type": "hostname",
        "uuid": "72841c41-0b85-4589-89fe-5dff52beee98",
        "value": "hr.contacttrixauvex.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326445",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e810c89a-08e7-4723-bd27-a6995e3732f1",
        "value": "hr.mailpredicttogether.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "79ded2af-8c40-4dec-a57f-3a55a86045ef",
        "value": "alex@contacttrixauvex.ink"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "39aed538-6bf9-43ac-947c-02d65a750e12",
        "value": "alex@mailpredicttogether.ink"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "3f1454c7-d505-40dd-ba5c-7892f9acf106",
        "value": "alex@predicttocareer.space"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "46c73832-dff5-4100-b20a-6dbe3bd74247",
        "value": "alex@pulsynk.org"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "e951bfc8-16a6-485a-9be8-4763926a5345",
        "value": "alex@trixauvexnet.ink"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "2509c4a1-82c7-4bc0-9710-0a8678eadd47",
        "value": "alexsnow@hr.predicttocareer.space"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "6476e88b-78b0-4c3b-9a70-9c47f4d0056b",
        "value": "alexstone@hr.trixauvex.org"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "4989b097-7a03-471e-bb56-6c8b9b7fb643",
        "value": "carissae@hr.mailpulsynk.xyz"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "86b3ef25-1064-4416-bfa7-2ee2d72e352e",
        "value": "christopher@hr.trixauvex.org"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "d6a8f5df-c249-46f1-9633-981ffc56e454",
        "value": "chrisyan@hr.pulsynk.org"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "48297f39-00d8-4ce4-b8ae-9416f55f47cb",
        "value": "emmaparker@hr.recruitvex.us"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "2317a857-c088-4bbe-bfba-7814a73a3e99",
        "value": "faithtedesco@hr.mailtrixauvex.ink"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "c98ef856-ee61-4e00-bcfa-fd2dc6b1ed56",
        "value": "frankbloch@hr.trixauvex.org"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "a4edfab2-6a27-43c6-bc61-493be0fa7883",
        "value": "jamesrock@hr.trixauvexnet.ink"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "6f9feb67-987b-42c7-858a-ca6517fe880b",
        "value": "jamierain@hr.contacttrixauvex.ink"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "07475af4-e09e-4cad-9e8b-d4c7720169f9",
        "value": "jamierain@hr.onoplanoai.ink"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "8117c1eb-cbb7-4c80-bf53-aa8414699c5c",
        "value": "jamiereed@hr.mailpredicttogether.ink"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "c7748ab7-49c9-4a2a-bb77-e9fea1227ce9",
        "value": "jamiereed@hr.predicttocareer.space"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "0a9ab105-c069-4911-b23c-0365153faec0",
        "value": "joshn@hr.recruitvex.us"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "c5936836-b739-4569-bdb2-c72fe0b3ce97",
        "value": "justinstone@hr.trixauvex.org"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "f1f9e112-9f09-4bdd-8388-1d9a6874d0c4",
        "value": "nicoupdyke@hr.trixauvexnet.ink"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "7a3a5e10-21b6-4f06-8120-b3267cb51e69",
        "value": "oliviaben@hr.pulsynk.org"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "64d081a9-ce4c-4345-a3d1-4a821ae36862",
        "value": "sam@hr.pulsynk.org"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "f5dc04a6-9c42-433b-8d65-5ab134ed3f29",
        "value": "samalt@hr.contacttrixauvex.ink"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "93d937f5-124b-41f5-a02f-5fe25a7a78a1",
        "value": "samalt@hr.onoplanoai.ink"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "0110857b-5a10-46fa-8533-8ef5a1ebad54",
        "value": "samalt@hr.predicttocareer.space"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "59f9b9eb-70bd-4e54-b6b0-cd71091f4ca4",
        "value": "shelbysturm@hr.mailtrixauvex.ink"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "57548e8f-178d-45b7-a36f-2ff1a1bd8504",
        "value": "sophiareed@hr.contacttrixauvex.ink"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316603",
        "to_ids": true,
        "type": "email-src",
        "uuid": "41ede3bf-d31e-4c07-85d0-35cea68cb173",
        "value": "sophiareed@hr.onoplanoai.ink"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316604",
        "to_ids": true,
        "type": "email-src",
        "uuid": "26d57a07-7046-4e29-9b8d-38326d4e75ec",
        "value": "dalbir@empowerpharmacy.space"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316604",
        "to_ids": true,
        "type": "email-src",
        "uuid": "c20fc55d-cd06-42ed-81ce-3b31e6502204",
        "value": "dianaberendi@nxlog.tech"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316604",
        "to_ids": true,
        "type": "email-src",
        "uuid": "2ed11dbe-6eab-4fdf-98cb-debdbaa1a90f",
        "value": "gusb@ondofinance.tech"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316604",
        "to_ids": true,
        "type": "email-src",
        "uuid": "9832ffb6-f377-40e2-8581-255656d19aa5",
        "value": "jasen@empowerpharmacy.space"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316604",
        "to_ids": true,
        "type": "email-src",
        "uuid": "66f4afff-f3d4-43b1-8c01-488339144645",
        "value": "joshc@ondofinance.tech"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316604",
        "to_ids": true,
        "type": "email-src",
        "uuid": "f761ab9e-5238-4d75-8a6a-39c98ce76db0",
        "value": "jovanav@nxlog.tech"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316604",
        "to_ids": true,
        "type": "email-src",
        "uuid": "12f43a64-9440-4318-bf68-f192744deb16",
        "value": "michaelw@ondofinance.tech"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316604",
        "to_ids": true,
        "type": "email-src",
        "uuid": "2277fb20-926e-45f4-b80a-942184017200",
        "value": "neila@ondofinance.tech"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316604",
        "to_ids": true,
        "type": "email-src",
        "uuid": "1f17471b-a71f-4f49-9594-71340884132c",
        "value": "oladotuna@ondofinance.tech"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316604",
        "to_ids": true,
        "type": "email-src",
        "uuid": "5cb159d6-8a83-4bcf-b0ce-dee36dfbbc9c",
        "value": "sarikasinha@nxlog.tech"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316604",
        "to_ids": true,
        "type": "email-src",
        "uuid": "14c408fa-5e00-459a-b7bc-9a54ffa110e5",
        "value": "sladjanas@nxlog.tech"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316604",
        "to_ids": true,
        "type": "email-src",
        "uuid": "77de6a65-754d-4bba-a0af-3e59f0b96388",
        "value": "valerie@empowerpharmacy.space"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781316604",
        "to_ids": true,
        "type": "email-src",
        "uuid": "10376f48-1b9b-4e61-98e5-d563ba6c86eb",
        "value": "vanjamirkovic@nxlog.tech"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326468",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8040b214-b27d-44e7-a8b1-91d0928417c8",
        "value": "170.205.29.83",
        "Tag": [
          {
            "colour": "#2e074d",
            "local": false,
            "name": "asn:asn=\"206216\"",
            "relationship_type": ""
          },
          {
            "colour": "#1ba34e",
            "local": false,
            "name": "asn:as-owner=\"ADVIN-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326489",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7b030553-f94a-494a-b3b1-c53c14457844",
        "value": "170.205.30.227",
        "Tag": [
          {
            "colour": "#2e074d",
            "local": false,
            "name": "asn:asn=\"206216\"",
            "relationship_type": ""
          },
          {
            "colour": "#1ba34e",
            "local": false,
            "name": "asn:as-owner=\"ADVIN-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326511",
        "to_ids": true,
        "type": "url",
        "uuid": "1921a132-34ff-44a1-89a7-cf8cb8afe9f2",
        "value": "https://github.com/Pulsynk/pulsynk",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326532",
        "to_ids": true,
        "type": "url",
        "uuid": "5f90ca0f-c396-43a5-8a26-472b43cd8c8e",
        "value": "https://github.com/Trixauvex-org/trixauvex",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326553",
        "to_ids": true,
        "type": "url",
        "uuid": "8229ddc7-ef21-4d37-838d-05084c47375c",
        "value": "https://github.com/PedrinPY/rekt-db",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326575",
        "to_ids": true,
        "type": "url",
        "uuid": "0d754129-df71-446d-b6ee-3c51d3593bc4",
        "value": "https://github.com/sr-werney/forge-4626invariants",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326596",
        "to_ids": true,
        "type": "url",
        "uuid": "caa40c42-26ae-4a39-90ac-1d255e9541b1",
        "value": "https://github.com/wayout4u/rekt-db",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326619",
        "to_ids": true,
        "type": "url",
        "uuid": "0582133b-cafb-4648-ba72-7874aac0268f",
        "value": "https://github.com/ziobiri/forge-4626-invariants",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326640",
        "to_ids": true,
        "type": "url",
        "uuid": "387fba6e-fff9-45ca-9c07-3fc5649aa1c4",
        "value": "https://github.com/skyjum/x402-kit",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326661",
        "to_ids": true,
        "type": "url",
        "uuid": "b9347253-7ae4-4da0-a1b5-a4291bcfeb68",
        "value": "https://github.com/Stomp47/rekt-db",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326683",
        "to_ids": true,
        "type": "url",
        "uuid": "81f7b5e6-565d-40ab-877d-98512966e1dc",
        "value": "https://github.com/mireles343/forge-4626invariants",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326704",
        "to_ids": true,
        "type": "url",
        "uuid": "5205410e-146d-431f-8d86-6408deac0269",
        "value": "https://gitlab.com/pulsynk-org/rekt-db.git",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326727",
        "to_ids": true,
        "type": "url",
        "uuid": "ce76ef19-aa8a-4303-9465-ca207db620b0",
        "value": "https://gitlab.com/trixauvex-org/x402-kit.git",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326749",
        "to_ids": true,
        "type": "url",
        "uuid": "ca8046a0-808f-4604-9ce5-d8dba03a5bf7",
        "value": "https://gitlab.com/predict-together/forge-4626invariants.git",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781326771",
        "to_ids": true,
        "type": "url",
        "uuid": "7c212f14-7531-43b1-83f9-2d4c2ceca0b3",
        "value": "https://github.com/rkama411/x402-kit",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781326792",
        "uuid": "b5db5e40-24ee-45f8-9ef6-38a1fc1689a4",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781326792",
            "to_ids": true,
            "type": "md5",
            "uuid": "a82db2eb-b6a4-4ad8-a50b-2c827f345199",
            "value": "098222fb51cb20fb785949001eef306e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323446",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d9f17c19-c1d0-4073-ae46-711bae18b81c",
            "value": "d1191719b9b2ed3dfc71fb247da6f6bae5c3ca99",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323446",
            "to_ids": true,
            "type": "sha256",
            "uuid": "efec4b02-89de-4055-86ab-e1b9cdf2f99c",
            "value": "2812e0847d472cb8870c94f463331dbe53b84135132b9bf5f6d84c2382be628f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319290",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "099a71f0-f744-42dc-a1ce-516d47068d0e",
            "value": "1536:/7BJehzZAf2K/9njE/1fuXbo0cLWvy9rV9nNvoN:/9JK+9g/4U0cLWK/vK"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319290",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6a07b167-d7cd-488d-b83a-ef2cf7b8c291",
            "value": "60082"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319290",
            "to_ids": true,
            "type": "filename",
            "uuid": "2a2a1726-98b1-42f1-bf87-724b00444ac1",
            "value": "detect_malware.py.enc"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  13/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319290",
            "to_ids": false,
            "type": "text",
            "uuid": "34cc7888-2b3b-4d11-aabd-e0f516581682",
            "value": "Type Description: unknown\nMicrosoft: None\nVT Total Detection:1/62\nFirst Submission:2026-06-08T10:06:35.000000+00:00\nLast Submission:2026-06-08T10:06:35.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781326813",
        "uuid": "34f05fb7-665a-4f80-bdf6-d8c2dae82be8",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781326813",
            "to_ids": true,
            "type": "md5",
            "uuid": "27883927-29bf-4637-a69c-5a66a45f7c54",
            "value": "673c62aa3715ab32a789aeb7400aabf1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323447",
            "to_ids": true,
            "type": "sha1",
            "uuid": "3100e8ba-e521-4403-902b-5a5c6364a0be",
            "value": "09b02fd441143ffb108a244bd231b95fca09c320",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323447",
            "to_ids": true,
            "type": "sha256",
            "uuid": "85c5a132-d6d7-4410-9745-298b334f9510",
            "value": "339907b44f161f57ff30819f422c552382ff437b3ae437463b4222cfe86bd943",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319312",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4dac45e3-1c28-4440-887e-bc371e0d3ff3",
            "value": "98304:8fbYlOJpfiuTehuzO1Wd529l5OtKUOc/ud1GNty7yK8piFKMzxYsd2MQpZcK2lHM:8fa8ZTI1A296tP21wdfEhy5F"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319312",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d0de6ad2-7c12-4b4d-abe4-f4c271d57317",
            "value": "13304624"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781319312",
            "to_ids": true,
            "type": "vhash",
            "uuid": "808a0ef2-e464-456b-845e-5911a0a5c004",
            "value": "e6d10b74b15ce66b28eda36d6f923bde"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319312",
            "to_ids": true,
            "type": "filename",
            "uuid": "26a37936-20d9-4d27-85b8-fd07bec15856",
            "value": "google-update-support-darwin-arm64-55554944982e7cbf36bd3f1ff92f147ff4de961a"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  13/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319312",
            "to_ids": false,
            "type": "text",
            "uuid": "3249a20f-a17c-451f-b18f-5291d490352c",
            "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Overlord!AMTB\nVT Total Detection:20/63\nFirst Submission:2026-06-08T10:04:28.000000+00:00\nLast Submission:2026-06-08T10:04:28.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781326834",
        "uuid": "30c634d2-6edb-4a12-950e-f0248f00710c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781326834",
            "to_ids": true,
            "type": "md5",
            "uuid": "cc8d0d85-5b11-49a4-90ec-51bd28b0200e",
            "value": "f455994f54b3454df3ac73647f249c91",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323449",
            "to_ids": true,
            "type": "sha1",
            "uuid": "9fe0a4ae-01b0-4444-ba4e-e462bf87084e",
            "value": "7c3c36cf4e5af1f569fc32601959057924498dc4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323449",
            "to_ids": true,
            "type": "sha256",
            "uuid": "765d8b42-67da-4a71-9c8e-04b09460ec17",
            "value": "35813f4401d3ad77b618275473a556eb47bfa6f4b7439dd8943b19f81aa7252e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319334",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ffd27f85-73ac-4a73-94a4-5ab2e30f90cf",
            "value": "12:Zj5vq2eVGSHRhH7G0HKQvGIFG/HBf2CbN:Zj5C2e7xhHkH4CR"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319334",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e6a09adb-809a-44c5-b9bb-bf01095cbb54",
            "value": "458"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319334",
            "to_ids": true,
            "type": "filename",
            "uuid": "bd2f12ad-31a4-4fa1-8fff-5312204cd104",
            "value": "settings.json"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  13/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319334",
            "to_ids": false,
            "type": "text",
            "uuid": "803aa8f8-d95c-4d42-bf97-47e44fc84459",
            "value": "Type Description: JSON\nMicrosoft: None\nVT Total Detection:1/61\nFirst Submission:2026-06-08T10:07:54.000000+00:00\nLast Submission:2026-06-08T10:07:54.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781326856",
        "uuid": "1621c758-0580-41d6-9a8d-c517093f8d03",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781326856",
            "to_ids": true,
            "type": "md5",
            "uuid": "31072321-cc0d-470e-b1a9-a7271b26b173",
            "value": "70280fd83204611bb107e14cd5e307fc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323450",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4698ca07-7a97-4e8f-8147-e4fc840d3a05",
            "value": "1e8b71cc1d5faedd4243ac9e5e6404544a478df2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323450",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f3be62d7-6020-4f18-915d-182a208fb00f",
            "value": "4c0d9b802c075be79e9edb52d88f8dd72e6904f5c58267213745818470945c78",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319356",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6a183b57-2d1c-4b66-87f8-d1a4074e8a62",
            "value": "24:Z32sLBsrpTMm0i3bK9oWv/5mHpj6C91mWB8MTINBN6MghPkyFjfY:ZDLapD3bioWvkaF39ghPK"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319356",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "5330afea-5321-4711-8e17-2412f2404578",
            "value": "1464"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781319356",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c5558ff3-ce82-4977-839d-c04ab2def0fd",
            "value": "f92ab7a1b125fbded1d7e1dbada0c561"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319356",
            "to_ids": true,
            "type": "filename",
            "uuid": "b6fdbb41-a325-4e9d-9505-09b49e17c97e",
            "value": "run-update-hidden-launch.vbs"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319356",
            "to_ids": false,
            "type": "text",
            "uuid": "e42b216b-0c00-400b-be16-56601483bdf4",
            "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:5/61\nFirst Submission:2026-06-08T10:07:45.000000+00:00\nLast Submission:2026-06-08T10:07:45.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781326877",
        "uuid": "4be79572-64c6-44f9-98a1-6c719b4d47f0",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781326877",
            "to_ids": true,
            "type": "md5",
            "uuid": "81d62975-57a2-4d35-b446-2d23e9e41215",
            "value": "96e1760ecc7e03a2cafa5750dd5ef3fa",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323451",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4e099ec1-7c37-4825-9ad0-3581d88c1e41",
            "value": "5eb20610eda3e6300b8758b638fce9e8c12da279",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323451",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c5ced108-a1d1-49de-95c6-b97e69452f63",
            "value": "52886aab179f26421678ff23af1b0fabf0a17ffbb534369cdbbac8008cbed8e7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319399",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "21322b8c-8c1b-433f-85be-222c7be5df2e",
            "value": "393216:dWT6tB/FboEZqfO/nzXXnu2W5yeF5KBkBlEi2cG6R4nI+iSO3obMgpnsN9:k2tB/FUEZz/ix7ak4W40SOYYgpsv"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319399",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "bdbe2b91-784c-487b-9c65-ffcaa0d3bb0a",
            "value": "17647582"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781319399",
            "to_ids": true,
            "type": "vhash",
            "uuid": "e529bd86-4882-47f6-902a-f9e399429b7f",
            "value": "621092287254300010ad4d456d3743da"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319399",
            "to_ids": true,
            "type": "filename",
            "uuid": "af4ecc9c-3885-4dd5-bfc9-57b3ffe8db04",
            "value": "google-update-support.vsix"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  12/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319399",
            "to_ids": false,
            "type": "text",
            "uuid": "5e9f040e-0a6b-4a57-a3d7-3a20bf236b10",
            "value": "Type Description: ZIP\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:23/66\nFirst Submission:2026-06-08T10:07:00.000000+00:00\nLast Submission:2026-06-10T12:55:06.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781326898",
        "uuid": "c6e07c7c-7f00-4444-b547-5735957d27d2",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781326898",
            "to_ids": true,
            "type": "md5",
            "uuid": "9740e58f-b2f4-4853-9af1-826e512cb1d9",
            "value": "34820759e0f4a6ddaf59a636dd31a74d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323452",
            "to_ids": true,
            "type": "sha1",
            "uuid": "78ada1fb-aa46-4662-bf4b-ab5b2868126c",
            "value": "3327f019904b0e4ca05800bfaa6e93716b69896c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323452",
            "to_ids": true,
            "type": "sha256",
            "uuid": "89463ed9-fd41-4be6-b18f-2baeae8334a2",
            "value": "62761f38ed194c59abe15c49f09f0ebc431ac852c965180c9327ed84d3a454fb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319420",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "980061c8-2248-45d5-9b2f-97507546cebe",
            "value": "384:rouV5l2V8eZIuLefZNq8Se5aAWS6ACTK6zOJQPcX2cEpdhhTmQUl6kUqgwSizEWO:PlKL6qu5TWl5ZHufgwdXjq5"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319420",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "8f25406b-8df2-4bea-8007-82651c6fa10f",
            "value": "23356"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319420",
            "to_ids": true,
            "type": "filename",
            "uuid": "82d64d7f-92c1-40a8-bfc1-86a916f8b7af",
            "value": "run-update.cmd"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  13/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319420",
            "to_ids": false,
            "type": "text",
            "uuid": "1f7e04c8-ccef-4df3-ad9e-202d4ffda64d",
            "value": "Type Description: DOS batch file\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:24/61\nFirst Submission:2026-06-08T10:07:27.000000+00:00\nLast Submission:2026-06-08T10:07:27.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781326919",
        "uuid": "72947437-fe47-498d-b8fb-83e9dbe5d6ac",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781326919",
            "to_ids": true,
            "type": "md5",
            "uuid": "53320829-da00-4bed-8fda-d6a8e6d5d452",
            "value": "5e20e4e369109ebfd2a2fdea14f43b1d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323453",
            "to_ids": true,
            "type": "sha1",
            "uuid": "c6efbea3-cbb7-43e1-9b74-0ac61aed73f1",
            "value": "7dcb2c499838755e0c7474db28d8f1fd732b28d1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323453",
            "to_ids": true,
            "type": "sha256",
            "uuid": "52c641ce-ca7e-49b8-b40a-6c5f408c73c8",
            "value": "6cf9f7b2aa456a0b438600588df869b38d8007e28f01fa96022f9d8059f120b0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319443",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9756e86a-b296-4355-80a5-d02aa95f9e83",
            "value": "768:YZ+VZAvRTDjX0GsODtIi4mN3uImflE524szqN3ge:imgDkLyn4mLQlE5QAd"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319443",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "17134ab2-b982-4527-b5ef-70eb14047c8e",
            "value": "32352"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319443",
            "to_ids": true,
            "type": "filename",
            "uuid": "219d1661-0e0b-4e85-b281-1f586557e7a2",
            "value": "windows-js-pipeline.js.enc"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  13/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319443",
            "to_ids": false,
            "type": "text",
            "uuid": "cc5748c4-53ea-4aef-8b1b-186a663ff47f",
            "value": "Type Description: unknown\nMicrosoft: None\nVT Total Detection:1/61\nFirst Submission:2026-06-08T10:08:15.000000+00:00\nLast Submission:2026-06-08T10:08:15.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781326940",
        "uuid": "b81dff3c-e301-489d-b418-9abe17a9eae0",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781326940",
            "to_ids": true,
            "type": "md5",
            "uuid": "9ed94181-60e4-4a34-99c0-ea7542b02238",
            "value": "cdf75e09646eb558606241d8d2530c27",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323454",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4814fef8-7812-457c-b8c3-5edb65be5ed6",
            "value": "70d966408b970f537a072ba2188e434c2174ca0b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323454",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c79e415c-949f-4904-8e59-f9f276c054e6",
            "value": "734699773e53d995f20d485eb61261033d9d00b4332b39ca26071bcd60cd352f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319465",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "07ab6036-9f55-4ad8-a3ac-2fcae02db731",
            "value": "384:I1uZqC7E/uIUC4PzjcQKHwvtV+GMA9lxz:INvuIUZPzjRKQ5lxz"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319465",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "30115654-4149-40e5-ad5c-c959078dec68",
            "value": "25357"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319465",
            "to_ids": true,
            "type": "filename",
            "uuid": "cece189f-97d6-43a9-a914-d9abab12cfc3",
            "value": "run-update.sh"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  12/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319465",
            "to_ids": false,
            "type": "text",
            "uuid": "14129958-59ec-4cb7-9f0d-a959d851c1f2",
            "value": "Type Description: Shell script\nMicrosoft: None\nVT Total Detection:1/61\nFirst Submission:2026-06-08T10:07:37.000000+00:00\nLast Submission:2026-06-08T10:07:37.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781326961",
        "uuid": "3da8edfc-d20e-4efd-9536-2d23f401ead0",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781326961",
            "to_ids": true,
            "type": "md5",
            "uuid": "b2c1bb13-dfa3-4623-867e-228159886ff4",
            "value": "09f9788e9cbdd3c1afba9adf01608b40",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323455",
            "to_ids": true,
            "type": "sha1",
            "uuid": "2bbb61e0-3b1f-448a-88ef-7ee07b6db2d3",
            "value": "d8849b95c64df7e807583e23fa0505cf870004d6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323455",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c8cf3595-63c0-4c10-9c52-09f694cf51f4",
            "value": "808e7154b7af2bc7a4b28d577297c55f77221c355191cbe00f9f1810b6d4a619",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319487",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "1ad00357-7b54-4909-9dee-555666946478",
            "value": "1536:ke0ZuZKn5e/bjsLRL5kYuWtTrjjaKUqgfwUOka+GRsLCZNssRCumjd:kZu0e/b4tL+YuW3C2ZOeCumjd"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319487",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "89c91a50-f393-4b9e-b598-7f97e037722a",
            "value": "158232"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781319487",
            "to_ids": true,
            "type": "vhash",
            "uuid": "a576cc97-6966-45ff-bb42-f5b69f7dc093",
            "value": "4a7b9fe7dd9868f100f4f2fbc17d74c1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319487",
            "to_ids": true,
            "type": "filename",
            "uuid": "453c780f-256a-464a-ad7c-8993c0b57e5a",
            "value": "pw_arm64"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  12/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319487",
            "to_ids": false,
            "type": "text",
            "uuid": "112f1486-6694-4552-b41a-c9c7fb59146a",
            "value": "Type Description: Mach-O\nMicrosoft: None\nVT Total Detection:1/63\nFirst Submission:2026-06-08T10:06:24.000000+00:00\nLast Submission:2026-06-08T10:06:24.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781326982",
        "uuid": "df556575-0a50-4da4-af90-cd2b97cba148",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781326982",
            "to_ids": true,
            "type": "md5",
            "uuid": "89bf2463-316b-4735-a5d1-640e8f82748d",
            "value": "c8181861d255bbfdbc7c3f9a44387985",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323456",
            "to_ids": true,
            "type": "sha1",
            "uuid": "dc0a35c2-9087-4bdc-906e-eeca1094bfcb",
            "value": "576ef35f1b73a2ed5be1b9780a6c40fd5d8314b0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323465",
            "to_ids": true,
            "type": "sha256",
            "uuid": "454350d2-1fd1-4822-b0ec-848bbd21d557",
            "value": "91b9381d19b2e6a2db5cc0307167979b502731cb3fb50da684479e9ed35261aa",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319509",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ab88b034-aa75-4afe-955a-ea54f20a24ca",
            "value": "768:99JcRBsjzdYgrROpQqKFumjCArYqxUQ3F3Hi5JfiUILHX5cjsA2kuz6Em/jSIFd9:ogI1kKAsaUQ3E/63rmwlkvjxejE"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319509",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "55cf5f8c-592a-4060-82a4-f47ca8c2aef9",
            "value": "56121"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319509",
            "to_ids": true,
            "type": "filename",
            "uuid": "823c29fb-bc6c-4685-8309-c03fc164376f",
            "value": "windows-agent-node.js.enc"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  12/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319509",
            "to_ids": false,
            "type": "text",
            "uuid": "419072a1-c46e-4c28-b887-407a64a0bdaa",
            "value": "Type Description: unknown\nMicrosoft: None\nVT Total Detection:1/61\nFirst Submission:2026-06-08T10:08:07.000000+00:00\nLast Submission:2026-06-08T10:08:07.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327003",
        "uuid": "58d11613-c9e1-46de-a942-cc0a9c8be7bc",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327003",
            "to_ids": true,
            "type": "md5",
            "uuid": "c237a36c-b57c-4bac-b839-ce135496363f",
            "value": "4cc11e4593e1d9cc66d56c21a668412e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323466",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ffd37b22-d878-4972-9546-a1597ecd1782",
            "value": "80e8e7be487d66b6176443dc7f5cdb3103afe6fb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323466",
            "to_ids": true,
            "type": "sha256",
            "uuid": "87a1ef48-8eb7-44ff-909b-5380f803112a",
            "value": "a2b9a769df84d9d3a4694bb0252a2c6a5e5f5d1a85a04565362737092bbb3a86",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319531",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a3fb88bd-084e-4cc3-889c-0e860109fd09",
            "value": "98304:EVbRbgTKcA01MwR4SjFfE/CsZDtYT40M9ERZ42NXnbugZq9mbvbbJr7brD8ltBez:ETETysGJeC9CZugZq9Qv/5brDcIeKyU"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319531",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "10529fc4-4e90-47f5-880a-8651dfda75fc",
            "value": "14655650"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781319531",
            "to_ids": true,
            "type": "vhash",
            "uuid": "4557be3a-2824-499a-a111-f85eb6d336a2",
            "value": "77ac44bddf4050b946718bc38ad0cf3e"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319531",
            "to_ids": true,
            "type": "filename",
            "uuid": "a297f171-e1c4-490c-92f3-1dc3690dc766",
            "value": "google-update-support-linux-amd64"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  12/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319531",
            "to_ids": false,
            "type": "text",
            "uuid": "00afb673-f24c-4853-a6ea-612e73ede5e4",
            "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Overlord!AMTB\nVT Total Detection:24/64\nFirst Submission:2026-06-08T10:04:29.000000+00:00\nLast Submission:2026-06-08T10:04:29.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327025",
        "uuid": "7f5e8518-321c-46c0-adb2-ad4897220371",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327025",
            "to_ids": true,
            "type": "md5",
            "uuid": "18d4fcdc-6868-43ff-a914-e0ff08a0c8c2",
            "value": "4298f7dbed45b433bbffd327df58f62d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323467",
            "to_ids": true,
            "type": "sha1",
            "uuid": "91e0b84b-b68f-401b-abf5-6aac3082f65d",
            "value": "ce96ec9753db2c5bce27447c665500370aa85b4c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323467",
            "to_ids": true,
            "type": "sha256",
            "uuid": "0837e5a1-cff3-46c1-9ab6-90e9f19dada6",
            "value": "bb10adac5b0124efedfe71102c1d5638135ec9e1cde8c8cb3353c5ed91bb9f81",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319553",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "05711a86-448b-427f-b066-fa3d93ac2b61",
            "value": "98304:TRSQ4Y79I3CTuM5cEqot8Bex1WjMlqJTrCT0ejM06Vgk1YSyR0eQEjs11lCfz:Tn5nkex1W4YqHQ7VgkSju1l"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319553",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "eb1773e9-1d80-4dcc-b4b4-44161839c8a8",
            "value": "14495504"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781319553",
            "to_ids": true,
            "type": "vhash",
            "uuid": "35140b96-3e81-4250-987c-f30aa6b25fd1",
            "value": "cdc6e8b3f6ffb604f585a581e1e55f96"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319553",
            "to_ids": true,
            "type": "filename",
            "uuid": "83d09906-48a8-49e3-a08f-b1d66a613667",
            "value": "google-update-support-darwin-amd64-55554944beeb10d00f3c3273dd6decdf6e780d18"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  13/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319553",
            "to_ids": false,
            "type": "text",
            "uuid": "78bd55ce-fb6a-4381-85bd-22f7bded68bd",
            "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nVT Total Detection:20/63\nFirst Submission:2026-06-08T10:04:28.000000+00:00\nLast Submission:2026-06-08T10:04:28.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327046",
        "uuid": "9c94a9ab-3ba2-4d81-a24b-84ab48ad60cf",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327046",
            "to_ids": true,
            "type": "md5",
            "uuid": "0faea6fd-5375-4f9e-9697-496e91a0d18f",
            "value": "582581dfa177bb8ec8a34be35a2f5316",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323469",
            "to_ids": true,
            "type": "sha1",
            "uuid": "8886dbb2-d2ff-4901-b06f-474f4f01b5f2",
            "value": "261adfb35acb1fcab728868e9d6975ee803b9ca8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323469",
            "to_ids": true,
            "type": "sha256",
            "uuid": "8da593f5-fb45-460f-852e-b370d5f41d5d",
            "value": "c935808147f0236c81483d7bbeda4b9d602f3595d5d4057f8115d39e222d1c4b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319574",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "e4b00fed-1ffb-4ea3-ba6d-e7e572f6a039",
            "value": "24:Y19xAStpJ6kR1GDA1GTFYhqUd4plGTFgPnseZULooplnKlHjdL:A91n6kRuJJYAUd4pIJgfVZUMoplKdjdL"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319574",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "c1b041cc-13c8-4c1c-bcbf-f2129654d50b",
            "value": "1337"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319574",
            "to_ids": true,
            "type": "filename",
            "uuid": "eb1d8b97-3179-42bf-aab5-65770560abcc",
            "value": "tasks.json"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  12/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319574",
            "to_ids": false,
            "type": "text",
            "uuid": "5f09aaaf-ae54-4fb8-88b0-821f23d6fb48",
            "value": "Type Description: JSON\nMicrosoft: None\nVT Total Detection:1/61\nFirst Submission:2026-06-08T10:08:00.000000+00:00\nLast Submission:2026-06-08T10:08:00.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327067",
        "uuid": "31d98232-4171-4011-bf1c-70b790c5a215",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327067",
            "to_ids": true,
            "type": "md5",
            "uuid": "f8bcc742-8365-4569-924b-afc89413627f",
            "value": "f0249ec1c7025c84d3298d51d169f36b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323470",
            "to_ids": true,
            "type": "sha1",
            "uuid": "47f22d55-abb4-4b6b-a93c-807206444663",
            "value": "d47e8fc54c62cc4491cdd5726e13c0505d63e5d0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323470",
            "to_ids": true,
            "type": "sha256",
            "uuid": "3508df54-6089-41a5-9b50-3e65cef9bdab",
            "value": "d3ebce2f05fe91a8260e87fd11a6ea17c156703d081b3f91d9bbe5fd6aeedc10",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319596",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "73f07eb4-c07b-42fc-8366-7149f451278e",
            "value": "3072:1HtpYUiq16wPuBQ4PoWS28SrYi0wYR/yJLlgXkw92p9boa6j:1Npn16Vu748Ssi0wYR/yJLlgXHwp9bol"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319596",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "62b3dca4-bda6-4c8c-af88-4b51cc25ed98",
            "value": "177060"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781319596",
            "to_ids": true,
            "type": "vhash",
            "uuid": "79635bbb-994f-4c98-8beb-4e05d0441e26",
            "value": "0f6e3afbbd7ce2eb3c1bce066a850d25"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319596",
            "to_ids": true,
            "type": "filename",
            "uuid": "03e6885f-d5de-4028-98b4-be7596f36b90",
            "value": "gus-node-bootstrap.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  12/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319596",
            "to_ids": false,
            "type": "text",
            "uuid": "7a81e0cf-01a1-4282-9543-3ee17eac369d",
            "value": "Type Description: JavaScript\nMicrosoft: None\nVT Total Detection:1/61\nFirst Submission:2026-06-08T10:07:14.000000+00:00\nLast Submission:2026-06-08T10:07:14.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327088",
        "uuid": "ce2e5946-d5c9-4343-936d-9fd833c5220e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327088",
            "to_ids": true,
            "type": "md5",
            "uuid": "77b129ba-2e49-43dd-a6a2-776b9e93b126",
            "value": "0e41db3aaea1a5b6be0a4ae89a4b921b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323471",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d2c97839-9b75-4ce5-a100-6b9cc9ac7933",
            "value": "12f6e05f3c17f80a4c170ec126baf281189d4c7c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323471",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b0a10ee9-3899-4da0-8f0d-9fcfb631fa85",
            "value": "d5e9288693aa745dc89368deac677e7ea1ec81e663283af30838cdae189b7a7e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319619",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4f5b82fc-15e9-4369-80f0-bc806c60613c",
            "value": "12288:n0X/KbrhEBWzDlXm2HsFfJM9JTkNDNUkkS5RLNvC:0PK/XQfJaAu+XvC"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319619",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "b80ed47d-d917-4e5c-9d1d-b3d6ea326594",
            "value": "606460"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319619",
            "to_ids": true,
            "type": "filename",
            "uuid": "4543d08a-1826-4611-879c-40c983c28019",
            "value": "extension.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  12/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319619",
            "to_ids": false,
            "type": "text",
            "uuid": "a1ddf3cb-c4b2-4958-aeb9-bd991a36f5d1",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:JS/Overlord!AMTB\nVT Total Detection:6/61\nFirst Submission:2026-06-08T10:06:46.000000+00:00\nLast Submission:2026-06-10T12:39:25.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327109",
        "uuid": "93eb5bb0-9add-4b51-b54b-15d21d22f99e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327109",
            "to_ids": true,
            "type": "md5",
            "uuid": "6a581a98-85a9-4659-9611-d38b51fc9ba3",
            "value": "da11df27377603c69a264cd2d3e62b94",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323472",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a7a540d3-8f15-42bc-8799-5d0b33d6fb5b",
            "value": "ad1622b83f941eecb5bd5f140a4c97418d41d51b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323472",
            "to_ids": true,
            "type": "sha256",
            "uuid": "38fb43ba-7a4f-441e-9c59-31b48d233de7",
            "value": "e1bf1b29e6fa3525d7f32f429290a88d6ea2890e61c06574b8ff6372aa5d0667",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319641",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9a75928e-9471-4e4e-80d7-91bfad1afe20",
            "value": "393216:FWT6tB/FboEZqfO/nzXXnu2W5yeF5KBkBlEi2cG6R4nI+iSO3obMgpnX:82tB/FUEZz/ix7ak4W40SOYYgpX"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319641",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "130d8797-1348-49e1-a9cd-53199d48bcc1",
            "value": "17283435"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781319641",
            "to_ids": true,
            "type": "vhash",
            "uuid": "4808f4d9-f0f7-4d23-b6d1-4034ab0433c6",
            "value": "6cd647e7d9772f330aa3d39be23c6f3a"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319641",
            "to_ids": true,
            "type": "filename",
            "uuid": "1dce7a06-2298-4f38-8a83-3deb58171a16",
            "value": "google-update-support-agent.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  12/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319641",
            "to_ids": false,
            "type": "text",
            "uuid": "a254a116-2e7e-4d92-9a5e-bdad20e9172b",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:23/67\nFirst Submission:2026-06-08T10:03:47.000000+00:00\nLast Submission:2026-06-10T12:14:48.000000+00:00"
          }
        ]
      }
    ]
  }
}